Re: [PATCH] groups: don't return unmapped gids in getgroups(2)

From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] groups: don't return unmapped gids in getgroups(2)
Date	2017-02-17 18:10 +0100
Message-ID	<tbUcH-76j-31@gated-at.bofh.it> (permalink)
References	<tbylP-1ec-5@gated-at.bofh.it> <tbyYz-1KY-37@gated-at.bofh.it> <tbMoO-1Y8-31@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Feb 17, 2017 at 12:44 AM, Aleksa Sarai <asarai@suse.de> wrote:
>>> One thing overlooked by commit 9cc46516ddf4 ("userns: Add a knob to
>>> disable setgroups on a per user namespace basis") is that because
>>> setgroups(2) no longer works in user namespaces it doesn't make any
>>> sense to be returning weird group IDs that the process cannot do
>>> anything with.
>>
>>

> bool DropPrivileges()
> {
>         /* ... */
>       // Verify that the user isn't still in any supplementary groups

But the user *is* still in a supplementary group.  Your proposed
change would break the intent of this code.

Thread

[PATCH] groups: don't return unmapped gids in getgroups(2) Aleksa Sarai <asarai@suse.de> - 2017-02-16 18:50 +0100
  Re: [PATCH] groups: don't return unmapped gids in getgroups(2) ebiederm@xmission.com (Eric W. Biederman) - 2017-02-16 19:30 +0100
    Re: [PATCH] groups: don't return unmapped gids in getgroups(2) Aleksa Sarai <asarai@suse.de> - 2017-02-17 09:50 +0100
      Re: [PATCH] groups: don't return unmapped gids in getgroups(2) Andy Lutomirski <luto@amacapital.net> - 2017-02-17 18:10 +0100
        Re: [PATCH] groups: don't return unmapped gids in getgroups(2) Aleksa Sarai <asarai@suse.de> - 2017-02-17 19:00 +0100
          Re: [PATCH] groups: don't return unmapped gids in getgroups(2) Mike Frysinger <vapier@chromium.org> - 2017-02-17 20:50 +0100
    Re: [PATCH] groups: don't return unmapped gids in getgroups(2) Djalal Harouni <tixxdz@gmail.com> - 2017-02-20 15:00 +0100

csiph-web