picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

core: initialize groups list before checking SupplementaryGroups= of a unit (#4533)

Browse source 
Always initialize the supplementary groups of caller before checking the
unit SupplementaryGroups= option.

Fixes https://github.com/systemd/systemd/issues/4531
This commit is contained in:
Djalal Harouni 2016-11-02 17:51:35 +01:00 committed by Lennart Poettering
parent 4887b656c2
commit bbeea27117
1 changed files with 15 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/core/execute.c
View file

@ -787,6 +787,20 @@ static int get_fixed_supplementary_groups(const ExecContext *c,
assert(c); assert(c);
/*
* If user is given, then lookup GID and supplementary groups list.
* We avoid NSS lookups for gid=0. Also we have to initialize groups
* as early as possible so we keep the list of supplementary groups
* of the caller.
*/
if (user && gid_is_valid(gid) && gid != 0) {
/* First step, initialize groups from /etc/groups */
if (initgroups(user, gid) < 0)
return -errno;
keep_groups = true;
}
if (!c->supplementary_groups) if (!c->supplementary_groups)
return 0; return 0;
@ -803,18 +817,6 @@ static int get_fixed_supplementary_groups(const ExecContext *c,
return -EOPNOTSUPP; /* For all other values */ return -EOPNOTSUPP; /* For all other values */
} }
/*
* If user is given, then lookup GID and supplementary group list.
* We avoid NSS lookups for gid=0.
*/
if (user && gid_is_valid(gid) && gid != 0) {
/* First step, initialize groups from /etc/groups */
if (initgroups(user, gid) < 0)
return -errno;
keep_groups = true;
}
l_gids = new(gid_t, ngroups_max); l_gids = new(gid_t, ngroups_max);
if (!l_gids) if (!l_gids)
return -ENOMEM; return -ENOMEM;
@ -2577,7 +2579,7 @@ static int exec_child(
return r; return r;
} }
/* Drop group as early as possbile */ /* Drop groups as early as possbile */
if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) { if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
r = enforce_groups(context, gid, supplementary_gids, ngids); r = enforce_groups(context, gid, supplementary_gids, ngids);
if (r < 0) { if (r < 0) {