TakeV
/
guix
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Preserve supplementary groups of build users 

The following patch is an attempt to address this bug (see
<http://bugs.gnu.org/18994>) by preserving the supplementary groups of
build users in the build environment.

In practice, I would expect that supplementary groups would contain only
one or two groups: the build users group, and possibly the “kvm” group.

[Changed &at(0) to data() and removed tabs - Eelco]
This commit is contained in:
Ludovic Courtès 2015-07-01 14:56:34 +02:00
parent 6e38685ef6
commit 2cd28517b1
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
nix/libstore/build.cc
View File

@ -447,6 +447,7 @@ private:
string user;
uid_t uid;
gid_t gid;
std::vector<gid_t> supplementaryGIDs;
public:
UserLock();
@ -460,6 +461,7 @@ public:
string getUser() { return user; }
uid_t getUID() { return uid; }
uid_t getGID() { return gid; }
std::vector<gid_t> getSupplementaryGIDs() { return supplementaryGIDs; }
bool enabled() { return uid != 0; }
@ -539,6 +541,17 @@ void UserLock::acquire()
throw Error(format("the Nix user should not be a member of `%1%'")
% settings.buildUsersGroup);
/* Get the list of supplementary groups of this build user. This
is usually either empty or contains a group such as "kvm". */
supplementaryGIDs.resize(10);
int ngroups = supplementaryGIDs.size();
int err = getgrouplist(pw->pw_name, pw->pw_gid,
supplementaryGIDs.data(), &ngroups);
if (err == -1)
throw Error(format("failed to get list of supplementary groups for ‘%1’") % pw->pw_name);
supplementaryGIDs.resize(ngroups);
return;
}
}
@ -2173,10 +2186,11 @@ void DerivationGoal::runChild()
setuid() when run as root sets the real, effective and
saved UIDs. */
if (buildUser.enabled()) {
printMsg(lvlChatty, format("switching to user `%1%'") % buildUser.getUser());
if (setgroups(0, 0) == -1)
throw SysError("cannot clear the set of supplementary groups");
/* Preserve supplementary groups of the build user, to allow
admins to specify groups such as "kvm". */
if (setgroups(buildUser.getSupplementaryGIDs().size(),
buildUser.getSupplementaryGIDs().data()) == -1)
throw SysError("cannot set supplementary groups of build user");
if (setgid(buildUser.getGID()) == -1 ||
getgid() != buildUser.getGID() ||