morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 08:25:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

core/exec-invoke: gracefully handle lack of privilege for initgroups() in user mode

Browse Source 
Otherwise specifying User=SELF also fails because we got
no privilege to call setgroups().

Fixes #39038
This commit is contained in:
Mike Yuan
2025-09-20 00:00:14 +02:00
parent f03b49b079
commit c86914667a
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/core/exec-invoke.c
View File

@@ -902,8 +902,16 @@ static int get_supplementary_groups(
bool keep_groups = false;
if (user && gid_is_valid(gid) && gid != 0) {
/* First step, initialize groups from /etc/groups */
if (initgroups(user, gid) < 0)
return -errno;
if (initgroups(user, gid) < 0) {
/* If our primary gid is already the one specified in Group= (i.e. we're running in
* user mode), gracefully handle the case where we have no privilege to re-initgroups().
*
* Note that group memberships of the current user might have been modified, but
* the change will only take effect after re-login. It's better to continue on with
* existing credentials rather than erroring out. */
if (!ERRNO_IS_PRIVILEGE(errno) || gid != getgid())
return -errno;
}
keep_groups = true;
}