[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
07/08: Preserve supplementary groups of build users
From: |
Ludovic Courtès |
Subject: |
07/08: Preserve supplementary groups of build users |
Date: |
Thu, 02 Jul 2015 22:34:06 +0000 |
civodul pushed a commit to branch nix
in repository guix.
commit 2cd28517b13524c242c7758783b0b2d8250fdded
Author: Ludovic Courtès <address@hidden>
Date: Wed Jul 1 14:56:34 2015 +0200
Preserve supplementary groups of build users
The following patch is an attempt to address this bug (see
<http://bugs.gnu.org/18994>) by preserving the supplementary groups of
build users in the build environment.
In practice, I would expect that supplementary groups would contain only
one or two groups: the build users group, and possibly the “kvm†group.
[Changed &at(0) to data() and removed tabs - Eelco]
---
nix/libstore/build.cc | 22 ++++++++++++++++++----
1 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 9041ae0..5c05d8f 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -447,6 +447,7 @@ private:
string user;
uid_t uid;
gid_t gid;
+ std::vector<gid_t> supplementaryGIDs;
public:
UserLock();
@@ -460,6 +461,7 @@ public:
string getUser() { return user; }
uid_t getUID() { return uid; }
uid_t getGID() { return gid; }
+ std::vector<gid_t> getSupplementaryGIDs() { return supplementaryGIDs; }
bool enabled() { return uid != 0; }
@@ -539,6 +541,17 @@ void UserLock::acquire()
throw Error(format("the Nix user should not be a member of
`%1%'")
% settings.buildUsersGroup);
+ /* Get the list of supplementary groups of this build user. This
+ is usually either empty or contains a group such as "kvm". */
+ supplementaryGIDs.resize(10);
+ int ngroups = supplementaryGIDs.size();
+ int err = getgrouplist(pw->pw_name, pw->pw_gid,
+ supplementaryGIDs.data(), &ngroups);
+ if (err == -1)
+ throw Error(format("failed to get list of supplementary groups
for ‘%1’") % pw->pw_name);
+
+ supplementaryGIDs.resize(ngroups);
+
return;
}
}
@@ -2173,10 +2186,11 @@ void DerivationGoal::runChild()
setuid() when run as root sets the real, effective and
saved UIDs. */
if (buildUser.enabled()) {
- printMsg(lvlChatty, format("switching to user `%1%'") %
buildUser.getUser());
-
- if (setgroups(0, 0) == -1)
- throw SysError("cannot clear the set of supplementary groups");
+ /* Preserve supplementary groups of the build user, to allow
+ admins to specify groups such as "kvm". */
+ if (setgroups(buildUser.getSupplementaryGIDs().size(),
+ buildUser.getSupplementaryGIDs().data()) == -1)
+ throw SysError("cannot set supplementary groups of build
user");
if (setgid(buildUser.getGID()) == -1 ||
getgid() != buildUser.getGID() ||
- branch nix updated (e531520 -> 0dccab9), Ludovic Courtès, 2015/07/02
- 01/08: Allow substitutes for builds that have preferLocalBuild set, Ludovic Courtès, 2015/07/02
- 03/08: Export outputPaths function, Ludovic Courtès, 2015/07/02
- 04/08: Make /nix/var/nix/db/reserved bigger, Ludovic Courtès, 2015/07/02
- 05/08: Use posix_fallocate to create /nix/var/nix/db/reserved, Ludovic Courtès, 2015/07/02
- 06/08: GC: Handle ENOSPC creating/moving to the trash directory, Ludovic Courtès, 2015/07/02
- 02/08: Use std::vector::data(), Ludovic Courtès, 2015/07/02
- 08/08: Typo, Ludovic Courtès, 2015/07/02
- 07/08: Preserve supplementary groups of build users,
Ludovic Courtès <=