Skip to content

exec-file/exec-env: reset supplementary groups when changing user#2194

Open
felixfontein wants to merge 2 commits into
getsops:mainfrom
felixfontein:set-groups
Open

exec-file/exec-env: reset supplementary groups when changing user#2194
felixfontein wants to merge 2 commits into
getsops:mainfrom
felixfontein:set-groups

Conversation

@felixfontein
Copy link
Copy Markdown
Contributor

No description provided.

Signed-off-by: Felix Fontein <felix@fontein.de>
@felixfontein felixfontein requested a review from a team May 25, 2026 14:05
Comment thread cmd/sops/subcommand/exec/exec_unix.go Outdated
uid, _ := strconv.Atoi(user.Uid)
gid, _ := strconv.Atoi(user.Gid)

err = syscall.Setgroups([]int{gid})
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we looking to map the supplemental groups for the specified user or reset it so that it only contains the primary group?

Mapping could be accomplished by something similar to the following

	groupIds, _ := user.GroupIds()
	intGroupIds := make([]int, len(groupIds))
	for i, gid := range groupIds {
		intGroupIds[i], _ = strconv.Atoi(gid)
	}

	err = syscall.Setgroups(intGroupIds)
	if err != nil {
		log.Fatal(err)
	}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I missed user.GroupIds(). Yeah, that makes sense. I've changed it slightly so that it falls back to []int{gid} if GroupIds() returns an error.

Signed-off-by: Felix Fontein <felix@fontein.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants