[PATCH v3] support: Don't fail on fchown when spawning sgid processes

[Carlos O'Donell]

On 6/1/23 07:01, Carlos O'Donell wrote:
> On 5/31/23 12:07, Siddhesh Poyarekar wrote:
>> In some cases (e.g. when podman creates user containers), the only other
>> group assigned to the executing user is nobody and fchown fails with it
>> because the group is not mapped.  Do not fail the test in this case,
>> instead exit as unsupported.
>>
>> Reported-by: Frédéric Bérat <fberat@redhat.com>
>> Tested-by: Frédéric Bérat <fberat@redhat.com>
>> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
> 
> LGTM.
> 
> Reviewed-by: Carlos O'Donell <carlos@redhat.com>

I have filed an RFE with distrobox upstream. The podman wrapper tools can and should
be able to map all supplementary gid's into the container so that filesystem access
works correctly. In some cases supplementary groups could be critical to user access
of files on disk.

Map all supplementary groups into the distro container.
https://github.com/89luca89/distrobox/issues/777

>> ---
>>  support/support_capture_subprocess.c | 15 +++++++++++++--
>>  1 file changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/support/support_capture_subprocess.c b/support/support_capture_subprocess.c
>> index bae7d5fb20..2a8d37b284 100644
>> --- a/support/support_capture_subprocess.c
>> +++ b/support/support_capture_subprocess.c
>> @@ -153,9 +153,18 @@ copy_and_spawn_sgid (char *child_id, gid_t gid)
>>  	  p += wrcount;
>>  	}
>>      }
>> -  TEST_VERIFY (fchown (outfd, getuid (), gid) == 0);
>> +
>> +  bool chowned = false;
>> +  TEST_VERIFY ((chowned = fchown (outfd, getuid (), gid) == 0)
>> +	       || errno == EPERM);
>>    if (support_record_failure_is_failed ())
>>      goto err;
>> +  else if (!chowned)
>> +    {
>> +      ret = 77;
>> +      goto err;
>> +    }
>> +
>>    TEST_VERIFY (fchmod (outfd, 02750) == 0);
>>    if (support_record_failure_is_failed ())
>>      goto err;
>> @@ -192,8 +201,10 @@ err:
>>        free (dirname);
>>      }
>>  
>> +  if (ret == 77)
>> +    FAIL_UNSUPPORTED ("Failed to make sgid executable for test\n");
>>    if (ret != 0)
>> -    FAIL_EXIT1("Failed to make sgid executable for test\n");
>> +    FAIL_EXIT1 ("Failed to make sgid executable for test\n");
>>  
>>    return status;
>>  }
> 

-- 
Cheers,
Carlos.