Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not setgroups() on FreeBSD #257

Closed
wants to merge 1,026 commits into from
Closed

Do not setgroups() on FreeBSD #257

wants to merge 1,026 commits into from

Conversation

kiryanov
Copy link

setgroups() call will fail with EPERM on FreeBSD. It renders --user and --uid options useless.

@bol-van
Copy link
Owner

bol-van commented Aug 22, 2024

It doesn't reproduce on my system
What is your BSD version ?
May be you run tpws not as root ? If so then --user and --uid options are not available for obvious reasons. They will cause error

@kiryanov
Copy link
Author

14.1. I run it from root as a daemon, it drops privileges with no issues, but a call to setgroups fails.
PS: setgroups invocation differs between linux and freebsd, in particular freebsd needs a primary group to be specified twice in the list of groups, maybe that’s the issue. I can do some more testing in a week or two.

@bol-van
Copy link
Owner

bol-van commented Aug 22, 2024

the only call to setgroups is
setgroups(0,NULL);
it's intended to drop all supplimentary groups

@kiryanov
Copy link
Author

kiryanov commented Sep 1, 2024

So I have conducted quite some testing and I definitely could not make it work with setgroups() on FreeBSD 14.1 even using the FreeBSD semantics and passing the primary gid as the first member of the groups array.
Maybe instead of removing the call just make the error non-fatal? Most of the code I have looked at just prints a warning if setgroups() call fails.

@bol-van
Copy link
Owner

bol-van commented Sep 2, 2024

may be you share your test code ?
i cant reproduce what you talk about

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants