chpst -u and supplementary groups

[Jan Braun <janbraun@gmx.de>]

[-- Attachment #1: Type: text/plain, Size: 1527 bytes --]

Hello list!

Yesterday, I spent way too much time chasing down a permissions problem
caused by the fact that "chpst -u acc prog..." only sets the account's
primary group, and ignores any supplementary groups the account may be a
member of.

TFM mentions "All initial supplementary groups are removed.", but I
failed to memorize that. (Also, what does "initial" signify here?)

My inability to see the issue came from the fact that all other similar
programs (I'm aware of) do in fact add the supplementary groups. Watch:

| # chpst -u test id
| uid=1003(test) gid=1003(test) groups=1003(test)
| # runuser -u test id
| uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
| # s6-setuidgid test id
| uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
| # su - test -c id
| uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
| # su test -c id
| uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
| # sudo -u test id
| uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
| #

So now I'm wondering:
What are the use cases for not applying existing supplementary groups?
Should chpst apply them by default?
Should chpst grow an option to (not) apply them?
    "chpst -u acc: prog..." is still free.
Or is everything as it's supposed to be, and people might need to munge
    the output of "getent initgroups acc" and feed it to the -u option?

I'll be happy to try to come up with a patch (even if it's still a
fatter warning in the manpage) if people can agree here what the right
thing to do is.

regards,
    Jan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]