• Wander Lairson Costa's avatar
    syscall: only call setgroups if we need to · 79f6a5c7
    Wander Lairson Costa authored
    If the caller set ups a Credential in os/exec.Command,
    os/exec.Command.Start will end up calling setgroups(2), even if no
    supplementary groups were given.
    
    Only root can call setgroups(2) on BSD kernels, which causes Start to
    fail for non-root users when they try to set uid and gid for the new
    process.
    
    We fix by introducing a new field to syscall.Credential named
    NoSetGroups, and setgroups(2) is only called if it is false.
    We make this field with inverted logic to preserve backward
    compatibility.
    
    RELNOTES=yes
    
    Change-Id: I3cff1f21c117a1430834f640ef21fd4e87e06804
    Reviewed-on: https://go-review.googlesource.com/36697Reviewed-by: 's avatarIan Lance Taylor <iant@golang.org>
    79f6a5c7
exec_unix.go 7.21 KB