getting that functionality in mainline kernel

[stsp]

Hi.

I recently posted this patch-set to LKML: https://lore.kernel.org/lkml/20241108204102.1752206-3-stsp2@yandex.ru/T/ It allows to get the group list from another (privileged) process. It should solve the problem your module addresses, among other things. But it fails to get a lot of interest (just 1 change request so far). I wonder if you can evaluate the possibility of my patch solving your problem, and if it suits, maybe you can post your use-case and/or review my patch in LKML.

Thanks!

[xuancong84]

Thanks @stsp for your kernel patch! So how exactly can I test your patch? Take note that my solution (in this repo) is only a temporary workaround of this issue. The ideal way should be one without any coding effort, e.g., directly cat or pipe writing > to /proc/<pid>/groups (for example).

[stsp]

Well, firstly you need to read the patch description, as it has all the usage instructions as well as other info. Then you need to clone this repo: https://github.com/stsp/cred_test It shows how the privileged helper process can grant the group list to the unpriv'd one.

The ideal way should be one without any coding effort, e.g., directly cat or pipe writing > to /proc//groups

That's too insecure. What if you write the groups root and wheel to your process? There needs to be some coding efforts for sure. In my approach you need a separate privileged entity that helps you to perform the task.

Please note that if you want to completely ignore security, then all you need is setcap cap_setgid+p <your_binary> and after that, your binary can change groups at any time w/o any restrictions by calling cap_setgroups().

[stsp]

The ideal way should be one without any coding effort, e.g., directly cat or pipe writing > to /proc//groups

You can actually achieve something like this with the following steps:

• create the fifo file with mkfifo
• write the code to open it with O_ASYNC
• hook SIGIO signal and in a handler read your fifo and/or call initgroups() or cap_setgroups().
• link your code as a solib and inject it with LD_PRELOAD into an app for which you want to change groups

This works w/o any patches. Except that IIRC LD_PRELOAD won't work with setcap.