Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Always use primary group for initgroups #456

Open
wants to merge 1 commit into
base: 6.1-dev
Choose a base branch
from

Conversation

mattmix
Copy link

@mattmix mattmix commented Dec 3, 2018

When users are not members of their primary group[1], initgroups(3) being called with the group listed in the group_list parameter causes the primary group to be missing in supplemental group list for the launched job.

This change will cause init_groups to always call initgroups(3) with the user's primary group so that it will continue to exist later on when setgid is called with the group from the group_list.

Redacted example:

[user@login ~] # groups
primarygrp secondarygrp

# Unpatched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp

# Patched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp primarygrp

[1] Happens when the user's entry in LDAP assigns them to a group, but they aren't added to the group member list.

When users are not members of their primary group[1], initgroups(3) being called with the group listed in the group_list parameter causes the primary group to be missing in supplemental group list for the launched job. 

This change will cause init_groups to always call initgroups(3) with the user's primary group so that it will continue to exist later on when setgid is called with the group from the group_list. 

Redacted example:
```
[user@login ~] # groups
primarygrp secondarygrp

# Unpatched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp

# Patched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp primarygrp
```

[1] Happens when the user's entry in LDAP assigns them to a group, but they aren't added to the group member list.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant