jvgutierrez commented on code in PR #11872:
URL: https://github.com/apache/trafficserver/pull/11872#discussion_r1847952505
##########
src/tscore/ink_cap.cc:
##########
@@ -156,8 +156,10 @@ impersonate(const struct passwd *pwd, ImpersonationLevel
level)
#endif
// Always repopulate the supplementary group list for the new user.
- if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
- Fatal("switching to user %s, failed to initialize supplementary groups ID
%ld", pwd->pw_name, (long)pwd->pw_gid);
+ if (geteuid() == 0) { // check that we have enough rights to call
initgroups()
+ if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
Review Comment:
that would require to add `CAP_SETGID` to `RestrictCapabilities()`? maybe
it's worth moving this discussion to another PR/issue and solve #11869 with
this one
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscr...@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
