user-util: rework maybe_setgroups() a bit
Let's drop the caching of the setgroups /proc field for now. While there's a strict regime in place when it changes states, let's better not cache it since we cannot really be sure we follow that regime correctly. More importantly however, this is not in performance sensitive code, and there's no indication the cache is really beneficial, hence let's drop the caching and make things a bit simpler. Also, while we are at it, rework the error handling a bit, and always return negative errno-style error codes, following our usual coding style. This has the benefit that we can sensible hanld read_one_line_file() errors, without having to updat errno explicitly.
This commit is contained in:
+6
-4
@@ -781,9 +781,10 @@ static int enforce_groups(const ExecContext *context, const char *username, gid_
|
||||
k++;
|
||||
}
|
||||
|
||||
if (maybe_setgroups(k, gids) < 0) {
|
||||
r = maybe_setgroups(k, gids);
|
||||
if (r < 0) {
|
||||
free(gids);
|
||||
return -errno;
|
||||
return r;
|
||||
}
|
||||
|
||||
free(gids);
|
||||
@@ -950,8 +951,9 @@ static int setup_pam(
|
||||
* If this fails, ignore the error - but expect sd-pam threads
|
||||
* to fail to exit normally */
|
||||
|
||||
if (maybe_setgroups(0, NULL) < 0)
|
||||
log_warning_errno(errno, "Failed to setgroups() in sd-pam: %m");
|
||||
r = maybe_setgroups(0, NULL);
|
||||
if (r < 0)
|
||||
log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
|
||||
if (setresgid(gid, gid, gid) < 0)
|
||||
log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
|
||||
if (setresuid(uid, uid, uid) < 0)
|
||||
|
||||
Reference in New Issue
Block a user