This is something I haven't been able to find much info on so any help would be appreciated.
My understanding is thus. Take the following file:
-rw-r----- 1 root adm 69524 May 21 17:31 debug.1
phil cannot access this file:
phil@server:/var/log$ head -n 1 debug.1 cat: debug.1: Permission denied
phil is added to the
adm group, it can:
root@server:~# adduser phil adm Adding user `phil' to group `adm' ... Adding user phil to group adm Done. phil@server:/var/log$ head -n 1 debug.1 May 21 11:23:15 server kernel: [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-184.108.40.206-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
If, however, a process is started whilst explicitly setting the
phil:phil it cannot read the file. Process started like this:
nice -n 19 chroot --userspec phil:phil / sh -c "process"
If the process is started as
phil:adm, it can read the file:
nice -n 19 chroot --userspec phil:adm / sh -c "process"
So the question really is:
What is special about running a process with a specific user/group combo that prevents the process being able to access files owned by supplementary groups of that user and is there any way around this?