1

I have the following test program:

//File: egid_test.c
#include <stdio.h>
#include <unistd.h>

int main(int argc, char** argv)
{
  int egid =  getegid();
  printf("my effective group is %d\n", egid);
  return 0;
}

I run the following series of commands:

$ sudo groupadd so_test
$ grep so_test /etc/group
so_test:x:1002:

$ gcc egid_test.c 
$ ./a.out
my effective group is 1000

$ sudo chown :so_test a.out
$ sudo chmod g+s a.out
$ ./a.out
my effective group is 1000

I expect the result of the last line to be "my effective group is 1002". Co-workers get exactly that. I don't.
Why? How do I debug what's wrong with my machine and/or configuration?

(Ubuntu 16.04.6 LTS)
**use sudo groupdel so_test after you try this to undo group creation


Additional Info:

$ ls -l a.out
-rwxrwsr-x 1 ashelly so_test 8664 Nov  1 12:17 a.out

$ stat a.out
  File: 'a.out'
  Size: 8664        Blocks: 40         IO Block: 4096   regular file
Device: 33h/51d Inode: 23466994    Links: 1
Access: (2775/-rwxrwsr-x)  Uid: ( 1000/    ashelly)   Gid: ( 1002/ so_test)
Access: 2019-11-01 12:17:46.149582840 -0700
Modify: 2019-11-01 12:17:08.949341154 -0700
Change: 2019-11-01 12:38:01.454109385 -0700
 Birth: -

$ df .
Filesystem          1K-blocks     Used Available Use% Mounted on
/home/ashelly/.Private 660427896 45250096 581606988   8% /home/ashelly

$ mount | grep /home/ashelly
/home/.ecryptfs/ashelly/.Private on /home/ashelly type ecryptfs (rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=<...>,ecryptfs_sig=<...>,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)

Is it the 'nosuid' flag on the encryptfs that's causing problems?

  • 1
    Start off with ls -l a.out to ensure that the sgid bit is set. Then us df . as an easy way to find where the filesystem you are using is mounted, and then find that mount point in the output of mount to see what options you have on the mount. – icarus Nov 1 '19 at 19:34
  • 1
    Added the output - I'm guessing nosuid is a problem... – AShelly Nov 1 '19 at 19:46
1

Thanks to @icarus, I realize that my home directory, unlike my co-workers', is mounted from an ecryptfs encrypted partition, which has the nosuid flag set. (Apparently to patch a security hole).

This prevents the sgid bit from taking effect. If I move my program to /usr/local/bin, which doesn't have the nosuid flag, it correctly reports the effective group.

At this point, what I need is a good answer to this question about ecryptfs and nosuid.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.