From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Date: Fri, 7 Jan 2011 20:58:05 +0000 (+0000)
Subject: setgid first, setuid second
X-Git-Tag: fio-1.50-rc2~8^2
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=dfc6e7513c82d83491e90b8583fb52e301053d1b;hp=5b42a488b1e3be03ecec9305affbbabaa2f2134e;ds=sidebyside

setgid first, setuid second

Setting a new effective gid requires privileges.  We must set the gid
while we potentially still have superuser privileges.  Otherwise
setgid(2) fails because we've already changed to an unprivileged uid.

Here is a test case:
[global]
rw=read
directory=tmp
size=512m
buffered=0

[file1]
uid=1000
gid=1000

Without this patch fio will fail when invoked by root.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
---

diff --git a/fio.c b/fio.c
index 8dff813c..8cc8fcf3 100644
--- a/fio.c
+++ b/fio.c
@@ -1068,14 +1068,18 @@ static void *thread_main(void *data)
 	 */
 	fio_mutex_remove(td->mutex);
 
-	if (td->o.uid != -1U && setuid(td->o.uid)) {
-		td_verror(td, errno, "setuid");
-		goto err;
-	}
+	/*
+	 * A new gid requires privilege, so we need to do this before setting
+	 * the uid.
+	 */
 	if (td->o.gid != -1U && setgid(td->o.gid)) {
 		td_verror(td, errno, "setgid");
 		goto err;
 	}
+	if (td->o.uid != -1U && setuid(td->o.uid)) {
+		td_verror(td, errno, "setuid");
+		goto err;
+	}
 
 	/*
 	 * May alter parameters that init_io_u() will use, so we need to