From dfc6e7513c82d83491e90b8583fb52e301053d1b Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Fri, 7 Jan 2011 20:58:05 +0000 Subject: [PATCH] setgid first, setuid second Setting a new effective gid requires privileges. We must set the gid while we potentially still have superuser privileges. Otherwise setgid(2) fails because we've already changed to an unprivileged uid. Here is a test case: [global] rw=read directory=tmp size=512m buffered=0 [file1] uid=1000 gid=1000 Without this patch fio will fail when invoked by root. Signed-off-by: Stefan Hajnoczi Signed-off-by: Jens Axboe --- fio.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/fio.c b/fio.c index 8dff813c..8cc8fcf3 100644 --- a/fio.c +++ b/fio.c @@ -1068,14 +1068,18 @@ static void *thread_main(void *data) */ fio_mutex_remove(td->mutex); - if (td->o.uid != -1U && setuid(td->o.uid)) { - td_verror(td, errno, "setuid"); - goto err; - } + /* + * A new gid requires privilege, so we need to do this before setting + * the uid. + */ if (td->o.gid != -1U && setgid(td->o.gid)) { td_verror(td, errno, "setgid"); goto err; } + if (td->o.uid != -1U && setuid(td->o.uid)) { + td_verror(td, errno, "setuid"); + goto err; + } /* * May alter parameters that init_io_u() will use, so we need to -- 2.25.1