up vote 1 down vote favorite
share [g+] share [fb]

I need to test linux group permissions on a repository. In one shell, how can I temporarily remove one of my group associations?

e.g.
If my groups are defined as:

 % groups
 foo bar baz

How can I make it so it only returns foo bar without baz?

link|improve this question

77% accept rate
feedback

2 Answers

up vote 2 down vote accepted

It IS possible.

Check out this code (valid C89, heh) I wrote in 25 mins. Usage example:

whitequark@forth:~/skipgroup$ ls
skipgroup.c
whitequark@forth:~/skipgroup$ gcc skipgroup.c -o skipgroup
whitequark@forth:~/skipgroup$ sudo chown root:root skipgroup
whitequark@forth:~/skipgroup$ sudo chmod u+s skipgroup
whitequark@forth:~/skipgroup$ groups
whitequark adm dialout cdrom plugdev lpadmin admin sambashare
whitequark@forth:~/skipgroup$ ./skipgroup 
Usage: ./skipgroup <group to remove>
Must be SUID. Launches shell.
whitequark@forth:~/skipgroup$ ./skipgroup cdrom
$ id
uid=1000(whitequark) gid=1000(whitequark)
groups=4(adm),20(dialout),46(plugdev),104(lpadmin),114(admin),118(sambashare),1000(whitequark)

WARNING THIS CODE IS SUID!

While it drops privileges as you see on id's output, it MAY BE DANGEROUS. Dixi.

link|improve this answer
wow. If I had root permissions, I'd definitely try this out. – Ross Rogers Jan 21 '10 at 19:20
I think there is really no way to change your group list without root privileges. – whitequark Jan 21 '10 at 19:27
feedback

I think that this is not possible, since files (and POSIX ACLs) can specify subtractive rights for certain groups. Allowing people to escape from a group would then be a security hole.

Of course if you have root access, you could simply remove yourself from the group and do

sudo su - $USER
link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.