2

I'm having trouble configuring things on linux so that a program can access certain files. Let's call it pgm A. It has uid uA and gid gA. In addition, uid uA is listed in /etc/group as a member of group gX. The problem is that pgm A cannot access files for which the uid is root and the gid is gX, but only when pgm A is called from another program, pgm B, which also runs as user uA.

If I su as user uA and run pgm A from bash, it has no problem accessing files in group gX.

But if another program, pgm B, which also runs as user uA, forks and execs pgm A, pgm A cannot access the files. I've verified that pgm A is indeed running as user uA, group gA, when launched from pgm B. So, if uA is a member of group gX, why can't the program access files which are readable by group gX? It's as if the operating system is ignoring the fact that user uA is also in group gX.

Improve this question
1
  • 1
    This is not a programming question as much as it is a Linux super-user question.
    – Gray
    Nov 24, 2011 at 21:29

1 Answer 1

Reset to default
6

You may need to login again after adding the user to the group, as group permissions are only read on login time.

Improve this answer
3
  • 1
    Plus, Pgm B must have logged in the same way, without dropping group privileges. Do NOT think as if the user belongs to the groups. Think of it as "the user is added to these groups during login". If an application is started via setuid/setgid, I believe it does NOT get all the groups from the user, but it either keeps the groups it has (not setgid) or gets the group the app is (setgid).
    – user1060350
    Nov 24, 2011 at 21:51
  • Thanks. I had assumed that supplementary group assignments were inherent to a uid. But as you explain, they need to be added explcitly at some point during the launch of a process.
    – msidell
    Nov 25, 2011 at 14:56
  • 1
    My pgm A is launched, indirectly, by Bernstein's tcpserver, which does a setuid() and setgid() for itself (and for its subprocesses), but does not do a setgroups(). I could solve my particular problem either by patching tcpserver to also do a setgroups(), or to rearrange some file rights to allow by program to access the files it needs without requiring supplementary group assignments. Thanks for helping me understand how group assignments work.
    – msidell
    Nov 25, 2011 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .