Commit 7224afe
The guard that skips the "chown to gid 0 should fail" assertion used
only `os.getgroups()` (supplementary groups). The kernel also accepts
the effective/filesystem gid for chown, so when a process runs with
egid 0 and a non-zero uid (common in containers and user namespaces),
chown(-1, 0) succeeds and the assertion spuriously fails.
Add an `os.getegid() != 0` check alongside the existing
`0 not in os.getgroups()` guard.
(cherry picked from commit 2ce2600)
Co-authored-by: Itamar Oren <itamarost@gmail.com>
1 parent ab61101 commit 7224afe
1 file changed
Lines changed: 3 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
899 | 899 | | |
900 | 900 | | |
901 | 901 | | |
902 | | - | |
| 902 | + | |
| 903 | + | |
| 904 | + | |
903 | 905 | | |
904 | 906 | | |
905 | 907 | | |
| |||
0 commit comments