Commit c6b26b5
The guard that skips the "chown to gid 0 should fail" assertion used
only `os.getgroups()` (supplementary groups). The kernel also accepts
the effective/filesystem gid for chown, so when a process runs with
egid 0 and a non-zero uid (common in containers and user namespaces),
chown(-1, 0) succeeds and the assertion spuriously fails.
Add an `os.getegid() != 0` check alongside the existing
`0 not in os.getgroups()` guard.
(cherry picked from commit 2ce2600)
Co-authored-by: Itamar Oren <itamarost@gmail.com>
1 parent 10d93ff commit c6b26b5
1 file changed
Lines changed: 3 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
838 | 838 | | |
839 | 839 | | |
840 | 840 | | |
841 | | - | |
| 841 | + | |
| 842 | + | |
| 843 | + | |
842 | 844 | | |
843 | 845 | | |
844 | 846 | | |
| |||
0 commit comments