setgid first, setuid second
Setting a new effective gid requires privileges. We must set the gid
while we potentially still have superuser privileges. Otherwise
setgid(2) fails because we've already changed to an unprivileged uid.
Here is a test case:
[global]
rw=read
directory=tmp
size=512m
buffered=0
[file1]
uid=1000
gid=1000
Without this patch fio will fail when invoked by root.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
diff --git a/fio.c b/fio.c
index 8dff813..8cc8fcf 100644
--- a/fio.c
+++ b/fio.c
@@ -1068,14 +1068,18 @@
*/
fio_mutex_remove(td->mutex);
- if (td->o.uid != -1U && setuid(td->o.uid)) {
- td_verror(td, errno, "setuid");
- goto err;
- }
+ /*
+ * A new gid requires privilege, so we need to do this before setting
+ * the uid.
+ */
if (td->o.gid != -1U && setgid(td->o.gid)) {
td_verror(td, errno, "setgid");
goto err;
}
+ if (td->o.uid != -1U && setuid(td->o.uid)) {
+ td_verror(td, errno, "setuid");
+ goto err;
+ }
/*
* May alter parameters that init_io_u() will use, so we need to