From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Fri, 9 Oct 2026 21:57:16 +0000 (-0700)
Subject: Core: made initgroups() failures fatal
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=9a7439fd79076de03c408de136ba1772347030c2;p=nginx.git

Core: made initgroups() failures fatal

Previously, an initgroups() failure was only logged, and the worker
process went on with the supplementary groups inherited from the master
process, since setgid() does not change them.  Anything relying on the
configured user's groups then failed at run time, far from the log
message, and the outcome depended on which worker hit the error.

Now such a failure is fatal, similarly to setgid() and setuid().  The
exception is EPERM, which is logged and ignored: it is returned when
supplementary groups cannot be changed at all, for example, in a user
namespace with setgroups denied, see user_namespaces(7), or under
seccomp.

This dates back to 42b12b34f (0.1.11).
---

diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index ede5ae0ba..c6338305c 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -839,8 +839,17 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
         }
 
         if (initgroups(ccf->username, ccf->group) == -1) {
-            ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
-                          "initgroups(%s, %d) failed",
+
+            if (ngx_errno != NGX_EPERM) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "initgroups(%s, %d) failed",
+                              ccf->username, ccf->group);
+                /* fatal */
+                exit(2);
+            }
+
+            ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
+                          "initgroups(%s, %d) failed, ignored",
                           ccf->username, ccf->group);
         }