Core: made initgroups() failures fatal

Previously, an initgroups() failure was only logged, and the worker
process went on with the supplementary groups inherited from the master
process, since setgid() does not change them.  Anything relying on the
configured user's groups then failed at run time, far from the log
message, and the outcome depended on which worker hit the error.

Now such a failure is fatal, similarly to setgid() and setuid().  The
exception is EPERM, which is logged and ignored: it is returned when
supplementary groups cannot be changed at all, for example, in a user
namespace with setgroups denied, see user_namespaces(7), or under
seccomp.

This dates back to 42b12b34f (0.1.11).

diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index ede5ae0ba181ada35586059f7c685f20a1e108e4..c6338305cfac114711d9634e91367e30e3669a12 100644 (file)
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -839,8 +839,17 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
         }
 
         if (initgroups(ccf->username, ccf->group) == -1) {
-            ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
-                          "initgroups(%s, %d) failed",
+
+            if (ngx_errno != NGX_EPERM) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "initgroups(%s, %d) failed",
+                              ccf->username, ccf->group);
+                /* fatal */
+                exit(2);
+            }
+
+            ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
+                          "initgroups(%s, %d) failed, ignored",
                           ccf->username, ccf->group);
         }