From 9a7439fd79076de03c408de136ba1772347030c2 Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Fri, 9 Oct 2026 14:57:16 -0700 Subject: [PATCH] Core: made initgroups() failures fatal Previously, an initgroups() failure was only logged, and the worker process went on with the supplementary groups inherited from the master process, since setgid() does not change them. Anything relying on the configured user's groups then failed at run time, far from the log message, and the outcome depended on which worker hit the error. Now such a failure is fatal, similarly to setgid() and setuid(). The exception is EPERM, which is logged and ignored: it is returned when supplementary groups cannot be changed at all, for example, in a user namespace with setgroups denied, see user_namespaces(7), or under seccomp. This dates back to 42b12b34f (0.1.11). --- src/os/unix/ngx_process_cycle.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c index ede5ae0ba..c6338305c 100644 --- a/src/os/unix/ngx_process_cycle.c +++ b/src/os/unix/ngx_process_cycle.c @@ -839,8 +839,17 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker) } if (initgroups(ccf->username, ccf->group) == -1) { - ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno, - "initgroups(%s, %d) failed", + + if (ngx_errno != NGX_EPERM) { + ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno, + "initgroups(%s, %d) failed", + ccf->username, ccf->group); + /* fatal */ + exit(2); + } + + ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno, + "initgroups(%s, %d) failed, ignored", ccf->username, ccf->group); } -- 2.47.3