2

User spock belongs to groups human and vulcan.

File holo is owned by user root and by group vulcan. Its permissions are rwxrwx--- (770).

Process tractor is started by user spock, and has uid spock and primary gid human.

Will tractor automatically have access to holo, or will it have to explicitly request the supplemental group permissions of spock via an initgroups call?

The comment here says that it has to be designed to make an explicit request, but the credentials manpage does not mention anything like that and seems (to me) to imply that the supplemental-group checking is automatically done by the OS.

Community
  • 1
Sundar R
  • 1,539

1 Answers1

1

Just so long as the permissions were in place before the tractor process was started it will have access to the file 'holo' because it's part of the 'vulcan' group.

If you start the tractor process then add the 'spock' user to the 'vulcan' group it may not work.

Gene
  • 220