On 2020-07-08 03:25, Tom H wrote:
> In my case, I'd halted the VM so the output above reflects accurately
> the state of affairs.

I know what I said, but....

An even more direct way to demonstrate that nesting of groups is bogus.
(Everything done below was via ssh with logout/login between changes)

First, with this in /etc/group on the system f32x.

users:x:100:maria
wireshark:x:973:egreshko,don,@users

[egreshko@f32x ~]$ id
uid=1026(egreshko) gid=65536(egreshko) 
groups=65536(egreshko),10(wheel),973(wireshark),975(libvirt) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[egreshko@f32x ~]$ cd /tmp
[egreshko@f32x tmp]$ echo "Ed wrote this" > text
[egreshko@f32x tmp]$ chgrp wireshark text
[egreshko@f32x tmp]$ chmod 640 text
[egreshko@f32x tmp]$ ll text
-rw-r-----. 1 egreshko wireshark 14 JulĀ  8 05:20 text

[don@f32x ~]$ id
uid=1028(don) gid=1028(don) groups=1028(don),973(wireshark) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[don@f32x ~]$ cd /tmp
[don@f32x tmp]$ cat text
Ed wrote this

[maria@f32x ~]$ id
uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[maria@f32x ~]$ cd /tmp
[maria@f32x tmp]$ cat text
cat: text: Permission denied

And, even worse, with this in /etc/group

users:x:100:maria
wireshark:x:973:egreshko,don:@users

[don@f32x ~]$ id
uid=1028(don) gid=1028(don) groups=1028(don) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[don@f32x ~]$ cd /tmp
[don@f32x tmp]$ cat text
cat: text: Permission denied

Notice that user Don is no longer considered to be in group wireshark.

And, of course maria is still the same

[maria@f32x ~]$ id
uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[maria@f32x ~]$ cd /tmp
[maria@f32x tmp]$ cat text
cat: text: Permission denied


Now, anyone interested in really proving to themselves that this doesn't work 
can do this on their
own system.




_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org

Reply via email to