blob: 33e0f9d7b3daee734c625eed6b48c3a87be0010f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
require_relative '../../spec_helper'
describe "Process.groups" do
platform_is_not :windows do
it "gets an Array of the gids of groups in the supplemental group access list" do
groups = `id -G`.scan(/\d+/).map { |i| i.to_i }
# Include the standard `id` command output. On macOS, GNU
# coreutils `id` is limited to NGROUPS_MAX groups, because of
# the backward compatibility of getgroups(2).
(groups |= `/usr/bin/id -G`.scan(/\d+/).map { |i| i.to_i }) rescue nil
gid = Process.gid
expected = (groups.sort - [gid]).uniq.sort
actual = (Process.groups - [gid]).uniq.sort
actual.should == expected
end
end
end
describe "Process.groups=" do
platform_is_not :windows, :android do
as_superuser do
it "sets the list of gids of groups in the supplemental group access list" do
groups = Process.groups
Process.groups = []
Process.groups.should == []
Process.groups = groups
Process.groups.sort.should == groups.sort
end
end
as_user do
platform_is :aix do
it "sets the list of gids of groups in the supplemental group access list" do
# setgroups() is not part of the POSIX standard,
# so its behavior varies from OS to OS. AIX allows a non-root
# process to set the supplementary group IDs, as long as
# they are presently in its supplementary group IDs.
# The order of the following tests matters.
# After this process executes "Process.groups = []"
# it should no longer be able to set any supplementary
# group IDs, even if it originally belonged to them.
# It should only be able to set its primary group ID.
groups = Process.groups
Process.groups = groups
Process.groups.sort.should == groups.sort
Process.groups = []
Process.groups.should == []
Process.groups = [ Process.gid ]
Process.groups.should == [ Process.gid ]
supplementary = groups - [ Process.gid ]
if supplementary.length > 0
-> { Process.groups = supplementary }.should raise_error(Errno::EPERM)
end
end
end
platform_is_not :aix do
it "raises Errno::EPERM" do
-> {
Process.groups = [0]
}.should raise_error(Errno::EPERM)
end
end
end
end
end
|