syscall: only call setgroups if we need to

If the caller set ups a Credential in os/exec.Command,
os/exec.Command.Start will end up calling setgroups(2), even if no
supplementary groups were given.

Only root can call setgroups(2) on BSD kernels, which causes Start to
fail for non-root users when they try to set uid and gid for the new
process.

We fix by introducing a new field to syscall.Credential named
NoSetGroups, and setgroups(2) is only called if it is false.
We make this field with inverted logic to preserve backward
compatibility.

RELNOTES=yes

Change-Id: I3cff1f21c117a1430834f640ef21fd4e87e06804
Reviewed-on: https://go-review.googlesource.com/36697
Reviewed-by: Ian Lance Taylor <iant@golang.org>

1 files changed, 45 insertions, 0 deletions

diff --git a/src/os/exec/exec_posix_test.go b/src/os/exec/exec_posix_test.go
new file mode 100644
index 0000000000..b1f24d6c4e
--- /dev/null
+++ b/src/os/exec/exec_posix_test.go
@@ -0,0 +1,45 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build darwin dragonfly freebsd linux netbsd openbsd solaris
+
+package exec_test
+
+import (
+	"os/user"
+	"strconv"
+	"syscall"
+	"testing"
+)
+
+func TestCredentialNoSetGroups(t *testing.T) {
+	u, err := user.Current()
+	if err != nil {
+		t.Fatalf("error getting current user: %v", err)
+	}
+
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil {
+		t.Fatalf("error converting Uid=%s to integer: %v", u.Uid, err)
+	}
+
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil {
+		t.Fatalf("error converting Gid=%s to integer: %v", u.Gid, err)
+	}
+
+	// If NoSetGroups is true, setgroups isn't called and cmd.Run should succeed
+	cmd := helperCommand(t, "echo", "foo")
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Credential: &syscall.Credential{
+			Uid:         uint32(uid),
+			Gid:         uint32(gid),
+			NoSetGroups: true,
+		},
+	}
+
+	if err = cmd.Run(); err != nil {
+		t.Errorf("Failed to run command: %v", err)
+	}
+}