On 2020-07-08 03:25, Tom H wrote:
In my case, I'd halted the VM so the output above reflects
accurately
the state of affairs.
I know what I said, but....
An even more direct way to demonstrate that nesting of groups is bogus.
(Everything done below was via ssh with logout/login between changes)
First, with this in /etc/group on the system f32x.
users:x:100:maria
wireshark:x:973:egreshko,don,@users
[egreshko@f32x ~]$ id
uid=1026(egreshko) gid=65536(egreshko)
groups=65536(egreshko),10(wheel),973(wireshark),975(libvirt)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[egreshko@f32x ~]$ cd /tmp
[egreshko@f32x tmp]$ echo "Ed wrote this" > text
[egreshko@f32x tmp]$ chgrp wireshark text
[egreshko@f32x tmp]$ chmod 640 text
[egreshko@f32x tmp]$ ll text
-rw-r-----. 1 egreshko wireshark 14 JulĀ 8 05:20 text
[don@f32x ~]$ id
uid=1028(don) gid=1028(don) groups=1028(don),973(wireshark)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[don@f32x ~]$ cd /tmp
[don@f32x tmp]$ cat text
Ed wrote this
[maria@f32x ~]$ id
uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[maria@f32x ~]$ cd /tmp
[maria@f32x tmp]$ cat text
cat: text: Permission denied
And, even worse, with this in /etc/group
users:x:100:maria
wireshark:x:973:egreshko,don:@users
[don@f32x ~]$ id
uid=1028(don) gid=1028(don) groups=1028(don)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[don@f32x ~]$ cd /tmp
[don@f32x tmp]$ cat text
cat: text: Permission denied
Notice that user Don is no longer considered to be in group wireshark.
And, of course maria is still the same
[maria@f32x ~]$ id
uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[maria@f32x ~]$ cd /tmp
[maria@f32x tmp]$ cat text
cat: text: Permission denied
Now, anyone interested in really proving to themselves that this doesn't work can do
this on their
own system.