{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/802","repository_url":"https://api.github.com/repos/opencontainers/runc","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/802/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/802/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/802/events","html_url":"https://github.com/opencontainers/runc/issues/802","id":153200752,"number":802,"title":"How runC should treat supplementary groups?","user":{"login":"albertoleal","id":15064,"avatar_url":"https://avatars.githubusercontent.com/u/15064?v=3","gravatar_id":"","url":"https://api.github.com/users/albertoleal","html_url":"https://github.com/albertoleal","followers_url":"https://api.github.com/users/albertoleal/followers","following_url":"https://api.github.com/users/albertoleal/following{/other_user}","gists_url":"https://api.github.com/users/albertoleal/gists{/gist_id}","starred_url":"https://api.github.com/users/albertoleal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertoleal/subscriptions","organizations_url":"https://api.github.com/users/albertoleal/orgs","repos_url":"https://api.github.com/users/albertoleal/repos","events_url":"https://api.github.com/users/albertoleal/events{/privacy}","received_events_url":"https://api.github.com/users/albertoleal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-05T09:50:10Z","updated_at":"2016-05-10T11:01:41Z","closed_at":null,"body":"We are wondering what the preferred way is to treat the supplementary groups a user is in. Say the user `alice` is in groups `group1` and `group2`:\r\n\r\n```\r\n/etc/passwd\r\nalice:x:1001:1001::/home/alice:::::\r\n\r\n/etc/group\r\ngroup1:x:1001:alice\r\ngroup2:x:1002:alice\r\n```\r\n\r\nand the OCI spec requires that the process defined in `process.json` will run as `alice:group1`. We are thinking of two possible options on how supplementary groups (in this case `group2`) can be applied.\r\n\r\n## Option 1: Let the spec author explicitly request for it\r\n\r\nHonour the [`AdditionalGids` field in the OCI spec][process_spec]. Currently, this works for the `AdditionalGroups` specified in `config.json` when [starting the container][spec_conv] (`runc start`). It would not work though for `AdditionalGids` specified in a `process.json` that is fed to `runc exec`.\r\n\r\n## Option 2: RunC should apply the supplementary groups the user is a member of\r\n\r\nRunC reads `/etc/group` and sets the supplementary groups to `group1` and `group2`. Currently this only works if `user.GID` is not specified in the spec. Otherwise, RunC will [only apply the primary group][exec_user].\r\n\r\nWe think that the second option is better since RunC should apply the supplementary groups a user is in regardless of whether a primary group is explicitly specified or not. We are happy to make a PR in either case.\r\n\r\n[process_spec]: https://github.com/opencontainers/runtime-spec/blob/bf58a8f54497acc1f414a5e752057a6694feccf3/config.md#linux-and-solaris-user\r\n[spec_conv]: https://github.com/opencontainers/runc/blob/master/libcontainer/specconv/spec_linux.go#L228-L230\r\n[exec_user]: https://github.com/opencontainers/runc/blob/master/libcontainer/user/user.go#L319-L328\r\n[libcontainer_conv]: https://github.com/opencontainers/runc/blob/master/utils_linux.go#L78\r\n\r\nThanks,\r\n@glestaris and @albertoleal\r\n\r\n/cc @cloudfoundry/garden"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/218125683","html_url":"https://github.com/opencontainers/runc/issues/802#issuecomment-218125683","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/802","id":218125683,"user":{"login":"glestaris","id":1753414,"avatar_url":"https://avatars.githubusercontent.com/u/1753414?v=3","gravatar_id":"","url":"https://api.github.com/users/glestaris","html_url":"https://github.com/glestaris","followers_url":"https://api.github.com/users/glestaris/followers","following_url":"https://api.github.com/users/glestaris/following{/other_user}","gists_url":"https://api.github.com/users/glestaris/gists{/gist_id}","starred_url":"https://api.github.com/users/glestaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glestaris/subscriptions","organizations_url":"https://api.github.com/users/glestaris/orgs","repos_url":"https://api.github.com/users/glestaris/repos","events_url":"https://api.github.com/users/glestaris/events{/privacy}","received_events_url":"https://api.github.com/users/glestaris/received_events","type":"User","site_admin":false},"created_at":"2016-05-10T11:01:41Z","updated_at":"2016-05-10T11:01:41Z","body":"Any thoughts on that? \r\n\r\nAfter further discussion, we are now leaning towards option 1, as OCI should remain agnostic of `/etc/passwd` and `/etc/group`.\r\n\r\nThanks,\r\n@williammartin and @glestaris"}}