yousong:

Hi, please check relevant entries in /etc/passwd and /etc/group to see if user "foo" has the right primary group id set there. If you are using /lib/functions.sh to add group and users, it's very likely that it generated wrong id in the user/group database.

The following snippet should confirm that.

. /lib/functions/procd.sh
service_triggers() { true; }
procd_open_service foo foo
procd_open_instance bz
procd_set_param user foo
procd_set_param command '/bin/sh' '-c' 'logger $(id)'
procd_close_instance
procd_close_service


flipreverse:

Pls excuse my later response. I didn't get any notification about your answer.
Procd works perfectly with respect to a user's primary group. However, a user might be in more than just his or her primary group.
In my case, the user's foo primary group is staff, and he is also member of the group bar.
However, the procd scripts do not respect those groups....

por:

Just to understand the issue, what has this to do with procd ?

The user and group information, in case of OpenWrt implemented in passwd/groups, and retrievable with f.i. getent() and id, seems completely unrelated. Or is that data not available in the procd its jail ?

yousong:

The issue should be that procd only sets effective group id to user's primary group id while Alexander the reporter expects it also sets supplementary group ids for instance processes ;) I think this is a valid feature request, better than adding another "group" option.

yousong:

Hi, Alexander, I just posted 2 patches [1] to the mailing list that should address the issue for you. Please have it a try and see if it works for you. Thank you.

[1] http://patchwork.ozlabs.org/project/lede/list/?series=27951

flipreverse:

Yeah, sure! I'll try them.
Unfortunately, I do not see any patches. Do I have to login to see them?

EDIT: Found them: http://patchwork.ozlabs.org/patch/871761/

flipreverse:

Where do I find that file instance.c?
I do not have such file in my checkout (https://git.lede-project.org/source.git).

flipreverse:

Got it. :) It took me a while to notice that the procd sources are downloaded as a tarball.
I then successfully patched the sources, and it works.

Thanks!