Make minijail respect the groups of the uid provided on the command line.

src/platform/minijail/env.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 // Some portions Copyright (c) 2009 The Chromium Authors.
 //
 // Default implementation of the Env interface.
 
 #include "minijail/env.h"
 
 #include <asm/unistd.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <grp.h>
+#include <pwd.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/capability.h>
 #include <sys/mount.h>
 #include <sys/prctl.h>
@@ skipping 51 matching lines @@
   if (prctl(PR_SET_SECUREBITS, kSecureBitsAllLocked)) {
     PLOG(FATAL) << "Failed to set PR_SET_SECUREBITS";
   }
   DLOG(INFO) << "Success.";
   return true;
 }
 
 bool Env::ChangeUser(uid_t uid, gid_t gid) const {
   // TODO(wad) support supplemental groups
   DLOG(INFO) << "Dropping root...";
-  if (setgroups(0, NULL)) {
-    PLOG(FATAL) << "Failed to drop supplementary groups";
+  struct passwd* entry = getpwuid(uid);
+  endpwent();
+  if (!entry) {
+    LOG(INFO) << "UID is unknown. Clearing all supplemental groups";
+    PLOG_IF(FATAL, setgroups(0, NULL))
+        << "Failed to clear supplementary groups";
+  } else {
+    PLOG_IF(FATAL, initgroups(entry->pw_name, entry->pw_gid))
+      << "Failed to set supplementary groups";
   }
   if (setresgid(gid, gid, gid)) {
     PLOG(FATAL) << "Failed to change to gid " << gid;
   }
   if (setresuid(uid, uid, uid)) {
     PLOG(FATAL) << "Failed to change to uid " << uid;
   }
   DLOG(INFO) << "Success.";
   return true;
 }
@@ skipping 125 matching lines @@
   for (char * const* arg = argv; *arg; ++arg) {
     DLOG(INFO) << "-> " << *arg;
   }
   execve(path, argv, envp);
   PLOG(FATAL) << "failed to execute " << path;
   return false;
 }
 
 }  // namespace minijail
 }  // namespace chromeos