Bug 608

If I understand Jonathan's problem on IRC correctly the CUPS version of "lpr"
cannot forward the print jobs to the CUPS deamon because it isn't in the "right"
Unix group when it is being launched.

I guess the problem is that Xprt - running as "root" - calls |setuid()| before
running the spooler application (e.g. "lpr"). All attach a small test program as
demonatration...

Created attachment 274 [details]
setuidforktest.c testcase

Test case "setuidforktest.c" to demonstrate the problem (this is a cut-down
version of the code in xc/programs/Xserver/Xprint/attributes.c).

In my test environment by group memberships look like this:
% /usr/bin/id
uid=500(gismobile) gid=2306(gisburn)
groups=2306(gisburn),14(uucp),16(dialout),17(audio),33(video),300(mozilla),100(users),8000(xprint)

-- snip --
... but when I run the example application as user "root" the output of
/usr/bin/id looks like this:
-- snip --
# ./a.out 
child: Setting uid=500
uid=500(gismobile) gid=0(root) groups=2306(gisburn)
-- snip --
All groups (except the primary one) are missing which leads to the problem that
Unix/Linux systems which require an extra group membership for printing won't
work.

Created attachment 275 [details]
setuidforktest_initgroups_test1.c testcase

setuidforktest_initgroups_test1.c - an attempt to use initgroups() to fix the
problem (per Alan's suggestion)
Note that I added a |system()| call after |setuid()|.
The output (starting it as "root") looks like this:
-- snip --
# ./a.out 
child: Setting uid=500
uid=500(gismobile) gid=2306(gisburn)
groups=2306(gisburn),14(uucp),16(dialout),17(audio),33(video),300(mozilla),100(users),8000(xprint)

uid=500(gismobile) gid=2306(gisburn) groups=2306(gisburn)
-- snip --
The 2nd line of the output is from the |system("/usr/bin/id")| call - this is
how it should be...
... but the 3rd line is from the |execv("/usr/bin/id", NULL)| call - which is
still not correct.

It seems that |execv()| kills any extra groups (except the primary one) ... ;-(


Does anyone have an idea how to solve that problem ?

Created attachment 276 [details]
setuidforktest_initgroups_test1.c testcase

Sorry, I attached the wrong version... this is the correct one...

I tested the problem on Solaris and the |execv()| call failed. It seems that the
2nd argument (the parameter array) must not be NULL. Fixing that also gets the
non-primary groups working... :)

s/Fixing that also gets the non-primary groups working/Fixing that also gets the
non-primary groups working on Linux/

Created attachment 277 [details] [review]
Patch for 2004-05-07-trunk

Patch checked-in into trunk...

Checking in xc/ChangeLog;
/cvs/xorg/xc/ChangeLog,v  <--  ChangeLog
new revision: 1.21; previous revision: 1.20
done
Checking in xc/programs/Xserver/Xprint/attributes.c;
/cvs/xorg/xc/programs/Xserver/Xprint/attributes.c,v  <--  attributes.c
new revision: 1.3; previous revision: 1.2
done
Mailing the commit message to xorg-commit@pdx.freedesktop.org...

... marking bug as FIXED.

Drew:
Can you include the fix into the Debian version of Xprt, please ?

Created attachment 296 [details] [review]
Patch for 2004-07-16-oldcvs_trunk (X11R6.6)

The patch is for the old X11R6.6-based trunk for those vendors who need it (and
for the 009.001 maintaince release).

attachment 296 [details] [review] checked-in into oldcvs-trunk:

Checking in xc/programs/Xserver/Xprint/attributes.c;
/cvs/xprint/xprint/src/xprint_main/xc/programs/Xserver/Xprint/attributes.c,v 
<--  attributes.c
new revision: 1.6; previous revision: 1.5
done