On 2020-07-08 03:25, Tom H wrote: > In my case, I'd halted the VM so the output above reflects accurately > the state of affairs. I know what I said, but.... An even more direct way to demonstrate that nesting of groups is bogus. (Everything done below was via ssh with logout/login between changes) First, with this in /etc/group on the system f32x. users:x:100:maria wireshark:x:973:egreshko,don,@users [egreshko@f32x ~]$ id uid=1026(egreshko) gid=65536(egreshko) groups=65536(egreshko),10(wheel),973(wireshark),975(libvirt) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [egreshko@f32x ~]$ cd /tmp [egreshko@f32x tmp]$ echo "Ed wrote this" > text [egreshko@f32x tmp]$ chgrp wireshark text [egreshko@f32x tmp]$ chmod 640 text [egreshko@f32x tmp]$ ll text -rw-r-----. 1 egreshko wireshark 14 Jul 8 05:20 text [don@f32x ~]$ id uid=1028(don) gid=1028(don) groups=1028(don),973(wireshark) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [don@f32x ~]$ cd /tmp [don@f32x tmp]$ cat text Ed wrote this [maria@f32x ~]$ id uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [maria@f32x ~]$ cd /tmp [maria@f32x tmp]$ cat text cat: text: Permission denied And, even worse, with this in /etc/group users:x:100:maria wireshark:x:973:egreshko,don:@users [don@f32x ~]$ id uid=1028(don) gid=1028(don) groups=1028(don) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [don@f32x ~]$ cd /tmp [don@f32x tmp]$ cat text cat: text: Permission denied Notice that user Don is no longer considered to be in group wireshark. And, of course maria is still the same [maria@f32x ~]$ id uid=1027(maria) gid=1027(maria) groups=1027(maria),100(users) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [maria@f32x ~]$ cd /tmp [maria@f32x tmp]$ cat text cat: text: Permission denied Now, anyone interested in really proving to themselves that this doesn't work can do this on their own system. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
