Plugin missing secondary group
Summary
When running a plugin it is run as the user 'git' in the group 'git'. However, if the 'git' user has secondary groups (such as the requirement of a second group 'docker' to run docker without sudo), no secondary groups are added when the plugin is run.
Steps to reproduce
- Set up gitlab
- Add the 'git' user to the secondary group 'docker'
- Restart the machine, so that the git group is set appropriately
- Create a plugin
test.sh
that looks like this, and add it to the plugins directory:
#!/bin/bash
whoami >> /var/log/test.log
groups >> /var/log/test.log
- Make sure the plugin has all the correct permissions, is owned but 'git' etc.
- Invoke the plugin by performing an action in gitlab
- Check the logfile
/var/log/test.log
Example Project
Doesn't require a project
What is the current bug behaviour?
Plugin is run with user 'git' in group 'git'
What is the expected correct behaviour?
Plugin is run with user 'git', and the group should include any secondary groups. In this case it should be 'git docker'
Relevant logs and/or screenshots
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Current User: git Using RVM: no Ruby Version: 2.5.3p105 Gem Version: 2.7.6 Bundler Version:1.17.3 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.18.1 Sidekiq Version:5.2.5 Go Version: unknownGitLab information Version: 11.10.4 Revision: 62c464651d2 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 9.6.11 URL: (redacted) Using LDAP: no Using Omniauth: yes Omniauth Providers:
GitLab Shell Version: 9.0.0 Repository storage paths:
- default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 9.0.0 ? ... OK (9.0.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Redis available via internal API: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 5/1 ... yes 5/2 ... yes 5/3 ... yes 5/4 ... yes 5/5 ... yes 5/6 ... yes 5/7 ... yes 5/8 ... yes 5/9 ... yes 5/10 ... yes 5/11 ... yes 5/12 ... yes 4/13 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.5.3) Git version >= 2.18.0 ? ... yes (2.18.1) Git user has default SSH configuration? ... yes Active users: ... 3
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished
Possible fixes
I don't know the cause, but maybe something is spawning a plugin process and setting the effective user/group manually, and is forgetting to add secondary groups?