Re: [libvirt] [PATCHv2 2/2] security_dac: compute supplemental groups before fork

On 18.07.2013 01:08, Eric Blake wrote: > Commit 75c1256 states that virGetGroupList must not be called > between fork and exec, then commit ee777e99 promptly violated > that for lxc's use of virSecurityManagerSetProcessLabel. Hoist > the supplemental group detection to the time that the security > manager is created. Qemu is safe, as it uses > virSecurityManagerSetChildProcessLabel which in turn uses > virCommand to determine supplemental groups. >

> - if ((ret = virSecurityDACParseIds(def, uidPtr, gidPtr)) <= 0) > + if ((ret = virSecurityDACParseIds(def, uidPtr, gidPtr)) <= 0) { > + if (groups) > + *groups = NULL; > + if (ngroups) > + ngroups = 0; I believe you wanted *ngroups = 0; in here.

ACK series, but see the issue I'm raising in 2/2.