User should can run su-exec as self

[hason]

Confused behaviour:

$ id -u -n
user
$ su-exec user ls
su-exec: setgroups: Operation not permitted

[dbjpanda]

Can this behaviour achieved by su-exec ?

$ whoami
deploy
$ ls -al /sbin/su-exec 
-rwxr-xr-x    1 deploy   deploy        9936 May  1  2018 /sbin/su-exec
$ composer.phar -V
Composer version 1.7.3 2018-11-01 10:05:06
$ su-exec deploy composer.phar -V
su-exec: setgroups: Operation not permitted
 

[dbjpanda]

@hason Did you find any workaround for this type of case ?

[tianon]

What is it you're hoping "su-exec" will do in this condition? You seem to want to switch from the user you are to ... the user you are (which is kind of a strange ask).

[bchallenor]

Not the OP but my use case is this: I would like to use a docker image (provided by a third party) that uses su-exec to switch to a user dynamically specified in an environment variable. This works nicely - unless you happen to want to not change user at all.

It seems to me that by detecting this case and permitting it (by doing nothing), su-exec would be eliminating an edge case and allowing itself to be used in more situations.

[dbjpanda]

What is it you're hoping "su-exec" will do in this condition? You seem to
want to switch from the user you are to ... the user you are (which is kind
of a strange ask).

@tianon Exactly this is the case. I am trying to su-exec from the user deploy to user deploy

Here is my case.
I run su-exec deploy composer.phar install . composer.phar calls a shell script i.e post-install.sh after it complete installing all the php dependencies . Within the post_install.sh there is one line composer.phar install something_else. So here I get the error that is su-exec: setgroups: Operation not permitted

[ncopa]

so basically, check if you are trying to switch to current user, and do nothing in that case?

Something like:

#!/bin/sh

# su-exec-wrapper.sh

user=$1
shift

if [ "$user" != "$(whoami)" ]; then
    su-exec "$@"
else
    "$@"
fi

[tianon]

Indeed, a pattern similar to that is very common in the official images, although we typically check for id -u being 0 (since being root is the only case where we can step-down) -- to use a different user from the one the image was designed for, we usually recommend Docker's built-in --user functionality (which is more secure anyhow).

See also docker-library/rabbitmq#60, docker-library/cassandra#48, docker-library/mongo#81, redis/docker-library-redis#48, docker-library/mysql#161, MariaDB/mariadb-docker#59, docker-library/percona#21, docker-library/ghost#54, docker-library/postgres#253, docker-library/redmine#136.