Re: [PATCH] selftests/capabilities: test_execve: drop supplementary groups

[sashiko-bot@kernel.org]

> When run as root, test_execve keeps the caller's supplementary groups,
> which usually include group 0.
> 
> Since commit 337490f0007f ("exec: Correct the permission check for
> unsafe exec"), a setgid exec is not an id change if the new egid is
> already one of the caller's groups. As group 0 is one of them, the
> ambient capabilities survive exec of the sgidroot helper, and two
> cases fail:
> 
>   # [RUN]	Root, gid != 0, +ia, sgidroot => eip
>   # Wrong ambient state (AT_SECURE is set)
>   # [RUN]	Non-root +ia, sgidroot => i
>   # Wrong effective state (AT_SECURE is set)
> 
> Clear the supplementary groups before switching UIDs.
> 
> An AI coding assistant (Claude) was used to analyze the failure and to
> draft the fix and this changelog. Tested on v7.4-rc2: as root, all 21
> cases now pass (2 failed before); the unprivileged user namespace path
> is unchanged.
> 
> Fixes: 337490f0007f ("exec: Correct the permission check for unsafe exec")
> Signed-off-by: Kurt Lin <lylin1023@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111164645.260593-1-lylin1023@gmail.com?part=1