RPM lint warning in dependency {users-0.7.0 via update-ssh-keys-0.3.0): call to setgroups before setuid about afterburn

[jfkw]

@lucab Yes, thanks, I'll report the issue at rust-users.

[lucab]

Thanks for the report. I think this ticket is actually covering update-ssh-keys, but I'm fine handling this here.

The warning is related to switch_user_group in the users crate (all versions): https://github.com/ogham/rust-users/blob/15af1576e40fd3e5592b918de353df6a976c42c4/src/switch.rs#L134-L143

We are calling that in update-ssh-keys: https://github.com/coreos/update-ssh-keys/blob/v0.3.0/src/lib.rs#L108

In our specific case I think this is not a security bug. We are calling that method in order to align user/group on file creation only, not to drop privileges for the process (those are reset when the guard value is dropped at the end of the function).

I think it is still worth to report as bug against https://github.com/ogham/rust-users. @jfkw do you want to do that yourself? If/when fixed, we will pick up the new dependency both here an in update-ssh-keys.

[bgilbert]

I'm not seeing the rpmlint warning with Afterburn 5.3.0, so I'll assume that recent rust-users (we're using 0.11) has fixed this. Closing, but feel free to reopen if you're still seeing this.