Return
-
Title
Secondary groups of pmrun run user account are not accessible -
Description
When running a command from within pmrun, the user account that the command is being run as doesn't show any of its secondary group memberships. For example:
$ /bin/id testusruid=274386735(testusr) gid=8000(unix) groups=8000(unix),100001(localgrp),966916429(adgroup),1391836024(sudo_users)$ pmrun -u testusr /bin/iduid=274386735(testusr) gid=8000(unix) groups=8000(unix) -
Cause
This is a result of how the default profile is configured. -
Resolution
To change the behaviour so that your run user has access to all of their secondary group memberships you may edit the profileBasedPolicy.conf file. Make the following change to the procedure pr_processProfile(), found around line 2484 in the default file:rungroups={pf_authgroup};to:rungroups={use_rungroups};