Support setfsuid, setfsgid

[ianlewis]

http://man7.org/linux/man-pages/man2/setfsuid32.2.html
http://man7.org/linux/man-pages/man2/setfsgid.2.html

[hugelgupf]

FWIW, we explicitly decided not to implement these as we couldn't find any users of them. EUID/EGID are used instead.

Saying this to say this could probably easily be a p3 or p4.

[ianlewis]

Fair enough, I added here based on the we had in the internal tracker.

[BinaryKhaos]

I spent quite a bit of time debugging the following failure since it naturally works fine with crun/runc and PAM related problems aren't that easy to debug:

google-authenticator-libpam fails during authentication w/o setfs{uid|gid} support. It has no fallback for setfsuid on Linux and has a hard (build) dependency on those syscalls, see here, here, here and here.

Is there any chance this can be added to sentry or should I report this issue over at google-authenticator-libpam and see if they can ease up that dependency? It naturally also works if I rebuild and patch it, so it doesn't use both syscalls but that is not a good long-term solution.

[BinaryKhaos]

Interestingly and related, PAM has two helper functions that deal with dropping and reacquiring privileges: pam_modutil_drop_priv() and pam_modutil_regain_priv(). The former uses setfsuid and setfsgid. In the context of this bug, it would be interesting to know how many PAM modules use those helpers too.