Do not ignore EPERM when dropping supplementary groups

GrigorenkoPV · GrigorenkoPV · commit b4a4ab41a53b · 2024-02-29T17:03:00.000+03:00
As per rust-lang#121650 (comment)
diff --git a/library/std/src/sys/pal/unix/process/process_unix.rs b/library/std/src/sys/pal/unix/process/process_unix.rs
@@ -330,22 +330,14 @@ impl Command {
             if let Some(u) = self.get_uid() {
                 // When dropping privileges from root, the `setgroups` call
                 // will remove any extraneous groups. We only drop groups
-                // if we have CAP_SETGID and we weren't given an explicit
-                // set of groups. If we don't call this, then even though our
+                // if we weren't given an explicit set of groups.
+                // If we don't call this, then even though our
                 // uid has dropped, we may still have groups that enable us to
                 // do super-user things.
                 //FIXME: Redox kernel does not support setgroups yet
                 #[cfg(not(target_os = "redox"))]
                 if self.get_groups().is_none() {
-                    let res = cvt(libc::setgroups(0, crate::ptr::null()));
-                    if let Err(e) = res {
-                        // Here we ignore the case of not having CAP_SETGID.
-                        // An alternative would be to require CAP_SETGID (in
-                        // addition to CAP_SETUID) for setting the UID.
-                        if e.raw_os_error() != Some(libc::EPERM) {
-                            return Err(e.into());
-                        }
-                    }
+                    cvt(libc::setgroups(0, crate::ptr::null()))?;
                 }
                 cvt(libc::setuid(u as uid_t))?;
             }
