RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
The nsenter program changes uid and then gid around lines 331. This should be done in the reverse order because changing uid drops capabilities and won't allow the gid to be changed. This is not a security problem because the call to setgid checks the return code and exits.

Also, between changing gid and uid, supplemental groups should be dropped or changed. Perhaps the best thing is to call initgroups with the new uid so that whatever groups the new uid has can be picked up. If this is not desirable, then just call setgroups(0, NULL) to unconditionally drop the supplemental groups. Not doing this can allow leakage of group root as a supplemental group.

Version-Release number of selected component (if applicable):
util-linux-2.23.2-12.el7.x86_64

Ah, stupid bug. 

Fixed by upstream commit 99d7e174119e8717efae0f0fec5f7dec14492fb3 (for now setgroups() seems good enough.) RHEL7/Fedora packages will be updated ASAP.

Well, nsenter(1) on RHEL7 does not have --setuid and --setgid options yet, it seems that the comment #0 is mostly about Fedora :-)

Anyway, rhel7 version also supports user namespaces, so I'm going to backport setuid and setgid stuff too. It seems more robust to have all the functionally in the util to avoid unexpected UIDs and GIDs leaks.

We're going to remove user namespaces (see bug #1073851) at all from unshare and nsenter, so this bug has no sense any more. Closing.