[rpms/slurm] epel10: Patch changes per resolution of upstream bug #4101:

[Philip Kovacs <pkdevel@yahoo.com>]

            A new commit has been pushed.

            Repo   : rpms/slurm
            Branch : epel10
            Commit : f7f253a9a5257dda7dafdb07b7bb89e301d0fa39
            Author : Philip Kovacs <pkdevel@yahoo.com>
            Date   : 2017-10-05T14:22:05-04:00
            Stats  : +104/-60 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/slurm/c/f7f253a9a5257dda7dafdb07b7bb89e301d0fa39?branch=epel10

            Log:
            Patch changes per resolution of upstream bug #4101:
salloc/sbatch/srun: must be root to use --uid/--gid options.
salloc: supplemental groups dropped after setuid.

---
diff --git a/slurm.spec b/slurm.spec
index 2613026..58da823 100644
--- a/slurm.spec
+++ b/slurm.spec
@@ -26,7 +26,7 @@
 
 Name:           slurm
 Version:        17.02.7
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        Simple Linux Utility for Resource Management
 License:        GPLv2 and BSD
 URL:            https://slurm.schedmd.com/
@@ -38,16 +38,17 @@ Source4:        slurm-128x128.png
 Source5:        slurm_setuser.in
 
 # upstream bugs #4094, #4095, #4101, #4113
-Patch0:         slurm_salloc_privileges.patch
-Patch1:         slurm_format_truncation.patch
+Patch0:         slurm_opts_restrict.patch
+Patch1:         slurm_salloc_setgroups.patch
+Patch2:         slurm_format_truncation.patch
 
 # build-related patches
-Patch2:         slurm_perlapi_rpaths.patch
-Patch3:         slurm_html_doc_path.patch
-Patch4:         slurm_doc_fix.patch
+Patch3:         slurm_perlapi_rpaths.patch
+Patch4:         slurm_html_doc_path.patch
+Patch5:         slurm_doc_fix.patch
 
 # Fedora-related patches
-Patch5:         slurm_service_files.patch
+Patch6:         slurm_service_files.patch
 
 BuildRequires:  pkgconfig(gtk+-2.0)
 BuildRequires:  hdf5-devel
@@ -219,6 +220,7 @@ Torque wrapper scripts used for helping migrate from Torque/PBS to Slurm.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 cp %SOURCE1 etc/slurm.conf
 cp %SOURCE1 etc/slurm.conf.example
 cp %SOURCE2 etc/slurmdbd.conf
@@ -747,6 +749,11 @@ fi
 %systemd_postun_with_restart slurmdbd.service
 
 %changelog
+* Thu Oct 5 2017 Philip Kovacs <pkdevel@yahoo.com> - 17.02.7-4
+- Patch changes per resolution of upstream bug #4101:
+- salloc/sbatch/srun: must be root to use --uid/--gid options.
+- salloc: supplemental groups dropped after setuid.
+
 * Thu Oct 5 2017 Philip Kovacs <pkdevel@yahoo.com> - 17.02.7-3
 - Added BuildRequires gcc and minor packaging conformance items.
 

diff --git a/slurm_opts_restrict.patch b/slurm_opts_restrict.patch
new file mode 100644
index 0000000..ddf6bed
--- /dev/null
+++ b/slurm_opts_restrict.patch
@@ -0,0 +1,72 @@
+--- slurm-17.02.7/src/salloc/opt.c.old	2017-10-05 13:33:36.300529834 -0400
++++ slurm-17.02.7/src/salloc/opt.c	2017-10-05 13:37:02.093162798 -0400
+@@ -1054,6 +1054,10 @@
+ 			}
+ 			break;
+ 		case LONG_OPT_UID:
++			if (getuid() != 0) {
++ 				error("--uid only permitted by root user");
++				exit(error_exit);
++ 			}
+ 			if (opt.euid != (uid_t) -1) {
+ 				error("duplicate --uid option");
+ 				exit(error_exit);
+@@ -1064,6 +1068,10 @@
+ 			}
+ 			break;
+ 		case LONG_OPT_GID:
++			if (getuid() != 0) {
++ 				error("--gid only permitted by root user");
++				exit(error_exit);
++ 			}
+ 			if (opt.egid != (gid_t) -1) {
+ 				error("duplicate --gid option");
+ 				exit(error_exit);
+--- slurm-17.02.7/src/sbatch/opt.c.old	2017-10-05 13:39:04.067419821 -0400
++++ slurm-17.02.7/src/sbatch/opt.c	2017-10-05 13:41:20.388042002 -0400
+@@ -1621,6 +1621,10 @@
+ 			opt.jobid_set = true;
+ 			break;
+ 		case LONG_OPT_UID:
++			if (getuid() != 0) {
++				error("--uid only permitted by root user");
++				exit(error_exit);
++			}
+ 			if (opt.euid != (uid_t) -1) {
+ 				error("duplicate --uid option");
+ 				exit(error_exit);
+@@ -1631,6 +1635,10 @@
+ 			}
+ 			break;
+ 		case LONG_OPT_GID:
++			if (getuid() != 0) {
++				error("--gid only permitted by root user");
++				exit(error_exit);
++			}
+ 			if (opt.egid != (gid_t) -1) {
+ 				error("duplicate --gid option");
+ 				exit(error_exit);
+--- slurm-17.02.7/src/srun/libsrun/opt.c.old	2017-10-05 13:42:57.195643601 -0400
++++ slurm-17.02.7/src/srun/libsrun/opt.c	2017-10-05 13:44:34.753262251 -0400
+@@ -1450,6 +1450,10 @@
+ 				_get_int(optarg, "max-exit-timeout", true);
+ 			break;
+ 		case LONG_OPT_UID:
++			if (getuid() != 0) {
++				error("--uid only permitted by root user");
++				exit(error_exit);
++			}
+ 			if (opt.euid != (uid_t) -1) {
+ 				error("duplicate --uid option");
+ 				exit(error_exit);
+@@ -1460,6 +1464,10 @@
+ 			}
+ 			break;
+ 		case LONG_OPT_GID:
++			if (getuid() != 0) {
++				error("--gid only permitted by root user");
++				exit(error_exit);
++			}
+ 			if (opt.egid != (gid_t) -1) {
+ 				error("duplicate --gid option");
+ 				exit(error_exit);

diff --git a/slurm_salloc_privileges.patch b/slurm_salloc_privileges.patch
deleted file mode 100644
index 3cc2910..0000000
--- a/slurm_salloc_privileges.patch
+++ /dev/null
@@ -1,53 +0,0 @@
---- slurm-17.02.7/src/salloc/salloc.c	2017-08-14 13:48:43.000000000 -0400
-+++ slurm-17.02.7/src/salloc/salloc.c.new	2017-08-23 00:07:22.759099425 -0400
-@@ -42,6 +42,7 @@
- 
- #include <dirent.h>
- #include <fcntl.h>
-+#include <grp.h>
- #include <pwd.h>
- #include <stdbool.h>
- #include <stdio.h>
-@@ -298,13 +299,27 @@
- 	if (_fill_job_desc_from_opts(&desc) == -1) {
- 		exit(error_exit);
- 	}
--	if (opt.gid != (gid_t) -1) {
-+
-+	/* If the requested gid is different than ours, become that gid */
-+	if ((getgid() != opt.gid) && (opt.gid != (gid_t) -1)) {
- 		if (setgid(opt.gid) < 0) {
- 			error("setgid: %m");
- 			exit(error_exit);
- 		}
- 	}
- 
-+	/* If the requested uid is different than ours, become that uid */
-+	if ((getuid() != opt.uid) && (opt.uid != (uid_t) -1)) {
-+		if (setgroups(0, NULL) < 0) {
-+			error("setgroups: %m");
-+			exit(error_exit);
-+		}
-+		if (setuid(opt.uid) < 0) {
-+			error("setuid: %m");
-+			exit(error_exit);
-+		}
-+	}
-+
- 	callbacks.ping = _ping_handler;
- 	callbacks.timeout = _timeout_handler;
- 	callbacks.job_complete = _job_complete_handler;
-@@ -333,13 +348,6 @@
- 		sleep (++retries);
- 	}
- 
--	/* become the user after the allocation has been requested. */
--	if (opt.uid != (uid_t) -1) {
--		if (setuid(opt.uid) < 0) {
--			error("setuid: %m");
--			exit(error_exit);
--		}
--	}
- 	if (alloc == NULL) {
- 		if (allocation_interrupted) {
- 			/* cancelled by signal */

diff --git a/slurm_salloc_setgroups.patch b/slurm_salloc_setgroups.patch
new file mode 100644
index 0000000..efb9260
--- /dev/null
+++ b/slurm_salloc_setgroups.patch
@@ -0,0 +1,18 @@
+--- slurm-17.02.7/src/salloc/salloc.c.old	2017-10-05 13:25:52.403682572 -0400
++++ slurm-17.02.7/src/salloc/salloc.c	2017-10-05 13:29:52.913975815 -0400
+@@ -333,8 +333,13 @@
+ 		sleep (++retries);
+ 	}
+ 
+-	/* become the user after the allocation has been requested. */
+-	if (opt.uid != (uid_t) -1) {
++	/* If the requested uid is different than ours, become that uid */
++	if ((getuid() != opt.uid) && (opt.uid != (uid_t) -1)) {
++		/* drop extended groups before changing uid/gid */
++		if ((setgroups(0, NULL) < 0)) {
++			error("setgroups: %m");
++			exit(error_exit);
++		}
+ 		if (setuid(opt.uid) < 0) {
+ 			error("setuid: %m");
+ 			exit(error_exit);