File 0001-run-add-container-gid-to-additional-groups.patch of Package buildah.37504

From e77a82344575c3504710bde6f0412eb9c47a9a10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dcermak@suse.com>
Date: Tue, 22 Aug 2023 12:16:48 +0200
Subject: [PATCH 1/4] run: add container gid to additional groups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When container is created with specific uid and gid also add container
gid to supplementary/additional group.

(cherry-picked from 9934b17365083ce966b44c5ce3c7e052f516e255)

Signed-off-by: Aditya R <arajan@redhat.com>
Signed-off-by: Dan Čermák <dcermak@suse.com>
---
 run_linux.go                             |  1 +
 tests/bud.bats                           | 16 ++++++++++++++++
 tests/bud/supplemental-groups/Dockerfile |  3 +++
 tests/run.bats                           | 14 ++++++++++++++
 4 files changed, 34 insertions(+)
 create mode 100644 tests/bud/supplemental-groups/Dockerfile

diff --git a/run_linux.go b/run_linux.go
index 43720ee14..b4f2d416c 100644
--- a/run_linux.go
+++ b/run_linux.go
@@ -2095,6 +2095,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
 	}
 	g.SetProcessUID(user.UID)
 	g.SetProcessGID(user.GID)
+	g.AddProcessAdditionalGid(user.GID)
 	for _, gid := range user.AdditionalGids {
 		g.AddProcessAdditionalGid(gid)
 	}
diff --git a/tests/bud.bats b/tests/bud.bats
index 74fb21451..1ef067d50 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -304,6 +304,22 @@ _EOF
   expect_line_count 12
 }
 
+@test "build test has gid in supplemental groups" {
+  _prefetch alpine
+  run_buildah build --signature-policy ${TESTSDIR}/policy.json -t source -f ${TESTSDIR}/bud/supplemental-groups/Dockerfile
+  # gid 1000 must be in supplemental groups
+  expect_output --substring "Groups:	1000"
+}
+
+@test "build test if supplemental groups has gid with --isolation chroot" {
+  test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
+
+  _prefetch alpine
+  run_buildah build --isolation chroot --signature-policy ${TESTSDIR}/policy.json -t source -f ${TESTSDIR}/bud/supplemental-groups/Dockerfile
+  # gid 1000 must be in supplemental groups
+  expect_output --substring "Groups:	1000"
+}
+
 @test "bud-multistage-partial-cache" {
   _prefetch alpine
   target=foo
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
new file mode 100644
index 000000000..462d9ea7a
--- /dev/null
+++ b/tests/bud/supplemental-groups/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+USER 1000:1000
+RUN cat /proc/$$/status
diff --git a/tests/run.bats b/tests/run.bats
index 3fd5d4ffa..6ab47a567 100644
--- a/tests/run.bats
+++ b/tests/run.bats
@@ -335,6 +335,20 @@ function configure_and_check_user() {
   expect_output "888:888"
 }
 
+@test "run --user and verify gid in supplemental groups" {
+  skip_if_no_runtime
+
+  # Create the container.
+  _prefetch alpine
+  run_buildah from --signature-policy ${TESTSDIR}/policy.json alpine
+  ctr="$output"
+
+  # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
+  run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
+  # gid 1000 must be in additional/supplemental groups
+  expect_output --substring "Groups:	1000 "
+}
+
 @test "run --workingdir" {
 	skip_if_no_runtime
 
-- 
2.49.0