syscall(SYS_initgroups,...) replacement?

Our code for trying to set the user-group/s of a specific process produces a deprecation warning when building on macOS 10.12 and beyond.


<pre>

warning: 'syscall' is deprecated: first deprecated in macOS 10.12 - syscall(2) is unsupported; please switch to a supported interface. For SYS_kdebug_trace use kdebug_signpost(). [-Wdeprecated-declarations]

if (::syscall(SYS_initgroups, ngroups, _gids, uid.get()) == -1) {

^

/Applications/Xcode-beta.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk/usr/include/unistd.h:745:6: note: 'syscall' has been explicitly marked deprecated here

int syscall(int, ...);

^

</pre>


That warning is however not too helpful in that it references an entirely different system function.


Is there a replacement that can be used for macOS >=10.12 achieving the same?


One reference that we have used in the past are the samba sources as provided by Apple's opensource website (see this mirror for added convenience);

https://github.com/practicalswift/osx/blob/master/src/samba/patches/support-darwin-initgroups-syscall#L51


However I have failed to find any more recent samba source which, in thoery would use a non deprecated way of initializing/setting user-groups for the hosting process.


Thanks for any pointers!

Replies

You're doing this from user space, right? Can't you just use the initgroups() function, declared in <unistd.h> and provided by libSystem? It's just the syscall() function itself which is deprecated, not that syscall in specific.

Does that mean the limitations of setgroups/initgroups as documented below do not apply anymore?

https://github.com/practicalswift/osx/blob/master/src/samba/patches/support-darwin-initgroups-syscall#L31-L51

Does that mean the limitations of setgroups/initgroups as documented below do not apply anymore?

This is one of those “What are you really trying to do?” moments. It is very hard to reliably change a process from one user identity to another.

initgroups
with a large group list is only one of many problems you’re likely to encounter.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"