From 94f7eb4b9c838651c3201b48e1e7142feca12745 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 30 Jun 2026 11:22:22 +0200 Subject: [PATCH] user: GetExecUser: always clone default Sgids Clone the default Sgids slice instead of sharing it to prevent accidentally mutating, and simplify the initialization by creating a non-nil copy directly. Signed-off-by: Sebastiaan van Stijn --- user/user.go | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/user/user.go b/user/user.go index 03f1df4..1fd9a08 100644 --- a/user/user.go +++ b/user/user.go @@ -296,15 +296,10 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) ( user := &ExecUser{ Uid: defaults.Uid, Gid: defaults.Gid, - Sgids: defaults.Sgids, + Sgids: append([]int{}, defaults.Sgids...), // Sgids slice *cannot* be nil. Home: defaults.Home, } - // Sgids slice *cannot* be nil. - if user.Sgids == nil { - user.Sgids = []int{} - } - // Allow for userSpec to have either "user", or optionally "user:group" syntax. userArg, groupArg, _ := strings.Cut(userSpec, ":")