setuid mode: spawned commands missing supplementary groups (no initgroups call)

[jariji]

Version Information

• swhkd 1.3.0-dev (built from latest commit)
• NixOS 26.05, Linux 6.12

Describe the bug

When swhkd runs as a setuid binary (as described in the README), commands spawned by swhkd are missing the user's supplementary groups. For example, if the user is in the wheel group, sudo fails with "user may not run sudo" because the spawned shell has Groups: 0 (root's groups) instead of the user's groups.

Root cause

In daemon.rs around line 207, Command::new("sh") sets .uid(invoking_uid) and .gid(user.gid.as_raw()) but does not call initgroups() to set up the user's supplementary groups. The spawned process inherits the supplementary groups of the swhkd process (running as root), which is just group 0.

When swhkd is launched via sudo or pkexec, this isn't an issue because those tools call initgroups() themselves. But in setuid mode, swhkd is responsible for setting up groups before spawning commands.

Expected behavior

Commands spawned by swhkd should have the same supplementary groups as the invoking user (e.g., wheel, input, networkmanager).

Fix

Add a pre_exec call to initgroups(username, gid) before spawning commands. Something like:

unsafe {
    cmd.pre_exec(move || {
        nix::unistd::initgroups(&username, user.gid)
            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
        Ok(())
    });
}

To Reproduce

1. Make swhkd setuid root (chown root:root swhkd && chmod u+s swhkd)
2. Start swhks && swhkd
3. Press a hotkey bound to e.g. kitty
4. In the spawned terminal, run id -Gn — supplementary groups are missing
5. sudo fails because the user is not seen as being in wheel

[jariji]

Sorry, agent out of control.

[jariji]

Tbh I'm no expert on this stuff but I did get tripped up here and I wonder if the thing about missing supplementary groups might be right.

[jariji]

I'm running master on NixOS, swhkd bindings to open a terminal produce a terminal without my supplementary groups.

I'm really not familiar with this code and not sure if https://github.com/rust-lang/rust/blob/main/library/std/src/sys/process/unix/unix.rs#L305-L324 is relevant, or the initgroups() suggested by the agent.

cc @andycandy-dev re #325

[jastintime]

I have this same issue on master.

a terminal spawned from swhkd results in only my $USERNAME group being preserved, which breaks my usage of doas which requires the wheel group.

For more info im on void linux with kernel 6.12.81 and swhkd running as a setuid binary.