Support bash in privileged mode

Library/Homebrew/brew.sh

@@ -216,7 +216,7 @@ numeric() {
 }
 
 check-run-command-as-root() {
- [[ "$(id -u)" == 0 ]] || return
+ [[ "$(id -u)" == 0 || "$(id -ur)" == 0 ]] || return
 
  # Allow Azure Pipelines/GitHub Actions/Docker/Concourse/Kubernetes to do everything as root (as it's normal there)
  [[ -f /.dockerenv ]] && return

Library/Homebrew/global.rb

@@ -106,8 +106,8 @@ def auditing?
  end
 
  def running_as_root?
- @process_uid ||= Process.uid
- @process_uid.zero?
+ @process_euid ||= Process.euid
+ @process_euid.zero?
  end
 
  def owner_uid

Library/Homebrew/shims/shared/curl

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # Make our $HOMEBREW_CURL selection universal - including in formulae usage.
 

Library/Homebrew/shims/shared/git

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # This script because we support $HOMEBREW_GIT, $HOMEBREW_SVN, etc., Xcode-only and
 # no Xcode/CLT configurations. Order is careful to be what the user would want.

Library/Homebrew/utils/fork.rb

@@ -42,6 +42,9 @@ def self.safe_fork
  server.close
  read.close
  write.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+
+ Process::UID.change_privilege(Process.euid) if Process.euid != Process.uid
+
  yield
  rescue Exception => e # rubocop:disable Lint/RescueException
  error_hash = JSON.parse e.to_json

Library/Homebrew/utils/lock.sh

@@ -44,12 +44,17 @@ _create_lock() {
  [[ -x "${ruby}" ]] || ruby="$(type -P ruby)"
  [[ -x "${python}" ]] || python="$(type -P python)"
 
- if [[ -x "${ruby}" ]] && "${ruby}" -e "exit(RUBY_VERSION >= '1.8.7')"
+ # Use a bash subprocess to reset setuid, which Ruby can error if != euid.
+ if [[ -x "${ruby}" ]] && /bin/bash -c "\"${ruby}\" -e \"exit(RUBY_VERSION >= '1.8.7')\""
  then
- "${ruby}" -e "File.new(${lock_fd}).flock(File::LOCK_EX | File::LOCK_NB) || exit(1)"
+ /bin/bash <<-SCRIPT
+ "${ruby}" -e "File.new(${lock_fd}).flock(File::LOCK_EX | File::LOCK_NB) || exit(1)"
+SCRIPT
  elif [[ -x "${python}" ]]
  then
- "${python}" -c "import fcntl; fcntl.flock(${lock_fd}, fcntl.LOCK_EX | fcntl.LOCK_NB)"
+ /bin/bash <<-SCRIPT
+ "${python}" -c "import fcntl; fcntl.flock(${lock_fd}, fcntl.LOCK_EX | fcntl.LOCK_NB)"
+SCRIPT
  elif [[ -x "$(type -P flock)" ]]
  then
  flock -n "${lock_fd}"

bin/brew

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 set -u
 
 # Fail fast with concise message when not using bash
@@ -245,4 +245,4 @@ then
 fi
 unset VAR ENV_VAR_NAMES
 
-exec /usr/bin/env -i "${FILTERED_ENV[@]}" /bin/bash "${HOMEBREW_LIBRARY}/Homebrew/brew.sh" "$@"
+exec /usr/bin/env -i "${FILTERED_ENV[@]}" /bin/bash -p "${HOMEBREW_LIBRARY}/Homebrew/brew.sh" "$@"