Support bash in privileged mode

Author: Bo98

Library/Homebrew/brew.sh

@@ -216,7 +216,7 @@ numeric() {
 }
 
 check-run-command-as-root() {
-  [[ "$(id -u)" == 0 ]] || return
+  [[ "$(id -u)" == 0 || "$(id -ur)" == 0 ]] || return
 
   # Allow Azure Pipelines/GitHub Actions/Docker/Concourse/Kubernetes to do everything as root (as it's normal there)
   [[ -f /.dockerenv ]] && return

Library/Homebrew/global.rb

@@ -106,8 +106,8 @@ def auditing?
     end
 
     def running_as_root?
-      @process_uid ||= Process.uid
-      @process_uid.zero?
+      @process_euid ||= Process.euid
+      @process_euid.zero?
     end
 
     def owner_uid

Library/Homebrew/shims/shared/curl

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # Make our $HOMEBREW_CURL selection universal - including in formulae usage.
 

Library/Homebrew/shims/shared/git

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # This script because we support $HOMEBREW_GIT, $HOMEBREW_SVN, etc., Xcode-only and
 # no Xcode/CLT configurations. Order is careful to be what the user would want.

Library/Homebrew/utils/fork.rb

@@ -42,6 +42,9 @@ def self.safe_fork
           server.close
           read.close
           write.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+
+          Process::UID.change_privilege(Process.euid) if Process.euid != Process.uid
+
           yield
         rescue Exception => e # rubocop:disable Lint/RescueException
           error_hash = JSON.parse e.to_json

Library/Homebrew/utils/lock.sh

@@ -44,12 +44,17 @@ _create_lock() {
   [[ -x "${ruby}" ]] || ruby="$(type -P ruby)"
   [[ -x "${python}" ]] || python="$(type -P python)"
 
-  if [[ -x "${ruby}" ]] && "${ruby}" -e "exit(RUBY_VERSION >= '1.8.7')"
+  # Use a bash subprocess to reset setuid, which Ruby can error if != euid.
+  if [[ -x "${ruby}" ]] && /bin/bash -c "\"${ruby}\" -e \"exit(RUBY_VERSION >= '1.8.7')\""
   then
-    "${ruby}" -e "File.new(${lock_fd}).flock(File::LOCK_EX | File::LOCK_NB) || exit(1)"
+    /bin/bash <<-SCRIPT
+      "${ruby}" -e "File.new(${lock_fd}).flock(File::LOCK_EX | File::LOCK_NB) || exit(1)"
+SCRIPT
   elif [[ -x "${python}" ]]
   then
-    "${python}" -c "import fcntl; fcntl.flock(${lock_fd}, fcntl.LOCK_EX | fcntl.LOCK_NB)"
+    /bin/bash <<-SCRIPT
+      "${python}" -c "import fcntl; fcntl.flock(${lock_fd}, fcntl.LOCK_EX | fcntl.LOCK_NB)"
+SCRIPT
   elif [[ -x "$(type -P flock)" ]]
   then
     flock -n "${lock_fd}"

bin/brew

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -p
 set -u
 
 # Fail fast with concise message when not using bash
@@ -245,4 +245,4 @@ then
 fi
 unset VAR ENV_VAR_NAMES
 
-exec /usr/bin/env -i "${FILTERED_ENV[@]}" /bin/bash "${HOMEBREW_LIBRARY}/Homebrew/brew.sh" "$@"
+exec /usr/bin/env -i "${FILTERED_ENV[@]}" /bin/bash -p "${HOMEBREW_LIBRARY}/Homebrew/brew.sh" "$@"