{"record":{"id":"7006f38a73d7a926","repo":"openmediavault/openmediavault","slug":"unauthorized-attempt-to-modify-the-system-group-account-s","errorCode":null,"errorMessage":"Unauthorized attempt to modify the system group account '%s'","messagePattern":"Unauthorized attempt to modify the system group account '(.+?)'","errorType":"exception","errorClass":"OMV\\Exception","httpStatus":null,"severity":"error","filePath":"deb/openmediavault/usr/share/openmediavault/engined/rpc/usermgmt.inc","lineNumber":911,"sourceCode":"     *   \\em name The name of the group.\n     *   \\em gid The group ID. This field is optional.\n     *   \\em comment Any text string.\n     *   \\em members The group members as an array of user names.\n     * @param context The context of the caller.\n     * @return The stored configuration object.\n     */\n    public function setGroup($params, $context)\n    {\n        // Validate the RPC caller context.\n        $this->validateMethodContext($context, [\n            \"role\" => OMV_ROLE_ADMINISTRATOR\n        ]);\n        // Validate the parameters of the RPC service method.\n        $this->validateMethodParams($params, \"rpc.usermgmt.setgroup\");\n        // Check if the given group is a system account. Abort this attempt.\n        $group = new \\OMV\\System\\Group($params['name']);\n        if ($group->exists() && $group->isSystemAccount()) {\n            throw new \\OMV\\Exception(\n                \"Unauthorized attempt to modify the system group account '%s'\",\n                $params['name']\n            );\n        }\n        // Try to get existing configuration object.\n        $filter = [\n            \"operator\" => \"stringEquals\",\n            \"arg0\" => \"name\",\n            \"arg1\" => $params['name']\n        ];\n        $db = \\OMV\\Config\\Database::getInstance();\n        // Does the group already exist in the database?\n        $oldObject = null;\n        if ($db->exists(\"conf.system.usermngmnt.group\", $filter)) {\n            $notifyType = OMV_NOTIFY_MODIFY;\n            // Get the group configuration object. Since the name of a group\n            // is unique, we can simply use the first object found.\n            $object = $oldObject = $db->getByFilter(","sourceCodeStart":893,"sourceCodeEnd":929,"githubUrl":"https://github.com/openmediavault/openmediavault/blob/dce610eb66f624c640d0eb7ce401ddd65b763520/deb/openmediavault/usr/share/openmediavault/engined/rpc/usermgmt.inc#L893-L929","documentation":"The rpc.usermgmt.setgroup RPC checks whether the target group exists on the system and is a system group (GID below the system threshold). System groups must not be altered through OMV, so the engine throws this exception before any change is applied.","triggerScenarios":"Calling rpc.usermgmt.setgroup with params['name'] set to a system group such as root, sudo, www-data, or a package-created group that exists in /etc/group.","commonSituations":"Automation trying to add users to 'sudo' or 'www-data' via setgroup instead of user membership RPCs; scripts iterating all groups without filtering system GIDs; name collisions after package installation.","solutions":["Only target OMV-managed (non-system) groups in setgroup calls.","To manage membership of system groups, use the appropriate user membership RPC or OS tooling (usermod -aG).","Verify the group's GID with getent group and ensure it is above the system range before calling.","Create a new OMV-managed group and use it instead of modifying a system group."],"exampleFix":"// before\n$omv->rpc('usermgmt.setGroup', ['name' => 'sudo', 'comment' => 'admins']);\n// after\n$grp = posix_getgrnam($name);\nif ($grp && $grp['gid'] < 1000) { throw new DomainException(\"system group\"); }\n$omv->rpc('usermgmt.setGroup', ['name' => $name, 'comment' => 'admins']);","handlingStrategy":"validation","validationCode":"$gr = posix_getgrnam($name);\nif ($gr !== false && $gr['gid'] < 1000) {\n    throw new DomainException(\"$name is a system group\");\n}","typeGuard":"function isSystemGroup(string $name): bool {\n    $gr = @posix_getgrnam($name);\n    return $gr !== false && $gr['gid'] < 1000;\n}","tryCatchPattern":"try {\n    $omv->rpc('usermgmt.setGroup', $params);\n} catch (\\OMV\\Exception $e) {\n    if (str_contains($e->getMessage(), 'system group account')) {\n        throw new DomainException(\"Refusing to modify system group\", 0, $e);\n    } throw $e;\n}","preventionTips":["Only create/modify OMV-managed groups via the RPC","Use usermod -aG (or the membership RPC) for system-group membership","Filter group listings to GID >= 1000 in automation"],"tags":["php","rpc","groups","security"],"backgroundTag":"permission-denied","analyzedSha":"dce610eb66f624c640d0eb7ce401ddd65b763520","analyzedAt":"2026-09-15T09:48:09.960Z","contentChangedAt":"2026-09-15T09:48:09.960Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}