Re: [Security-Discuss] Bug remains in useradd

On Sun, 7 Nov 2004, Bob Puff@NLE wrote:

> Vincent and gang,
> 
> I just installed the new shadow-utils package from MDKSA-2004:126 on my 9.2 machines. 
> Unfortunately, the bug that I reported in bugzilla didn't seem to make it into the fix: that
> usernames with periods in them no longer work.  I'm forced to use a useradd from a 9.0 install
> to do the job.
> 
> What is most strange is that I just logged on to bugzilla, and it doesn't have my bug report
> listed!  I know I filed that a couple months ago, but it doesn't appear there.  Most strange!
> 
> This is a fairly significant issue for me (and others, as evidenced by some google searches), as
> setting up email accounts like "joe.smith" won't work with the stock (or updated) useradd.
> 

Looking at the source it seems to be by design, and I don't see anything 
in either the spec changelog or the source tree that indicates it was 
changed, but the behavior of accepting dots might have been one of the 
many patches this package has had applied.  libmisc/chkname.c shows:

        /*
         * User/group names must match [a-z_][a-z0-9_-]*
         */

Following patch will allow dots (worked in a quick local test):

--- ./chkname.c.dot     2002-01-10 14:04:34.000000000 +0100
+++ ./chkname.c 2004-11-08 14:06:27.875778594 +0100
@@ -30,7 +30,7 @@
        while (*++name) {
                if (!((*name >= 'a' && *name <= 'z') ||
                    (*name >= '0' && *name <= '9') ||
-                   *name == '_' || *name == '-' ||
+                   *name == '_' || *name == '-' || *name == '.' ||
                    (*name == '$' && *(name+1) == NULL)))
                        return 0;
        }

But, it's normally up to the package maintainer to deal with the 
anthill/bugzilla entries.  We don't scan bugzilla for any open issues when 
we do security updates. If the maintainer accepts the bug and has a fix, 
he/she either applies it to the community tree or they submit the src.rpm 
to use for updates. If we have security fixes pending at the same time, 
we'd probably combine the two.

> Did bugzilla have any data loss?
> 

No idea.  I thought stuff stayed there forever, even after closed. I 
didn't find any old report either, just your new one.

-- 
Stew Benedict
Mandrakesoft
---
[This E-mail scanned for viruses by Declude Virus]

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________