Re: [Security-Discuss] Bug remains in useradd

On 8-Nov-04, at 6:20 AM, Stew Benedict wrote:

>> Vincent and gang,
>>
>> I just installed the new shadow-utils package from MDKSA-2004:126 on 
>> my 9.2 machines.
>> Unfortunately, the bug that I reported in bugzilla didn't seem to 
>> make it into the fix: that
>> usernames with periods in them no longer work.  I'm forced to use a 
>> useradd from a 9.0 install
>> to do the job.
>>
>> What is most strange is that I just logged on to bugzilla, and it 
>> doesn't have my bug report
>> listed!  I know I filed that a couple months ago, but it doesn't 
>> appear there.  Most strange!
>>
>> This is a fairly significant issue for me (and others, as evidenced 
>> by some google searches), as
>> setting up email accounts like "joe.smith" won't work with the stock 
>> (or updated) useradd.
>>
>
> Looking at the source it seems to be by design, and I don't see 
> anything
> in either the spec changelog or the source tree that indicates it was
> changed, but the behavior of accepting dots might have been one of the
> many patches this package has had applied.  libmisc/chkname.c shows:
>
>         /*
>          * User/group names must match [a-z_][a-z0-9_-]*
>          */
>
> Following patch will allow dots (worked in a quick local test):
>
> --- ./chkname.c.dot     2002-01-10 14:04:34.000000000 +0100
> +++ ./chkname.c 2004-11-08 14:06:27.875778594 +0100
> @@ -30,7 +30,7 @@
>         while (*++name) {
>                 if (!((*name >= 'a' && *name <= 'z') ||
>                     (*name >= '0' && *name <= '9') ||
> -                   *name == '_' || *name == '-' ||
> +                   *name == '_' || *name == '-' || *name == '.' ||
>                     (*name == '$' && *(name+1) == NULL)))
>                         return 0;
>         }
>
> But, it's normally up to the package maintainer to deal with the
> anthill/bugzilla entries.  We don't scan bugzilla for any open issues 
> when
> we do security updates. If the maintainer accepts the bug and has a 
> fix,
> he/she either applies it to the community tree or they submit the 
> src.rpm
> to use for updates. If we have security fixes pending at the same time,
> we'd probably combine the two.

Stew is right here.  Typically when we issue a security update, we only 
apply security fixes, and we certainly don't spend time going thru 
bugzilla to fix things maintainers should be fixing.  So unless the 
maintainer explicitly tells us about a fix or sends us a patch, it's 
unlikely that it will go into updates.

>> Did bugzilla have any data loss?
>
> No idea.  I thought stuff stayed there forever, even after closed. I
> didn't find any old report either, just your new one.

Bugzilla shouldn't unless warly cleaned out some old reports, but I 
sincerely doubt he did that.

-- 
*Please note gpg keyid FE6F2AFD has been replaced with keyid FEE30AD4*
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}