[Pkg-shadow-devel] [PATCH 1/1] Do not read login.defs before doing chroot()

[Serge Hallyn]

Quoting Peter Kjellerstedt (peter.kjellerstedt at axis.com):
> > -----Original Message-----
> > From: Serge Hallyn [mailto:serge.hallyn at ubuntu.com]
> > Sent: den 19 september 2014 21:07
> > To: Peter Kjellerstedt
> > Cc: pkg-shadow-devel at lists.alioth.debian.org; Peter Kjellerstedt
> > Subject: Re: [Pkg-shadow-devel] [PATCH 1/1] Do not read login.defs
> > before doing chroot()
> > 
> > Quoting Peter Kjellerstedt (peter.kjellerstedt at axis.com):
> > > If "useradd --root <root> ..." was used, the login.defs file would
> > > still be read from /etc/login.defs instead of <root>/etc/login.defs. 
> > > This was due to getdef_ulong() being called before process_root_flag().
> > >
> > > Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt at axis.com>
> > 
> > Which tree is this patch against?  The uid_min/uid_max context doesn't
> > seem to exist in any tree that I have.
> 
> Sorry if I missed that information. The patch applies to 
> the "upstream" branch of the pkg-shadow repository at 
> "git://anonscm.debian.org/git/pkg-shadow/shadow.git".

Even at http://anonscm.debian.org/cgit/pkg-shadow/shadow.git/tree/src/useradd.c
I'm not seeing the "getdef_ulong ("UID_MIN", 1000UL)" which your patch removes.

Would you mind taking a look at git://github.com/shadow-maint/shadow.git and
seeing whether it already fixes the bug you're seeing?  It looks to me like
it should.

> > Rather, the lookup for UID_MIN is done much later, in
> > find_new_sub_uids().
> > 
> > > ---
> > >  src/useradd.c | 8 ++++++--
> > >  1 file changed, 6 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/src/useradd.c b/src/useradd.c
> > > index a8a1f76..e1ebf50 100644
> > > --- a/src/useradd.c
> > > +++ b/src/useradd.c
> > > @@ -1993,9 +1993,11 @@ int main (int argc, char **argv)
> > >  #endif				/* USE_PAM */
> > >  #endif				/* ACCT_TOOLS_SETUID */
> > >
> > > +#ifdef ENABLE_SUBIDS
> > >  	/* Needed for userns check */
> > > -	uid_t uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
> > > -	uid_t uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
> > > +	uid_t uid_min;
> > > +	uid_t uid_max;
> > > +#endif
> > >
> > >  	/*
> > >  	 * Get my name so that I can use it to report errors.
> > > @@ -2026,6 +2028,8 @@ int main (int argc, char **argv)
> > >  	is_shadow_grp = sgr_file_present ();
> > >  #endif
> > >  #ifdef ENABLE_SUBIDS
> > > +	uid_min = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
> > > +	uid_max = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
> > >  	is_sub_uid = sub_uid_file_present () && !rflg &&
> > >  	    (!user_id || (user_id <= uid_max && user_id >= uid_min));
> > >  	is_sub_gid = sub_gid_file_present () && !rflg &&
> > > --
> > > 1.9.0
> > >
> > >
> > > _______________________________________________
> > > Pkg-shadow-devel mailing list
> > > Pkg-shadow-devel at lists.alioth.debian.org
> > > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-shadow-devel
> 
> //Peter
>