Bug#287899: Vdr should not be released unless this bug is fixed

[Javier Fernández-Sanguino Peña]

--oyUTqETQ0mS9luUI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

severity 287899 critical
tags 287899 security
thanks

(Setting this bug as higher severity after discussing with the security=20
team and the maintainer)

The vdr package, as it is currently, should not be accepted into sarge=20
unless the daemon runs as a non-root user. There are several troublesome=20
issues with running vdr as root and even the upstream user discourages=20
this (please read the INSTALL file).

Also notice that the patch provided to this bug is not correct:

1.- the postinst will not check if the user exists before creating. It=20
should do something like:
---------------------------------------------------------------------------

       CREATEUSER=3Dvdr
       CREATEGROUP=3Dvdr
        if ! getent group | grep -q "^$CREATEGROUP:" ; then
          echo -n "Adding group $CREATEGROUP.."
          addgroup --quiet --system $HONEYUSERGROUP
          echo "..done"
        fi
       if ! getent passwd | grep -q "^$CREATEUSER:"; then
          echo -n "Adding user $CREATEUSER.."
	  adduser --system --home /var/lib/vdr --shell /bin/false \
                  --gecos "VDR user" --no-create-home \
                  --disabled-login --disabled-password \
		  --ingroup $CREATEGROUP \
		  $CREATEUSER
          echo "...done"
       fi
---------------------------------------------------------------------------

2.- The postrm should remove this user/group combination if they exist.=20
This is usually done as follows (for user, similar for group):
---------------------------------------------------------------------------
        # find first and last SYSTEM_UID numbers
         for LINE in `grep SYSTEM_UID /etc/adduser.conf | grep -v "^#"`; do
            case $LINE in
               FIRST_SYSTEM_UID*)
                  FIST_SYSTEM_UID=3D`echo $LINE | cut -f2 -d '=3D'`
               ;;
               LAST_SYSTEM_UID*)
                  LAST_SYSTEM_UID=3D`echo $LINE | cut -f2 -d '=3D'`
               ;;
               *)
               ;;
            esac
         done
         # remove  system account if necessary
         CREATEDUSER=3Dvdr
         if [ -n "$FIST_SYSTEM_UID" ] && [ -n "$LAST_SYSTEM_UID" ]; then
            if USERID=3D`getent passwd $CREATEDUSER | cut -f 3 -d ':'`; then
               if [ -n "$USERID" ]; then
                  if [ "$FIST_SYSTEM_UID" -le "$USERID" ] && \
                     [ "$USERID" -le "$LAST_SYSTEM_UID" ]; then
                        deluser --quiet $CREATEDUSER || true
                  fi
               fi
            fi
         fi
---------------------------------------------------------------------------


Regards

Javier

--oyUTqETQ0mS9luUI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB6rPVi4sehJTrj0oRAjz5AKCcIgETlfgGcmbvODIzqPwM46+TBwCghbYN
iWnu/tQkHjzDQ9PP0BPgxL4=
=39/z
-----END PGP SIGNATURE-----

--oyUTqETQ0mS9luUI--