103421 alt-enewuser 2005-08-23 02:32 0000 enewuser should *not* use /bin/false as shell 2006-04-12 10:50:16 0000 1 1 1 Unclassified Gentoo/Alt Other unspecified All FreeBSD RESOLVED FIXED P2 normal --- 1 flameeyes@gentoo.org bsd@gentoo.org osx@gentoo.org flameeyes@gentoo.org 2005-08-23 02:32:19 0000 Currently apache calls enewuser with /bin/false with /bin/false as shell to create an user that cannot login. This breaks on BSD and Darwin that uses other shells to login-disabled accounts, passing -1 (default parameter) let enewuser decide which shell to use. Thanks, Diego flameeyes@gentoo.org 2005-08-23 06:01:06 0000 Instead of opening one bug per package, maybe it's better creating a single bug report for all :) I've wrote a little ruby script to check for erroneous syntax on last and last-unmasked (if different) ebuilds, and run it to check for enewuser called with /bin/false as shell (that breaks Gentoo/FreeBSD and Gentoo/Darwin). As said, -1 is what you should use to let enewuser select the right no-login shell depending on userland. *-marked are unmaintained, I'll take care app-admin/tenshi/tenshi-0.3.4.ebuild app-antivirus/clamav/clamav-0.86.2.ebuild app-crypt/trousers/trousers-0.2.1.ebuild dev-db/mysql/mysql-5.0.9_beta-r2.ebuild dev-db/mysql/mysql-4.0.25-r2.ebuild dev-dotnet/xsp/xsp-1.0.9.ebuild dev-util/cvsd/cvsd-1.0.8.ebuild mail-filter/qmail-scanner/qmail-scanner-1.25-r1.ebuild mail-filter/amavisd-new/amavisd-new-2.3.2.ebuild mail-filter/postgrey/postgrey-1.21.ebuild mail-mta/xmail/xmail-1.21.ebuild mail-mta/qmail/qmail-1.03-r16.ebuild mail-mta/sendmail/sendmail-8.13.4-r1.ebuild mail-mta/postfix/postfix-2.2.4.ebuild mail-mta/postfix/postfix-2.2.2-r1.ebuild media-video/flumotion/flumotion-0.1.8.ebuild net-analyzer/scanlogd/scanlogd-2.2.5.ebuild net-analyzer/flow-tools/flow-tools-0.68-r1.ebuild net-analyzer/zabbix-agent/zabbix-agent-1.1_alpha7.ebuild net-analyzer/zabbix-server/zabbix-server-1.1_alpha7.ebuild net-analyzer/ntop/ntop-3.1.ebuild net-analyzer/snort/snort-2.4.0.ebuild net-analyzer/snort/snort-2.3.3-r1.ebuild net-analyzer/FlowScan/FlowScan-1.006-r2.ebuild *net-dns/ldapdns/ldapdns-2.06.ebuild net-dns/maradns/maradns-1.0.27.ebuild net-dns/bind/bind-9.3.1-r3.ebuild net-dns/pdnsd/pdnsd-1.2.2.ebuild *net-dns/dnrd/dnrd-2.19.1.ebuild net-dns/rbldnsd/rbldnsd-0.995.ebuild net-dns/ddclient/ddclient-3.6.6.ebuild net-ftp/frox/frox-0.7.18.ebuild *net-ftp/jftpgw/jftpgw-0.13.4-r1.ebuild net-ftp/ftpbase/ftpbase-0.00.ebuild net-im/jabberd/jabberd-2.0.9.ebuild net-im/jabberd/jabberd-1.4.3-r5.ebuild net-im/ejabberd/ejabberd-0.7.5.ebuild net-im/pymsn-t/pymsn-t-0.9.2.ebuild net-irc/srvx/srvx-1.3.0.2005_p9.ebuild net-mail/vpopmail/vpopmail-5.4.9-r2.ebuild net-mail/popa3d/popa3d-1.0.ebuild net-mail/mailman/mailman-2.1.6_rc4.ebuild net-mail/cmd5checkpw/cmd5checkpw-0.30.ebuild net-mail/dovecot/dovecot-0.99.14-r1.ebuild net-misc/ndtpd/ndtpd-3.1.5.ebuild net-misc/tor/tor-0.1.0.14.ebuild *net-misc/radvd/radvd-0.8.ebuild *net-misc/apt-proxy/apt-proxy-1.3.0.ebuild net-misc/nxserver-freenx/nxserver-freenx-0.4.0.ebuild net-misc/udhcp/udhcp-0.9.9_pre20041216-r1.ebuild net-misc/openssh/openssh-4.1_p1-r1.ebuild net-misc/asterisk/asterisk-1.0.9-r1.ebuild net-misc/dhcp/dhcp-3.0.2.ebuild net-misc/gofish/gofish-0.29.ebuild *net-misc/ser/ser-0.9.0.ebuild *net-misc/openntpd/openntpd-3.7_p1.ebuild *net-misc/mdidentd/mdidentd-1.04a.ebuild net-misc/entropy/entropy-0.8.2.418.ebuild *net-nds/portmap/portmap-5b-r9.ebuild net-nds/openldap/openldap-2.2.27-r1.ebuild net-p2p/gnunet/gnunet-0.6.6b-r1.ebuild net-p2p/amule/amule-2.0.3.ebuild net-www/apache/apache-2.0.54-r9.ebuild net-zope/zope/zope-2.8.0.ebuild sci-misc/boinc/boinc-4.72.20050813.ebuild sys-apps/hal/hal-0.5.2.ebuild sys-apps/hal/hal-0.4.8.ebuild sys-apps/dbus/dbus-0.35.2.ebuild sys-apps/dbus/dbus-0.23.4-r1.ebuild sys-fs/captive/captive-1.1.5-r2.ebuild www-apps/rt/rt-3.4.3.ebuild www-servers/shttpd/shttpd-1.25.ebuild *www-servers/publicfile/publicfile-0.52-r1.ebuild www-servers/fnord/fnord-1.9.ebuild www-servers/aolserver/aolserver-4.0.9-r1.ebuild www-servers/skunkweb/skunkweb-3.4_beta5-r1.ebuild x11-apps/xfs/xfs-0.99.0-r1.ebuild x11-base/xorg-x11/xorg-x11-6.8.99.15.ebuild stuart@gentoo.org 2005-08-23 06:04:57 0000 Some background would be helpful. Is the problem that these userlands lack /bin/false, or just that they don't support setting a user's shell to /bin/false when you want to disable logins? Many thanks, Stu swegener@gentoo.org 2005-08-23 06:09:26 0000 net-irc done genstef@gentoo.org 2005-08-23 06:11:32 0000 captive done flameeyes@gentoo.org 2005-08-23 06:13:05 0000 /bin/false is not present on Darwin and on FreeBSD, and it's in /usr/bin/false (so /bin/false it's not in shell file -> invalid shell -> enewuser fail). For darwin /usr/bin/false is a valid shell, so it's used. For FreeBSD /usr/sbin/nologin is used instead. enewuser function take care of selecting the right shell when not specified or "-1", depending on current ${USERLAND} value. vapier@gentoo.org 2005-08-23 06:13:21 0000 different userlands have better nologin shells ... all this background info was posted to the gentoo-dev mailing list some time ago already ticho@gentoo.org 2005-08-23 06:19:24 0000 app-antivirus/clamav done ramereth@gentoo.org 2005-08-23 06:31:16 0000 dev-dotnet/xsp done uberlord@gentoo.org 2005-08-23 06:34:03 0000 net-ftp/ftpbase fixed latexer@gentoo.org 2005-08-23 06:36:12 0000 Ramereth fixed xsp, removing myself. ka0ttic@gentoo.org 2005-08-23 06:46:39 0000 www-servers/fnord and dev-util/cvsd done. ticho@gentoo.org 2005-08-23 06:50:14 0000 Done, on behalf of net-mail: mail-filter/qmail-scanner mail-filter/amavisd-new mail-filter/postgrey mail-mta/xmail mail-mta/qmail mail-mta/sendmail mail-mta/postfix net-mail/vpopmail net-mail/popa3d net-mail/mailman net-mail/cmd5checkpw net-mail/dovecot ka0ttic@gentoo.org 2005-08-23 06:52:34 0000 net-analyzer/{flow-tools,ntop,scanlogd,snort} done. tigger@gentoo.org 2005-08-23 06:54:16 0000 fixed app-admin/tenshi satya@gentoo.org 2005-08-23 06:59:51 0000 www-servers/skunkweb fixed stkn@gentoo.org 2005-08-23 07:00:01 0000 net-misc/asterisk done net-misc/ser has already been fixed by Diego cryos@gentoo.org 2005-08-23 07:27:44 0000 Fixed sci-misc/boinc. port001@gentoo.org 2005-08-23 09:02:26 0000 www-servers/aolserver done. vericgar@gentoo.org 2005-08-23 10:09:49 0000 net-www/apache fixed dberkholz@gentoo.org 2005-08-23 10:27:16 0000 xorg, xfs fixed. flameeyes@gentoo.org 2005-08-23 10:34:08 0000 Reopening, xorg is not the last one :) Thanks though, removing x11 from CC. dberkholz@gentoo.org 2005-08-23 10:37:04 0000 That's bugzilla being retarded. rl03@gentoo.org 2005-08-23 12:29:41 0000 www-apps/rt done batlogg@gentoo.org 2005-08-23 12:51:06 0000 net-zope done humpback@gentoo.org 2005-08-23 15:00:32 0000 net-im fixed dragonheart@gentoo.org 2005-08-23 15:12:05 0000 net-ftp/frox net-analyzer/flow-tools app-crypt/trousers net-misc/asterisk fixed vapier@gentoo.org 2005-08-23 17:10:24 0000 fixed: net-misc/udhcp net-misc/openssh net-misc/dhcp net-misc/openntpd net-misc/entropy flameeyes@gentoo.org 2005-08-24 01:58:56 0000 Forgot to add... if you want me to take care of fixing these bugs for your/your herd's packages, just state so and remove yourself/the herd from CC, and I'll do the change as stated (enewuser, cp -a and chown, it's a multi-comment). If it's for a herd, please say which herd you're referring to as i don't know them all by heart :) flameeyes@gentoo.org 2005-08-24 07:31:29 0000 Removing a couple of CC whose ebuilds are alredy fixed... cardoe@gentoo.org 2005-08-25 22:41:45 0000 Fixed the HAL & dbus that I maintain. (dbus 0.3x & hal 0.5.x) flameeyes@gentoo.org 2005-08-26 05:22:12 0000 Updated list (much shorter :)) dev-db/mysql/mysql-5.0.9_beta-r2.ebuild: enewuser called with /bin/false [mysql] dev-db/mysql/mysql-4.0.25-r2.ebuild: enewuser called with /bin/false [mysql] media-video/flumotion/flumotion-0.1.8.ebuild: enewuser called with /bin/false [gstreamer] net-dns/maradns/maradns-1.0.27.ebuild: enewuser called with /bin/false [no-herd | matsuu@gentoo.org] net-dns/bind/bind-9.3.1-r3.ebuild: enewuser called with /bin/false [bind | voxus@gentoo.org] net-dns/pdnsd/pdnsd-1.2.2.ebuild: enewuser called with /bin/false [net-dialup] net-dns/rbldnsd/rbldnsd-0.995.ebuild: enewuser called with /bin/false [no-herd | chriswhite@gentoo.org] net-misc/ndtpd/ndtpd-3.1.5.ebuild: enewuser called with /bin/false [no-herd | usata@gentoo.org] net-misc/tor/tor-0.1.0.14.ebuild: enewuser called with /bin/false [no-herd | humpback@gentoo.org] net-misc/nxserver-freenx/nxserver-freenx-0.4.0.ebuild: enewuser called with /bin/false [no-herd | stuart@gentoo.org] net-misc/gofish/gofish-0.29.ebuild: enewuser called with /bin/false [no-herd | zul@gentoo.org] net-nds/openldap/openldap-2.2.28.ebuild: enewuser called with /bin/false [no-herd | robbat2@gentoo.org] net-p2p/gnunet/gnunet-0.6.6b-r1.ebuild: enewuser called with /bin/false [net-p2p] net-p2p/amule/amule-2.0.3.ebuild: enewuser called with /bin/false [net-p2p] sys-apps/hal/hal-0.4.8.ebuild: enewuser called with /bin/false [gnome, gentopia | foser@gentoo.org, cardoe@gentoo.org] sys-apps/dbus/dbus-0.23.4-r1.ebuild: enewuser called with /bin/false [base-system, gentopia | foser@gentoo.org, cardoe@gentoo.org] Affected herds: base-system, gentopia, net-p2p, gstreamer, mysql, gnome, net-dialup, bind, no-herd Affected devs: stuart@gentoo.org, matsuu@gentoo.org, cardoe@gentoo.org, zul@gentoo.org, foser@gentoo.org, humpback@gentoo.org, robbat2@gentoo.org, voxus@gentoo.org, chriswhite@gentoo.org, usata@gentoo.org sekretarz@gentoo.org 2005-08-26 08:22:36 0000 net-p2p done chriswhite@gentoo.org 2005-08-26 13:47:46 0000 fixed net-dns/rbldnsd matsuu@gentoo.org 2005-08-26 18:11:38 0000 net-dns/maradns done vivo@gentoo.org 2005-08-29 16:39:36 0000 dev-db/mysql done voxus@gentoo.org 2005-09-02 02:15:55 0000 fixed net-dns/bind sorry for long delay. flameeyes@gentoo.org 2005-09-02 04:17:05 0000 media-video/flumotion/flumotion-0.1.8.ebuild: enewuser called with /bin/false [gstreamer] net-dns/pdnsd/pdnsd-1.2.2.ebuild: enewuser called with /bin/false [net-dialup] net-im/jive-messenger/jive-messenger-2.2.0.ebuild: enewuser called with /bin/false [lostlogic@gentoo.org] net-misc/ndtpd/ndtpd-3.1.5.ebuild: enewuser called with /bin/false [usata@gentoo.org] net-misc/tor/tor-0.1.0.14.ebuild: enewuser called with /bin/false [humpback@gentoo.org] net-misc/nxserver-freenx/nxserver-freenx-0.4.0.ebuild: enewuser called with /bin/false [stuart@gentoo.org] net-misc/asterisk/asterisk-1.2.0_beta1.ebuild: enewuser called with /bin/false [voip | stkn@gentoo.org] net-misc/gofish/gofish-0.29.ebuild: enewuser called with /bin/false [zul@gentoo.org] net-nds/openldap/openldap-2.2.28.ebuild: enewuser called with /bin/false [robbat2@gentoo.org] sys-apps/hal/hal-0.4.8.ebuild: enewuser called with /bin/false [gnome, gentopia | foser@gentoo.org, cardoe@gentoo.org] sys-apps/dbus/dbus-0.23.4-r1.ebuild: enewuser called with /bin/false [base-system, gentopia | foser@gentoo.org, cardoe@gentoo.org] Affected herds: base-system, gentopia, gstreamer, gnome, voip, net-dialup Affected devs: stkn@gentoo.org, stuart@gentoo.org, lostlogic@gentoo.org, cardoe@gentoo.org, zul@gentoo.org, foser@gentoo.org, humpback@gentoo.org, robbat2@gentoo.org, usata@gentoo.org vanquirius@gentoo.org 2005-09-02 18:38:50 0000 net-misc/gofish done humpback@gentoo.org 2005-09-03 05:09:17 0000 net-misc/tor fixed, sorry for the delay .... mrness@gentoo.org 2005-09-07 22:38:26 0000 net-dns/pdnsd fixed. sorry for not seeing this bug, but you failed to add net-proxy herd to CC. zaheerm@gentoo.org 2005-09-14 12:20:08 0000 media-video/flumotion done flameeyes@gentoo.org 2005-09-15 14:44:46 0000 Please I'd like to have this fixed before 30 september, else I'll start fixing that directly. Thanks. net-dns/pdnsd/pdnsd-1.2.3.ebuild: enewuser called with /bin/false [net-dialup] net-im/jive-messenger/jive-messenger-2.2.0.ebuild: enewuser called with /bin/fal se [lostlogic@gentoo.org] net-misc/ndtpd/ndtpd-3.1.5.ebuild: enewuser called with /bin/false [usata@gentoo .org] net-misc/nxserver-freenx/nxserver-freenx-0.4.0.ebuild: enewuser called with /bin /false [stuart@gentoo.org] net-nds/openldap/openldap-2.2.28-r1.ebuild: enewuser called with /bin/false [rob bat2@gentoo.org] sys-apps/hal/hal-0.4.8.ebuild: enewuser called with /bin/false [gnome, gentopia | foser@gentoo.org, cardoe@gentoo.org] sys-apps/ivman/ivman-0.6.4.ebuild: enewuser called with /bin/false [genstef@gent oo.org] sys-apps/dbus/dbus-0.23.4-r1.ebuild: enewuser called with /bin/false [base-syste m, gentopia | foser@gentoo.org, cardoe@gentoo.org] Affected herds: base-system, gentopia, gnome, net-dialup Affected devs: stuart@gentoo.org, lostlogic@gentoo.org, cardoe@gentoo.org, foser @gentoo.org, robbat2@gentoo.org, genstef@gentoo.org, usata@gentoo.org Alin, you should fix the replication in pkg_preinst, too. dang@gentoo.org 2005-09-15 15:07:41 0000 dbus and hal fixed. mrness@gentoo.org 2005-09-15 22:39:44 0000 (In reply to comment #42) > net-dns/pdnsd/pdnsd-1.2.3.ebuild: enewuser called with /bin/false [net-dialup] ... > Alin, you should fix the replication in pkg_preinst, too. fixed. appologies for my omision flameeyes@gentoo.org 2005-09-16 04:04:38 0000 net-im/jive-messenger/jive-messenger-2.2.0.ebuild: enewuser called with /bin/false [lostlogic@gentoo.org] net-misc/ndtpd/ndtpd-3.1.5.ebuild: enewuser called with /bin/false [usata@gentoo.org] net-misc/nxserver-freenx/nxserver-freenx-0.4.0.ebuild: enewuser called with /bin/false [stuart@gentoo.org] net-nds/openldap/openldap-2.2.28-r1.ebuild: enewuser called with /bin/false [robbat2@gentoo.org] Affected herds: Affected devs: stuart@gentoo.org, lostlogic@gentoo.org, robbat2@gentoo.org, usata@gentoo.org All the herd are clear now. robbat2@gentoo.org 2005-09-22 12:58:51 0000 fixed openldap. flameeyes@gentoo.org 2005-10-02 08:01:03 0000 Ok I've fixed the remaining packages, hopefully this is not going to be reopen again.