Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 193541
Alias:
Product:
Component:
Status: RESOLVED
Resolution: INVALID
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Jakub Moc (RETIRED) <jakub@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 193541 depends on: Show dependency tree
Bug 193541 blocks: 195033

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug


Description:   Opened: 2007-09-23 16:26 0000
Same issue like Bug 189412. Why does this need /bin/bash as shell?

------- Comment #1 From SpanKY 2007-09-24 10:34:14 0000 -------
games.eclass uses enewuser() which uses `adduser` which by default, disables
the account ... i dont know why you think you can login as games w/out a
password since it clearly does not work

a quick test over here shows correct behavior:
# grep games /etc/shadow
games:!:13780:0:99999:7:::
(where '!' obviously means the account is locked out)

it needs /bin/bash as a shell in order to run shell script daemons properly

------- Comment #2 From Jakub Moc (RETIRED) 2007-09-24 11:05:16 0000 -------
Well, unfortunately this is what I had here: 

# grep games /etc/shadow
games::13230:0:99999:7:::

The install on this box might be from 1.4 times or so. Needless to add, the
games.eclass forcing /bin/bash totally doesn't help, and the only reference to
an ebuild that requires bash (that I could find in the eclass) is some games
server that should use s-s-d plus chuid instead.

------- Comment #3 From SpanKY 2007-09-24 12:14:57 0000 -------
easy enough to add a warning to shadow's pkg_postinst() that scans /etc/shadow
for users with blank passwords ...

------- Comment #4 From Jakub Moc (RETIRED) 2007-09-24 18:33:05 0000 -------
(In reply to comment #3)
> easy enough to add a warning to shadow's pkg_postinst() that scans /etc/shadow
> for users with blank passwords ...

Well, that sounds a lot better than the current situation. :)

Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug