Bug 832780

Summary:	sys-apps/util-linux: su implementation not working (unable to change to other users using password)
Product:	Gentoo Linux	Reporter:	Vadim <lvd.mhm>
Component:	Current packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	RESOLVED WORKSFORME
Severity:	normal	CC:	sam
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=699930
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	emerge --info sys-apps/util-linux

Description Vadim 2022-02-06 06:20:11 UTC

After a recent (~1 day ago) update, su implementation changed from shadow to util-linux package.

As a result, su'ing from one non-root user to another non-root user using a password of the second one no longer works.

more info here: https://forums.gentoo.org/viewtopic-t-1147120.html

Comment 1 Sam James archtester

2022-02-06 06:26:03 UTC

emerge --info sys-apps/util-linux?

Comment 2 Vadim 2022-02-06 20:18:25 UTC

Created attachment 764482 [details]
emerge --info sys-apps/util-linux

attached.

Comment 3 Mike Gilbert gentoo-dev

2022-02-06 22:52:56 UTC

Is the user invoking su a member of the "wheel" group?

Comment 4 Vadim 2022-02-06 23:05:53 UTC

no

Comment 5 Mike Gilbert gentoo-dev

2022-02-06 23:14:23 UTC

/etc/pam.d/su has this by default:

> auth            sufficient      pam_rootok.so
> auth            required        pam_wheel.so use_uid
> auth            include         system-auth

This means you must be a member of the "wheel" group to use su.

You can add "root_only" to the pam_wheel.so line to make this a requirement only when switching to the "root" user.

If you don't want to use the wheel group at all, just remove pam_wheel.so from /etc/pam.d/su.

Comment 6 Vadim 2022-02-07 18:03:14 UTC

> You can add "root_only" to the pam_wheel.so line to make this a requirement
> only when switching to the "root" user.

That worked -- thanks.

Probably worth to become the default?

Comment 7 Mike Gilbert gentoo-dev

2022-02-07 18:27:56 UTC

(In reply to Vadim from comment #6)
> Probably worth to become the default?

No, I think we will stick with the pam_wheel default.