severity 287899 critical tags 287899 security thanks (Setting this bug as higher severity after discussing with the security team and the maintainer)
The vdr package, as it is currently, should not be accepted into sarge
unless the daemon runs as a non-root user. There are several troublesome
issues with running vdr as root and even the upstream user discourages
this (please read the INSTALL file).
Also notice that the patch provided to this bug is not correct:
1.- the postinst will not check if the user exists before creating. It
should do something like:
---------------------------------------------------------------------------
CREATEUSER=vdr
CREATEGROUP=vdr
if ! getent group | grep -q "^$CREATEGROUP:" ; then
echo -n "Adding group $CREATEGROUP.."
addgroup --quiet --system $HONEYUSERGROUP
echo "..done"
fi
if ! getent passwd | grep -q "^$CREATEUSER:"; then
echo -n "Adding user $CREATEUSER.."
adduser --system --home /var/lib/vdr --shell /bin/false \
--gecos "VDR user" --no-create-home \
--disabled-login --disabled-password \
--ingroup $CREATEGROUP \
$CREATEUSER
echo "...done"
fi
---------------------------------------------------------------------------
2.- The postrm should remove this user/group combination if they exist.
This is usually done as follows (for user, similar for group):
---------------------------------------------------------------------------
# find first and last SYSTEM_UID numbers
for LINE in `grep SYSTEM_UID /etc/adduser.conf | grep -v "^#"`; do
case $LINE in
FIRST_SYSTEM_UID*)
FIST_SYSTEM_UID=`echo $LINE | cut -f2 -d '='`
;;
LAST_SYSTEM_UID*)
LAST_SYSTEM_UID=`echo $LINE | cut -f2 -d '='`
;;
*)
;;
esac
done
# remove system account if necessary
CREATEDUSER=vdr
if [ -n "$FIST_SYSTEM_UID" ] && [ -n "$LAST_SYSTEM_UID" ]; then
if USERID=`getent passwd $CREATEDUSER | cut -f 3 -d ':'`; then
if [ -n "$USERID" ]; then
if [ "$FIST_SYSTEM_UID" -le "$USERID" ] && \
[ "$USERID" -le "$LAST_SYSTEM_UID" ]; then
deluser --quiet $CREATEDUSER || true
fi
fi
fi
fi
---------------------------------------------------------------------------
Regards
Javier
signature.asc
Description: Digital signature
