Jira (PUP-4042) Exec runs with wrong user if user matches a hex-like string

[Henrik Lindberg (JIRA)]

Title: Message Title

Henrik Lindberg commented on PUP-4042   Re: Exec runs with wrong user if user matches a hex-like string Tried to find where this goes wrong. The only smelly thing I found on a first read-trhough was this: newproperty(:uid) do desc "The user ID; must be specified numerically. If no user ID is specified when creating a new user, then one will be chosen automatically. This will likely result in the same user having different UIDs on different systems, which is not recommended. This is especially noteworthy when managing the same user on both Darwin and other platforms, since Puppet does UID generation on Darwin, but the underlying tools do so on other platforms.   On Windows, this property is read-only and will return the user's security identifier (SID)."   munge do |value| case value when String if value =~ /^[-0-9]+$/ value = Integer(value) end end   return value end end The regexp there matches strings like "-0-1-2" and "---", that does not seem right. The same regexp is used in several other places. That regexp does however not explain the interpretation of "0x01" as a user id. There are a couple of things in action here: The Puppet::Util::Execution that is given the resource[:user] from the exec - i.e. the string "0x01" as I understand it The Exec type performs an autorequire on the user if the name is not a sequence of digits 0-9 (that regexp looks ok) it finds that "0x01" is indeed a name and not an id The Execution performs this: Puppet::Util::SUIDManager.change_privileges(options[:uid], options[:gid], true) which again should be given the string "0x01". It in turns does something like convert_xid(:uid, user) Which calls into some meta programming like this: Puppet::Util.send(:uid, id) Which ends up does this: get_posix_value(:passwd, :uid, user) And this uses field = Integer(field) to see if value is convertible to integer, which "0x01" is !!! - it now takes the wrong path through the rest of the logic for getting the :uid posix field It seems the problem at this low level of getting a posix passwd field for the user. Not sure if the solution is to change that as other logic may rely on strings like "0x10" are automatically converted at this very low level... Add Comment   This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.