Bug#1031309: accountsservice: accounts-daemon service will prevent system boot if shadowconfig is off

[Simon McVittie]

Control: tags -1 + pending

On Tue, 14 Feb 2023 at 14:53:34 -0500, john amidon wrote:
> I set shadowconfig to 'off' when I edited '/etc/group'

I would strongly recommend not doing this: it makes the hashed passwords
of all users visible in /etc/passwd, defeating the purpose of having
/etc/shadow, and is also an uncommon (and therefore rarely-tested)
configuration that is quite likely to trigger things like this.

But, yes, accounts-daemon shouldn't be crashing in this situation. This
is a regression from fixing #1030262. I can see why this is happening,
and I'll aim to upload a fix tomorrow.

smcv

Bug#1031309: accountsservice: accounts-daemon service will prevent system boot if shadowconfig is off

[john amidon]

Package: accountsservice
Version: 22.08.8-5
Severity: critical
Justification: breaks the whole system
X-Debbugs-Cc: jami...@helixinnovations.io

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
I set shadowconfig to 'off' when I edited '/etc/group' and forgot to reset it.
Sometime later, I ran 'apt upgrade', rebooted, and found that the boot did not
complete, complaining about accounts-daemon.service not starting.

   * What exactly did you do (or not do) that was effective (or
 ineffective)?
booted into recovery mode, looked at journal and discovered that 'shadowconfig'
was set to 'off' and re-enabled it

   * What was the outcome of this action?
machine successfully rebooted


-- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-3-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages accountsservice depends on:
ii  dbus [default-dbus-system-bus]  1.14.6-1
ii  libaccountsservice0 22.08.8-5
ii  libc6   2.36-8
ii  libglib2.0-02.74.5-1
ii  libpolkit-gobject-1-0   122-3

Versions of packages accountsservice recommends:
ii  libpam-systemd [logind]  252.5-2
ii  polkitd  122-3

Versions of packages accountsservice suggests:
ii  gnome-control-center  1:43.2-2

-- no debconf information