Re: adduser race conditions

2021-02-22 Thread Christian Ehrhardt
On Fri, Feb 19, 2021 at 6:19 PM Brent W. Baccala  wrote:
>
> Hi -
>
> I've found at least one race condition in the adduser script on Ubuntu 18.
>
> The program searches for an available UID (and GID), then adds the new user 
> with the selected UID/GID numbers without any synchronization, so two 
> near-simultaneous invocations of the program can produce two users with 
> identical GIDs (what I saw), or, presumably, identical UIDs.
>
> Is there a bug/issue tracker somewhere for this program?

Hi Brent,
the upstream for this program is Debian [1][2] for general bugs and/or
feature requests you'd use those.
While the Ubuntu bug tracker [3] would mostly be for issues due to the
Ubuntu Delta or to ask for backports of fixes into active Ubuntu
Releases as part of the SRU process [4].

Do these pointers help enough to enable you to take the next step
reporting [5][6] this?

[1]: https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=yes=adduser
[2]: https://salsa.debian.org/debian/adduser
[3]: https://bugs.launchpad.net/ubuntu/+source/adduser
[4]: https://wiki.ubuntu.com/StableReleaseUpdates
[5]: https://www.debian.org/Bugs/Reporting
[6]: https://ubuntu.com/server/docs/reporting-bugs


> agape
> brent
>
> --
> Ubuntu-devel-discuss mailing list
> Ubuntu-devel-discuss@lists.ubuntu.com
> Modify settings or unsubscribe at: 
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss



-- 
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss


adduser race conditions

2021-02-19 Thread Brent W. Baccala
Hi -

I've found at least one race condition in the adduser script on Ubuntu 18.

The program searches for an available UID (and GID), then adds the new user
with the selected UID/GID numbers without any synchronization, so two
near-simultaneous invocations of the program can produce two users with
identical GIDs (what I saw), or, presumably, identical UIDs.

Is there a bug/issue tracker somewhere for this program?

agape
brent
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss