Bug#854792: fails when there are two users with the same UID

[John Paul Adrian Glaubitz]

Hi!

> I can't come up with a good use case, why one would want the same uid
> for unprivileged users.

I agree with Michael. I don't think this is a particular use case that
is expected to work. accountservice is probably not the only package
that will stumble over this issue.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer - glaub...@debian.org
`. `'   Freie Universitaet Berlin - glaub...@physik.fu-berlin.de
  `-GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Bug#854792: fails when there are two users with the same UID

[Michael Biebl]

On Fri, 24 Feb 2017 01:58:36 +0100 Axel Beckert  wrote:
> Dear Emilio,
> 
> Emilio Pozuelo Monfort wrote:
> > > Summary: accounts-daemon.service fails to work properly when there are
> > > two users in the system with the same UID.
> [...]
> > I'm not sure that's a system configuration that is supported.
> 
> it's a not seldom thing to have a second root account which is often

system accounts, including uid=0 (root), are filtered out by
accountsservice. So this is a non-issue.


I can't come up with a good use case, why one would want the same uid
for unprivileged users.


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature

Bug#854792: fails when there are two users with the same UID

[Axel Beckert]

Dear Emilio,

Emilio Pozuelo Monfort wrote:
> > Summary: accounts-daemon.service fails to work properly when there are
> > two users in the system with the same UID.
[...]
> I'm not sure that's a system configuration that is supported.

it's a not seldom thing to have a second root account which is often
called toor as that's its common name in the BSD world, see
https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/security.html#idp60124648

There are multiple reasons to do that:

* If the beginning of /etc/passwd is wrecked for some reason, the
  second root user at the end of the passwd can still login

* root usually has the default login shell. Some people do not want to
  change that but have a user with root permissions and their
  favourite interactive shell, e.g. tcsh or zsh.

* The second root account could also sport a less comfortable but
  statically compiled shell including some builtin commands (e.g.
  busybox-static or sash) for fixing the system with onboard tools if
  libc6 is broken for some reason.

Actually Debian's sash package even encouraged the admin via debconf
to create such a second root user (called sashroot). That feature
though has been removed from the sash package quite a while ago
(although I learned about this only now and was unpleasantly surprised
about that maintainer's move).

> If you shoot yourself in the foot, you should expect some
> problems...

Unfortunately it has been become very common in Debian recently to use
such arguments to get rid of unpleasant bugs.

Regards, Axel
-- 
 ,''`.  |  Axel Beckert , http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-|  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

Bug#854792: fails when there are two users with the same UID

[Juan Céspedes]

On Thu, Feb 16, 2017 at 12:16 AM, Emilio Pozuelo Monfort 
wrote:

> On 10/02/17 13:38, Juan Cespedes wrote:
> > Summary: accounts-daemon.service fails to work properly when there are
> > two users in the system with the same UID.
>

> I'm not sure that's a system configuration that is supported. If you shoot
> yourself in the foot, you should expect some problems...
>

Neither the Debian Policy nor any other document I am aware of states that
it shouldn't be done.  I do it fairly often for several reasons, and I know
of some other people who do it too.

Furthermore, it has always worked, and suddenly, after upgrading to
stretch, it fails to work *silently*...

-- 
Juan Cespedes

Bug#854792: fails when there are two users with the same UID

[Emilio Pozuelo Monfort]

On 10/02/17 13:38, Juan Cespedes wrote:
> Package: accountsservice
> Version: 0.6.43-1
> Severity: serious
> 
> Summary: accounts-daemon.service fails to work properly when there are
> two users in the system with the same UID.  The service is still
> running, but it shows an error message and makes unrelated software
> break: gdm3 waits indefinitely and does not start Xorg at boot time.
> Removing one of the offending users (or changing its UID) and
> restarting accounts-daemon.service makes gdm3 work again.
> 
> Details:
> 
> After upgrading the system to stretch, gdm3 would not start Xorg
> anymore, without giving any error or warning.  After enabling debug
> and restarting, its last message was:
> 
> Feb 10 13:30:17 petete gdm-launch-environment]: AccountsService: 
> ActUserManager: waiting for user manager to load before finding user 
> 'Debian-gdm'
> 
> This made me think there was some problem with accounts-daemon:
> 
> 8<8<---
> # systemctl status accounts-daemon | cat
> ● accounts-daemon.service - Accounts Service
>Loaded: loaded (/lib/systemd/system/accounts-daemon.service; enabled; 
> vendor preset: enabled)
>Active: active (running) since Fri 2017-02-10 13:19:37 CET; 14min ago
>  Main PID: 29171 (accounts-daemon)
> Tasks: 3 (limit: 4915)
>Memory: 1.4M
>   CPU: 81ms
>CGroup: /system.slice/accounts-daemon.service
>└─29171 /usr/lib/accountsservice/accounts-daemon
> 
> Feb 10 13:19:36 petete systemd[1]: Stopped Accounts Service.
> Feb 10 13:19:36 petete systemd[1]: Starting Accounts Service...
> Feb 10 13:19:37 petete accounts-daemon[29171]: error exporting user object: 
> An object is already exported for the interface org.freedesktop.Accounts.User 
> at /org/freedesktop/Accounts/User1000
> Feb 10 13:19:37 petete accounts-daemon[29171]: started daemon version 0.6.43
> Feb 10 13:19:37 petete systemd[1]: Started Accounts Service.
> 8<8<---
> 
> As you can see, the service is "loaded" and "active", but it shows an
> error about "an object is already exported".  As I said, after
> removing the users with duplicate UIDs, accounts-daemon starts without
> errors, and gdm3 runs fine and starts Xorg properly.

I'm not sure that's a system configuration that is supported. If you shoot
yourself in the foot, you should expect some problems...

Cheers,
Emilio

Bug#854792: fails when there are two users with the same UID

[Juan Cespedes]

Package: accountsservice
Version: 0.6.43-1
Severity: serious

Summary: accounts-daemon.service fails to work properly when there are
two users in the system with the same UID.  The service is still
running, but it shows an error message and makes unrelated software
break: gdm3 waits indefinitely and does not start Xorg at boot time.
Removing one of the offending users (or changing its UID) and
restarting accounts-daemon.service makes gdm3 work again.

Details:

After upgrading the system to stretch, gdm3 would not start Xorg
anymore, without giving any error or warning.  After enabling debug
and restarting, its last message was:

Feb 10 13:30:17 petete gdm-launch-environment]: AccountsService: 
ActUserManager: waiting for user manager to load before finding user 
'Debian-gdm'

This made me think there was some problem with accounts-daemon:

8<8<---
# systemctl status accounts-daemon | cat
● accounts-daemon.service - Accounts Service
   Loaded: loaded (/lib/systemd/system/accounts-daemon.service; enabled; vendor 
preset: enabled)
   Active: active (running) since Fri 2017-02-10 13:19:37 CET; 14min ago
 Main PID: 29171 (accounts-daemon)
Tasks: 3 (limit: 4915)
   Memory: 1.4M
  CPU: 81ms
   CGroup: /system.slice/accounts-daemon.service
   └─29171 /usr/lib/accountsservice/accounts-daemon

Feb 10 13:19:36 petete systemd[1]: Stopped Accounts Service.
Feb 10 13:19:36 petete systemd[1]: Starting Accounts Service...
Feb 10 13:19:37 petete accounts-daemon[29171]: error exporting user object: An 
object is already exported for the interface org.freedesktop.Accounts.User at 
/org/freedesktop/Accounts/User1000
Feb 10 13:19:37 petete accounts-daemon[29171]: started daemon version 0.6.43
Feb 10 13:19:37 petete systemd[1]: Started Accounts Service.
8<8<---

As you can see, the service is "loaded" and "active", but it shows an
error about "an object is already exported".  As I said, after
removing the users with duplicate UIDs, accounts-daemon starts without
errors, and gdm3 runs fine and starts Xorg properly.


-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (300, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=UTF-8 (charmap=UTF-8) (ignored: LC_ALL set 
to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages accountsservice depends on:
ii  dbus   1.10.14-1
ii  init-system-helpers1.47
ii  libaccountsservice00.6.43-1
ii  libc6  2.24-9
ii  libglib2.0-0   2.50.2-2
ii  libpolkit-gobject-1-0  0.105-17

accountsservice recommends no packages.

Versions of packages accountsservice suggests:
ii  gnome-control-center  1:3.22.1-2

-- no debconf information