freebsd stable - Jun 2004 - Bug in PW

I thin this exists in both -STABLE and -CURRENT, but I don't have a
bang up to date instalation of either, so appologies if it has been
fixed.

Tested on 5.2.1 and 4.8. may have some security implications in that
someone may think they have changed a shell (eg to /nonexistant) but
they haven't really.

Apparently, supplying -d EXITING_HOME_DIR stops -s from setting the
shell. 

        # finger fred
        Login: fred                           Name: Fred Flintstone
        Directory: /home/fred                 Shell: /usr/local/bin/bash
        Never logged in.
        No Mail.
        No Plan.

	# pw usermod fred -s /bin/sh -d /home/fred

	# finger fred
        Login: fred                           Name: Fred Flintstone
        Directory: /home/fred                 Shell: /usr/local/bin/bash
        Never logged in.
        No Mail.
        No Plan.

(ie no change)

    # pw usermod fred -s /bin/sh

    # finger fred
        Login: fred                           Name: Fred Flintstone
        Directory: /home/fred                 Shell: /bin/sh
        Never logged in.
        No Mail.
        No Plan.

(now we have changed)

        # pw usermod fred -s /usr/local/bin/bash -d /home/fred2
        pw: WARNING: home `/home/fred2' does not exist

        # finger fred
        Login: fred                           Name: Fred Flintstone
        Directory: /home/fred2                Shell: /usr/local/bin/bash
        Never logged in.
        No Mail.
        No Plan.
     
(ie setting a different home allows the shell to change)

Looks like an over-enthusiastic `if' in the code to me.

-- 
rjc@interactive.co.uk				_O_
						 |<

Richard Caley wrote:
> I thin this exists in both -STABLE and -CURRENT, but I don't have a
> bang up to date instalation of either, so appologies if it has been
> fixed.
No, it still present in current version (pw_user.c, as of ver. 1.55)
> Tested on 5.2.1 and 4.8. may have some security implications in that
> someone may think they have changed a shell (eg to /nonexistant) but
> they haven't really.
> 
> Apparently, supplying -d EXITING_HOME_DIR stops -s from setting the
> shell. 
Well, it cause some other option to work as well. :-)

This is because 'edited' flags which shows whether something has changed
is set this way in -d option handling:
     edited = strcmp(pwd->pw_dir, arg->val) != 0;
so it sets 'edited' to false, if home directory not changed regardless
of its previous value.

Attached patch should fix this bug (untested)






-------------- next part --------------
*** pw_user.c	Wed Jun 16 17:38:22 2004
--- pw_user.c.new	Wed Jun 16 17:41:37 2004
***************
*** 537,543 ****
  		}
  
  		if ((arg  = getarg(args, 'd')) != NULL) {
! 			edited = strcmp(pwd->pw_dir, arg->val) != 0;
  			if (stat(pwd->pw_dir = arg->val, &st) == -1) {
  				if (getarg(args, 'm') == NULL && strcmp(pwd->pw_dir,
"/nonexistent") != 0)
  				  warnx("WARNING: home `%s' does not exist",
pwd->pw_dir);
--- 537,544 ----
  		}
  
  		if ((arg  = getarg(args, 'd')) != NULL) {
! 			if (strcmp(pwd->pw_dir, arg->val) != 0)
! 				edited = 1;
  			if (stat(pwd->pw_dir = arg->val, &st) == -1) {
  				if (getarg(args, 'm') == NULL && strcmp(pwd->pw_dir,
"/nonexistent") != 0)
  				  warnx("WARNING: home `%s' does not exist",
pwd->pw_dir);

Denis Antrushin wrote:
>> Apparently, supplying -d EXITING_HOME_DIR stops -s from setting the
>> shell. 
> 
> Well, it cause some other option to work as well. :-)
> 
Oops, I meant to say "it causes some other options to stop working as
well"