After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 580182 - users-admin allows the creation of user's with predefined group names
users-admin allows the creation of user's with predefined group names
Status: RESOLVED FIXED
Product: gnome-system-tools
Classification: Deprecated
Component: users-admin
unspecified
Other All
: Normal critical
: ---
Assigned To: Milan Bouchet-Valat
Carlos Garnacho
Depends on:
Blocks:
 
 
Reported: 2009-04-24 21:57 UTC by Jonathan Davies
Modified: 2009-07-26 20:59 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Patch which prevents the creation of user with existing group names (2.00 KB, patch)
2009-04-24 21:59 UTC, Jonathan Davies
committed Details | Review

Description Jonathan Davies 2009-04-24 21:57:59 UTC
Please describe the problem:
users-admin allows one to create a user with a predefined group name, and thus, the group gets overwritten for the new user.

For example, if someone creates a new user called 'admin' on Ubuntu, this creates a new user called admin and adds this user to a new 'admin' group - rendering system administration useless with sudo.

Reported on Launchpad here: https://bugs.launchpad.net/ubuntu/+source/gnome-system-tools/+bug/236305

Steps to reproduce:


Actual results:


Expected results:


Does this happen every time?


Other information:
Comment 1 Jonathan Davies 2009-04-24 21:59:17 UTC
Created attachment 133278 [details] [review]
Patch which prevents the creation of user with existing group names
Comment 2 Martin Pitt 2009-04-27 09:25:51 UTC
I'd like to stress the urgency of this. The previous behaviour led and still leads to loads of problems if people create an "admin", "adm", "sound", or other user, which totally wedges the permission system.
Comment 3 Milan Bouchet-Valat 2009-07-26 20:59:45 UTC
Very problematic indeed! I've modified your patch to avoid duplicating the group_exists() function, improved a few messages to make them match their equivalent in usernames, and pushed this as 90f34bc566857a037d65daaa302da43b2cf8a0b3.

BTW, I've discovered a typo that allowed to seemingly create groups with already existing names. These were not overwriting previous ones, though, AFAIK.