[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3ac016b6-74ce-5aad-927c-e9c014cdd52c@redhat.com>
Date: Wed, 5 Jul 2017 09:37:32 -0500
From: Eric Blake <eblake@...hat.com>
To: oss-security@...ts.openwall.com, Pali Rohár
<pali.rohar@...il.com>
Cc: Daniel Skowroński <daniel@...nf.net>
Subject: Re: systemd fails to parse user that should run
service
On 07/05/2017 03:50 AM, Pali Rohár wrote:
> There are basically two problems:
>
> 1) In more Linux distributions useradd tool allow to create a new user
> which starts with digit. Also according to POSIX such user name is a
> valid. This means that valid user name (for some Linux distributions)
> from /etc/passwd specified in systemd unit file results running service
> as root user.
In fact, it is possible to create a username of '0' which is a non-root
user. GNU Coreutils has several tools that support a lookup of '+0' to
force a numeric uid interpretation (get information related to uid 0,
regardless of whether there is also a username "0"), while omitting the
leading + does a username lookup first then falls back to a uid, since
leading + is not a valid POSIX username start character.
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
Download attachment "signature.asc" of type "application/pgp-signature" (605 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
