|Summary:||[patch] pw(8) takes strings after option -g for GID 0|
|Product:||Base System||Reporter:||Björn König <bkoenig>|
|Component:||bin||Assignee:||freebsd-bugs (Nobody) <bugs>|
|Severity:||Affects Only Me||Flags:||bugmeister:
Description Björn König 2005-12-08 19:30:02 UTC
pw assumes the group with the ID 0 if you specify a string mistakenly instead of a number in conjunction with option -g. This might be problematic because it is possible that you delete the group 'wheel' accidentally and silently. This issue has been discovered by Mars G. Miro (marsgmiro at gmail.com) Fix: The patch below checks the error value returned by atoi and aborts the current action if the user supplied an invalid GID. Note that pw still accepts erroneous values in certain cases, e.g. -g 0somestring. How-To-Repeat: Back up your /etc/group. ;) # pw groupshow -g wheel wheel:*:0:root # pw groupdel -g somestring # pw groupshow -g wheel pw: unknown group `wheel'
Comment 1 commit-hook 2014-10-28 14:54:16 UTC
A commit references this bug: Author: bapt Date: Tue Oct 28 14:54:05 UTC 2014 New revision: 273782 URL: https://svnweb.freebsd.org/changeset/base/273782 Log: Do not delete the group wheel when bad argument is passed to pw groupdel -g Check that the -g argument is actually a number, if not report an error. This argument is converted without checking with atoi(3) later so without this check it converts any alpha entries into 0 meaning it deletes the group wheel Add a regression test about it PR: 90114 Reported by: email@example.com MFC after: 1 week Changes: head/usr.sbin/pw/pw_group.c head/usr.sbin/pw/tests/pw_delete.sh
Comment 2 commit-hook 2014-11-04 07:51:47 UTC
A commit references this bug: Author: bapt Date: Tue Nov 4 07:50:51 UTC 2014 New revision: 274082 URL: https://svnweb.freebsd.org/changeset/base/274082 Log: MFC: 272445,272578,273772,273779,273782,273786,273787,273791 Add a test for bug 191427 where pw(8) will go into an infinite loop Add some tests for modifying groups When a group is renamed then the group has been invalidated for sure. In that case get the group information using the new name. Fix a regression in pw usermod -G list The user was perperly adding the to different groups from "list" but was not removed from the other groups it could have belong to. Do not delete the group wheel when bad argument is passed to pw groupdel -g Check that the -g argument is actually a number, if not report an error. This argument is converted without checking with atoi(3) later so without this check it converts any alpha entries into 0 meaning it deletes the group wheel Ensure pw userdel -u <invalid> do not try to remove root Check the uid passed is actually a number as early as possible Fix renaming a group via the gr_copy function Add a regression test to pw(8) because the bug was discovered via using: pw groupmod PR: 193704 , 185666 , 90114 , 187189  Submitted by: Marc de la Gueronniere  Reported by: az , firstname.lastname@example.org , email@example.com , firstname.lastname@example.org  Changes: _U stable/10/ stable/10/etc/mtree/BSD.tests.dist stable/10/lib/libutil/gr_util.c stable/10/usr.sbin/pw/Makefile stable/10/usr.sbin/pw/pw_group.c stable/10/usr.sbin/pw/pw_user.c stable/10/usr.sbin/pw/tests/ stable/10/usr.sbin/pw/tests/Makefile stable/10/usr.sbin/pw/tests/pw_delete.sh stable/10/usr.sbin/pw/tests/pw_modify.sh
Comment 3 Glen Barber 2015-07-08 18:17:56 UTC
Close PRs that have had a corresponding fix committed.