Bug 149972 - [patch] pw(8): usermod -u <non-numeric> should error
Summary: [patch] pw(8): usermod -u <non-numeric> should error
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 1.0-CURRENT
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-25 21:00 UTC by jschauma
Modified: 2015-07-28 12:17 UTC (History)
0 users

See Also:


Attachments
pw_current.diff (1.06 KB, patch)
2010-10-09 23:36 UTC, Bakulin Ilya
no flags Details | Diff
pw_user.c-diff (2.31 KB, application/octet-stream)
2011-10-22 17:22 UTC, cjr
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description jschauma 2010-08-25 21:00:16 UTC
pw usermod -d /home/bob -u bob -m

yields

drwxr-xr-x  2 root  wheel  512 Aug 25 12:43 /home/bob

Ie, the home directory is owned by root.

This makes (some) sense once you realize that "-u" is supposed to take
a number:

-u uid        Specify the user/account numeric id.

So I'm guessing that in this case pw(8) determined that there is no UID
"bob", and hence created the directory as being owned by root.

Now to make the whole story short, I think that if the argument to "-u"
is supposed to be numeric, then pw(8) should error out if it is not
actually numeric.

Fix: 

some sort of atoi checking in src/usr.sbin/pw/pw_user.c
How-To-Repeat: pw usermod -d /home/bob -u bob -m
Comment 1 Bakulin Ilya 2010-10-09 23:36:27 UTC
Fixed. Now pw(1) will exit with error if supplied with non-numeric ID.
Generated at:	EuroBSDCon-2010 hackers lounge by gpf@, kibab@, bcr@
Comment 2 cjr 2011-10-22 17:22:46 UTC
The included diff implements the suggestion from the audit-trail. More
specifically, when pw is invoced as in "pw usermod testuser2 -u
testuser1", the routine changes testuser2's uid to testuser2's.

This behaviour is in dissaccord with the man-page, which expects -u
<uid>, it is, however, more convenient to the admin wishing to declare
aliases.

It is necessary to reach a decision as to if to implement the first fix (returning error) or the second (deriving uid from uname). The PR should be closed in the one or the other, but timely, fashion, though.

Cheers,
-- 
Christopher J. Ruwe
TZ GMT + 2
Comment 3 cjr 2011-10-23 00:15:32 UTC
Sorry, above "fix" breaks when invoced with anything more than "pw
usermpd user -u otheruser" and should not be considered a fix, it
introduces more problems instead.

-- 
Christopher J. Ruwe
TZ GMT + 2
Comment 4 Baptiste Daroussin freebsd_committer freebsd_triage 2015-07-28 12:17:43 UTC
This has been fixed in the meantime