Bug 1139318

Summary: useradd allows usernames that break many basic tools
Product: Red Hat Enterprise Linux 7 Reporter: Marcel Kolaja <mkolaja>
Component: shadow-utilsAssignee: Tomas Mraz <tmraz>
Status: CLOSED NEXTRELEASE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: unspecified    
Version: 7.0   
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-10 13:48:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marcel Kolaja 2014-09-08 16:04:27 UTC
Description of problem:
useradd allows digit only usernames. That, however, breaks some basic tools that take both username and UID as their argument, like setfacl or getent:

[root@rhel7 ~]# grep 500001 /etc/passwd
500001:x:1001:1001::/home/500001:/bin/bash
test:x:500001:1001::/tmp:/bin/bash
[root@rhel7 ~]# getfacl /tmp/test 
getfacl: Removing leading '/' from absolute path names
# file: tmp/test
# owner: root
# group: root
user::rw-
group::r--
other::r--

[root@rhel7 ~]# setfacl -m u:500001:r /tmp/test 
[root@rhel7 ~]# getfacl /tmp/test 
getfacl: Removing leading '/' from absolute path names
# file: tmp/test
# owner: root
# group: root
user::rw-
user:test:r--
group::r--
mask::r--
other::r--

[root@rhel7 ~]# getent passwd 500001
test:x:500001:1001::/tmp:/bin/bash
[root@rhel7 ~]# 

Version-Release number of selected component (if applicable):
shadow-utils-4.1.5.1-13.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. try to create a user with digits only username

Actual results:
The user gets created.

Expected results:
The user does not get created and appropriate error message is printed (useradd: invalid user name).

Additional info:
N/A

Comment 3 Tomas Mraz 2014-09-09 15:25:15 UTC
I do not think we should change this behavior in already released RHEL. In general the UNIX philosophy is that the user is allowed to shoot himself into his foot with the UNIX commands. :)

However I agree that all numeric user names should be disallowed in Fedora and future major RHEL releases.