Bug 212329

Summary:	"Unable to change GID to 501 temporarily"
Product:	Red Hat Enterprise Linux 5	Reporter:	Tim Waugh <twaugh>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.0	CC:	dhowells
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	beta2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-12-23 01:43:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tim Waugh 2006-10-26 10:55:58 UTC

Description of problem:
I get lots of messages like this in /var/log/secure:

Oct 25 11:30:18 cyberelk su: pam_keyinit(su-l:session): Unable to change GID to 
501 temporarily 

Is this likely to be a pam_keyinit problem or a coreutils problem?

Version-Release number of selected component (if applicable):
pam-0.99.6.2-3.fc6
coreutils-5.97-11

How reproducible:
100%

Steps to Reproduce:
1. As root, 'su - someuser'
2. Exit from that sub-shell.

Comment 1 Tomas Mraz 2006-10-26 12:59:46 UTC

Bug in pam_keyinit. In kill_keyrings() it sets effective uid instead of the real
uid.

David, IMO real uid is important for kernel keyrings or am I wrong?

Comment 2 Tomas Mraz 2006-10-26 13:00:31 UTC

This should be fixed for RHEL5 final.

Comment 3 Tomas Mraz 2006-10-26 14:04:14 UTC

Ah so my comment #1 was wrong as revoking the keyrings must be done with
effective uid set to user id. So we must switch the order of setreuid and
setregid call.

Comment 4 RHEL Program Management 2006-10-26 18:55:07 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Comment 6 Tomas Mraz 2006-11-15 13:54:13 UTC

Fixed in pam-0.99.6.2-3.4.el5

Comment 7 RHEL Program Management 2006-12-23 01:43:20 UTC

A package has been built which should help the problem described in 
this bug report. This report is therefore being closed with a resolution 
of CURRENTRELEASE. You may reopen this bug report if the solution does 
not work for you.