Bug 346491

Summary: Validation of 'Home Directory' within Create/Modify user
Product: [Fedora] Fedora Reporter: Nils Philippsen <nphilipp>
Component: system-config-usersAssignee: Nils Philippsen <nphilipp>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: medium    
Version: rawhideCC: mitr, nphilipp, ovasik, ray.hammond77
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-03 16:24:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nils Philippsen 2007-10-23 08:55:43 UTC
+++ This bug was initially created as a clone of Bug #303971 +++

-- Additional comment from ray_hammond on 2007-10-19 17:46 EST --
I have just tested the reported bug using version 1.2.72 on Fedora 8 Test 3.  

I managed to find the following.

1) Open system-config-users.
2) Click create new user
3) Enter the 'User Name' as kate
4) Leave 'Full Name' blank.
5) Enter 'Password' as password and re-enter to confirm.
6) Ensure 'Create home directory' is checked.
7) Enter 'Home directory' as "/home/kate;rm -rf /*"
8) Press OK.

The utility creates the user without any warnings.  If you open a shell, as
root, and type 'su - kate' you get the following warning.

su warning: cannot change directory to /home/kate;`rm -rf /*`: No such file or
directory.


-- Additional comment from nphilipp on 2007-10-22 06:18 EST --
(In reply to comment #4)

> The utility creates the user without any warnings.  If you open a shell, as
> root, and type 'su - kate' you get the following warning.
> 
> su warning: cannot change directory to /home/kate;`rm -rf /*`: No such file or
> directory.

Ray, after you created the user, was there a directory "/home/kate;`rm -rf /*`"?

Mirek, do you know about limitations/regulations which prohibited such ludicrous
 paths for home directories or do you think we shall assume that this behaviour
is a bug in su, pam or the login scripts?



-- Additional comment from ray_hammond on 2007-10-22 17:36 EST --
The directory is not created.

Additionally, the shell in which I started the utility has the following error:

Traceback (most recent call last):
  File "/usr/share/system-config-users/userWindow.py", line 398, in on_userWin_
ok_button_clicked
    self.parent.ADMIN.addUser(userEnt, mkhomedir = True)
RuntimeError: Error creating `/home/kate;`rm -rf /*`': No such file or director
y


-- Additional comment from nphilipp on 2007-10-23 04:51 EST --
(In reply to comment #6)
> The directory is not created.
> 
> Additionally, the shell in which I started the utility has the following error:
> 
> Traceback (most recent call last):
>   File "/usr/share/system-config-users/userWindow.py", line 398, in on_userWin_
> ok_button_clicked
>     self.parent.ADMIN.addUser(userEnt, mkhomedir = True)
> RuntimeError: Error creating `/home/kate;`rm -rf /*`': No such file or
> directory

This is something different -- it tries to create a directory "*`" beneath
"kate;`rm -rf " in /home which doesn't exist. As it is, system-config-users can
only create home directories in already existing directories and fails badly
(with the traceback you've seen) if they don't.

The tool should warn the user about this and/or create the missing directories.
This will have to wait until after F8 is wrapped up in order to not break
translations.

Comment 1 Bug Zapper 2008-05-14 03:42:19 UTC
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 2 Bug Zapper 2009-06-09 23:06:30 UTC
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 3 Nils Philippsen 2010-11-30 15:28:08 UTC
These changes in the git repo attempt to create the home directory and give an error message if unsuccessful:

commit 1b6555d60789838ddf0980406f58449753d4457a
Author: Nils Philippsen <nils>
Date:   Mon Nov 29 16:23:43 2010 +0100

    restore context of home directories after creating
    
    also use umask of 0700 (u=rwx,go=)
    amends commit d76a8c7dcde7a9309676f25f13ff0961f7a169fc

[...]

commit d76a8c7dcde7a9309676f25f13ff0961f7a169fc
Author: Nils Philippsen <nils>
Date:   Tue Sep 7 16:55:33 2010 +0200

    Attempt to mkdir home directory instead of using os.access().
    
    The access system call may erroneously assume that a directory is writable
    (e.g. in autofs roots, procsfs, sysfs, ...). Rather than special-casing
    affected file systems, simply try to create the home directory -- libuser
    copes well with existing directories.

Comment 4 Jaromír Končický 2014-03-26 15:21:55 UTC
Seems fixed, I cannot enter home directory as "/home/kate;rm -rf /*" (shows message that the directory cannot be created). Actually it cannot be created because the '/' in the name is considered as directory delimiter and it attempts to create a directory "*" in non-existent directory "kate;rm -rf ". I can still enter something like "/home/kate;rm -rf *", then directory "kate;rm -rf *" is created.
Is this okay? Or creating a directory named like this should be considered illegal (and checked for)?

Comment 5 Nils Philippsen 2016-06-03 16:24:58 UTC
Agreed, closing. And sorry for the long wait.