Bug 1031334 - LMI_AccountProvider crash if user password is in /etc/passwd instead of /etc/shadow
Summary: LMI_AccountProvider crash if user password is in /etc/passwd instead of /etc/...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: openlmi-providers
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Tomáš Bžatek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1049499
TreeView+ depends on / blocked
 
Reported: 2013-11-16 23:07 UTC by Klaus Kämpf
Modified: 2014-01-07 16:05 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1049499 (view as bug list)
Environment:
Last Closed: 2013-12-03 12:38:17 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Patch to fall back to /etc/passwd if /etc/shadow returns NULL password (738 bytes, patch)
2013-11-16 23:07 UTC, Klaus Kämpf
no flags Details | Diff

Description Klaus Kämpf 2013-11-16 23:07:37 UTC
Created attachment 825007 [details]
Patch to fall back to /etc/passwd if /etc/shadow returns NULL password

Description of problem:
Enumeration of LMI_Account instances leads to a NULL pointer exceptiion

Version-Release number of selected component (if applicable):


How reproducible:
Enumerate instances of LMI_Account

Steps to Reproduce:
1.
2.
3.

Actual results:
sigsegv

Expected results:
List of user accounts

Additional info:
Adding debug prints lead to a user name which has no entry in /etc/shadow, leading to a NULL value returned from aux_lu_get_str(lue, LU_SHADOWPASSWORD)

Comment 1 Tomáš Bžatek 2013-12-03 12:38:17 UTC
Thanks for the patch, good catch. I've committed slightly modified version upstream: https://git.fedorahosted.org/cgit/openlmi-providers.git/commit/?id=593292b27221d05d2d43485d8ac9d026cca8a7c2

FYI, pulling information from two independent files is always racy as they're modified separately and e.g. the account indication watcher is getting inotify events on both files. That means there's slight chance to hit the moment where both files are not fully updated yet and libuser reader may not provide all information we require. We're working on a workaround.


Note You need to log in before you can comment on or make changes to this bug.