Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1139318 - useradd allows usernames that break many basic tools
useradd allows usernames that break many basic tools
Status: CLOSED NEXTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: shadow-utils (Show other bugs)
7.0
Unspecified Linux
unspecified Severity low
: rc
: ---
Assigned To: Tomas Mraz
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-09-08 12:04 EDT by Marcel Kolaja
Modified: 2014-09-10 09:48 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-09-10 09:48:46 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marcel Kolaja 2014-09-08 12:04:27 EDT
Description of problem:
useradd allows digit only usernames. That, however, breaks some basic tools that take both username and UID as their argument, like setfacl or getent:

[root@rhel7 ~]# grep 500001 /etc/passwd
500001:x:1001:1001::/home/500001:/bin/bash
test:x:500001:1001::/tmp:/bin/bash
[root@rhel7 ~]# getfacl /tmp/test 
getfacl: Removing leading '/' from absolute path names
# file: tmp/test
# owner: root
# group: root
user::rw-
group::r--
other::r--

[root@rhel7 ~]# setfacl -m u:500001:r /tmp/test 
[root@rhel7 ~]# getfacl /tmp/test 
getfacl: Removing leading '/' from absolute path names
# file: tmp/test
# owner: root
# group: root
user::rw-
user:test:r--
group::r--
mask::r--
other::r--

[root@rhel7 ~]# getent passwd 500001
test:x:500001:1001::/tmp:/bin/bash
[root@rhel7 ~]# 

Version-Release number of selected component (if applicable):
shadow-utils-4.1.5.1-13.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. try to create a user with digits only username

Actual results:
The user gets created.

Expected results:
The user does not get created and appropriate error message is printed (useradd: invalid user name).

Additional info:
N/A
Comment 3 Tomas Mraz 2014-09-09 11:25:15 EDT
I do not think we should change this behavior in already released RHEL. In general the UNIX philosophy is that the user is allowed to shoot himself into his foot with the UNIX commands. :)

However I agree that all numeric user names should be disallowed in Fedora and future major RHEL releases.

Note You need to log in before you can comment on or make changes to this bug.