Bug 1899410 - non-sudoers cannot authenticate because of bad username in prompt
Summary: non-sudoers cannot authenticate because of bad username in prompt
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: hplip
Version: 32
Hardware: Unspecified
OS: Unspecified
medium
low
Target Milestone: ---
Assignee: Zdenek Dohnal
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-11-19 06:44 UTC by udo
Modified: 2020-11-29 01:13 UTC (History)
4 users (show)

Fixed In Version: hplip-3.20.9-4.fc33 hplip-3.20.9-4.fc32
Clone Of:
Environment:
Last Closed: 2020-11-28 02:03:44 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Proposed patch (860 bytes, patch)
2020-11-19 13:29 UTC, Zdenek Dohnal
no flags Details | Diff
Proposed patch (1019 bytes, patch)
2020-11-19 15:27 UTC, Zdenek Dohnal
no flags Details | Diff

Description udo 2020-11-19 06:44:35 UTC
Description of problem:
While trying to make my HP LaserJet MFP work as scanner the installation of a 'driver plugin' fails due to inability to change user name in gui of what appears to be hp-diagnose_plugin.

Version-Release number of selected component (if applicable):
hplip-3.20.9-2.fc32.x86_64

How reproducible:
Start gimp.
File -> Create -> Xsane: Device dialog...
(xsane starts)
Choose the laserjet from the device list. Click OK.
Error appears:
Failed to open device `hpaio:/net/HP_LaserJet_MFP_M129-M134?hostname=printer`: Error during device I/O.
Click Close.
Click Next in the HP Device Manager - Plug-in Installer that has appeared.
Click Next in the HP Device Manager.
Wait for download.
Accept the License Agreement and click Next.
Dialog appears 'HP Device Manager- Enter Username/Password' with request to authenticate. It shows my username in a grey box without ability to change to root.



Actual results:
See above.

Expected results:
Installation of scanner requirements without issues.

Additional info:
The LaserJet prints OK.

Comment 1 udo 2020-11-19 06:56:00 UTC
$ scanimage -L
device `hpaio:/net/HP_LaserJet_MFP_M129-M134?hostname=printer' is a Hewlett-Packard HP_LaserJet_MFP_M129-M134 all-in-one

Comment 2 udo 2020-11-19 06:58:43 UTC
On the CLI OTOH:

# hp-plugin 

HP Linux Imaging and Printing System (ver. 3.20.9)
Plugin Download and Install Utility ver. 2.1

Copyright (c) 2001-18 HP Development Company, LP
This software comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to distribute it
under certain conditions. See COPYING file for more details.

warning: It is not recommended to run 'hp-plugin' in a root mode.

HP Linux Imaging and Printing System (ver. 3.20.9)
Plugin Download and Install Utility ver. 2.1

Copyright (c) 2001-18 HP Development Company, LP
This software comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to distribute it
under certain conditions. See COPYING file for more details.

(Note: Defaults for each question are maked with a '*'. Press <enter> to accept the default.)


-----------------------------------------
| PLUG-IN INSTALLATION FOR HPLIP 3.20.9 |
-----------------------------------------

  Option      Description                                       
  ----------  --------------------------------------------------
  d           Download plug-in from HP (recommended)            
  p           Specify a path to the plug-in (advanced)          
  q           Quit hp-plugin (skip installation)                

Enter option (d=download*, p=specify path, q=quit) ? d

-------------------
| DOWNLOAD PLUGIN |
-------------------

Checking for network connection...
Downloading plug-in from: 
Downloading plug-in: [\                                   ] 0%     
Receiving digital keys: /usr/bin/gpg --homedir /root/.hplip/.gnupg --no-permission-warning --keyserver pool.sks-keyservers.net --recv-keys 0x4ABA2F66DBD5A95894910E0673D770CDA59047B9
 

----------------------
| INSTALLING PLUG-IN |
----------------------

Creating directory plugin_tmp
Verifying archive integrity... All good.
Uncompressing HPLIP 3.20.9 Plugin Self Extracting Archive..............................................................

HP Linux Imaging and Printing System (ver. 3.20.9)
Plugin Installer ver. 3.0

Copyright (c) 2001-18 HP Development Company, LP
This software comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to distribute it
under certain conditions. See COPYING file for more details.

Plug-in version: 3.20.9
Installed HPLIP version: 3.20.9
Number of files to install: 64

You must agree to the license terms before installing the plug-in:

LICENSE TERMS FOR HP Linux Imaging and Printing (HPLIP) Driver Plug-in          


These License Terms govern your Use of the HPLIP Driver Plug-in Software (the   
"Software"). USE OF THE SOFTWARE INCLUDING, WITHOUT LIMITATION, ANY             
DOCUMENTATION, IS SUBJECT TO THESE LICENSE TERMS AND THE APPLICABLE AS-IS       
WARRANTY STATEMENT. BY DOWNLOADING AND INSTALLING THE SOFTWARE, YOU ARE AGREEING
TO BE BOUND BY THESE TERMS. IF YOU DO NOT AGREE TO ALL OF THESE TERMS, DO NOT   
DOWNLOAD AND INSTALL THE SOFTWARE ON YOUR SYSTEM.                               


1. License Grant. HP grants you a license to Use one copy of the Software with  
HP printing products only. "Use" includes using, storing, loading, installing,  
executing, and displaying the Software. You may not modify the Software or      
disable any licensing or control features of the Software.                      


2. Ownership. The Software is owned and copyrighted by HP or its third party    
suppliers. Your license confers no title to, or ownership in, the Software and  
is not a sale of any rights in the Software. HP's third party suppliers may     
protect their rights in the Software in the event of any violation of these     
license terms.                                                                  


3. Copies and Adaptations. You may only make copies or adaptations of the       
Software for archival purposes or when copying or adaptation is an essential    
step in the authorized Use of the Software. You must reproduce all copyright    
notices in the original Software on all copies or adaptations. You may not copy 
the Software onto any public network.                                           


4. No Disassembly. You may not Disassemble the Software unless HP's prior       
written consent is obtained. "Disassemble" includes disassembling, decompiling, 
decrypting, and reverse engineering. In some jurisdictions, HP's consent may not
be required for limited Disassembly. Upon request, you will provide HP with     
reasonably detailed information regarding any Disassembly.                      


5. No Transfer. You may not assign, sublicense or otherwise transfer all or any 
part of these License Terms or the Software.                                    


6. Termination. HP may terminate your license, upon notice, for failure to      
comply with any of these License Terms. Upon termination, you must immediately  
destroy the Software, together with all copies, adaptations and merged portions 
in any form.                                                                    


7. Export Requirements. You may not export or re-export the Software or any copy
or adaptation in violation of any applicable laws or regulations.               


8. U.S. Government Restricted Rights. The Software has been developed entirely  
at private expense. It is delivered and licensed, as defined in any applicable  
DFARS, FARS, or other equivalent federal agency regulation or contract clause,  
as either "commercial computer software" or "restricted computer software",     
whichever is applicable. You have only those rights provided for such Software  
by the applicable clause or regulation or by these License Terms.               


9. DISCLAIMER OF WARRANTIES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, 
HP AND ITS SUPPLIERS PROVIDE THE SOFTWARE "AS IS" AND WITH ALL FAULTS, AND      
HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, EITHER EXPRESS, IMPLIED, OR
STATUTORY, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF TITLE AND               
NON-INFRINGEMENT, ANY IMPLIED WARRANTIES, DUTIES OR CONDITIONS OF               
MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE, AND OF LACK OF VIRUSES ALL
WITH REGARD TO THE SOFTWARE. Some states/jurisdictions do not allow exclusion of
implied warranties or limitations on the duration of implied warranties, so the 
above disclaimer may not apply to you in its entirety.                          


10. LIMITATION OF LIABILITY. Notwithstanding any damages that you might incur,  
the entire liability of HP and any of its suppliers under any provision of this 
agreement and your exclusive remedy for all of the foregoing shall be limited to
the greater of the amount actually paid by you separately for the Software or   
U.S. $5.00. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL
HP OR ITS SUPPLIERS BE LIABLE FOR ANY SPECIAL, INCIDENTAL,                      
INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, BUT NOT LIMITED TO,   
DAMAGES FOR LOSS OF PROFITS OR CONFIDENTIAL OR OTHER INFORMATION, FOR BUSINESS  
INTERRUPTION, FOR PERSONAL INJURY, FOR LOSS OF PRIVACY ARISING OUT OF OR IN ANY 
WAY RELATED TO THE USE OF OR INABILITY TO USE THE SOFTWARE, OR OTHERWISE IN     
CONNECTION WITH ANY PROVISION OF THIS AGREEMENT, EVEN IF HP OR ANY SUPPLIER HAS 
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF THE REMEDY FAILS OF 
ITS ESSENTIAL PURPOSE. Some states/jurisdictions do not allow the exclusion or  
limitation of incidental or consequential damages, so the above limitation or   
exclusion may not apply to you.                                                 

Do you accept the license terms for the plug-in (y=yes*, n=no, q=quit) ? y
 
Done.
 
Done.


So a workaround exists if one dares to use it.
Successful scan occurred.

Comment 3 Zdenek Dohnal 2020-11-19 13:22:36 UTC
Hi udo,

thank you for reporting the issue!

I can reproduce the issue, finding this:

1) if hp-plugin caller is an user from wheel group or root, then hp-plugin hardcodes username 'root' into prompt.

2) otherwise, it hardcodes your username into prompt

First, one note - the script hardcodes the username intentionally to help the user which username+password he needs to use to do the trick. To put it simply, it suggests an user wich has permissions to install plugin. I find it useful as it is, so this behavior will not be fixed.
The current setup has a con in use case if you are user and you want to use superuser instead of root, but its fix will be more complex and it is not doable with hplip upstream.

So the fix will be following:

1) if the script caller is in wheel group (sudoers), its username is preset and its password will be requested

2) if the script caller is root or isn't in wheel group, root's username is preset and his password will be requested.

Comment 4 udo 2020-11-19 13:26:17 UTC
Thanks for the quick response!
I think the fix you describe will make things OK.

Comment 5 Zdenek Dohnal 2020-11-19 13:28:51 UTC
The root of problem is that the script sets 'sudo' before any command which needs more permissions without actually checking if the script caller is capable of running 'sudo'.

The fix will check that, and if the caller isn't sudoer, then it will call commands with 'su -c'.

This settings is reflected to what fixed username is shown during prompt too ('su -c' uses 'root' username, 'sudo' a specific user).

Comment 6 Zdenek Dohnal 2020-11-19 13:29:49 UTC
Created attachment 1730933 [details]
Proposed patch

Comment 7 Zdenek Dohnal 2020-11-19 15:27:29 UTC
Created attachment 1730959 [details]
Proposed patch

Comment 8 Zdenek Dohnal 2020-11-19 15:27:52 UTC
Reported as https://bugs.launchpad.net/hplip/+bug/1904888

Comment 9 Fedora Update System 2020-11-20 07:32:35 UTC
FEDORA-2020-14c4a3ecbc has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-14c4a3ecbc

Comment 10 Fedora Update System 2020-11-20 07:56:15 UTC
FEDORA-2020-187123aec6 has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-187123aec6

Comment 11 Fedora Update System 2020-11-21 02:43:20 UTC
FEDORA-2020-14c4a3ecbc has been pushed to the Fedora 33 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-14c4a3ecbc`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-14c4a3ecbc

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2020-11-21 02:46:06 UTC
FEDORA-2020-187123aec6 has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-187123aec6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-187123aec6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2020-11-28 02:03:44 UTC
FEDORA-2020-14c4a3ecbc has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2020-11-29 01:13:52 UTC
FEDORA-2020-187123aec6 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.