Bug 211089 - "id -Z root" throws an error when running as root
"id -Z root" throws an error when running as root
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: coreutils (Show other bugs)
5.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
David Lawrence
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-10-17 06:21 EDT by Bastien Nocera
Modified: 2007-11-30 17:07 EST (History)
1 user (show)

See Also:
Fixed In Version: beta2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-12-22 20:24:03 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
coreutils-id-Z-better-error.patch (861 bytes, patch)
2006-10-17 06:21 EDT, Bastien Nocera
no flags Details | Diff
coreutils-id-selinux.patch (664 bytes, patch)
2006-11-17 09:28 EST, Tim Waugh
no flags Details | Diff

  None (edit)
Description Bastien Nocera 2006-10-17 06:21:12 EDT
# id -Z root
id: cannot display context when selinux not enabled or when displaying the id
# id -Z
root:system_r:unconfined_t:SystemLow-SystemHigh

The attached patch tries to check whether the username passed is the same as the
current one, and displays the context properly:
# id -Z root
root:system_r:unconfined_t:SystemLow-SystemHigh
Comment 1 Bastien Nocera 2006-10-17 06:21:13 EDT
Created attachment 138673 [details]
coreutils-id-Z-better-error.patch
Comment 2 Tim Waugh 2006-10-17 10:12:53 EDT
No, I don't really like this patch.  Why would you run 'id -Z root'?  Its output
is nothing like that of 'id root', even if that's the user running the command.
 'id -Z' has special output not like any other options.

It's a similar situation to the reason 'id' is different to 'id root' -- one is
contextual and depends on the environment and history of the (parent) process,
the other is not and just reads the user database.
Comment 3 Bastien Nocera 2006-10-18 11:32:55 EDT
Then please consider this a request to fix the usage output, the man page, and
the wrongly worded error message.
Comment 4 RHEL Product and Program Management 2006-10-24 15:43:27 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 7 Tim Waugh 2006-11-17 09:28:05 EST
Created attachment 141473 [details]
coreutils-id-selinux.patch

How about this?
Comment 8 Bastien Nocera 2006-11-17 09:37:52 EST
Would still need man page and usage output changes, but looks good.
Comment 9 Tim Waugh 2006-11-17 11:26:50 EST
Do you think adding 'of the current process' is sufficient?  Otherwise, would
you like to suggest alternate wording?  Thanks.
Comment 10 Bastien Nocera 2006-11-23 11:10:38 EST
+    error (1, 0, _("\
+cannot display context when not displaying current user"));

when I do "id -Z root", it is displaying the current user.

The usage and man page need to make it clear that "-Z" is stand-alone, and not
an option to which you can append a username.
Comment 11 Tim Waugh 2006-11-23 11:34:10 EST
Running 'id' without a user-name is asking it to tell you "the current user". 
id basically has two modes: telling you about the "current" anything (effective
user ID, security context, group list), and telling you things from the pw
database.  The first is related to the context in which you have run 'id'; the
second is nothing to do with that context, and just reports objective facts from
the system-wide pw database.

When you add 'root' to the command line, you are trying to ask about something
in the pw database, not something related to the context in which 'id' is
running -- but that sort of usage makes no sense with -Z.  There are no
objective facts about security contexts to look up in the pw database.  Were you
trying to find out the default SELinux context for root logging in?  It's a more
complicated question than that.

I still don't really understand why you are trying to run it like this.  I don't
really understand why you will ever see this error message.  What do you really
expect 'id -Z root' to tell you?
Comment 12 Bastien Nocera 2006-11-23 11:45:55 EST
(In reply to comment #11)
> I still don't really understand why you are trying to run it like this.  I don't
> really understand why you will ever see this error message.  What do you really
> expect 'id -Z root' to tell you?

Because the man page:
       id [OPTION]... [USERNAME]
and the usage output:
Usage: id [OPTION]... [USERNAME]
tell me I can.

I expect "id -Z root" to work as in comment 0, or for the usage and man pages to
be fixed.
Comment 13 Tim Waugh 2006-11-23 12:00:34 EST
I'm going to change the error to this then:

id: cannot print security context in default format

modelled on the error message you get from 'id -r root'.
Comment 14 Bastien Nocera 2006-11-23 12:02:45 EST
(In reply to comment #13)
> I'm going to change the error to this then:
> 
> id: cannot print security context in default format
> 
> modelled on the error message you get from 'id -r root'.

Not the most eloquent of error messages, but I guess it's better than a
misleading one :)
Comment 15 Tim Waugh 2006-11-23 12:05:34 EST
Or even better:

id: cannot print security context when user specified
Comment 16 Bastien Nocera 2006-11-23 12:06:23 EST
Sounds great.
Comment 17 Jay Turner 2006-11-27 10:36:14 EST
QE ack for RHEL5.
Comment 18 RHEL Product and Program Management 2006-12-22 20:24:03 EST
A package has been built which should help the problem described in 
this bug report. This report is therefore being closed with a resolution 
of CURRENTRELEASE. You may reopen this bug report if the solution does 
not work for you.

Note You need to log in before you can comment on or make changes to this bug.