Hide Forgot
+++ This bug was initially created as a clone of Bug #303971 +++ -- Additional comment from ray_hammond on 2007-10-19 17:46 EST -- I have just tested the reported bug using version 1.2.72 on Fedora 8 Test 3. I managed to find the following. 1) Open system-config-users. 2) Click create new user 3) Enter the 'User Name' as kate 4) Leave 'Full Name' blank. 5) Enter 'Password' as password and re-enter to confirm. 6) Ensure 'Create home directory' is checked. 7) Enter 'Home directory' as "/home/kate;rm -rf /*" 8) Press OK. The utility creates the user without any warnings. If you open a shell, as root, and type 'su - kate' you get the following warning. su warning: cannot change directory to /home/kate;`rm -rf /*`: No such file or directory. -- Additional comment from nphilipp on 2007-10-22 06:18 EST -- (In reply to comment #4) > The utility creates the user without any warnings. If you open a shell, as > root, and type 'su - kate' you get the following warning. > > su warning: cannot change directory to /home/kate;`rm -rf /*`: No such file or > directory. Ray, after you created the user, was there a directory "/home/kate;`rm -rf /*`"? Mirek, do you know about limitations/regulations which prohibited such ludicrous paths for home directories or do you think we shall assume that this behaviour is a bug in su, pam or the login scripts? -- Additional comment from ray_hammond on 2007-10-22 17:36 EST -- The directory is not created. Additionally, the shell in which I started the utility has the following error: Traceback (most recent call last): File "/usr/share/system-config-users/userWindow.py", line 398, in on_userWin_ ok_button_clicked self.parent.ADMIN.addUser(userEnt, mkhomedir = True) RuntimeError: Error creating `/home/kate;`rm -rf /*`': No such file or director y -- Additional comment from nphilipp on 2007-10-23 04:51 EST -- (In reply to comment #6) > The directory is not created. > > Additionally, the shell in which I started the utility has the following error: > > Traceback (most recent call last): > File "/usr/share/system-config-users/userWindow.py", line 398, in on_userWin_ > ok_button_clicked > self.parent.ADMIN.addUser(userEnt, mkhomedir = True) > RuntimeError: Error creating `/home/kate;`rm -rf /*`': No such file or > directory This is something different -- it tries to create a directory "*`" beneath "kate;`rm -rf " in /home which doesn't exist. As it is, system-config-users can only create home directories in already existing directories and fails badly (with the traceback you've seen) if they don't. The tool should warn the user about this and/or create the missing directories. This will have to wait until after F8 is wrapped up in order to not break translations.
Changing version to '9' as part of upcoming Fedora 9 GA. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
This message is a reminder that Fedora 9 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 9. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '9'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 9's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 9 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
These changes in the git repo attempt to create the home directory and give an error message if unsuccessful: commit 1b6555d60789838ddf0980406f58449753d4457a Author: Nils Philippsen <nils> Date: Mon Nov 29 16:23:43 2010 +0100 restore context of home directories after creating also use umask of 0700 (u=rwx,go=) amends commit d76a8c7dcde7a9309676f25f13ff0961f7a169fc [...] commit d76a8c7dcde7a9309676f25f13ff0961f7a169fc Author: Nils Philippsen <nils> Date: Tue Sep 7 16:55:33 2010 +0200 Attempt to mkdir home directory instead of using os.access(). The access system call may erroneously assume that a directory is writable (e.g. in autofs roots, procsfs, sysfs, ...). Rather than special-casing affected file systems, simply try to create the home directory -- libuser copes well with existing directories.
Seems fixed, I cannot enter home directory as "/home/kate;rm -rf /*" (shows message that the directory cannot be created). Actually it cannot be created because the '/' in the name is considered as directory delimiter and it attempts to create a directory "*" in non-existent directory "kate;rm -rf ". I can still enter something like "/home/kate;rm -rf *", then directory "kate;rm -rf *" is created. Is this okay? Or creating a directory named like this should be considered illegal (and checked for)?
Agreed, closing. And sorry for the long wait.