Subject: Bug#3244: no subject)

From: [email-masked]
Date: Fri, 7 Jun 96 11:51 EDT

Moin

  Martin>  Subject: Changing wrong password Package: passwd Version: 1.0-4
  Martin>
  Martin> Good day folks,
  Martin>
  Martin> recently I noticed that the password program doesn t change the
  Martin> password it should.  If I su and call passwd the root password
  Martin> isn't changed, but my user password.
  Martin>
  Martin> I think (?!) this can be fixed by looking at the uid/euid when
  Martin> trying to find out for which user the program should work.
  Martin>
  Martin> Here's an excerpt:
  Martin>
  Martin> namib!joey:~> su - Password: namib!root:~# passwd Changing password
  Martin> for joey Enter new password: Re-type new password: You misspelled
  Martin> it. Password not changed.

Hast Du mal 'su' ohne '-' versucht?.

Von su(1):

       -, -l, --login
              Make  the shell a login shell.  This means the fol-
              lowing.  Unset  all  environment  variables  except
              `TERM',  `HOME',  and  `SHELL'  (which  are  set as
              described above), and `USER' and  `LOGNAME'  (which
              are  set,  even  for  the  super-user, as described
              above), and set `PATH'  to  a  compiled-in  default
              value.   Change  to USER's home directory.  Prepend
              "-" to the shell's name, to make it read its  login
              startup file(s).

Tschoe,

--
Dirk Eddelb"uttel                             http://qed.econ.queensu.ca/~edd

---

From: [email-masked] (Martin Schulze)
Date: Fri, 7 Jun 96 16:00 MET DST

Subject: Changing wrong password

Package: passwd
Version: 1.0-4

Good day folks,

recently I noticed that the password program doesn
t change the password it should.  If I su and call passwd
the root password isn't changed, but my user password.

I think (?!) this can be fixed by looking at the uid/euid
when trying to find out for which user the program should work.

Here's an excerpt:

namib!joey:~> su -
Password:
namib!root:~# passwd
Changing password for joey
Enter new password:
Re-type new password:
You misspelled it. Password not changed.

Regards,

	Martin

---

From: Guy Maor <[email-masked]>
Date: Fri, 7 Jun 1996 16:48:46 -0500 (CDT)

> when trying to find out for which user the program should work.

Actually this isn't a bug.  If you want to change root's passwd, you'll
just have to type 'passwd root' as root.

passwd must find out the login name of the user running the program.
Doing a getpwuid(getuid()) as you suggest won't work if a user has
multiple login names, each with the same user ID.  Looking through the
utmp for ttyname() or doing getenv("LOGNAME") can both be fooled.

So POSIX provides getlogin().  The system keeps track of who's logged
in for you.  But if you su to a user, the old user is still logged in.
This is only a problem if you su to an id=0 account.

(Closing this bug.)

Guy

---

From: Ian Jackson <[email-masked]>
Date: Mon, 10 Jun 96 02:28 BST

Guy Maor writes ("Re: Bug#3244: (no subject)"):
...
> This is only a problem if you su to an id=0 account.

This is not a good explanation.  getlogin() should never return a
username whose uid is not the current ruid.

This is therefore a libc bug; I'm reopening it and assigning it to
libc (that is to say, I'm sending the message now that will reopen it
when the bug system is sorted out again).

Ian.