Subject: Bug#4119: chgrp not detecting error, causing unpredictable results

From: [email-masked] (J.H.M.Dassen)
Date: Mon, 12 Aug 1996 13:05:48 +0200 (MDT)

Package: fileutils
Version: 3.13-1

When running "chgrp" as root, no errors or warnings are given when the
group doesn't exist (e.g. when accidently using "chown"'s user.group
syntax), but the group is changed to a nearly unpredictable value.

Script started on Sat Aug 10 15:36:27 1996
zensunni root 15:36:28 ~/tmp # id
uid=0(root) gid=0(root) groups=0(root)
zensunni root 15:36:32 ~/tmp # touch demo
zensunni root 15:36:37 ~/tmp # ls -l demo
-rw-r--r--   1 root     root            0 Aug 10 15:36 demo
zensunni root 15:36:41 ~/tmp # chgrp an.error demo
zensunni root 15:36:54 ~/tmp # ls -l demo
-rw-r--r--   1 root     sys             0 Aug 10 15:36 demo
zensunni root 15:36:58 ~/tmp # chgrp --help
Usage: chgrp [OPTION]... GROUP FILE...
Change the group membership of each FILE to GROUP.

  -c, --changes           like verbose but report only when a change is made
  -h, --no-dereference    affect symbolic links instead of any referenced file
                          (available only on systems with lchown system call)
  -f, --silent, --quiet   suppress most error messages
  -v, --verbose           output a diagnostic for every file processed
  -R, --recursive         change files and directories recursively
      --help              display this help and exit
      --version           output version information and exit
zensunni root 15:37:06 ~/tmp # chgrp -c an.error demo
group of demo changed to an.error
zensunni root 15:37:26 ~/tmp # ls -l demo
-rw-r--r--   1 root     adm             0 Aug 10 15:36 demo
zensunni root 15:37:30 ~/tmp # chgrp -c -v an.error demo
group of demo changed to an.error
zensunni root 15:37:39 ~/tmp # ls -l demo
-rw-r--r--   1 root     tty             0 Aug 10 15:36 demo
zensunni root 15:37:42 ~/tmp # exit

Script done on Sat Aug 10 15:37:47 1996

Additional information:
- when running "chgrp" as an ordinary user and specifying a non-existant
  group, an error message is likely to be given, e.g.
	zensunni ray 15:41 /tmp> touch blech
	zensunni ray 15:41 /tmp> chgrp blub blech
	chgrp: you are not a member of group `blub': Operation not permitted
	Exit 1
	zensunni ray 15:41 /tmp> grep blub /etc/group
	Exit 1
  A better message would be: `blub': no such group, but at least an error
  is given.

Educated guess of cause:
This is an upstream bug. chgrp's parse_group (chgrp.c:123) is designed
to handle numeric gids too. For this purpose, xstrtoul is called
(line 138) which returns 0 for OK, or an error value (defined in
lib/xstrol.h). Only one of the possible error values (LONGINT_OVERFLOW)
causes chgrp to exit with a fatal error.

This explains why the problem doesn't often manifest itself when
chgrp is run as an ordinary user: ordinary users are members of only
a few groups, and are not allowed to chgrp to a group that they are
not a member of, including numerical gids not in /etc/group. The
interpretation of the "group" argument as a numerical gid is unlikely to
be that of a group of which the user is a member.

Ray
-- 
Cyberspace, a final frontier. These are the voyages of my messages, 
on a lightspeed mission to explore strange new systems and to boldly go
where no data has gone before.