From owner-freebsd-stable@FreeBSD.ORG  Mon Jan 17 19:59:51 2005
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5B78B16A4CF
	for <stable@freebsd.org>; Mon, 17 Jan 2005 19:59:51 +0000 (GMT)
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP id CEB0543D48
	for <stable@freebsd.org>; Mon, 17 Jan 2005 19:59:50 +0000 (GMT)
	(envelope-from robert@fledge.watson.org)
Received: from fledge.watson.org (localhost [127.0.0.1])
	by fledge.watson.org (8.13.1/8.13.1) with ESMTP id j0HJxiZ5014456;
	Mon, 17 Jan 2005 14:59:44 -0500 (EST)
	(envelope-from robert@fledge.watson.org)
Received: from localhost (robert@localhost)j0HJxeMH014451;
	Mon, 17 Jan 2005 19:59:44 GMT
	(envelope-from robert@fledge.watson.org)
Date: Mon, 17 Jan 2005 19:59:39 +0000 (GMT)
From: Robert Watson <rwatson@freebsd.org>
X-Sender: robert@fledge.watson.org
To: Ivan Voras <ivoras@fer.hr>
In-Reply-To: <41EBD155.7040309@fer.hr>
Message-ID: <Pine.NEB.3.96L.1050117195804.50371W-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: stable@freebsd.org
Subject: Re: cannot su?
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Jan 2005 19:59:51 -0000

On Mon, 17 Jan 2005, Ivan Voras wrote:

> >>I have a user that's in wheel group. Logging in as root works on the
> >>console, but su-ing from the user just writes 'Sorry', like the
> >>password's wrong. There are no clues in log files.
> > 
> > Make sure /usr/sbin/su is suid root (and /usr isn't mounted nosuid).
> 
> It's stupid of me not to have checked that, but this is a very good
> candidate for more information/verbosity - failure mode was just like
> password/credentials were invalid. 

I've modified the su(1) source in HEAD to print a message if su(1) is
executed without an effective uid of 0 (i.e., as root, or setuid as
another user).  Hopefully this error message will be more suggestive than
"sorry": 

  paprika:~/freebsd/commit/src/usr.bin/su> ./su
  su: not running setuid

Assuming I didn't shoot any feet, I'll MFC this to RELENG_5 in a couple of
weeks.

Robert N M Watson