From owner-freebsd-current Wed Jul 25 19:20:57 2001 Delivered-To: freebsd-current@freebsd.org Received: from obsecurity.dyndns.org (adsl-64-169-104-149.dsl.lsan03.pacbell.net [64.169.104.149]) by hub.freebsd.org (Postfix) with ESMTP id 7699B37B401 for ; Wed, 25 Jul 2001 19:20:46 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id A5CE766E04; Wed, 25 Jul 2001 19:20:45 -0700 (PDT) Date: Wed, 25 Jul 2001 19:20:45 -0700 From: Kris Kennaway To: Sheldon Hearn Cc: current@FreeBSD.org Subject: Re: su root broken in -CURRENT Message-ID: <20010725192044.C3833@xor.obsecurity.org> References: <30911.996110138@axl.seasidesoftware.co.za> <65545.996111975@axl.seasidesoftware.co.za> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="GZVR6ND4mMseVXL/" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <65545.996111975@axl.seasidesoftware.co.za>; from sheldonh@starjuice.net on Thu, Jul 26, 2001 at 03:46:15AM +0200 Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --GZVR6ND4mMseVXL/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 26, 2001 at 03:46:15AM +0200, Sheldon Hearn wrote: >=20 >=20 > On Thu, 26 Jul 2001 03:15:38 +0200, Sheldon Hearn wrote: >=20 > > I've completed a pretty clean crossgrade [1] to -CURRENT and find that > > su is broken. I thought this had been fixed. > >=20 > > I have a virgin rev 1.17 /etc/pam.conf, I'm in group wheel, I built > > world with no funky options, the su binary (built from su rev 1.39) > > really is setuid root and yet I get the amazingly helpful error message: > >=20 > > su: Sorry >=20 > Found it. pam_wheel is a whore. It doesn't use getgid() or getegid(), > but instead grovels through /etc/group manually. >=20 > I'm in group wheel by virtue of the fact that my GID specified in the > passwd file is 0. I don't have to be in /etc/group. >=20 > Unless, of course, I want to su. :-) Isn't this backwards? Code shouldn't be making assumptions about the special meaning of numeric gids. What if you wanted to renumber gid wheel to something else? Kris --GZVR6ND4mMseVXL/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7X358Wry0BWjoQKURAtO2AJ9JLkbLDaZDqyHv/0/vCSjTouWYqwCg9YR8 SUvzwrrYca0j+jCthAjV6Gk= =SYRb -----END PGP SIGNATURE----- --GZVR6ND4mMseVXL/-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message