Bug 12006

Summary:	updating /etc/shadow file with new file locks root password
Product:	Mageia	Reporter:	Andrew S <andybiker>
Component:	RPM Packages	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	major
Priority:	Normal	CC:	mageia, pf, pterjan, rverschelde, thierry.vignaud
Version:	Cauldron
Target Milestone:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Source RPM:	rpmdrake	CVE:
Status comment:
Attachments:	be verbose about ignored .rpmnew files

Description Andrew S 2013-12-16 01:33:58 CET

Description of problem:
Doing a standard prompted update, we have the option to inspect and change the /etc/shadow on new installations.
However, this locks out the root user from MCC and the console.

Version-Release number of selected component (if applicable):


How reproducible:
Accept changes to /etc/shadow on inspect file option

Steps to Reproduce:
1.
2.
3.
console work before and after updating
[andrew@localhost ~]$ su 
Password: 
[root@localhost andrew]# echo "now updating...."
now updating....
[root@localhost andrew]# cp /etc/shadow /etc/shadow.old
[root@localhost andrew]# exit
exit
[andrew@localhost ~]$ su
Password: 
su: Authentication failure
[andrew@localhost ~]$ ls /etc/shadow*
/etc/shadow  /etc/shadow-  /etc/shadow.lock  /etc/shadow.old
[andrew@localhost ~]$ ls /etc/shadow*
/etc/shadow  /etc/shadow-  /etc/shadow.lock  /etc/shadow.old
[andrew@localhost ~]$ cat /etc/shadow
root:*:16053:0:99999:7:::
bin:*:16053:0:99999:7:::
daemon:*:16053:0:99999:7:::
adm:*:16053:0:99999:7:::
lp:*:16053:0:99999:7:::
sync:*:16053:0:99999:7:::
mail:*:16053:0:99999:7:::
news:*:16053:0:99999:7:::
uucp:*:16053:0:99999:7:::
operator:*:16053:0:99999:7:::
games:*:16053:0:99999:7:::
nobody:*:16053:0:99999:7:::
[andrew@localhost ~]$ cat /etc/shadow.old
root:$2a$08$05JNKxRrpVyo.qjYPvkkW.sEnNXgY8LX7hq.fUkFRWdrJVSvrW5CK:16054:0:99999:7:::
bin:*:15850:0:99999:7:::
daemon:*:15850:0:99999:7:::
adm:*:15850:0:99999:7:::
lp:*:15850:0:99999:7:::
sync:*:15850:0:99999:7:::
mail:*:15850:0:99999:7:::
news:*:15850:0:99999:7:::
uucp:*:15850:0:99999:7:::
operator:*:15850:0:99999:7:::
games:*:15850:0:99999:7:::
nobody:*:15850:0:99999:7:::
messagebus:!:16054::::::
avahi:!:16054::::::
avahi-autoipd:!:16054::::::
polkitd:!:16054::::::
colord:!:16054::::::
usbmux:!:16054::::::
rpm:!:16054::::::
rtkit:!:16054::::::
vcsa:!:16054::::::
gdm:!:16054::::::
andrew:$2a$08$t4riv9wx4iI1hejuW4bH1eNn1GkuiJuTA15NlRxT8Xz/fX4C1b63m:16054:0:99999:7:::
mpd:!:16054::::::
lightdm:!:16054::::::
davfs2:!:16054::::::
[andrew@localhost ~]$ su
Password: 
su: Authentication failure
[andrew@localhost ~]$ cat /etc/shadow.lock
cat: /etc/shadow.lock: Permission denied
[andrew@localhost ~]$ cat /etc/shadow-
cat: /etc/shadow-: Permission denied
[andrew@localhost ~]$ 


Reproducible: 

Steps to Reproduce:

Comment 1 Thierry Vignaud 2013-12-16 10:35:15 CET

You should have kept your own file!
Maybe rpmdrake should have a list of know files where a warning should be displayed

CC: (none) => mageia, pterjan, thierry.vignaud

Comment 2 Colin Guthrie 2013-12-16 10:39:24 CET

Could we not create them as %ghost files instead? i.e. install the real files into /usr/share/setup/defaultetc/ and copy them over to /etc if the files are missing? That way they won't get updated thereafter but would still be "owned" by the package. WDYT?

Comment 3 Andrew S 2013-12-16 13:40:46 CET

It's impossible to get back in once the /etc/shadow has been changed. Even rebooting the computer in safe mode took me to a maintenance screen, but my root password was no good, so it is imposible to fix without a live disk.

Comment 4 Colin Guthrie 2013-12-16 13:45:26 CET

FYI: You can typically get in via init=/bin/bash on the kernel command line. The initrd should be responsible for mounting /usr if it's separate and thus this should give you enough to set the root and any user passwords again.

Manuel Hiebel 2013-12-30 02:46:44 CET

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=12064

Comment 5 Thierry Vignaud 2013-12-30 02:55:59 CET

*** Bug 12064 has been marked as a duplicate of this bug. ***

See Also: https://bugs.mageia.org/show_bug.cgi?id=12064 => (none)
CC: (none) => pf

Comment 6 Thierry Vignaud 2013-12-30 02:56:36 CET

This should not happen as this file is in the list of files to ignore...

Source RPM: (none) => rpmdrake

Comment 7 Thierry Vignaud 2013-12-30 03:11:39 CET

Created attachment 4682 [details]
be verbose about ignored .rpmnew files

And indeed with that patch, rpmdrake show it's ignoring those files:

Searching .rpmnew and .rpmsave files...
>> ignoring /etc/sysconfig/harddisks
>> ignoring /etc/adjtime
>> ignoring /etc/crypttab
>> ignoring /etc/modules
>> ignoring /etc/sysconfig/autofsck
>> ignoring /etc/sysconfig/init
>> ignoring /etc/ld.so.conf
>> ignoring /etc/fstab
>> ignoring /etc/group
>> ignoring /etc/gshadow
>> ignoring /etc/hosts
>> ignoring /etc/passwd
>> ignoring /etc/resolv.conf
>> ignoring /etc/shadow
>> ignoring /etc/shells
>> ignoring /etc/sudoers
>> ignoring /etc/sysconfig/saslauthd
>> ignoring /etc/sysconfig/harddrake2/previous_hw
>> ignoring /etc/sysconfig/alsa
>> ignoring /etc/security/fileshare.conf
>> ignoring /etc/sysconfig/installkernel
done.

Comment 8 Rémi Verschelde 2015-03-23 08:28:26 CET

Dup of bug 14266 which is being fixed.

*** This bug has been marked as a duplicate of bug 14266 ***

Status: NEW => RESOLVED
CC: (none) => remi
Resolution: (none) => DUPLICATE