Bug 28624

Summary:	SDDM: Regular users should now have UIDs >= 1000, yet sddm.conf still accepts those as low as 500
Product:	Mageia	Reporter:	John L. ten Wolde <johnltw>
Component:	RPM Packages	Assignee:	KDE maintainers <kde>
Status:	NEW ---	QA Contact:
Severity:	normal
Priority:	Normal
Version:	8
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	sddm-0.19.0-15.1.mga8.src.rpm	CVE:
Status comment:

Description John L. ten Wolde 2021-03-21 21:29:18 CET

Since Mageia 6 we've embraced the newer paradigm that regular users should be assigned UIDs >= 1000 while UIDs < 1000 should remain reserved for system services.  Yet, on lines 146-150 in /etc/sddm.conf we see:

  ┌────
  │ #### Mageia-specific configuration
  │ 
  │ [Users]
  │ MinimumUid=500
  │ RememberLastUser=true
  └────

Should the MinimumUid here not also be set to 1000?

Comment 1 John L. ten Wolde 2021-03-21 21:31:05 CET

(I had originally raised this concern in Bug 28599 Comment 5)

John L. ten Wolde 2021-03-21 21:47:22 CET

Summary: SDDM: Regular users should now have UIDs >= 1000, yet sddm.conf accepts those as low as 500 => SDDM: Regular users should now have UIDs >= 1000, yet sddm.conf still accepts those as low as 500

Comment 2 Lewis Smith 2021-03-21 22:11:13 CET

Thanks for doing this, John.
The other bug 28599 is really about pure-ftp, but has accumulated responses on this SDDM UID issue; which I copy below:

From c6, lewis:
re SDDM MinimumUid=500 (thanks John for the pointer)
@Aurélien : if this is valid (it is true), should we ask John to raise a specific bug on it? You might have other views.

From c7, Aurélien:
No because of existing installations from at least Mageia 5 or 6 will see no users listed at login prompt.

From c8, tmb:
No, it should be fixed to 1000
from spec
%config(noreplace) %{_sysconfdir}/sddm.conf
which means it will work on upgrades as it wont be replaced, but new installs get the correct new value of 1000

From c9, Pascal:
I am not sure what the right solution is.
For real users, they will have uid >= 1000 and all work as expected, same for system users not allowed to login.
For virtual users it seems it is the UID of the server which is by design a system user < 1000.

Assigning this SDDM bug to the KDE group.
I see the same problem reported on various distros over the last 10 years but with only workarounds...

Assignee: bugsquad => kde