[Bug 59485] Can do admin tasks without a password or being in group admin
umarmung at planet.ms
Fri Sep 8 08:42:19 UTC 2006
Public bug reported:
I can use the system-tools without being asked for a password. I can add new users, put them in the admin group etc. without myself being in the admin group. useradd wouldn't work without proper rights though.
I can also set clock with time-admin without proper permissions. (date doesn't allow it) I can remove/add services with service-admin.
The permissions on the executables include no setuid or similar:
-rwxr-xr-x 1 root root 94556 2006-09-06 16:51 /usr/bin/network-admin
-rwxr-xr-x 1 root root 49012 2006-09-06 16:51 /usr/bin/services-admin
-rwxr-xr-x 1 root root 65908 2006-09-06 16:51 /usr/bin/shares-admin
-rwxr-xr-x 1 root root 82640 2006-09-06 16:51 /usr/bin/time-admin
-rwxr-xr-x 1 root root 74744 2006-09-06 16:51 /usr/bin/users-admin
I upgraded this system from dapper to edgy.
** Affects: gnome-system-tools (Ubuntu)
Assignee: Ubuntu Desktop Bugs
Can do admin tasks without a password or being in group admin
More information about the desktop-bugs