adduser race conditions

[Christian Ehrhardt]

On Fri, Feb 19, 2021 at 6:19 PM Brent W. Baccala <cosine at freesoft.org> wrote:
>
> Hi -
>
> I've found at least one race condition in the adduser script on Ubuntu 18.
>
> The program searches for an available UID (and GID), then adds the new user with the selected UID/GID numbers without any synchronization, so two near-simultaneous invocations of the program can produce two users with identical GIDs (what I saw), or, presumably, identical UIDs.
>
> Is there a bug/issue tracker somewhere for this program?

Hi Brent,
the upstream for this program is Debian [1][2] for general bugs and/or
feature requests you'd use those.
While the Ubuntu bug tracker [3] would mostly be for issues due to the
Ubuntu Delta or to ask for backports of fixes into active Ubuntu
Releases as part of the SRU process [4].

Do these pointers help enough to enable you to take the next step
reporting [5][6] this?

[1]: https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=yes&src=adduser
[2]: https://salsa.debian.org/debian/adduser
[3]: https://bugs.launchpad.net/ubuntu/+source/adduser
[4]: https://wiki.ubuntu.com/StableReleaseUpdates
[5]: https://www.debian.org/Bugs/Reporting
[6]: https://ubuntu.com/server/docs/reporting-bugs


>     agape
>     brent
>
> --
> Ubuntu-devel-discuss mailing list
> Ubuntu-devel-discuss at lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss



-- 
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd