Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd can't handle the process privilege for username startswith number

github.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Systemd can't handle the process privilege for username startswith number

#21

Post by hahainternet »

hug wrote: post #18
lysium wrote: post #2

I don't understand how this could be considered not a bug. Clearly, the unit was intended to run as 0day, not root. I must be missing something.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering.

Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

Re: Systemd can't handle the process privilege for username startswith number

#22

Post by hahainternet »

detaro wrote: post #20
hahainternet wrote: post #17

Earlier quoted context omitted.

Are you reading the same thread as me? He replied explaining precisely why this is an error and received nothing but hate for it, 40 thumbs downs. On the other hand, you come here to uselessly complain and have the temerity to complain that poettering doesn't write exactly the code you want him to write. How do you justify your ridiculous attitude?

Except it's less than clear that this is an "invalid username", as the following comments discuss. (even leaving out things like "defaulting to root")

> Except it's less than clear that this is an "invalid username"

Indeed, and once that was pointed out his response was equally polite and accurate, offering a workaround which keeps everyone happy.

Literally, what more do people expect?

Re: Systemd can't handle the process privilege for username startswith number

#23

Post by darklajid »

detaro wrote: post #20
hahainternet wrote: post #17

Earlier quoted context omitted.

Are you reading the same thread as me? He replied explaining precisely why this is an error and received nothing but hate for it, 40 thumbs downs. On the other hand, you come here to uselessly complain and have the temerity to complain that poettering doesn't write exactly the code you want him to write. How do you justify your ridiculous attitude?

Except it's less than clear that this is an "invalid username", as the following comments discuss. (even leaving out things like "defaulting to root")

Defaulting to root? Spawning a service defaults to .. the current user.

We can argue if User= lines should be validated more carefully or cause hard errors (vs warnings), but if you do not provide a valid User= line, the process will spawn with the current uid (which is 0 for initd).

Re: Systemd can't handle the process privilege for username startswith number

#25

Post by rndgermandude »

hahainternet wrote: post #19
glogla wrote: post #6

Earlier quoted context omitted.

"Trolls" have not forced anythings - just standard systemd developer behavior. They never make mistakes and everything is someone elses fault. Systemd is running something as root because it doesn't like something in configuration file, instead of returning error or running it under the correct user. That's a huge WTF and a possible security issue, but alas. Systemd doesn't make mistakes and everything is someone els…

> "Trolls" have not forced anythings - just standard systemd developer behavior. They've had to delete multiple posts from the thread which are nothing but trolls, hell YOUR post is nothing but a troll.

This is not true, I've seen the issue develop till it was closed. There were like 2 posts removed, 1 might have been trollish, the other(s) were just people voicing displeasure at general systemd dev behavior. That might be offtopic and not polite, but it's not a troll either. And the OP you're replying to falls into that snarky, impolite category too, but is not a troll.

Re: Systemd can't handle the process privilege for username startswith number

#26

Post by Thetawaves »

hahainternet wrote: post #21
hug wrote: post #18

Earlier quoted context omitted.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

While I am largely on the systemd side - that one is easy.

Make User= only accept input that starts with a character. Add another option for Uid= that would only accept numeric digits.

Re: Systemd can't handle the process privilege for username startswith number

#27

Post by garaetjjte »

hahainternet wrote: post #21
hug wrote: post #18

Earlier quoted context omitted.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

>How do you propose that it differentiate between UIDs and user names?

Maybe follow GNU coreutils, prefix ids with + https://www.gnu.org/software/coreutils/manual/html_node/Disa...

Re: Systemd can't handle the process privilege for username startswith number

#28

Post by codefined »

darklajid wrote: post #23
detaro wrote: post #20

Earlier quoted context omitted.

Except it's less than clear that this is an "invalid username", as the following comments discuss. (even leaving out things like "defaulting to root")

Defaulting to root? Spawning a service defaults to .. the current user. We can argue if User= lines should be validated more carefully or cause hard errors (vs warnings), but if you do not provide a valid User= line, the process will spawn with the current uid (which is 0 for initd).

Tempted to say it's a service, and the majority of these will want to run as root instead of any particular user. So in this sense the default makes sense.

Re: Systemd can't handle the process privilege for username startswith number

#29

Post by hahainternet »

garaetjjte wrote: post #27
hahainternet wrote: post #21

Earlier quoted context omitted.

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

>How do you propose that it differentiate between UIDs and user names? Maybe follow GNU coreutils, prefix ids with + https://www.gnu.org/software/coreutils/manual/html_node/Disa...

I wasn't really asking for a suggestion, more pointing out that it isn't some previously solved and agreed upon issue.

It's something that has to be picked, and the parent poster will undoubtedly count as 'arrogance' for choosing a workaround.

Re: Systemd can't handle the process privilege for username startswith number

#30

Post by detaro »

hahainternet wrote: post #22
detaro wrote: post #20

Earlier quoted context omitted.

Except it's less than clear that this is an "invalid username", as the following comments discuss. (even leaving out things like "defaulting to root")

> Except it's less than clear that this is an "invalid username" Indeed, and once that was pointed out his response was equally polite and accurate, offering a workaround which keeps everyone happy. Literally, what more do people expect?

The thing not being closed as "not a bug" before the situation is figured out (e.g. the opener had a user account starting with a 0, so it could be expected input) or clearer context is given (e.g. if systemd had an established policy on what a username is allowed to be, a reference to that)?

While understandable (maintainers are busy people and likely have to deal with a lot of reports that have clear cut answers), it sadly fits into the image people have of them.

I personally think "thumbs down" (since you referenced those) is a completely valid response to that – but to be clear, posting insults or other attacks is not!

Post reply on HN