Systemd can't handle the process privilege for username startswith number • Hacker News Board

Re: Systemd can't handle the process privilege for username startswith number

#31

Post by okasaki » Sun, Jul 02, 2017, 9:31 AM UTC

hahainternet wrote: post #21

hug wrote: post #18

Earlier quoted context omitted.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

Use UserName and UserID instead of User?

Re: Systemd can't handle the process privilege for username startswith number

#32

Post by lysium » Sun, Jul 02, 2017, 9:34 AM UTC

hug wrote: post #18

lysium wrote: post #2

I don't understand how this could be considered not a bug. Clearly, the unit was intended to run as 0day, not root. I must be missing something.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

Hm, seems as if this is what I was missing. I was on the sensible side.

Re: Systemd can't handle the process privilege for username startswith number

#33

Post by viraptor » Sun, Jul 02, 2017, 9:35 AM UTC

hahainternet wrote: post #22

detaro wrote: post #20

Earlier quoted context omitted.

Except it's less than clear that this is an "invalid username", as the following comments discuss. (even leaving out things like "defaulting to root")

> Except it's less than clear that this is an "invalid username" Indeed, and once that was pointed out his response was equally polite and accurate, offering a workaround which keeps everyone happy. Literally, what more do people expect?

Strict validation. If some option is not valid, fail loudly. And he still fails to acknowledge this is a security issue. Here's a scenario for you:

You're running a SaaS which spawns restricted demons/containers per customer, separating the users by assigning them local user accounts. One day, user "0zero" registers and their account has access to your whole environment. Would you expect this? Would you not classify this as a security issue?

Re: Systemd can't handle the process privilege for username startswith number

#34

Post by hug » Sun, Jul 02, 2017, 9:37 AM UTC

hahainternet wrote: post #21

hug wrote: post #18

Earlier quoted context omitted.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

By using a different setting name for UIDs and usernames, or by prepending UIDs with a +, or...

That's not the problem, though. The problem is that systemd encounters a username setting, and the workaround decided upon was that if you find an explicitly stated username setting, that the best thing to do in the case of that explicity stated username being something you consider invalid (despite it being completely valid on the largest platform you target) is to throw that statement away and proceed as the highest privileged user on the system, even though the very intent of the username setting is often to restrict privileges. It tells you about it in a log file, though, that you'll definitely see before it's too late!

Even that poorly thought out situation being the status quo isn't the problem. The problem is refusing to consider that this is perhaps not the best workaround, prior to this workaround becoming a de facto standard embedded by practice.

This isn't an us-versus-them thing. It's not about being combative or saying that anyone is wrong or bad. It's about looking for continual improvement.

Re: Systemd can't handle the process privilege for username startswith number

#35

Post by mjw1007 » Sun, Jul 02, 2017, 9:41 AM UTC

zokier wrote: post #16

srett wrote: post #10

I'm less and less surprised by the hate poettering gets. It's like he's deliberately trying to be as arrogant and ignorant as possible. POSIX says usernames starting with a digit should be fine. But because very few utils have more restrictive rules, systemd arbitrarily follows them too, but reacts in the most idiotic way possible if it considers a username invalid. Like last time, when in his opinion, "rm -rf *" sho…

> POSIX says usernames starting with a digit should be fine. I'm not sure if POSIX has any relevance here. Afaik systemd isn't claiming any sort of POSIX compliance, nor is it targeting POSIX systems in general, in fact it is explicitly Linux-only.

In that case the systemd developers ought to have been thinking «usernames beginning with digits do exist in the wild on linux systems, therefore we should support them».

Re: Systemd can't handle the process privilege for username startswith number

#36

Post by srett » Sun, Jul 02, 2017, 9:42 AM UTC

zokier wrote: post #16

srett wrote: post #10

I'm less and less surprised by the hate poettering gets. It's like he's deliberately trying to be as arrogant and ignorant as possible. POSIX says usernames starting with a digit should be fine. But because very few utils have more restrictive rules, systemd arbitrarily follows them too, but reacts in the most idiotic way possible if it considers a username invalid. Like last time, when in his opinion, "rm -rf *" sho…

> POSIX says usernames starting with a digit should be fine. I'm not sure if POSIX has any relevance here. Afaik systemd isn't claiming any sort of POSIX compliance, nor is it targeting POSIX systems in general, in fact it is explicitly Linux-only.

Yes I tried to do research on this on the past. Linux, as in "just the kernel", doesn't care about user name formats as far as I can tell. However, the Linux philosophy goes "try to adhere to POSIX where it makes sense, break it where we think it sucks", which isn't exactly a clear statement, but lead me to conclude that it might make sense to check what posix does, if anything, because everything else is user space, e.g. GNU (coreutils, adduser) and thus isn't tied to Linux. systemd should call into libc and let it deal with the username, so if any of the nsswitch backends think 0day is a valid username and returns a uidnumber, just use it and don't try to be extra clever.

Re: Systemd can't handle the process privilege for username startswith number

#37

Post by viraptor » Sun, Jul 02, 2017, 9:42 AM UTC

zokier wrote: post #13

the_mitsuhiko wrote: post #5

Sadly trolls already forced the issue locked but i feel like a sensible thing to do would be to keep that behavior but change the default user for parsing errors from root to nobody.

I think the problem with that idea is that there is no guarantee that the system actually has a "nobody" user. Uid0 is pretty much guaranteed to exist, others not so much. So in case of invalid User= line, I think root is the only safe fallback.

It's definitely not a safe fallback. It could be just rejected instead.

Re: Systemd can't handle the process privilege for username startswith number

#38

Post by mjw1007 » Sun, Jul 02, 2017, 9:45 AM UTC

hahainternet wrote: post #17

srett wrote: post #10

I'm less and less surprised by the hate poettering gets. It's like he's deliberately trying to be as arrogant and ignorant as possible. POSIX says usernames starting with a digit should be fine. But because very few utils have more restrictive rules, systemd arbitrarily follows them too, but reacts in the most idiotic way possible if it considers a username invalid. Like last time, when in his opinion, "rm -rf *" sho…

Are you reading the same thread as me? He replied explaining precisely why this is an error and received nothing but hate for it, 40 thumbs downs. On the other hand, you come here to uselessly complain and have the temerity to complain that poettering doesn't write exactly the code you want him to write. How do you justify your ridiculous attitude?

In this case there seem to be three bad design decisions:

systemd rejects usernames starting with a digit even though they exist in the wild;

systemd ignores config lines containing values it considers invalid, rather than failing the whole unit;

systemd defaults User to root, rather than making User required.

Any of those might be defensible on their own, but the combination is horrid.

Re: Systemd can't handle the process privilege for username startswith number

#39

Post by mjw1007 » Sun, Jul 02, 2017, 9:47 AM UTC

srett wrote: post #10

I'm less and less surprised by the hate poettering gets. It's like he's deliberately trying to be as arrogant and ignorant as possible. POSIX says usernames starting with a digit should be fine. But because very few utils have more restrictive rules, systemd arbitrarily follows them too, but reacts in the most idiotic way possible if it considers a username invalid. Like last time, when in his opinion, "rm -rf *" sho…

I think you're a bit too harsh.

If you maintain widely-used software, you're going to get a lot of bug reports which are in fact user error, and you don't have a great deal of time to spend on each report.

So it's easy to mistakenly dismiss a report when it contains at least one user error, or even something close to a user error, even when it also exposes a real bug.

(It's less forgivable to continue being loudly wrong once other people have pointed out real problems more clearly.)

Re: Systemd can't handle the process privilege for username startswith number

#40

Post by mjw1007 » Sun, Jul 02, 2017, 9:50 AM UTC

hahainternet wrote: post #21

hug wrote: post #18

Earlier quoted context omitted.

Bugs are when software runs in a way other than the way the software is intended to run by the developer. If you define "usernames starting with numbers" as invalid, and then define the behaviour of unit files with a user directive containing an invalid user to run as root, then the behaviour is as expected, and is not a bug. The fact the software doesn't do what any sensible user would expect is completely irrelevan…

> The fact the software doesn't do what any sensible user would expect is completely irrelevant to Poettering. Logs and error and continues? I think you're confused by Systemd exposing all sorts of frailties of traditional software. How do you propose that it differentiate between UIDs and user names?

It could treat all-digit values differently to values that just start with a digit.