Weird F17 effect: New gdm-3.4.0.1 presents mysql server account on the login screen

[Joachim Backes]

Anybody sees this too: After applying all F17 updates (including
gnome-3.4... packages), the GDM login window presents the mysql server
account on the login screen. Why that?

Kind regards

-- 
Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;

http://www.rhrk.uni-kl.de/~backes

[Bruno Wolff III]

On Fri, Mar 30, 2012 at 14:59:08 +0200,
   Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
> Anybody sees this too: After applying all F17 updates (including
> gnome-3.4... packages), the GDM login window presents the mysql server
> account on the login screen. Why that? 
Because mysql has a normal shell.

I think the scheme used is better than using just uid.

I also wonder about why some of services have valid shells. I know that
Tom Lane indicated that postgres has a shell intentionally as it helps
to be able to su to postgres to do some tasks. Probably mysql is expected
to be used the same way 9as tom packages both). But there were other ones
that seemed suspect to me. The ones I wasn't using I changed to have
a shell of /sbin/nologin.

[Matthias Clasen]

On Fri, 2012-03-30 at 09:41 -0500, Bruno Wolff III wrote:
>  On Fri, Mar 30, 2012 at 14:59:08 +0200,
>     Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
>  >Anybody sees this too: After applying all F17 updates (including
>  >gnome-3.4... packages), the GDM login window presents the mysql server
>  >account on the login screen. Why that?
>  
>  Because mysql has a normal shell.
>  
>  I think the scheme used is better than using just uid.
>  
>  I also wonder about why some of services have valid shells. I know that
>  Tom Lane indicated that postgres has a shell intentionally as it helps
>  to be able to su to postgres to do some tasks. Probably mysql is expected
>  to be used the same way 9as tom packages both). But there were other ones
>  that seemed suspect to me. The ones I wasn't using I changed to have
>  a shell of /sbin/nologin. 
I think this is pretty clearly a bug of mysql or postgres, or rather, it
is a natural consequence of the decision to make these accounts usable
for login.

Ray and I have discussed various options, but no really satisfactory
solution has appeared so far.

[Ray Strode]

Hi,

----- Original Message -----
>  Anybody sees this too: After applying all F17 updates (including
>  gnome-3.4... packages), the GDM login window presents the mysql
>  server
>  account on the login screen. Why that? 
The issue arised, becase we no longer filter
users less than UID_MIN in /etc/login.defs

See 

https://bugs.freedesktop.org/show_bug.cgi?id=44408

for more backstory.  We made that change because users were disappearing from their user
lists
on upgrades, since the default for UID_MIN changed in Fedora.  We rationalized the change
as legitimate, and the
previous behavior as wrong because UID_MIN is documented only for user creation, not for
user filtering.

I think maybe the solution is to filter out disabled users from the user list.  This is a
little complicated, because
we can't query the system for disabled users, afaik.  We can only do heuristics like
getspnam() and look at sp_pwdp, but I don't think it will cover every case.

Anyway worth thinking about more.

--Ray

[cornel panceac]

2012/3/30 Ray Strode <rstrode(a)redhat.com&gt;

>  Hi,
>
>  ----- Original Message -----
>  > Anybody sees this too: After applying all F17 updates (including
>  > gnome-3.4... packages), the GDM login window presents the mysql
>  > server
>  > account on the login screen. Why that?
>  The issue arised, becase we no longer filter users less than UID_MIN in
>  /etc/login.defs
>
>  See
>
>  https://bugs.freedesktop.org/show_bug.cgi?id=44408
>
>  for more backstory.  We made that change because users were disappearing
>  from their user lists
>  on upgrades, since the default for UID_MIN changed in Fedora.  We
>  rationalized the change as legitimate, and the
>  previous behavior as wrong because UID_MIN is documented only for user
>  creation, not for user filtering.
>
>  I think maybe the solution is to filter out disabled users from the user
>  list.  This is a little complicated, because
>  we can't query the system for disabled users, afaik.  We can only do
>  heuristics like getspnam() and look at sp_pwdp, but I don't think it will
>  cover every case.
>
>  Anyway worth thinking about more.
>
>  why not offer to 'root' user a list of users that can be displayed or not
on gdm? why not filtering out by defaul the famous non-human users, like
mysql and postgresql?

[Ray Strode]

Hi,

>  on gdm? why not filtering out by defaul the famous non-human users,
>  like
>  mysql and postgresql? 
We could do that, but it's not a very scalable or
upstream friendly answer (since different upstreams might have different account names for
these users).

It's something worth considering though.

--Ray

[drago01]

On Fri, Mar 30, 2012 at 11:10 PM, Ray Strode <rstrode(a)redhat.com&gt; wrote:
>  Hi,
>
> > on gdm? why not filtering out by defaul the famous non-human users,
> > like
> > mysql and postgresql?
>  We could do that, but it's not a very scalable or upstream friendly answer (since
> different upstreams might have different account names for these users). 
The current situation isn't a user friendly answer though. So we
should do something about it. If the short term fix is a hardcoded
list so be it.

[Kalev Lember]

On 03/31/2012 12:04 PM, drago01 wrote:
>  On Fri, Mar 30, 2012 at 11:10 PM, Ray Strode
> <rstrode(a)redhat.com&gt; wrote:
> > Hi,
> >
> >> on gdm? why not filtering out by defaul the famous non-human users,
> >> like
> >> mysql and postgresql?
> > We could do that, but it's not a very scalable or upstream friendly answer (since
> different upstreams might have different account names for these users).
>  
>  The current situation isn't a user friendly answer though. So we
>  should do something about it. If the short term fix is a hardcoded
>  list so be it. 
Another short-term hack might be filtering out all users with
UID < 500.

This would make it possible to display human users that have UID
between 500 and 1000 and at the same time, filter out statically
assigned non-human users, e.g. mysql with UID 27.

-- 
Kalev

[Bruno Wolff III]

On Fri, Mar 30, 2012 at 23:29:08 +0300,
   cornel panceac <cpanceac(a)gmail.com&gt; wrote:
> 2012/3/30 Ray Strode <rstrode(a)redhat.com&gt;
>
> > why not offer to 'root' user a list of users that can be displayed or not
> on gdm? why not filtering out by defaul the famous non-human users, like
> mysql and postgresql? 
You can change the shells of these accounts and they won't show up anymore.
If you want to keep the effective shell the same, you can make a sym link
to /bin/sh or /bin/bash and if it isn't in /etc/shells then those accounts
won't show up in the login window.

[Joachim Backes]

On 03/30/2012 11:28 PM, Bruno Wolff III wrote:
>  On Fri, Mar 30, 2012 at 23:29:08 +0300,
>     cornel panceac <cpanceac(a)gmail.com&gt; wrote:
> > 2012/3/30 Ray Strode <rstrode(a)redhat.com&gt;
> >
> >> why not offer to 'root' user a list of users that can be displayed or
> not
> > on gdm? why not filtering out by defaul the famous non-human users, like
> > mysql and postgresql?
>  
>  You can change the shells of these accounts and they won't show up anymore.
>  If you want to keep the effective shell the same, you can make a sym link
>  to /bin/sh or /bin/bash and if it isn't in /etc/shells then those accounts
>  won't show up in the login window. 
Are you sure? I went to /bin, made "ln -s bash mysql-bash" and changed
the login shell for the mysql account in /etc/passwd to /bin/mysql-bash,
but the login for mysql still shows up on the login screen :-)

Kind regards

Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;

http://www.rhrk.uni-kl.de/~backes

[Bruno Wolff III]

On Sat, Mar 31, 2012 at 10:58:03 +0200,
   Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
> Are you sure? I went to /bin, made "ln -s bash mysql-bash" and changed
> the login shell for the mysql account in /etc/passwd to /bin/mysql-bash,
> but the login for mysql still shows up on the login screen :-) 
No I am not sure. I thought the bug for this feature implied they were
going to use /etc/shells with /sbin/nologin black listed. But maybe they
did something else.

I want to try this out anyway, so I can report back what I find.

[Bruno Wolff III]

On Sat, Mar 31, 2012 at 08:36:27 -0500,
   Bruno Wolff III <bruno(a)wolff.to&gt; wrote:
> On Sat, Mar 31, 2012 at 10:58:03 +0200,
>   Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
> >
> >Are you sure? I went to /bin, made "ln -s bash mysql-bash" and changed
> >the login shell for the mysql account in /etc/passwd to /bin/mysql-bash,
> >but the login for mysql still shows up on the login screen :-)
>
> No I am not sure. I thought the bug for this feature implied they were
> going to use /etc/shells with /sbin/nologin black listed. But maybe they
> did something else.
>
> I want to try this out anyway, so I can report back what I find. 
It looks like they aren't checking /etc/shells. I couldn't find the code
they use to build the list. They do appear to be black listing /sbin/nologin.
There are a few accounts that don't have /sbin/nologin as a shell, but
don't show up in the list. I am not sure how those are being filtered.

[Bruno Wolff III]

I found the code used. It is in the accountsservices package, not gdm as 
expected.

There is a list of excluded users and any users with a shell that has 
a basename of false or "nologin" are also excepted.

The list of excluded users is currently:
bin, root, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator, 
nobody, nobody4, noaccess, postgres, pvm, rpm, nfsnobody, pcap

[Joachim Backes]

On 03/31/2012 05:17 PM, Bruno Wolff III wrote:
>  I found the code used. It is in the accountsservices package, not gdm
> as 
>  expected.
>  
>  There is a list of excluded users and any users with a shell that has 
>  a basename of false or "nologin" are also excepted.
>  
>  The list of excluded users is currently:
>  bin, root, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator, 
>  nobody, nobody4, noaccess, postgres, pvm, rpm, nfsnobody, pcap 
Hi Bruno,

thanks for your clarification. So my proposal: why not extend this hard
coded list by a second (dynamic) one administratable by the fedora admin?

Kind regards

-- 
Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;

http://www.rhrk.uni-kl.de/~backes

[Bruno Wolff III]

On Sat, Mar 31, 2012 at 18:40:46 +0200,
   Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
> On 03/31/2012 05:17 PM, Bruno Wolff III wrote:
> > I found the code used. It is in the accountsservices package, not gdm as
> > expected.
> >
> > There is a list of excluded users and any users with a shell that has
> > a basename of false or "nologin" are also excepted.
> >
> > The list of excluded users is currently:
> > bin, root, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator,
> > nobody, nobody4, noaccess, postgres, pvm, rpm, nfsnobody, pcap
>
> Hi Bruno,
>
> thanks for your clarification. So my proposal: why not extend this hard
> coded list by a second (dynamic) one administratable by the fedora admin? 
I think you can as there was code to add more logins to the list. I think
it uses dconf keys to do it, which are a bit of a pain to set, especially
for gdm instead of the current user.

[Matthias Clasen]

On Sat, 2012-03-31 at 12:26 -0500, Bruno Wolff III wrote:
>  On Sat, Mar 31, 2012 at 18:40:46 +0200,
>     Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
>  >On 03/31/2012 05:17 PM, Bruno Wolff III wrote:
>  >> I found the code used. It is in the accountsservices package, not gdm as
>  >> expected.
>  >>
>  >> There is a list of excluded users and any users with a shell that has
>  >> a basename of false or "nologin" are also excepted.
>  >>
>  >> The list of excluded users is currently:
>  >> bin, root, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator,
>  >> nobody, nobody4, noaccess, postgres, pvm, rpm, nfsnobody, pcap
>  >
>  >Hi Bruno,
>  >
>  >thanks for your clarification. So my proposal: why not extend this hard
>  >coded list by a second (dynamic) one administratable by the fedora admin?
>  
>  I think you can as there was code to add more logins to the list. I think
>  it uses dconf keys to do it, which are a bit of a pain to set, especially
>  for gdm instead of the current user. 
No, gdm doesn't currently do its own filtering on top, except for
excluding 'gdm' and uid 0.

[drago01]

On Mon, Apr 2, 2012 at 3:53 PM, Matthias Clasen <mclasen(a)redhat.com&gt; wrote:
>  On Sat, 2012-03-31 at 12:26 -0500, Bruno Wolff III wrote:
> > On Sat, Mar 31, 2012 at 18:40:46 +0200,
> >    Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt; wrote:
> > >On 03/31/2012 05:17 PM, Bruno Wolff III wrote:
> > >> I found the code used. It is in the accountsservices package, not gdm as
> > >> expected.
> > >>
> > >> There is a list of excluded users and any users with a shell that has
> > >> a basename of false or "nologin" are also excepted.
> > >>
> > >> The list of excluded users is currently:
> > >> bin, root, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp,
> operator,
> > >> nobody, nobody4, noaccess, postgres, pvm, rpm, nfsnobody, pcap
> > >
> > >Hi Bruno,
> > >
> > >thanks for your clarification. So my proposal: why not extend this hard
> > >coded list by a second (dynamic) one administratable by the fedora admin?
> >
> > I think you can as there was code to add more logins to the list. I think
> > it uses dconf keys to do it, which are a bit of a pain to set, especially
> > for gdm instead of the current user.
>
>  No, gdm doesn't currently do its own filtering on top, except for
>  excluding 'gdm' and uid 0. 
Discussion seem to have stalled  ... what are we going to do about this?

[Matthias Clasen]

On Sat, 2012-03-31 at 09:57 -0500, Bruno Wolff III wrote:

>  
>  It looks like they aren't checking /etc/shells. I couldn't find the code
>  they use to build the list. They do appear to be black listing /sbin/nologin.
>  There are a few accounts that don't have /sbin/nologin as a shell, but
>  don't show up in the list. I am not sure how those are being filtered. 
'They' are us, so you could just ask. (and stop talking about us in the
3rd person :-)

The code you are looking for is here:
http://cgit.freedesktop.org/accountsservice/tree/src/daemon.c#n156