Your message dated Thu, 3 Nov 2005 20:34:54 -0500
with message-id <[EMAIL PROTECTED]>
and subject line add-shell/remove-shell
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 16 Aug 2004 03:26:14 +0000
>From [EMAIL PROTECTED] Sun Aug 15 20:26:14 2004
Return-path: <[EMAIL PROTECTED]>
Received: from smtp010.tiscali.dk [212.54.64.103]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1BwY8U-0005pn-00; Sun, 15 Aug 2004 20:26:14 -0700
Received: from jbj2.jbj.homelinux.com (62.79.69.37.adsl.he.tiscali.dk
[62.79.69.37])
by smtp010.tiscali.dk (8.12.10/8.12.10) with ESMTP id i7G3Lmxf006156
for <[EMAIL PROTECTED]>; Mon, 16 Aug 2004 05:21:49 +0200 (MEST)
Received: from jbj by jbj2.jbj.homelinux.com with local (Exim 3.35 #1 (Debian))
id 1BwY8Q-0001Vc-00
for <[EMAIL PROTECTED]>; Mon, 16 Aug 2004 05:26:10 +0200
Date: Mon, 16 Aug 2004 05:26:10 +0200
From: Jakob Bohm <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: bash: Please do not depend on passwd at all, bad in chroot etc.
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.28i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
Subject: bash: Please do not depend on passwd at all, bad in chroot etc.
Package: bash
Version: 3.0-5
Severity: normal
bash 2.05b-2-17 added a dependency on the passwd package for the
sole purpose of using add-shell and remove-shell to update
/etc/shells when installing or removing bash.
This has the unfortunate side-effect that it is no longer safe
to install or update bash in chroot jails (like those used for
building packaged for a different Debian dist, but others too)
and similar stripped down installs of Debian. The problem is
greatly increased by the fact that this is a versioned depends
and dpkg/apt does not allow for versioned Provides.
Also note, that in the few weeks that have passed since this
dependency was introduced, both the passwd package and packages
brought in by it (specifically login) have had security bugs of
their own. This emphasizes why an Essential package such as
bash should avoid unneeded dependencies and should not depend on
any package containing daemons or suid executables.
Close examination of the package contents indicates that a
sufficient fix would be to change postrm so the call to
remove-shell becomes conditional in the same way you already did
for add-shell. With that small change to the postrm script, the
dependency on passwd can be dropped completely.
Note: I currently have a large number of chroot jails tracking
different parts of unstable. About half of those are now stuck
at bash-2.05b-2-16 and it would be a real pain for this problem
to affect sarge jails on a permanent basis.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.18jbj3.1.64
Locale: LANG=C, LC_CTYPE=da_DK
Versions of packages bash depends on:
ii base-files 3.1 Debian base system miscellaneous f
ii libc6 2.3.2.ds1-16 GNU C Library: Shared libraries an
ii libncurses5 5.4-4 Shared libraries for terminal hand
ii passwd 1:4.0.3-30 Change and administer password and
-- no debconf information
--
This message is hastily written, please ignore any unpleasant wordings,
do not consider it a binding commitment, even if its phrasing may
indicate so. Its contents may be deliberately or accidentally untrue.
Trademarks and other things belong to their owners, if any.
---------------------------------------
Received: (at 268657-done) by bugs.debian.org; 4 Nov 2005 01:34:55 +0000
>From [EMAIL PROTECTED] Thu Nov 03 17:34:55 2005
Return-path: <[EMAIL PROTECTED]>
Received: from acolyte.scowler.net [216.254.112.45]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EXqTn-0007PH-00; Thu, 03 Nov 2005 17:34:55 -0800
Received: by acolyte.scowler.net (Postfix, from userid 1000)
id B64A270046; Thu, 3 Nov 2005 20:34:54 -0500 (EST)
Date: Thu, 3 Nov 2005 20:34:54 -0500
From: Clint Adams <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: add-shell/remove-shell
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
Version: 2.15
add-shell and remove-shell moved from passwd to debianutils in 2.15.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
