Your message dated Thu, 27 Dec 2018 10:26:40 +0000
with message-id <[email protected]>
and subject line Bug#823660: fixed in sysvinit 2.93-2
has caused the Debian Bug report #823660,
regarding initscripts: Restore locked root account access by using sulogin
--force
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
823660: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823660
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: initscripts
Version: 2.88dsf-59.3
Severity: important
Dear Maintainer,
Since sysvinit-utils/util-linux package versions shipped in Debian Stretch
the sulogin program is now provided by util-linux (replacing previously
supplied sulogin implementation from sysvinit-utils).
The Debian sysvinit package used to carry a (buggy) patch against sulogin
which allowed people to log in as root even when the root account is locked.
(Neither sysvinit or util-linux upstreams for sulogin never supported it.)
This patch was not carried over to the util-linux package when switching
to util-linux sulogin implementation in Debian for various reasons primarily:
- the patch had serious bugs
- unconditionally handing out root shells where considered questionable
for some usecases (eg. kiosk mode).
After discussions with util-linux upstream a compromise was found to allow
handing out root shell even with locked root account *only* when the
--force (-e) option is specified.
As far as I've been told the Debian installer creates a locked root account
when people just press enter (without giving a password) at the root
password prompt, which seems reasonably common among users.
That means users has no way to be let in even when following instructions
given by sulogin. The systemd package has been updated to pass the --force
flag. The initscripts package (src:sysvinit) needs equivalent changes to
restore the old status quo (and thus ignoring potential kiosk mode usecase
problems -- kiosk mode users should alter their init scripts and remove
the --force flag to be secure).
Regards,
Andreas Henriksson
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.5.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages initscripts depends on:
ii coreutils 8.25-2
ii debianutils 4.7
ii lsb-base 9.20160110
ii mount 2.28-1
ii sysv-rc 2.88dsf-59.3
ii sysvinit-utils 2.88dsf-59.3
Versions of packages initscripts recommends:
ii e2fsprogs 1.43~WIP.2016.03.15-2
ii psmisc 22.21-2.1+b1
initscripts suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: sysvinit
Source-Version: 2.93-2
We believe that the bug you reported is fixed in the latest version of
sysvinit, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Dmitry Bogatov <[email protected]> (supplier of updated sysvinit package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 27 Dec 2018 09:49:41 +0000
Source: sysvinit
Binary: sysvinit-core sysvinit-utils sysv-rc initscripts bootlogd
Architecture: source
Version: 2.93-2
Distribution: unstable
Urgency: medium
Maintainer: Debian sysvinit maintainers
<[email protected]>
Changed-By: Dmitry Bogatov <[email protected]>
Description:
bootlogd - daemon to log boot messages
initscripts - scripts for initializing and shutting down the system
sysv-rc - System-V-like runlevel change mechanism
sysvinit-core - System-V-like init utilities
sysvinit-utils - System-V-like utilities
Closes: 546401 717356 725970 822753 823660 915159 915671 916624
Changes:
sysvinit (2.93-2) unstable; urgency=medium
.
* Update German translation of debconf templates (Closes: #915159)
+ Thanks: Chris Leick <[email protected]>
* Fix support of /tmp being symbolic link to non-existent directory
(Closes: #915671)
+ Thanks: Serge Belyshev <[email protected]>
+ Thanks: Thorsten Glaser <[email protected]>
* Invoke top-level upstream Makefile from `debian/rules'. This
way VERSION macro is set correctly in source code.
* Update French translation of debconf templates (Closes: #916624)
+ Thanks: Steve Petruzzello <[email protected]>
* Remove misleading commends in `/etc/init.d/rc' (Closes: #717356)
+ Thanks: Алексей Шилин <[email protected]>
* Disable concurrent boot if kernel boot parameter `concurrency=none'
is present (Closes: #725970)
* Re-introduce support for /etc/boot.d directory with scripts
(Closes: #546401)
* Fix bug number typo in changelog (Closes: #823660)
* Do not mask errors in `init-d-script' (Closes: #822753)
Checksums-Sha1:
b008b1860ed8296012616a56ed9fa9af6a4533a0 2769 sysvinit_2.93-2.dsc
a5c7282a0ccf8a9fbfd43ae0e2472fec68610955 128652 sysvinit_2.93-2.debian.tar.xz
Checksums-Sha256:
ba73ac6cfe33eff94de02ea63222c72cfd8aed4f3d7d065ffc84f9ac1ad4c886 2769
sysvinit_2.93-2.dsc
22750c8ad322af38bfe0926288cc534a20fbb55addee2db0b21bb11e4f37bfb6 128652
sysvinit_2.93-2.debian.tar.xz
Files:
542eb2ae3c6a4827b919904aabb2ee81 2769 admin optional sysvinit_2.93-2.dsc
018d1fe0b8043bf8672f7b6f3ed9e33f 128652 admin optional
sysvinit_2.93-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCgAxFiEEhnHVzDbtdH7ktKj4SBLY3qgmEeYFAlwkodsTHGthY3Rpb25A
ZGViaWFuLm9yZwAKCRBIEtjeqCYR5tkmD/47nVZfoBXhBPOntlA9Fahtxh+g1fqL
J0kllw+HOB5F14Zd7t3ATKdJtxayWSz2w5HW6vlYuoQIEC9fTtIEkvx7maed4DIS
epA9W0j3cMh3dAD7dua6LOXEhL0XK3ooGQZg5NSBKGO1lM3qxDFuhTKqklNcNL9i
5pWQ+RLvSiVfuoNYEYJIaad6IwNfhCw+/LS6K/ZLPOacYFuS7zp38MJxTiPYaTCd
svlP1qzFA4Ip/V6FNqp0itKZaxnmESWrxODumz6/dzHx0X90I1OP4T9PJp5Faas0
lZNHLbg57sZY37KIByzF4mkNHgideyqsZ3HQquVSgeNJ5Q7KPvkts5zmEf8m8iVM
uQ/vB3amkORoKrUwk/566m1GcrjAFsb+YMcN9l7lpCi7kdkUn/3RYupQW6fMCQ2+
YrXJMvPGyD7AGxTizZXZ39MIybOkvtWQQm+QY/huYndkuk9xPOXDPO+HEtzmhX8c
KbOdejI2V42TUSBcwaDYfKSOIBoZnIeaqpAvUXcO78ed4zM+pzlF5u4sPjEiBPlU
Ns1/s5gq5n9+jK46GuU5P/Ii7HTrmjrRQMQZ61FHevYKkb7+lWCXB4LoCPyRGiVp
3BXBM66YHV17DMVU3UytBQUPvmiF2zpxIXxNMzkq/jXJG4WWpDlwv+6371lYgyV+
0eL1j1MPso3Zyg==
=W3cd
-----END PGP SIGNATURE-----
--- End Message ---
