sudo breaks keyring access for normal user

Bug #1163361 reported by ctrl
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
gnupg (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

Version: gpg (GnuPG) 1.4.12 on up-to-date raring

If you delete a public key using sudo (by mistake), you get a security warning about pubring file owner. If you go ahead, the pubring file in you home is then owned by root:root and you have no access to it anymore unless you change owner by hand.

How to reproduce:

gpg --recv <somekey>
sudo gpg --delete-key <somekey>
gpg --recv <somekey>

you get

gpg: impossibile aprire "/home/dario/.gnupg/pubring.gpg"
gpg: keydb_get_keyblock failed: eof
gpg: non è stato trovato un portachiavi scrivibile: eof
gpg: errore nel leggere "[stream]": errore generale

that is something like

gpg: unable to open "/home/dario/.gnupg/pubring.gpg"
gpg: keydb_get_keyblock failed: eof
gpg: no writable keyring found: eof
gpg: error reading "[stream]": generic error

That's clearly fixed by a simple chown, anyway. This is probably because the pubring is entirely rewritten with root privileges, but I'm not sure it's the correct behavior.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnupg (Ubuntu):
status: New → Confirmed
Revision history for this message
Daniel Leidert (dleidert-deactivatedaccount) wrote :

You should probably check sudos manual pages and read about the -H option and sudoers env_* variables.

I'm not convinced, that you found a bug. Therefor setting this to Incomplete unless you provide further information or arguments.

Changed in gnupg (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for gnupg (Ubuntu) because there has been no activity for 60 days.]

Changed in gnupg (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.