chowns home directory even if --no-create-home is specified

[Stefan Mruk]

recent upgrades of a number of packages to unbuntu warty some of which were from
external sites chief was cinelerra but convinced that was not the damaging
import it may have been anti virus checker aegis as during a long winded perl
site access instulation my computer went down "power problem not software"
anyway upshot is I appear to have lost my root directory to cupsys ! when
checked in users owner of / is cupsys as user name and 103 as user ID with main
group Ipadmin and shell /bin/false also other groups dialout and Ip *this is
looking suspect". I first suspected a virus when I lost some user permission
control over firefox auto download would not turn off so i redirected it to an
empty CD drive and started looking for AV on my new Ubuntu. situation now is
computer functions but many of the required gnome and root functions will not
opperate. cannot insert menu items package manager will trip up various other
strange happenings. will leave this for you to ponder and try to run clamscan if
I can get near the root "Linux is very new to me"

[Matt Zimmerman (mdz)]

Hmm, so this sent me looking for occurrences of this problem, and I found no
root directories owned by cupsys, but I did find this:

drwxr-xr-x 23 hpojlp lp 4096 2005-02-25 21:35 /

so perhaps there is a bug in hpoj, in addition to whatever caused your cupsys
problem

[Martin Pitt (pitti)]

This seems to be a bug in adduser. Both cupsys and hpoj postinst do

  adduser --system --home / --no-create-home --ingroup lpadmin
--disabled-password cupsys

and

  adduser --quiet --system --home / --no-create-home --ingroup lp
--disabled-password hpojlp

It seems that adduser chown's the home directory although --no-create-home is
specified.

[Martin Pitt (pitti)]

For the records, this does not happen on my machines, too, so maybe it's a bug
of an old adduser version.

[Martin Pitt (pitti)]

Stefan,

please do not bother to try to run any antivirus software. It is next to
impossible that you have a virus on Ubuntu, and I think I understand what
happened to your system. In the meantime, please run

 sudo chown 0:0 /

to fix this problem.

However, neither the Warty nor the Hoary versions of adduser appear to change
the ownership of / if --no-create-home is specified.

Can you please do

  dpkg -s adduser | grep Version:

and put the result here?

Thanks

[Matt Zimmerman (mdz)]

Eek; I think it is better not to use --home /, even if we fix this bug. It is
confusing and dangerous for a user to have the root directory as their home
directory. The user's home directory should be changed to something more safe
on upgrade.

adduser --system does the right thing by default (it does not create a home
directory for the user).

[Martin Pitt (pitti)]

Current adduser should not chmod the home directory if --no-create-home is
specified.

To repair existing damage and correctly install in the future, I prepared the
following updates:

 cupsys (1.1.23-1ubuntu10) hoary; urgency=low
 .
   * debian/cupsys.postinst:
     - Remove "--home /" from adduser invocation; sometimes adduser chowns the
       home directory even if --no-create-home is given.
     - If upgrading from a previous version, chown / to 0:0 to fix the bug from
       previous releases.

 hpoj (0.91-3ubuntu4) hoary; urgency=low
 .
   * debian/postinst:
     - Remove "--home /" from adduser invocation; sometimes adduser chowns the
       home directory even if --no-create-home is given.
     - If upgrading from a previous version, chown / to 0:0 to fix the bug from
       previous releases.

Will upload after preview release.

[Martin Pitt (pitti)]

(In reply to comment #6)
>
> Will upload after preview release.

Done.