ccreds_chkpwd miss setuid

[Guilhem Lettron]

Binary package hint: libpam-ccreds

ccreds_chkpwd must have setuid rights because a program as "gnome-screensaver" must use it.

We use ccreds with an ldap and if computer isn't in the network, the authentification in gnome-screensaver doen't work.

Ther is a old changelog, but this is broken in the karmic package :

libpam-ccreds (4-3) unstable; urgency=low

  * Add a setuid ccreds_chkpwd binary to allow non root programs to verify the
    password. Patch based on http://bugzilla.padl.com/show_bug.cgi?id=227 with
    numerous cleanups. (Closes: #358818)

 -- Guido Guenther <email address hidden> Fri, 26 Oct 2007 16:31:09 +0200

ProblemType: Bug
Architecture: amd64
Date: Tue Nov 10 17:27:50 2009
DistroRelease: Ubuntu 9.10
NonfreeKernelModules: fglrx
Package: libpam-ccreds 10-1
ProcEnviron:
 LANG=fr_FR.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: libpam-ccreds
Uname: Linux 2.6.31-14-generic x86_64

[Karl M. Davis (karlmdavis)]

The need for setuid was also discussed back when the Redhat folks first got ccreds working with screensaver unlocks: https://bugzilla.redhat.com/show_bug.cgi?id=151914

[Franz (franz.pammer)]

Hi Karl.

thanks, this solution works fine

[ralfgro (ubuntu-pirx)]

Are there plans to fix this with an update of the ccreds_chkpwd package?

[Mathias Gug (mathiaz)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. However, I am closing it because the bug has been fixed in the latest development version of Ubuntu - Lucid Lynx.

$ dpkg -c ./libpam-ccreds_10-2_amd64.deb | grep chkpwd
-rwsr-xr-x root/root 10480 2009-11-06 03:17 ./sbin/ccreds_chkpwd

[Mike Javorski (mike-javorski)]

Mathias:

While I appreciate the need to move forward, is it not possible to release the fix for the current stable version (ie. Karmic) as well? Especially if the fix is just installing one file with setuid permissions.