opieinfo isn't setuid, whilst opiepasswd is

[Micah Cowan]

opieinfo isn't setuid, even though opiepasswd is. This leads to a situation where any user may change or set his passphrase, seed and sequence number, but is unable to use opieinfo to check what the seed and sequence number are (even though he could use opiepasswd to see this).

[Micah Cowan (micahcowan)]

When I submitted this bug, I was under the mistaken impression that opieinfo would check its real uid to determine who should be able to read whose info. It doesn't do this, and so setuid would be completely inappropriate. Rejecting.

[Chris Cowan (macil)]

I'm having a problem where running opieinfo doesn't work, and I think it's because it isn't root (and /etc/opiekeys is only readable by root). When I run "opieinfo", I get:
Error opening database! (errno = 13)

[Chris Cowan (macil)]

<continued>
And when I run "sudo opieinfo username", it correctly gives me my sequence number and seed.

[Thomas Liebetraut (tommie-lie)]

I have the same "problem" and don't see an issue with opieinfo being setuid root if opiepasswd is:
The information retrieved by opieinfo is not sensitive at all, sequence number and seed are publicly shown to anyone who wants to login as the specified user. The only sensitive data in the OPIE system is the user's passphrase and the keyfile /etc/opiekeys, which should never be world-readable.

[Micah Cowan (micahcowan)]

Again, opiepasswd does _not_ check the user id and act appropriately, so it should _not_ be made setuid, unless that issue is addressed, as it would allow any user to modify any other user's keys, AFAICT.

However, to address Thomas's comment: opiepasswd modifies an individual user's opie keys, and that user shouldn't necessarily be expected to have sudo access. opiepasswd ought to work analogously to passwd, and allow a user to change his own (opie)passwd information without becoming root.

[Jon Grimm (jgrimm)]

No longer a package in the archive in any supported release.