dash exits when receiving wall message

[Imre Gergely]

When using "/bin/sh" (dash) as a shell for ssh, or just starting /bin/sh in a terminal, when the shell receives a wall message (from another user or root), it just quits.

How to reproduce:
- start a terminal (xterm, gnome-terminal, etc), usually starts with bash
- from bash run 'sh' command to open a dash shell
- start another terminal, and run: echo "foo" | wall
- the broadcast message appears on both terminals
- in the first terminal you are thrown back to bash, because dash exits

I've tried this on Ubuntu 14.04, 16.04, 18.04 (64bits) latest updates and it's happening on all of them. I've also tried with latest dash from git, compiled on Ubuntu 16.04, same problem, that's why I don't think it's dash's problem.

Also tried on CentOS 7, there is no problem there.

The problem appears this morning (6 February) after updating to latest version of 16.04, 18.04. I also have a box with 16.04 but not the latest updates, and on that box the problem does not happen.

If one uses dash as a login shell, and enters on a remote box with SSH for example, the connection can be terminated by another user simply wall'ing a broadcast message (or a system daemon like NUT). This could be taken as a potential security issue.

[Imre Gergely (cemc)]

I've attached two straces, -bad when dash exits after receiving a wall message, and good when dash does NOT exit after a wall, only after I press Ctrl+D.

[Ubuntu Foundations Team Bug Bot (crichton)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1814905/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

[Seth Arnold (seth-arnold)]

Hello Imre, thanks for the report. I can't reproduce this issue myself, nor could I find anything in the source code that would suggest dash would try to quit. In fact I'm not even sure that dash knows that it's happened.

Here's the tail end of strace output (run on the same terminal as dash, to force intermingling of syscall output and terminal output), showing dash handling a write(1) without trouble, and checking for completed jobs after I hit enter several times:

geteuid() = 1000
getegid() = 1000
rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGINT, {sa_handler=0x55a82089e200, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTERM, {sa_handler=SIG_IGN, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
openat(AT_FDCWD, "/dev/tty", O_RDWR) = 3
fcntl(3, F_DUPFD, 10) = 10
close(3) = 0
fcntl(10, F_SETFD, FD_CLOEXEC) = 0
ioctl(10, TIOCGPGRP, [23306]) = 0
getpgrp() = 23306
rt_sigaction(SIGTSTP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTSTP, {sa_handler=SIG_IGN, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
rt_sigaction(SIGTTOU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTTOU, {sa_handler=SIG_IGN, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
rt_sigaction(SIGTTIN, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTTIN, {sa_handler=SIG_DFL, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7fd3be19df20}, NULL, 8) = 0
setpgid(0, 23308) = 0
ioctl(10, TIOCSPGRP, [23308]) = 0
wait4(-1, 0x7ffcdf89717c, WNOHANG|WSTOPPED, NULL) = -1 ECHILD (No child processes)
write(2, "$ ", 2$ ) = 2
read(0,
Message from sarnold@hunt on pts/13 at 17:41 ...
hello
EOF

"\n", 8192) = 1
wait4(-1, 0x7ffcdf89717c, WNOHANG|WSTOPPED, NULL) = -1 ECHILD (No child processes)
write(2, "$ ", 2$ ) = 2
read(0,
"\n", 8192) = 1
wait4(-1, 0x7ffcdf89717c, WNOHANG|WSTOPPED, NULL) = -1 ECHILD (No child processes)
write(2, "$ ", 2$ ) = 2
read(0, ^C0x55a820aa9a60, 8192) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
--- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} ---
rt_sigprocmask(SIG_SETMASK, [], ~[KILL STOP RTMIN RT_1], 8) = 0
write(2, "\n", 1
) = 1
wait4(-1, 0x7ffcdf89717c, WNOHANG|WSTOPPED, NULL) = -1 ECHILD (No child processes)
write(2, "$ ", 2$ ) = 2
read(0, "", 8192) = 0
write(2, "\n", 1
) ...

[Imre Gergely (cemc)]

Here's a quick demonstration with Ubuntu 18.10 desktop, fresh install in a VirtualBox VM, up-to-date

https://youtu.be/-VSj_ZZjv3w (1min screen capture)

with and without strace.
I've also attached a perf trace output. I've started /bin/sh as root like this:

perf trace -o /tmp/dash-perf-trace.txt /bin/sh

Pressed a couple of enters, did an echo, and then a "wall foo" from another terminal, as normal user.

I'm not saying it's dash's fault, I just didn't know where to open the ticket.

Please let me know if you need anything else.

Thanks!

[Launchpad Janitor (janitor)]

[Expired for dash (Ubuntu) because there has been no activity for 60 days.]