Remove automatically added groups from os-login

Bug #1878654 reported by Steve Beattie on 2020-05-14
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
gce-compute-image-packages (Ubuntu)
Status tracked in Groovy
Xenial
Undecided
Steve Beattie
Bionic
Undecided
Steve Beattie
Eoan
Undecided
Steve Beattie
Focal
Undecided
Steve Beattie
Groovy
Undecided
Steve Beattie

Bug Description

[Impact]

The google_oslogin_control script included in the google-compute-engine-oslogin binary package adds every new user to several unnecessary/unexpected groups. Upstream recommends disabling this behavior.

[Test Case]

Examine the /usr/bin/google_oslogin_control and ensure that the variable
assignment for

  group_conf_entry

in the modify_group_conf() function does not contain any of the following groups:

  dip, plugdev, adm, docker, lxd

[Regression Potential]

Implemented incorrectly, this could break group setup for users on new gce instances. Users may also have to alter configuration management tools that expect users to already have access to e.g. the docker or lxd group by default.

[References]

Upstream PR and commits:

  https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29

  https://github.com/GoogleCloudPlatform/guest-oslogin/commit/50b0fb7b5804c22ef9581e7dc91875801dfa5469

  https://github.com/GoogleCloudPlatform/guest-oslogin/pull/30

  https://github.com/GoogleCloudPlatform/guest-oslogin/commit/88f1ba85e20b3b3a07bfad2eeb723a6b06e41fc8

Steve Beattie (sbeattie) on 2020-05-14
Changed in gce-compute-image-packages (Ubuntu):
assignee: nobody → Steve Beattie (sbeattie)
Steve Beattie (sbeattie) on 2020-05-19
description: updated
Changed in gce-compute-image-packages (Ubuntu Xenial):
assignee: nobody → Steve Beattie (sbeattie)
Changed in gce-compute-image-packages (Ubuntu Bionic):
assignee: nobody → Steve Beattie (sbeattie)
Changed in gce-compute-image-packages (Ubuntu Eoan):
assignee: nobody → Steve Beattie (sbeattie)
Changed in gce-compute-image-packages (Ubuntu Focal):
assignee: nobody → Steve Beattie (sbeattie)
description: updated
description: updated
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gce-compute-image-packages - 20190801-0ubuntu5

---------------
gce-compute-image-packages (20190801-0ubuntu5) groovy; urgency=medium

  * Disable automatic adding of groups to all users (LP: #1878654)
    - d/p/0006-Remove-OS-Login-users-from-admin-groups.-29.patch: remove
      adm, docker, and lxd groups
    - d/p/0007-Remove-local-user-groups-for-OS-Login-users.-30.patch:
      remove dip and plugdev groups

 -- Steve Beattie <email address hidden> Thu, 14 May 2020 15:25:37 -0700

Changed in gce-compute-image-packages (Ubuntu Groovy):
status: New → Fix Released
David Krauser (davidkrauser) wrote :

The updated packages have been verified in GCE and work as expected.

Steve Beattie (sbeattie) wrote :

Thanks, David, for the feedback, marking all versions as verification-done.

tags: added: verification-done-bionic verification-done-eoan verification-done-focal verification-done-xenial
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gce-compute-image-packages - 20190801-0ubuntu4.1

---------------
gce-compute-image-packages (20190801-0ubuntu4.1) focal; urgency=medium

  * Disable automatic adding of groups to all users (LP: #1878654)
    - d/p/0006-Remove-OS-Login-users-from-admin-groups.-29.patch: remove
      adm, docker, and lxd groups
    - d/p/0007-Remove-local-user-groups-for-OS-Login-users.-30.patch:
      remove dip and plugdev groups

 -- Steve Beattie <email address hidden> Thu, 14 May 2020 15:25:37 -0700

Changed in gce-compute-image-packages (Ubuntu Focal):
status: New → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gce-compute-image-packages - 20190801-0ubuntu1.1

---------------
gce-compute-image-packages (20190801-0ubuntu1.1) eoan; urgency=medium

  * Disable automatic adding of groups to all users (LP: #1878654)
    - d/p/0006-Remove-OS-Login-users-from-admin-groups.-29.patch: remove
      adm, docker, and lxd groups
    - d/p/0007-Remove-local-user-groups-for-OS-Login-users.-30.patch:
      remove dip and plugdev groups

 -- Steve Beattie <email address hidden> Thu, 14 May 2020 16:42:42 -0700

Changed in gce-compute-image-packages (Ubuntu Eoan):
status: New → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gce-compute-image-packages - 20190801-0ubuntu1~18.04.1

---------------
gce-compute-image-packages (20190801-0ubuntu1~18.04.1) bionic; urgency=medium

  * Disable automatic adding of groups to all users (LP: #1878654)
    - d/p/0006-Remove-OS-Login-users-from-admin-groups.-29.patch: remove
      adm, docker, and lxd groups
    - d/p/0007-Remove-local-user-groups-for-OS-Login-users.-30.patch:
      remove dip and plugdev groups

 -- Steve Beattie <email address hidden> Thu, 14 May 2020 16:44:15 -0700

Changed in gce-compute-image-packages (Ubuntu Bionic):
status: New → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gce-compute-image-packages - 20190801-0ubuntu1~16.04.1

---------------
gce-compute-image-packages (20190801-0ubuntu1~16.04.1) xenial; urgency=medium

  * Disable automatic adding of groups to all users (LP: #1878654)
    - d/p/0006-Remove-OS-Login-users-from-admin-groups.-29.patch: remove
      adm, docker, and lxd groups
    - d/p/0007-Remove-local-user-groups-for-OS-Login-users.-30.patch:
      remove dip and plugdev groups

 -- Steve Beattie <email address hidden> Thu, 14 May 2020 17:05:31 -0700

Changed in gce-compute-image-packages (Ubuntu Xenial):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers