Move "admin" group to "sudo"

Bug #893842 reported by Doug McMahon
62
This bug affects 9 people
Affects Status Importance Assigned to Milestone
Release Notes for Ubuntu
Fix Released
Undecided
Unassigned
accountsservice (Ubuntu)
Fix Released
Medium
Martin Pitt
Precise
Fix Released
Medium
Martin Pitt
command-not-found (Ubuntu)
Fix Released
Medium
Canonical Foundations Team
Precise
Fix Released
Medium
Canonical Foundations Team
gnome-menus (Ubuntu)
Invalid
Medium
Martin Pitt
Precise
Invalid
Medium
Martin Pitt
indicator-cpufreq (Ubuntu)
Fix Released
Undecided
Unassigned
Precise
Fix Released
Undecided
Unassigned
jockey (Ubuntu)
Fix Released
Medium
Unassigned
Precise
Fix Released
Medium
Unassigned
language-selector (Ubuntu)
Fix Released
High
Canonical Desktop Team
Precise
Fix Released
High
Canonical Desktop Team
policykit-1 (Ubuntu)
Fix Released
Critical
Martin Pitt
Precise
Fix Released
Critical
Martin Pitt
policykit-desktop-privileges (Ubuntu)
Fix Released
High
Martin Pitt
Precise
Fix Released
High
Martin Pitt
update-notifier (Ubuntu)
Fix Released
Medium
Martin Pitt
Precise
Fix Released
Medium
Martin Pitt
userconfig (Ubuntu)
Fix Released
Undecided
Jonathan Riddell
Precise
Fix Released
Undecided
Jonathan Riddell

Bug Description

Fresh install from daily today, am unable to do many common admin actions, the 'root' password is requested
Attached orig /etc/group

TEST CASE:
1. Install Ubuntu Desktop, reboot and login
2. Click on the user indicator and select 'User Accounts'
3. On the dialog, click on 'Unlock'

EXPECTED RESULT
A authentication dialog is displayed asking for the user's password

WHAT HAPPENS
The user is prompted for the root password

WORKAROUND
Open a terminal and run the following command:
$ sudo adduser <your_user_name> admin
logout and login

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ubiquity 2.9.4
ProcVersionSignature: Ubuntu 3.1.0-2.3-generic 3.1.0
Uname: Linux 3.1.0-2-generic i686
ApportVersion: 1.26-0ubuntu1
Architecture: i386
Date: Tue Nov 22 20:56:50 2011
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20111122)
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: ubiquity
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Doug McMahon (mc3man) wrote :
Doug McMahon (mc3man)
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubiquity (Ubuntu):
status: New → Confirmed
Revision history for this message
Jean-Baptiste Lallement (jibel) wrote :

Thanks for your report. I can confirm this by trying to unlock the settings in 'Time & Date' or 'Users account'
Setting to Critical because a user cannot to any administrative task on a default installation without manually adding the user to the admin group.

Changed in ubiquity (Ubuntu):
importance: Undecided → Critical
milestone: none → precise-alpha-1
status: Confirmed → Triaged
description: updated
affects: ubiquity (Ubuntu Precise) → user-setup (Ubuntu Precise)
Changed in user-setup (Ubuntu Precise):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
tags: added: testcase
Revision history for this message
Colin Watson (cjwatson) wrote :

This appears to be deliberate. Here's Steve's changelog:

    - Don't set up the admin group or add the user to it; the sudo package
      now always sets up the sudo group on install, so we can as well use
      this group as the admin group. This will be inconsistent with
      previous Ubuntu releases, but consistent with Debian and compatible
      with sudo.

I think, for compatibility, policykit-1's configuration should allow both the admin and sudo groups.

affects: user-setup (Ubuntu Precise) → policykit-1 (Ubuntu Precise)
Changed in policykit-1 (Ubuntu Precise):
assignee: Canonical Foundations Team (canonical-foundations) → Canonical Desktop Team (canonical-desktop-team)
Martin Pitt (pitti)
Changed in policykit-1 (Ubuntu Precise):
status: Triaged → In Progress
assignee: Canonical Desktop Team (canonical-desktop-team) → Martin Pitt (pitti)
Revision history for this message
Martin Pitt (pitti) wrote :

Fixed in Debian packaging git.

Changed in policykit-1 (Ubuntu Precise):
status: In Progress → Fix Committed
Martin Pitt (pitti)
Changed in policykit-desktop-privileges (Ubuntu Precise):
status: New → In Progress
importance: Undecided → High
assignee: nobody → Martin Pitt (pitti)
milestone: none → precise-alpha-1
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package policykit-1 - 0.102-2

---------------
policykit-1 (0.102-2) unstable; urgency=low

  * 02_gettext.patch: Explicitly #include <locale.h> to fix non-optimized
    build. Thanks Ivan Krasilnikov for pointing this out.
  * debian/rules: When building on Ubuntu, also consider the "sudo" group as
    administrator, for compatibility with Debian and sudo itself. Keep "admin"
    for existing systems. (LP: #893842)
  * Convert to Multi-Arch and dh compat 9. Thanks Daniel Schaal for the
    patch! (Closes: #636196)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 07:44:09 +0100

Changed in policykit-1 (Ubuntu Precise):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package policykit-desktop-privileges - 0.10

---------------
policykit-desktop-privileges (0.10) precise; urgency=low

  * Group "sudo" is the new "admin", allow both. (LP: #893842)
  * debian/control: Fix overly long line.
  * debian/control: Add recently added privileges to description.
  * debian/control: Bump Standards-Version to 3.9.2, no changes necessary.
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:03:49 +0100

Changed in policykit-desktop-privileges (Ubuntu Precise):
status: In Progress → Fix Released
Martin Pitt (pitti)
summary: - installer doesn't add admin username to admin group causing many polkit
- action to request "root" password
+ Move "admin" group to "sudo"
Changed in accountsservice (Ubuntu Precise):
status: New → In Progress
importance: Undecided → Medium
assignee: nobody → Martin Pitt (pitti)
milestone: none → precise-alpha-1
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package accountsservice - 0.6.15-2

---------------
accountsservice (0.6.15-2) unstable; urgency=low

  [ Gunnar Hjalmarsson ]
  * 0009-language-tools.patch: Sort the list of language options, for the
    language chooser in LightDM (LP: #868346).

  [ Martin Pitt ]
  * 0002-create-and-manage-groups-like-on-a-ubuntu-system.patch: Use "sudo"
    group instead of "admin", for Debian/sudo compatibility. However, keep
    recognizing "admin" as administrator, too. (LP: #893842)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:28:18 +0100

Changed in accountsservice (Ubuntu Precise):
status: In Progress → Fix Released
Martin Pitt (pitti)
Changed in jockey (Ubuntu Precise):
status: New → In Progress
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Medium
Revision history for this message
Doug McMahon (mc3man) wrote :

Seems to work out ok, will try a fresh image when this fix is in it.

(user accounts may look 'odd' to people when they see their previously known as "Administrator" now as "Standard" or if creating an add. 'Administrator' user account getting a choice in the various auth popups

Revision history for this message
Martin Pitt (pitti) wrote :

jockey postinst fixed in bzr.

Changed in jockey (Ubuntu Precise):
assignee: Martin Pitt (pitti) → nobody
status: In Progress → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

For the record, the change in comment 4 applied to the "user-setup" package.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package jockey - 0.9.5-0ubuntu5

---------------
jockey (0.9.5-0ubuntu5) precise; urgency=low

  * debian/jockey-common.postinst: Move from group "admin" to "sudo".
    (LP: #893842)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:52:38 +0100

Changed in jockey (Ubuntu Precise):
status: Fix Committed → Fix Released
Jonathan Riddell (jr)
Changed in userconfig (Ubuntu Precise):
assignee: nobody → Jonathan Riddell (jr)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package userconfig - 0.9.0-0ubuntu10

---------------
userconfig (0.9.0-0ubuntu10) precise; urgency=low

  * In debian-changes-0.9.0-0ubuntu5 update admin user to sudo, LP:
    #893842
 -- Jonathan Riddell <email address hidden> Fri, 25 Nov 2011 13:12:17 +0000

Changed in userconfig (Ubuntu Precise):
status: New → Fix Released
Changed in language-selector (Ubuntu Precise):
importance: Undecided → High
status: New → Triaged
Revision history for this message
Jean-Baptiste Lallement (jibel) wrote :

Affects language-selector on a fresh Precise installation.

Traceback (most recent call last):
  File "/usr/bin/gnome-language-selector", line 27, in <module>
    options=options)
  File "/usr/lib/python2.7/dist-packages/LanguageSelector/gtk/GtkLanguageSelector.py", line 141, in __init__
    grp.getgrnam("admin")[2] in os.getgroups())
KeyError: 'getgrnam(): name not found: admin'

Changed in language-selector (Ubuntu Precise):
assignee: nobody → Canonical Desktop Team (canonical-desktop-team)
tags: added: rls-mgr-p-tracking
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package language-selector - 0.59

---------------
language-selector (0.59) precise; urgency=low

  * LanguageSelector/gtk/GtkLanguageSelector.py: Fix crash if "admin" group
    does not exist, and also look for membership of "sudo". (LP: #893842)
 -- Martin Pitt <email address hidden> Tue, 29 Nov 2011 14:56:22 +0100

Changed in language-selector (Ubuntu Precise):
status: Triaged → Fix Released
Revision history for this message
Erick Brunzell (lbsolost) wrote :

@ Jean-Baptiste Lallement,

I'm curious what problems to look for and just how to reproduce the problem.

Does this also effect the creation of a new user account?

Sorry if I'm just being stupid, but I'm just a simple minded end user :^)

As always, thanks for all you do.

Revision history for this message
Martin Pitt (pitti) wrote :

The GNOEM language selector is completely broken on the current image. No need to reproduce or provide further info. I already uploaded the fix, we'll spin another alpha-1 candiate soon.

tags: added: iso-testing
Revision history for this message
Erick Brunzell (lbsolost) wrote :

Thanks Martin.

Revision history for this message
Jean-Baptiste Lallement (jibel) wrote :

command-not-found also needs a fix. From bug 910481 :

===
To test -
As an admin user run a command for something not installed, the message will be -
To run 'whatever' please ask your administrator to install the package 'whatever'

What should be shown -
The program 'whatever' is currently not installed. You can install it by typing:
sudo apt-get install 'whatever'

confirmed by adding myself back to 'admin' group, then the latter message is shown
===

Changed in command-not-found (Ubuntu Precise):
importance: Undecided → Medium
status: New → Triaged
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.44.1ubuntu3

---------------
command-not-found (0.2.44.1ubuntu3) precise; urgency=low

  * Recognize the 'sudo' group as a valid admin group as well, so that we
    return the correct error message for those with admin access.
    LP: #893842.
 -- Steve Langasek <email address hidden> Mon, 02 Jan 2012 14:47:43 -0800

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released
Revision history for this message
Doug McMahon (mc3man) wrote :

"This bug was fixed in the package command-not-found - 0.2.44.1ubuntu3"
Sorry to say that on a fresh install with 1/08 image this isn't fixed, using 0.2.45ubuntu2 & also trying 0.2.44.1ubuntu3

Can also be seen on a live session with the ubuntu user, same deal, only the admin group gets proper 'command not found' prompt

Revision history for this message
Steve Langasek (vorlon) wrote :

confirmed here in testing. reopening.

Changed in command-not-found (Ubuntu Precise):
status: Fix Released → Triaged
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.45ubuntu3

---------------
command-not-found (0.2.45ubuntu3) precise; urgency=low

  * Use the right group name ('sudo', not 'sudoers'). LP: #893842.
 -- Steve Langasek <email address hidden> Thu, 12 Jan 2012 14:21:01 +0100

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released
Revision history for this message
Doug McMahon (mc3man) wrote :

As far as the new command-not-found - in a current 12.04 install still not working with the upgrade. Tried a purge & install, same thing, still getting the 'ask administrator ...'
(maybe all would be well of a new image that has the upgraded package?

So went ahead & edited the script simply changing the order, ie. -- lines 118-119

 try:
            self.user_can_sudo = grp.getgrnam("sudo")[2] in posix.getgroups() or grp.getgrnam("admin")[2] in posix.getgroups()

Then works as expected, attached terminal progression to show

Revision history for this message
Ubuntu QA Website (ubuntuqa) wrote : ISO tracker notification

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/893842

Revision history for this message
Doug McMahon (mc3man) wrote :

command-not-found still not working as intended. As previously mentioned if you reverse the ordering then it does work (at least in the normal case where the 'Admin' user is only in the sudo group

Changed in command-not-found (Ubuntu Precise):
status: Fix Released → New
Revision history for this message
Brian Murray (brian-murray) wrote :

@Doug - I've tried recreating this multiple times on different precise systems, that have been upgraded from feisyt and natty (or so), without any luck. Could you possibly test this again? Thanks in advance.

Changed in command-not-found (Ubuntu Precise):
status: New → Incomplete
Revision history for this message
Krzysztof Klimonda (kklimonda) wrote :

I can confirm that command-not-found 0.2.46ubuntu2 on my precise system (clean install) is still broken.
The problem is this line::
self.user_can_sudo = grp.getgrnam("admin")[2] in posix.getgroups() or grp.getgrnam("sudo")[2] in posix.getgroups()
on clean systems there is no admin group, so first grp.getgrnam("admin") raises KeyError which is then catched and self.user_can_sude is set to False without checking if user is in sudo group.
As mentioned by mc3man in #24 changing the order of grp.getgrnam will fix that because sudo group is always there (and if user is not part of it, admin group will be checked)

Changed in command-not-found (Ubuntu Precise):
status: Incomplete → Triaged
Revision history for this message
Brian Murray (brian-murray) wrote :

I've confirmed this on a Live CD now.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.46ubuntu3

---------------
command-not-found (0.2.46ubuntu3) precise; urgency=low

  * Check for the always-present sudo group first, so that checking for
    'admin' on new installs doesn't raise a key error by mistake.
    LP: #893842.
 -- Steve Langasek <email address hidden> Thu, 09 Feb 2012 14:46:59 -0800

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released
Revision history for this message
Matthew L. Dailey (matthew-l-dailey) wrote :

This bug also affects update-notifier 0.118.1ubuntu1 in precise. It's hard-coded to only launch for members of the admin group. Since there's no admin group in precise, it bails and launches for all users. The problem code is in the in_admin_group() function in update-notifier.c. I'm not sure if it makes more sense to just change this completely from admin to sudo or to check for either group.

Steve Langasek (vorlon)
Changed in update-notifier (Ubuntu Precise):
importance: Undecided → Medium
milestone: none → ubuntu-12.04
status: New → Triaged
Martin Pitt (pitti)
Changed in update-notifier (Ubuntu Precise):
assignee: nobody → Martin Pitt (pitti)
status: Triaged → In Progress
Martin Pitt (pitti)
Changed in update-notifier (Ubuntu Precise):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package update-notifier - 0.119ubuntu1

---------------
update-notifier (0.119ubuntu1) precise; urgency=low

  * src/update-notifier.c: Consider both the "sudo" and "admin" groups as
    administrator. (LP: #893842)
 -- Martin Pitt <email address hidden> Sun, 11 Mar 2012 10:29:28 +0100

Changed in update-notifier (Ubuntu Precise):
status: Fix Committed → Fix Released
Revision history for this message
Artem Popov (artfwo) wrote :

indicator-cpufreq is affected as well. Working as intended with this little patch, please sponsor the upload.

Changed in indicator-cpufreq (Ubuntu Precise):
status: New → Confirmed
Revision history for this message
Martin Pitt (pitti) wrote :

This change is in the current release notes.

Changed in ubuntu-release-notes:
status: New → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Thanks Artem! Sponsored.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package indicator-cpufreq - 0.1.4-0ubuntu2

---------------
indicator-cpufreq (0.1.4-0ubuntu2) precise; urgency=low

  * Allow both "sudo" and "admin" groups to change CPU frequency
    to prevent needless password prompts (LP: #893842).
 -- Artem Popov <email address hidden> Wed, 28 Mar 2012 12:18:50 +0700

Changed in indicator-cpufreq (Ubuntu Precise):
status: Confirmed → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Another instance of this in gnome-menus, will fix.

Changed in gnome-menus (Ubuntu Precise):
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Medium
status: New → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

gnome-menus is fine after all, the "admin" check patch is disabled.

Changed in gnome-menus (Ubuntu Precise):
status: In Progress → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers