Ubuntu

Move "admin" group to "sudo"

Reported by Doug McMahon on 2011-11-23
58
This bug affects 8 people
Affects Status Importance Assigned to Milestone
Release Notes for Ubuntu
Undecided
Unassigned
accountsservice (Ubuntu)
Medium
Martin Pitt
Precise
Medium
Martin Pitt
command-not-found (Ubuntu)
Medium
Canonical Foundations Team
Precise
Medium
Canonical Foundations Team
gnome-menus (Ubuntu)
Medium
Martin Pitt
Precise
Medium
Martin Pitt
indicator-cpufreq (Ubuntu)
Undecided
Unassigned
Precise
Undecided
Unassigned
jockey (Ubuntu)
Medium
Unassigned
Precise
Medium
Unassigned
language-selector (Ubuntu)
High
Canonical Desktop Team
Precise
High
Canonical Desktop Team
policykit-1 (Ubuntu)
Critical
Martin Pitt
Precise
Critical
Martin Pitt
policykit-desktop-privileges (Ubuntu)
High
Martin Pitt
Precise
High
Martin Pitt
update-notifier (Ubuntu)
Medium
Martin Pitt
Precise
Medium
Martin Pitt
userconfig (Ubuntu)
Undecided
Jonathan Riddell
Precise
Undecided
Jonathan Riddell

Bug Description

Fresh install from daily today, am unable to do many common admin actions, the 'root' password is requested
Attached orig /etc/group

TEST CASE:
1. Install Ubuntu Desktop, reboot and login
2. Click on the user indicator and select 'User Accounts'
3. On the dialog, click on 'Unlock'

EXPECTED RESULT
A authentication dialog is displayed asking for the user's password

WHAT HAPPENS
The user is prompted for the root password

WORKAROUND
Open a terminal and run the following command:
$ sudo adduser <your_user_name> admin
logout and login

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ubiquity 2.9.4
ProcVersionSignature: Ubuntu 3.1.0-2.3-generic 3.1.0
Uname: Linux 3.1.0-2-generic i686
ApportVersion: 1.26-0ubuntu1
Architecture: i386
Date: Tue Nov 22 20:56:50 2011
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20111122)
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: ubiquity
UpgradeStatus: No upgrade log present (probably fresh install)

Doug McMahon (mc3man) wrote :
Doug McMahon (mc3man) on 2011-11-23
description: updated
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubiquity (Ubuntu):
status: New → Confirmed
Jean-Baptiste Lallement (jibel) wrote :

Thanks for your report. I can confirm this by trying to unlock the settings in 'Time & Date' or 'Users account'
Setting to Critical because a user cannot to any administrative task on a default installation without manually adding the user to the admin group.

Changed in ubiquity (Ubuntu):
importance: Undecided → Critical
milestone: none → precise-alpha-1
status: Confirmed → Triaged
description: updated
affects: ubiquity (Ubuntu Precise) → user-setup (Ubuntu Precise)
Changed in user-setup (Ubuntu Precise):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
tags: added: testcase
Colin Watson (cjwatson) wrote :

This appears to be deliberate. Here's Steve's changelog:

    - Don't set up the admin group or add the user to it; the sudo package
      now always sets up the sudo group on install, so we can as well use
      this group as the admin group. This will be inconsistent with
      previous Ubuntu releases, but consistent with Debian and compatible
      with sudo.

I think, for compatibility, policykit-1's configuration should allow both the admin and sudo groups.

affects: user-setup (Ubuntu Precise) → policykit-1 (Ubuntu Precise)
Changed in policykit-1 (Ubuntu Precise):
assignee: Canonical Foundations Team (canonical-foundations) → Canonical Desktop Team (canonical-desktop-team)
Martin Pitt (pitti) on 2011-11-25
Changed in policykit-1 (Ubuntu Precise):
status: Triaged → In Progress
assignee: Canonical Desktop Team (canonical-desktop-team) → Martin Pitt (pitti)
Martin Pitt (pitti) wrote :

Fixed in Debian packaging git.

Changed in policykit-1 (Ubuntu Precise):
status: In Progress → Fix Committed
Martin Pitt (pitti) on 2011-11-25
Changed in policykit-desktop-privileges (Ubuntu Precise):
status: New → In Progress
importance: Undecided → High
assignee: nobody → Martin Pitt (pitti)
milestone: none → precise-alpha-1
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package policykit-1 - 0.102-2

---------------
policykit-1 (0.102-2) unstable; urgency=low

  * 02_gettext.patch: Explicitly #include <locale.h> to fix non-optimized
    build. Thanks Ivan Krasilnikov for pointing this out.
  * debian/rules: When building on Ubuntu, also consider the "sudo" group as
    administrator, for compatibility with Debian and sudo itself. Keep "admin"
    for existing systems. (LP: #893842)
  * Convert to Multi-Arch and dh compat 9. Thanks Daniel Schaal for the
    patch! (Closes: #636196)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 07:44:09 +0100

Changed in policykit-1 (Ubuntu Precise):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package policykit-desktop-privileges - 0.10

---------------
policykit-desktop-privileges (0.10) precise; urgency=low

  * Group "sudo" is the new "admin", allow both. (LP: #893842)
  * debian/control: Fix overly long line.
  * debian/control: Add recently added privileges to description.
  * debian/control: Bump Standards-Version to 3.9.2, no changes necessary.
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:03:49 +0100

Changed in policykit-desktop-privileges (Ubuntu Precise):
status: In Progress → Fix Released
Martin Pitt (pitti) on 2011-11-25
summary: - installer doesn't add admin username to admin group causing many polkit
- action to request "root" password
+ Move "admin" group to "sudo"
Changed in accountsservice (Ubuntu Precise):
status: New → In Progress
importance: Undecided → Medium
assignee: nobody → Martin Pitt (pitti)
milestone: none → precise-alpha-1
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package accountsservice - 0.6.15-2

---------------
accountsservice (0.6.15-2) unstable; urgency=low

  [ Gunnar Hjalmarsson ]
  * 0009-language-tools.patch: Sort the list of language options, for the
    language chooser in LightDM (LP: #868346).

  [ Martin Pitt ]
  * 0002-create-and-manage-groups-like-on-a-ubuntu-system.patch: Use "sudo"
    group instead of "admin", for Debian/sudo compatibility. However, keep
    recognizing "admin" as administrator, too. (LP: #893842)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:28:18 +0100

Changed in accountsservice (Ubuntu Precise):
status: In Progress → Fix Released
Martin Pitt (pitti) on 2011-11-25
Changed in jockey (Ubuntu Precise):
status: New → In Progress
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Medium
Doug McMahon (mc3man) wrote :

Seems to work out ok, will try a fresh image when this fix is in it.

(user accounts may look 'odd' to people when they see their previously known as "Administrator" now as "Standard" or if creating an add. 'Administrator' user account getting a choice in the various auth popups

Martin Pitt (pitti) wrote :

jockey postinst fixed in bzr.

Changed in jockey (Ubuntu Precise):
assignee: Martin Pitt (pitti) → nobody
status: In Progress → Fix Committed
Martin Pitt (pitti) wrote :

For the record, the change in comment 4 applied to the "user-setup" package.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package jockey - 0.9.5-0ubuntu5

---------------
jockey (0.9.5-0ubuntu5) precise; urgency=low

  * debian/jockey-common.postinst: Move from group "admin" to "sudo".
    (LP: #893842)
 -- Martin Pitt <email address hidden> Fri, 25 Nov 2011 08:52:38 +0100

Changed in jockey (Ubuntu Precise):
status: Fix Committed → Fix Released
Jonathan Riddell (jr) on 2011-11-25
Changed in userconfig (Ubuntu Precise):
assignee: nobody → Jonathan Riddell (jr)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package userconfig - 0.9.0-0ubuntu10

---------------
userconfig (0.9.0-0ubuntu10) precise; urgency=low

  * In debian-changes-0.9.0-0ubuntu5 update admin user to sudo, LP:
    #893842
 -- Jonathan Riddell <email address hidden> Fri, 25 Nov 2011 13:12:17 +0000

Changed in userconfig (Ubuntu Precise):
status: New → Fix Released
Changed in language-selector (Ubuntu Precise):
importance: Undecided → High
status: New → Triaged

Affects language-selector on a fresh Precise installation.

Traceback (most recent call last):
  File "/usr/bin/gnome-language-selector", line 27, in <module>
    options=options)
  File "/usr/lib/python2.7/dist-packages/LanguageSelector/gtk/GtkLanguageSelector.py", line 141, in __init__
    grp.getgrnam("admin")[2] in os.getgroups())
KeyError: 'getgrnam(): name not found: admin'

Changed in language-selector (Ubuntu Precise):
assignee: nobody → Canonical Desktop Team (canonical-desktop-team)
tags: added: rls-mgr-p-tracking
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package language-selector - 0.59

---------------
language-selector (0.59) precise; urgency=low

  * LanguageSelector/gtk/GtkLanguageSelector.py: Fix crash if "admin" group
    does not exist, and also look for membership of "sudo". (LP: #893842)
 -- Martin Pitt <email address hidden> Tue, 29 Nov 2011 14:56:22 +0100

Changed in language-selector (Ubuntu Precise):
status: Triaged → Fix Released
Erick Brunzell (lbsolost) wrote :

@ Jean-Baptiste Lallement,

I'm curious what problems to look for and just how to reproduce the problem.

Does this also effect the creation of a new user account?

Sorry if I'm just being stupid, but I'm just a simple minded end user :^)

As always, thanks for all you do.

Martin Pitt (pitti) wrote :

The GNOEM language selector is completely broken on the current image. No need to reproduce or provide further info. I already uploaded the fix, we'll spin another alpha-1 candiate soon.

tags: added: iso-testing
Erick Brunzell (lbsolost) wrote :

Thanks Martin.

command-not-found also needs a fix. From bug 910481 :

===
To test -
As an admin user run a command for something not installed, the message will be -
To run 'whatever' please ask your administrator to install the package 'whatever'

What should be shown -
The program 'whatever' is currently not installed. You can install it by typing:
sudo apt-get install 'whatever'

confirmed by adding myself back to 'admin' group, then the latter message is shown
===

Changed in command-not-found (Ubuntu Precise):
importance: Undecided → Medium
status: New → Triaged
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.44.1ubuntu3

---------------
command-not-found (0.2.44.1ubuntu3) precise; urgency=low

  * Recognize the 'sudo' group as a valid admin group as well, so that we
    return the correct error message for those with admin access.
    LP: #893842.
 -- Steve Langasek <email address hidden> Mon, 02 Jan 2012 14:47:43 -0800

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released
Doug McMahon (mc3man) wrote :

"This bug was fixed in the package command-not-found - 0.2.44.1ubuntu3"
Sorry to say that on a fresh install with 1/08 image this isn't fixed, using 0.2.45ubuntu2 & also trying 0.2.44.1ubuntu3

Can also be seen on a live session with the ubuntu user, same deal, only the admin group gets proper 'command not found' prompt

Steve Langasek (vorlon) wrote :

confirmed here in testing. reopening.

Changed in command-not-found (Ubuntu Precise):
status: Fix Released → Triaged
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.45ubuntu3

---------------
command-not-found (0.2.45ubuntu3) precise; urgency=low

  * Use the right group name ('sudo', not 'sudoers'). LP: #893842.
 -- Steve Langasek <email address hidden> Thu, 12 Jan 2012 14:21:01 +0100

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released
Doug McMahon (mc3man) wrote :

As far as the new command-not-found - in a current 12.04 install still not working with the upgrade. Tried a purge & install, same thing, still getting the 'ask administrator ...'
(maybe all would be well of a new image that has the upgraded package?

So went ahead & edited the script simply changing the order, ie. -- lines 118-119

 try:
            self.user_can_sudo = grp.getgrnam("sudo")[2] in posix.getgroups() or grp.getgrnam("admin")[2] in posix.getgroups()

Then works as expected, attached terminal progression to show

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/893842

Doug McMahon (mc3man) wrote :

command-not-found still not working as intended. As previously mentioned if you reverse the ordering then it does work (at least in the normal case where the 'Admin' user is only in the sudo group

Changed in command-not-found (Ubuntu Precise):
status: Fix Released → New
Brian Murray (brian-murray) wrote :

@Doug - I've tried recreating this multiple times on different precise systems, that have been upgraded from feisyt and natty (or so), without any luck. Could you possibly test this again? Thanks in advance.

Changed in command-not-found (Ubuntu Precise):
status: New → Incomplete
Krzysztof Klimonda (kklimonda) wrote :

I can confirm that command-not-found 0.2.46ubuntu2 on my precise system (clean install) is still broken.
The problem is this line::
self.user_can_sudo = grp.getgrnam("admin")[2] in posix.getgroups() or grp.getgrnam("sudo")[2] in posix.getgroups()
on clean systems there is no admin group, so first grp.getgrnam("admin") raises KeyError which is then catched and self.user_can_sude is set to False without checking if user is in sudo group.
As mentioned by mc3man in #24 changing the order of grp.getgrnam will fix that because sudo group is always there (and if user is not part of it, admin group will be checked)

Changed in command-not-found (Ubuntu Precise):
status: Incomplete → Triaged
Brian Murray (brian-murray) wrote :

I've confirmed this on a Live CD now.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.2.46ubuntu3

---------------
command-not-found (0.2.46ubuntu3) precise; urgency=low

  * Check for the always-present sudo group first, so that checking for
    'admin' on new installs doesn't raise a key error by mistake.
    LP: #893842.
 -- Steve Langasek <email address hidden> Thu, 09 Feb 2012 14:46:59 -0800

Changed in command-not-found (Ubuntu Precise):
status: Triaged → Fix Released

This bug also affects update-notifier 0.118.1ubuntu1 in precise. It's hard-coded to only launch for members of the admin group. Since there's no admin group in precise, it bails and launches for all users. The problem code is in the in_admin_group() function in update-notifier.c. I'm not sure if it makes more sense to just change this completely from admin to sudo or to check for either group.

Steve Langasek (vorlon) on 2012-03-09
Changed in update-notifier (Ubuntu Precise):
importance: Undecided → Medium
milestone: none → ubuntu-12.04
status: New → Triaged
Martin Pitt (pitti) on 2012-03-10
Changed in update-notifier (Ubuntu Precise):
assignee: nobody → Martin Pitt (pitti)
status: Triaged → In Progress
Martin Pitt (pitti) on 2012-03-11
Changed in update-notifier (Ubuntu Precise):
status: In Progress → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package update-notifier - 0.119ubuntu1

---------------
update-notifier (0.119ubuntu1) precise; urgency=low

  * src/update-notifier.c: Consider both the "sudo" and "admin" groups as
    administrator. (LP: #893842)
 -- Martin Pitt <email address hidden> Sun, 11 Mar 2012 10:29:28 +0100

Changed in update-notifier (Ubuntu Precise):
status: Fix Committed → Fix Released
Artem Popov (artfwo) wrote :

indicator-cpufreq is affected as well. Working as intended with this little patch, please sponsor the upload.

Changed in indicator-cpufreq (Ubuntu Precise):
status: New → Confirmed
Martin Pitt (pitti) wrote :

This change is in the current release notes.

Changed in ubuntu-release-notes:
status: New → Fix Released
Martin Pitt (pitti) wrote :

Thanks Artem! Sponsored.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package indicator-cpufreq - 0.1.4-0ubuntu2

---------------
indicator-cpufreq (0.1.4-0ubuntu2) precise; urgency=low

  * Allow both "sudo" and "admin" groups to change CPU frequency
    to prevent needless password prompts (LP: #893842).
 -- Artem Popov <email address hidden> Wed, 28 Mar 2012 12:18:50 +0700

Changed in indicator-cpufreq (Ubuntu Precise):
status: Confirmed → Fix Released
Martin Pitt (pitti) wrote :

Another instance of this in gnome-menus, will fix.

Changed in gnome-menus (Ubuntu Precise):
assignee: nobody → Martin Pitt (pitti)
importance: Undecided → Medium
status: New → In Progress
Martin Pitt (pitti) wrote :

gnome-menus is fine after all, the "admin" check patch is disabled.

Changed in gnome-menus (Ubuntu Precise):
status: In Progress → Invalid
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers