[ILUG] Re: Bug in dowkd.pl tool on dapper

[Niall O Broin]

On 14 May 2008, at 12:55, Florian Weimer wrote:

> * Niall O. Broin:
>
>> This tool fails on Ubuntu dapper (which is not a vulnerable
>> distribution, but I found the problem when testing some keys on a
>> dapper box) when called with the  user  option with no arguments.
>> Instead of looping through all users, instead it repeatedly checks
>> root. It seems that somehow the from_user function is effectively
>> doing a  setpwent .
>
> Interesting.  This seems to be a Perl or libc bug, though.
>
> Does the system use a special NSS configuration?

Hmm - this is definitely odd - here's a trivial test program to show  
the problem:

#!/usr/bin/perl
setpwent;
while (my $name = getpwent) {
   print "Checking user $name\n";
   @junk = getpwnam($name);
}
endpwent;

I've seen this fails on dapper, edgy, etch, RHES4 update 3. It works  
as expected on SLES10, and on OS-X. It definitely seems to be related  
to NSS where it fails. Anywhere I've looked where it fails has had  
either "passwd: files" or
"passwd: files nis"  and it could be made work by replacing that with
"passwd: compat".  However, on SLES10, it works with "either "passwd:  
files" or
"passwd: files nis".

So the subject line is incorrect - there isn't a bug in the tool's  
code per se, but there's certainly something afoot with perl or libc  
which causes the tool to fail very often in the right circumstances.



Kindest regards,



Niall  O Broin