From kde-bugs-dist  Thu May 20 00:04:00 2010
From: Tim Holy <holy () pcg ! wustl ! edu>
Date: Thu, 20 May 2010 00:04:00 +0000
To: kde-bugs-dist
Subject: [Bug 238253] New: Changing primary group silently deletes group
Message-Id: <bug-238253-17878 () http ! bugs ! kde ! org/>
X-MARC-Message: https://marc.info/?l=kde-bugs-dist&m=127431385917871

https://bugs.kde.org/show_bug.cgi?id=238253

           Summary: Changing primary group silently deletes group
                    membership, causing loss of privileges
           Product: systemsettings
           Version: unspecified
          Platform: unspecified
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: NOR
         Component: kcm_useraccount
        AssignedTo: frans.englich@telia.com
        ReportedBy: holy@pcg.wustl.edu


Version:           1.0 (using 4.4.2 (KDE 4.4.2), Kubuntu packages)
Compiler:          cc
OS:                Linux (i686) release 2.6.32-22-generic

Changing the "primary group" assigned to a user deletes the membership in the
original group, although the GUI claims otherwise. This bug is quite serious,
because it can effectively lock a user out of his/her own machine: if the
user's original primary group is "admin" and there is no other account on the
system with "admin" privileges (e.g., if a root password has not been defined,
as is common in (K)ubuntu systems), then this bug can easily eliminate all
admin privileges from all accounts on the machine. Thus, there is no way to
administer the system without going into a "rescue" mode.

How to reproduce:
1. Open up a konsole, and type "groups username" where username is the name a
of user on the system.
2. Open K menu->System settings->Advanced tab->User management, supply admin
password.
3. Select the user that you used above, and click "Modify"
4. Change the "Primary group" to something different; don't click "Apply" yet.
5. Click the "Privileges & groups" tab. Verify that the new primary group is
checked, and also note that the old primary group is also checked. Now click
"Apply".
6. Go back to the command line, and type "groups username" again. You will note
that---despite what it said in the check list of group membership in the
GUI---the original primary group has been deleted from the list of groups.
[7. If you don't want to mess up your system: before quitting the GUI, repair
the damage by going back to the "Details" tab and restoring the original
primary group. Check everything on the command line to make sure it's right.]

So if "admin" was the primary group, and one exited the GUI after #6, there
would be no way to restore admin privileges without using another account that
does possess admin privileges or booting into single-user mode.

In my view, the "Change primary group" should only present the user with a list
of the groups to which he/she already belongs (rather than the current "show
all groups") and should just change the ranking of the groups within that list.

-- 
Configure bugmail: https://bugs.kde.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.