Ubuntu 8.10rc Desktop amd64 - lots of files with gid 999

I tried to reproduce this and couldn't; everything had the ownership it was supposed to have. Perhaps you could attach /var/log/installer/syslog so we can see if there are any clues there?

Hi thanks for your very interessting Bugreport but further Stop please your Report to my Emailaddress: To much mails, Sorry you make me THIC !!!

That is to to to much much, please stopping mails sending for a while to my Email Account!!

Thank you, Fritz Raddatz

--- Colin Watson <email address hidden> schrieb am Fr, 24.10.2008:

> Von: Colin Watson <email address hidden>
> Betreff: [Bug 288479] Re: Ubuntu 8.10rc Desktop amd64 - lots of files with gid 999
> An: <email address hidden>
> Datum: Freitag, 24. Oktober 2008, 6:50
> ** Changed in: ubiquity (Ubuntu)
> Sourcepackagename: None => ubiquity
>
> --
> Ubuntu 8.10rc Desktop amd64 - lots of files with gid 999
> https://bugs.launchpad.net/bugs/288479
> You received this bug notification because you are
> subscribed to
> ubiquity in ubuntu.
>
> Status in “ubiquity” source package in Ubuntu: New
>
> Bug description:
> I reinstalled my laptop with the Ubuntu 8.10 desktop amd64
> cd since it finally seems to be working for resume. While
> setting my laptop back up I noticed something I hadn't
> when just doing the normal iso testing. Several files
> created when setting up the system eg /cdrom , /initrd.img ,
> and various other files under /etc have a GID of 999.
> I'm pretty sure this is a bug somewhere, but I'm not
> sure which package to assign it to, so I am assigning it to
> cjwatson since he deals with the installer.
>
> To find them all do an install and then run 'find /
> -gid 999'

Fritz,

It appears you have subscribed to lots of bugs somehow, you are listed on the side along with a lot of other users. Login to your launchpad account and unsubscribe from the bug reports. I just filed this bug last night so you must be setup somehow to receive new bug reports automatically through something you setup on launchpad.

Chris

The timestamps will jump around an hour at one point in the log it is because I booted off the cd backed up my main partition to another one then did the install after that.

I checked a virtual machine that I installed earlier this week and noticed that some files were indeed owned by group 999. Some examples are /etc/papersize, /etc/popularity-contest.conf and /etc/localtime. Attached is /var/log/installer/syslog from that system.

Fritz - you seem to have subscribed to all ubiquity bug reports. You can unsubscribe at the following link - https://bugs.launchpad.net/ubuntu/+source/ubiquity/+subscribe .

Hi Thank's for Helping!!!

Fritz

--- Chris Cheney <email address hidden> schrieb am Fr, 24.10.2008:

> Von: Chris Cheney <email address hidden>
> Betreff: [Bug 288479] Re: Ubuntu 8.10rc Desktop amd64 - lots of files with gid 999
> An: <email address hidden>
> Datum: Freitag, 24. Oktober 2008, 17:31
> Fritz,
>
> It appears you have subscribed to lots of bugs somehow, you
> are listed
> on the side along with a lot of other users. Login to your
> launchpad
> account and unsubscribe from the bug reports. I just filed
> this bug last
> night so you must be setup somehow to receive new bug
> reports
> automatically through something you setup on launchpad.
>
> Chris
>
> --
> Ubuntu 8.10rc Desktop amd64 - lots of files with gid 999
> https://bugs.launchpad.net/bugs/288479
> You received this bug notification because you are
> subscribed to
> ubiquity in ubuntu.
>
> Status in “ubiquity” source package in Ubuntu:
> Incomplete
>
> Bug description:
> I reinstalled my laptop with the Ubuntu 8.10 desktop amd64
> cd since it finally seems to be working for resume. While
> setting my laptop back up I noticed something I hadn't
> when just doing the normal iso testing. Several files
> created when setting up the system eg /cdrom , /initrd.img ,
> and various other files under /etc have a GID of 999.
> I'm pretty sure this is a bug somewhere, but I'm not
> sure which package to assign it to, so I am assigning it to
> cjwatson since he deals with the installer.
>
> To find them all do an install and then run 'find /
> -gid 999'

Confirmed. I can reproduce this on 20081028.2.

Confirmed, this seems to affect any installation via the "try Ubuntu" route (rather than "install Ubuntu"). The problem is that ubiquity drops privileges, but fails to regain them correctly before reconfiguring certain packages. The affected files are those which are written by the package reconfiguration process.

Some of them will be automatically cleaned up over time and as updates are released. I've categorized them as follows:

daily:
/var/lib/apt/extended_states
/var/lib/apt/cdroms.list
/var/lib/apt/lists/*

any package update:
/var/cache/debconf/config.dat-old
/var/cache/debconf/config.dat
/var/cache/debconf/templates.dat-old
/var/cache/debconf/passwords.dat
/var/cache/debconf/templates.dat
/var/lib/dpkg/status-old
/var/lib/dpkg/available-old
/var/lib/dpkg/status
/var/lib/dpkg/diversions
/var/lib/dpkg/available
/var/lib/dpkg/triggers/Unincorp
/var/lib/dpkg/diversions-old

kernel update:
/initrd.img
/vmlinuz
/boot/vmlinuz-2.6.27-7-generic
/boot/initrd.img-2.6.27-7-generic
/boot/grub
/boot/grub/xfs_stage1_5
/boot/grub/jfs_stage1_5
/boot/grub/minix_stage1_5
/boot/grub/e2fs_stage1_5
/boot/grub/stage1
/boot/grub/reiserfs_stage1_5
/boot/grub/stage2
/boot/grub/default
/boot/grub/device.map
/boot/grub/fat_stage1_5
/boot/grub/installed-version

locales update:
/var/lib/belocs/hashfile.old
/var/lib/belocs/hashfile

various updates:
/var/lib/gconf/debian.defaults/%gconf-tree.xml
/var/cache/ldconfig/aux-cache
/etc/ld.so.cache

tzdata update:
/etc/localtime

don't care:
/var/log/installer
/var/log/installer/partman
/var/log/installer/initial-status.gz

would have to be fixed manually(?):
/etc/papersize
/etc/popularity-contest.conf
/etc/initramfs-tools/conf.d/resume
/etc/fstab
/etc/hosts
/etc/X11/xorg.conf
/etc/default/console-setup
/etc/default/locale
/etc/apt/apt.conf.d/00trustcdrom
/etc/apt/sources.list
/var/lib/locales/supported.d/local
/media/cdrom0
/media/cdrom1
/media/cdrom
/cdrom

This was happening because when ubiquity was regaining privileges it would only set the EUID back to 0, rather than both the EUID and EGID. This bug would not present itself in the "Try Ubuntu" option as SUDO_UID and SUDO_GID were not set, so the installer would not drop privileges in the first place in that case.

This bug was fixed in the package ubiquity - 1.10.10

---------------
ubiquity (1.10.10) intrepid; urgency=low

  [ Evan Dandrea ]
  * Also set the EGID back to 0 when regaining privileges (LP: #288479).

  [ Colin Watson ]
  * Fix permissions on kernel images copied from /cdrom/casper/
    (LP: #290798).

 -- Colin Watson <email address hidden> Wed, 29 Oct 2008 18:51:06 +0000

I've confirmed that it all but one case, the group and other permissions on the files are identical, so there is no security concern even if gid 999 managed to come into use. However, in the process of reviewing these, I noticed the following exception:

 88658 2196 -rw-rw-rw- 1 root 999 2244272 Oct 29 10:15 /boot/vmlinuz-2.6.27-7-generic

and have filed bug 290798 about that.

I'd appreciate it if people could run this on their own machines to check it has no other side-effects

with corrected version

and right xargs :-/

I've uploaded Scott's fixes to my PPA:

deb http://ppa.launchpad.net/mdz/ubuntu intrepid main
deb-src http://ppa.launchpad.net/mdz/ubuntu intrepid main

deb http://ppa.launchpad.net/mdz/ubuntu hardy main
deb-src http://ppa.launchpad.net/mdz/ubuntu hardy main

Setting up base-files (4.0.4ubuntu2.1) ...
find: `/var/cache/fonts': No such file or directory
find: `/var/cache/anthy': No such file or directory
chgrp 0 /boot/grub /boot/grub/reiserfs_stage1_5 /boot/grub/fat_stage1_5 /boot/grub/jfs_stage1_5 /boot/grub/stage1 /boot/grub/xfs_stage1_5 /boot/grub/installed-version /boot/grub/minix_stage1_5 /boot/grub/device.map /boot/grub/stage2 /boot/grub/e2fs_stage1_5 /boot/grub/default /etc/popularity-contest.conf /etc/X11/xorg.conf /etc/initramfs-tools/conf.d/resume /etc/apt/sources.list /etc/apt/apt.conf.d/00trustcdrom /etc/papersize /etc/default/locale /etc/default/console-setup /var/lib/locales/supported.d/local /var/log/installer /var/log/installer/initial-status.gz /var/log/installer/partman
find: `/var/lib/anthy': No such file or directory
chgrp -h 0 /cdrom /media/cdrom
chgrp 0 /media/cdrom0

After installing base-files 4.0.4ubuntu2.1 on an affected Intrepid system, I can confirm that I no longer have any files with gid 999, and furthermore no other file ownership or permissions on my system were changed inappropriately.

base-files/hardy accepted into -proposed, please test and give feedback here. The same update for intrepid will be handled through -security.

The base-files fix has been published for intrepid but didn't get autoclosed by launchpad for some reason. Marking this task fixed-released.

This fix is also in Jaunty now.

I can confirm the fix in hardy-proposed (at least it mostly fixes it).

Right after installing "find / -gid 999" gives 112 locations. After installing base-files from hardy-proposed (and rebooting) I am down to 4 locations:
/media/floppy0
/media/floppy
/dev/.static/dev/mapper
/dev/.static/dev/mapper/control

I can also confirm that, after upgrading from base-files 4.0.1ubuntu5.8.04.2 from hardy-updates to base-files 4.0.1ubuntu5.8.04.3 in hardy-proposed, the number of files with guid 999 is significantly reduced but not eliminated; the ones remaining were the floppy ones listed by Andreas and the symlinks /vmlinuz.old and /initrd.img.old.

base-files copied to hardy-updates.

ubiquity 1.8.13 uploaded to hardy-proposed with the relevant fix.

Accepted ubiquity into hardy-proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

RELEASE: Hardy .2
CD/DVD VARIANT: 32bit Ubuntu Live cd
ISO BUILD: 20090108

This is currently working as expect.

find / -gid 999 Produces a long list of files that all say Permission denied

sudo find / -gid 999 Produces a list of 4 files 3 are /proc/6018/...... No such file or directory and the other is /home/user/.gvfs Permission denied

This bug was fixed in the package ubiquity - 1.8.13

---------------
ubiquity (1.8.13) hardy-proposed; urgency=low

  [ Colin Watson ]
  * Brown-paper-bag bug: open /target/var/log/installer/oem-id for writing
    (LP: #251751).
  * Automatic update of included source packages: base-installer
    1.86ubuntu2.3, console-setup 1.21ubuntu9, grub-installer 1.27ubuntu8.1,
    partman-base 114ubuntu6, partman-target 54ubuntu7, user-setup
    1.16ubuntu6.

  [ Evan Dandrea ]
  * Also set the EGID back to 0 when regaining privileges (LP: #288479).

 -- Colin Watson <email address hidden> Wed, 17 Dec 2008 11:54:00 +0000