ecryptfs-setup-private creates .ecryptfs dir with wrong permissions when GID is different than UID

Bug #445301 reported by Luis Mondesi
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
eCryptfs
Fix Released
High
Dustin Kirkland 
adduser (Ubuntu)
Invalid
Undecided
Unassigned
ecryptfs-utils (Ubuntu)
Fix Released
High
Dustin Kirkland 

Bug Description

when adding a user with an encrypted home directory passing the group ID from the CLI, the utility fail to set the permissions to the .ecryptfs and .Private directory.

Here is an example:

adduser --uid 1030 --gid 115 --encrypt-home lmondesi
...
chown: invalid group: `lmondesi:lmondesi'
chown: invalid group: `lmondesi:lmondesi'
chown: invalid group: `lmondesi:lmondesi'
chown: invalid group: `lmondesi:lmondesi'
chown: invalid group: `lmondesi:lmondesi'

This causes the permissions for the /home/.ecryptfs/lmondesi/.{ecryptfs,Private} which obviously prevents it from being mounted

lmondesi@zod:/home/.ecryptfs/lmondesi$ ls -la
total 16
drwxr-xr-x 4 root root 4096 2009-10-07 05:30 .
drwxr-xr-x 3 root root 4096 2009-10-07 05:30 ..
drwx------ 2 root root 4096 2009-10-07 05:30 .ecryptfs
drwx------ 2 root root 4096 2009-10-07 05:30 .Private

Related branches

Philip Muškovac (yofel)
affects: ubuntu → ecryptfs-utils (Ubuntu)
Sean Sosik-Hamor (sciri)
Changed in ecryptfs-utils (Ubuntu):
status: New → Confirmed
Revision history for this message
Sean Sosik-Hamor (sciri) wrote :

When creating a new user with a GID different than the UID using adduser --encrypt-home, the GID is not passed at all from adduser to ecryptfs-setup-private:

      if (defined($encrypt_home)) {
        printf gtx("Setting up encryption ...\n") if $verbose;
        &systemcall($ecryptfs_setup_private, '-b', '-u', $new_name);
      }

ecryptfs-setup-private then blindly chowns to $USER:$USER assuming the GID matches the UID:

        chown $USER:$USER "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
        (multiple chowns below this)

sciri@baka:~$ sudo adduser --encrypt-home --gid 2500 testuser
Adding user `testuser' ...
Adding new user `testuser' (1000) with group `warthogs' ...
Creating home directory `/home/testuser' ...
Setting up encryption ...

************************************************************************
YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.
  ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase
THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.
************************************************************************

Done configuring.

chown: invalid group: `testuser:testuser'
chown: invalid group: `testuser:testuser'
chown: invalid group: `testuser:testuser'
chown: invalid group: `testuser:testuser'
chown: invalid group: `testuser:testuser'
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for testuser
Enter the new value, or press ENTER for the default
 Full Name []:
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
Is the information correct? [Y/n] y
sciri@baka:~$ sudo ls -al /home/.ecryptfs/testuser/
total 16
drwxr-xr-x 4 root root 4096 2009-10-08 10:27 .
drwxr-xr-x 3 root root 4096 2009-10-08 10:27 ..
drwx------ 2 root root 4096 2009-10-08 10:27 .ecryptfs
drwx------ 2 root root 4096 2009-10-08 10:27 .Private

Changed in adduser (Ubuntu):
status: New → Confirmed
summary: - ecryptfs-utils creates dir with wrong permissions
+ ecryptfs-setup-private creates .ecryptfs dir with wrong permissions when
+ GID is different than UID
Revision history for this message
Sean Sosik-Hamor (sciri) wrote :

sciri@baka:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu karmic (development branch)
Release: 9.10
Codename: karmic
sciri@baka:~$ apt-cache policy adduser
adduser:
  Installed: 3.110ubuntu6
  Candidate: 3.110ubuntu6
  Version table:
 *** 3.110ubuntu6 0
        500 http://archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status
sciri@baka:~$ apt-cache policy ecryptfs-utils
ecryptfs-utils:
  Installed: 81-0ubuntu1
  Candidate: 81-0ubuntu1
  Version table:
 *** 81-0ubuntu1 0
        500 http://archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

Changed in ecryptfs-utils (Ubuntu):
status: Confirmed → In Progress
importance: Undecided → High
milestone: none → ubuntu-9.10
assignee: nobody → Dustin Kirkland (kirkland)
Changed in ecryptfs:
status: New → In Progress
assignee: nobody → Dustin Kirkland (kirkland)
importance: Undecided → High
Changed in adduser (Ubuntu):
status: Confirmed → Invalid
Changed in ecryptfs:
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ecryptfs-utils - 81-0ubuntu2

---------------
ecryptfs-utils (81-0ubuntu2) karmic; urgency=low

  * src/utils/ecryptfs-setup-private: fix bug where setup-private
    incorrectly assumed that the home/private dir ownerships should
    be owned by USER:USER; instead, default to USER:GROUP, where
    GROUP is the USER's primary group by default, cherry-pick upstream
    r463, LP: #445301

 -- Dustin Kirkland <email address hidden> Wed, 14 Oct 2009 14:20:42 -0500

Changed in ecryptfs-utils (Ubuntu):
status: In Progress → Fix Released
Changed in ecryptfs:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.