User jobs are run with root group

Bug #188141 reported by Håkon A. Hjortland
256
Affects Status Importance Assigned to Milestone
incron (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

With incron 0.5.5-2:
When a user starts a program with incron, the groups of the
process is set to "root" instead of the user's normal groups.

To reproduce the problem:
Create /tmp/incron_script:
----------------------------------------
#!/bin/bash
echo "$(date):" "$(id)" "$@" >> /tmp/incron_script.log
----------------------------------------
chmod 700 /tmp/incron_script
mkdir /tmp/testdir
sudo aptitude install incron
whoami | sudo tee -a /etc/incron.allow
echo '/tmp/testdir IN_ALL_EVENTS /tmp/incron_script $@/$# $%' | incrontab -
sudo /etc/init.d/incron restart
touch /tmp/testdir/foo
cat /tmp/incron_script.log

Actual result:
Fri Feb 1 18:54:02 CET 2008: uid=1000(myusername) gid=1000(myusername) groups=0(root) /tmp/testdir/foo IN_OPEN
Fri Feb 1 18:54:02 CET 2008: uid=1000(myusername) gid=1000(myusername) groups=0(root) /tmp/testdir/foo IN_ATTRIB
Fri Feb 1 18:54:02 CET 2008: uid=1000(myusername) gid=1000(myusername) groups=0(root) /tmp/testdir/foo IN_CLOSE_WRITE

Expected result:
"groups" should contain the groups which the user is in, and definitely not the "root" group.

Revision history for this message
Ansgar Burchardt (aburch) wrote :

Fixed 0.5.7 according to upstream changelog:
0.5.7 2007-09-04
    * manual pages updated - information about symbols (#0000157)
    * a few includes added due to compatibility with GCC 4.3 (#0000158)
    * supplementary group access list initialization added (#0000167)

The only release which still has 0.5.5 is Gutsy.

Kees Cook (kees)
Changed in incron:
status: New → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.