| Summary: | kdesu hang when wrong password is entered in sudo mode. | ||
|---|---|---|---|
| Product: | [Applications] kdesu | Reporter: | dE <de.techno> |
| Component: | general | Assignee: | kdesu bugs tracker <kdesu-bugs-null> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | major | CC: | cfeck, faure, jpalecek, post, thomas.luebking |
| Priority: | NOR | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | Debian testing | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
dE
2012-01-22 10:15:05 UTC
How long does it hang? Usually, sudo forces a delay on wrong passwords, so that you cannot do a fast password attack. (In reply to comment #1) > How long does it hang? Usually, sudo forces a delay on wrong passwords, so that > you cannot do a fast password attack. It hangs forever. Sudo does the delay or PAM (defaults to 3 seconds)? Also if I use 'kdesudo' (a Debian packages), it works fine. It's not reproducible on your case? Can anyone else reproduce this? I've started to get a feeling that this's a Debian problem. No, this's a KDE issue. It's reproducible on Gentoo with kde 4.7 apparently hangs here: #0 0xb7738424 in __kernel_vsyscall () #1 0xb621a85b in read () from /lib/libpthread.so.0 #2 0xb72a969a in KDESu::PtyProcess::readAll(bool) () from /usr/lib/libkdesu.so.5 #3 0xb72a9d4f in KDESu::PtyProcess::readLine(bool) () from /usr/lib/libkdesu.so.5 #4 0xb72af93b in KDESu::SuProcess::ConverseSU(char const*) () from /usr/lib/libkdesu.so.5 #5 0xb72b051b in KDESu::SuProcess::exec(char const*, int) () from /usr/lib/libkdesu.so.5 #6 0xb72b145b in KDESu::SuProcess::checkInstall(char const*) () from /usr/lib/libkdesu.so.5 since this is not a kwin bug i should not remove myself from CC ... *sigh* ... unbelievable ... ... and it continues once the passwd_tries (visudo setting) have failed, so readLine / readAll just is wrong since there's no EOL before that happened. Can there be any workarounds for this? (In reply to comment #10) > Can there be any workarounds for this? Only by setting passwd_tries to one for that account (but that also covers textshell usage) The problem afaics (i don't develop ksudo) is that sudo will probably return an EINTR errno until it's done to keep terminal stuff alive. Best solution i can think of is a sudo runtime switch to set passwd_tries to min(passwd_tries, switch) so you could use "sudo -passwd_tries 1" as backend. Thanks for the temporary fix! Actually, considering this, this's not a bug. It can be stated that by design -passwd_tries 1 is used NOTICE: there is NO such runtime flag, at least not on my sudo. You can ONLY configure this in visudo. I only suggested such flag could help. Passing this as kdesu backend command will actually alter the prompt - i've not tried if -as a side effect- this somehow helps kdesu. We need to wait for the kdesu dev. Thanks for the tip! Changing priority to major -- this hinders usability. i'm tempted to simply close this as a duplicate of bug 115898. kdesu was not designed to work with sudo, so any problems arising from this misguided re-purposing are out of scope by definition. you should be using kdesudo instead. patches are welcome, though. ;) (In reply to comment #16) > i'm tempted to simply close this as a duplicate of bug 115898. kdesu was not > designed to work with sudo, so any problems arising from this misguided > re-purposing are out of scope by definition. you should be using kdesudo > instead. patches are welcome, though. ;) But according to the docs, it's designed - http://techbase.kde.org/Projects/kdesu#sudo How can I use kdesudo in kdeapps which use kdesu libraries? This is a problem in Debian; it doesnt even have a binary named kdesu. I'm not a dev. ls /usr/lib/kde4/libexec/kdesu* might be lib64 in your case - i'm however not sure whether you can just replace the binaries to have applications invoke kdesudo instead of kdesu. For the "run krusader as root" case you could just alter the desktop service file. *cough* The provided link btw. also points the various issues regarding the sudo invocation *cough* (In reply to comment #17) > I'm not a dev. > yes, it shows. what you called "the docs" is in fact a "what's wrong with it" list. In that case, this bug should be closed as duplicate. Also, -passwd_tries 1 does not work, the sudo configs have to be altered to just have 1 attempt. I am also plagued by this bug, and it even made me set a root password, which IMHO is nothing but an unnecessary potential security problem.
> you should be using kdesudo instead.
How can we make KDE sue kdesudo for applications like KSystemLog or Synaptic, which have the "run as different user" option checked in KMenuEdit?
Dont use run as a different user, set the command to kdesudo <command>. Ah, that works, thanks. It's a bit inconvenient though since I need to change each item which needs root to run manually. Some central switch would be better, but I guess that can't work since kdesudo is not even part of the SC. I was wondering if there's any way to sync the root's and user's password. Dear Bug Submitter, This bug has been stagnant for a long time. Could you help us out and re-test if the bug is valid in the latest version? I am setting the status to NEEDSINFO pending your response, please change the Status back to REPORTED when you respond. Thank you for helping us make KDE software even better for everyone! Dear Bug Submitter, This is a reminder that this bug has been stagnant for a long time. Could you help us out and re-test if the bug is valid in the latest version? This bug will be moved back to REPORTED Status for manual review later, which may take a while. If you are able to, please lend us a hand. Thank you for helping us make KDE software even better for everyone! *** This bug has been marked as a duplicate of bug 389049 *** |