Bug 238253 - Changing primary group silently deletes group membership, causing loss of privileges
Summary: Changing primary group silently deletes group membership, causing loss of pri...
Status: RESOLVED DOWNSTREAM
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_useraccount (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR normal
Target Milestone: ---
Assignee: Frans Englich
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-05-20 02:03 UTC by Tim Holy
Modified: 2010-05-20 18:46 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Holy 2010-05-20 02:03:59 UTC
Version:           1.0 (using 4.4.2 (KDE 4.4.2), Kubuntu packages)
Compiler:          cc
OS:                Linux (i686) release 2.6.32-22-generic

Changing the "primary group" assigned to a user deletes the membership in the original group, although the GUI claims otherwise. This bug is quite serious, because it can effectively lock a user out of his/her own machine: if the user's original primary group is "admin" and there is no other account on the system with "admin" privileges (e.g., if a root password has not been defined, as is common in (K)ubuntu systems), then this bug can easily eliminate all admin privileges from all accounts on the machine. Thus, there is no way to administer the system without going into a "rescue" mode.

How to reproduce:
1. Open up a konsole, and type "groups username" where username is the name a of user on the system.
2. Open K menu->System settings->Advanced tab->User management, supply admin password.
3. Select the user that you used above, and click "Modify"
4. Change the "Primary group" to something different; don't click "Apply" yet.
5. Click the "Privileges & groups" tab. Verify that the new primary group is checked, and also note that the old primary group is also checked. Now click "Apply".
6. Go back to the command line, and type "groups username" again. You will note that---despite what it said in the check list of group membership in the GUI---the original primary group has been deleted from the list of groups.
[7. If you don't want to mess up your system: before quitting the GUI, repair the damage by going back to the "Details" tab and restoring the original primary group. Check everything on the command line to make sure it's right.]

So if "admin" was the primary group, and one exited the GUI after #6, there would be no way to restore admin privileges without using another account that does possess admin privileges or booting into single-user mode.

In my view, the "Change primary group" should only present the user with a list of the groups to which he/she already belongs (rather than the current "show all groups") and should just change the ranking of the groups within that list.
Comment 1 Christoph Feck 2010-05-20 18:46:40 UTC
The user/group management module in Systemsettings is not part of the KDE Software Compilation, but a Kubuntu specific addon. Please file the bug to https://bugs.launchpad.net/ubuntu/