Subject: login and NFS home directory w/o root access
To: None <current-users@NetBSD.ORG>
From: Dean Huxley <dean@fsa.ca>
List: current-users
Date: 07/18/1996 13:52:16
I think that login may behave strangely when:

	1) a users home directory is NFS mounted without root access 
	   (ie. the "root=foo.bar.com" export option isn't used)
AND	2) the home directory has no permissions for others (ie. drwxr-x---).
AND	3) root doesn't belong to the group of the users home directory.


In usr.bin/login/login.c:

        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No home directory %s!\n", pwd->pw_dir);
                if (chdir("/"))
                        exit(0);
                pwd->pw_dir = "/";
                (void)printf("Logging in with home = \"/\".\n");
        }

        quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;

This is all done as root (before any setuid/setgid stuff) so the chdir
should fail. (note the 3 conditions above) 

The user will be logged with home = "/" even though the user could do
the chdir and access.

This code should work properly if the effective uid and gid
temporarily switched to the users uid and gid.  It would work even
better if it could be done after the initgroups as well, but then
the quietlog stuff would have to be tweaked.

Unfortunately, I can't test this because my NetBSD drive (a cursed
Quantum Empire 1060) won't spin up anymore.

Here is a simple fix (not the best one) if someone wants to try it:

+	setegid(pwd->pw_gid);
+	seteuid(pwd->pw_uid);

        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No home directory %s!\n", pwd->pw_dir);
                if (chdir("/"))
                        exit(0);
                pwd->pw_dir = "/";
                (void)printf("Logging in with home = \"/\".\n");
        }

        quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;

+	seteuid(0);
+	setegid(0);  /* XXX use a saved gid instead? */


Cheers,

Dean Huxley (dean@fsa.ca)