canonical / canonical/authd

shadow-utils show no error when trying to add local user to authd group

Open
#1,374 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

Non-authd users (i.e. the ones defined in `/etc/passwd` and any other NSS modules beside authd's) can't be added to authd groups, because those are only defined in the authd database, not in `/etc/group`. However, both shadow-utils and Debian's `adduser` exit with 0 and without printing any error when trying to add a local user to an authd group:

```
sudo usermod -aG test-group user
echo $?
0
groups user
user : user adm cdrom sudo dip plugdev users lpadmin lxd
```

```
sudo adduser user test-group
info: Adding user `user' to group `test-group' ...
echo $?
0
groups user
user : user adm cdrom sudo dip plugdev users lpadmin lxd
```

I don't think there's anything to fix in authd here, it's expected that local users can't be added to authd groups. It should probably be fixed in shadow-utils that no error is shown. I'm still tracking it here for visibility.

Contributor guide

Open the contributing guide

Research direction

The report points to shadow-utils and Debian's adduser rather than an authd file. Reproduce the usermod and adduser commands with a local user and authd group, then inspect how those tools handle the unavailable group; done means the attempted operation reports an error and returns a nonzero status.

Written by the indexing model from the issue text.

Assessment

Tech stack
debian, linux
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.