Debian Bug report logs - #314727
login: suspend command from su shell fails to return to parent shell

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ned Patterson <ned.patterson@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: login: suspend command from su shell fails to return to parent shell

Date: Fri, 17 Jun 2005 18:21:57 -0700

Package: login
Version: 1:4.0.3-35
Severity: important

After using /bin/su to change to either the super user or another user, 
the bash 'suspend' command fails to work properly.  It does stop the
process, but it fails to return control to the parent shell.  Once
stopped, it moves the cursor to a new line, but does not echo any
characters typed.  Bash 'suspend' command does work correctly from a
new bash process started without the su command.  (i.e. just running
bash from the user prompt.)

The stopped process can be resumed by sending the -CONT signal from
another terminal.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.11.11
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages login depends on:
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libpam-modules              0.76-22      Pluggable Authentication Modules f
ii  libpam-runtime              0.76-22      Runtime support for the PAM librar
ii  libpam0g                    0.76-22      Pluggable Authentication Modules l

login recommends no packages.

Versions of packages login is related to:
ii  reportbug                     3.13       reports bugs in the Debian distrib
pn  totem-gstreamer               <none>     (no description available)

-- no debconf information

Message #10 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Christian Perrier <bubulle@debian.org>

To: Ned Patterson <ned.patterson@gmail.com>, 314727@bugs.debian.org

Cc: Tomasz Kłoczko <kloczek@zie.pg.gda.pl>

Subject: Re: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Sat, 18 Jun 2005 08:39:42 +0200

severity 314727 normal
tags 314727 confirmed
thanks

Quoting Ned Patterson (ned.patterson@gmail.com):
> Package: login
> Version: 1:4.0.3-35
> Severity: important
> 
> After using /bin/su to change to either the super user or another user, 
> the bash 'suspend' command fails to work properly.  It does stop the
> process, but it fails to return control to the parent shell.  Once
> stopped, it moves the cursor to a new line, but does not echo any
> characters typed.  Bash 'suspend' command does work correctly from a
> new bash process started without the su command.  (i.e. just running
> bash from the user prompt.)
> 
> The stopped process can be resumed by sending the -CONT signal from
> another terminal.

I really fail to see why this "has a major effect on the usability of
a package, without rendering it completely unusable to everyone."...:-)

Apart from this, I hope that other shadow package maintainers will be
able to investigate this. I can reproduce what you describe actually.

Tomasz, you also might want to have a look at it. 

Message #19 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Nicolas François <nicolas.francois@centraliens.net>

To: Ned Patterson <ned.patterson@gmail.com>, 314727@bugs.debian.org

Subject: Re: Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Sun, 19 Jun 2005 00:52:12 +0200

Hello,

I can also reproduce it. It is caused by the new setting of CLOSE_SESSIONS
to yes in /etc/login.defs.

To perform CLOSE_SESSIONS, a fork is needed, and when the shell is
suspended, the whole process is not completely suspended and thus the
previous shell (used to su) do not get the focus.

So, setting CLOSE_SESSIONS to no will solve this issue (but won't close
this bug).
I still don't know how to fix this issue with CLOSE_SESSIONS set to yes.


I noted that if "su -" is used, then bash reports:
suspend: cannot suspend a login shell
That may be an hint.


Best Regards,
-- 
Nekral

Message #24 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Alexander Gattin <arg@online.com.ua>

To: 314727@bugs.debian.org

Cc: Ned Patterson <ned.patterson@gmail.com>

Subject: Re: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Sun, 19 Jun 2005 14:50:54 +0300

Hi!

On Sun, Jun 19, 2005 at 12:52:12AM +0200, Nicolas François wrote:
> I can also reproduce it.

Me too, except for "no characters echoed" symptom.

> It is caused by the new setting of CLOSE_SESSIONS
> to yes in /etc/login.defs.

Excellent analysis.
I came to conclusion that suspend returns control to
its parent process, which is "su" in the below
examples:

 4957 ?        S      0:00              \_ xterm
 4958 pts/2    Ss     0:00                  \_ bash
 4961 pts/2    S      0:00                      \_ su -
 4963 pts/2    S      0:00                          \_ -su
 4969 pts/2    R+     0:00                              \_ ps -A f

In the above example `su -` was used, and therefore
child bash is called "-su" because it's treated like
login shell by "dashed su".

 4941 ?        S      0:00              \_ xterm
 4942 pts/1    Ss     0:00              |   \_ bash
 5042 pts/1    S      0:00              |       \_ su
 5044 pts/1    S      0:00              |           \_ bash
 5047 pts/1    R+     0:00              |               \_ ps -A f

This is for `su` without dash -- here you clearly see
where is child bash located WRT parent _shell_.

So, immediate parent of bash would be su and not
parent bash.

> To perform CLOSE_SESSIONS, a fork is needed, and when the shell is
> suspended, the whole process is not completely suspended and thus the
> previous shell (used to su) do not get the focus.

About fork you are right, but for the other I seem
to not understand your point.

> So, setting CLOSE_SESSIONS to no will solve this issue (but won't close
> this bug).

Yes, here we have:

 4941 ?        S      0:01              \_ xterm
 4942 pts/1    Ss     0:00              |   \_ bash
 5063 pts/1    S      0:00              |       \_ bash
 5067 pts/1    R+     0:00              |           \_ ps -A f

Here you can see that parent and child shells don't
have intermediate "su" process between them.

> I still don't know how to fix this issue with CLOSE_SESSIONS set to yes.

Wontfix?

> I noted that if "su -" is used, then bash reports:
> suspend: cannot suspend a login shell
> That may be an hint.

IMHO, this is just a warning that user will be simply
locked on that particular terminal, because login shell
usually is SHLVL==1, i.e. don't have a parent shell.

-- 
WBR,
xrgtn

Message #29 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Tomasz Kłoczko <kloczek@zie.pg.gda.pl>

To: Nicolas François <nicolas.francois@centraliens.net>, 314727@bugs.debian.org

Subject: Re: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Sun, 19 Jun 2005 19:40:27 +0200 (CEST)

[Message part 1 (text/plain, inline)]

On Sun, 19 Jun 2005, Nicolas [iso-8859-1] Fran�ois wrote:

> Hello,
> 
> I can also reproduce it. It is caused by the new setting of CLOSE_SESSIONS
> to yes in /etc/login.defs.
> 
> To perform CLOSE_SESSIONS, a fork is needed, and when the shell is
> suspended, the whole process is not completely suspended and thus the
> previous shell (used to su) do not get the focus.
> 
> So, setting CLOSE_SESSIONS to no will solve this issue (but won't close
> this bug).
> I still don't know how to fix this issue with CLOSE_SESSIONS set to yes.

OK but you probaly also agree it is only kind of simptomatic cure.

IMO using CLOSE_SESSIONS it is kind of "broken design" (in login and also 
in newgrp) and it must be solved by use only one variant of this code 
without use external login.defs::CLOSE_SESSIONS variable.
Probaly on CLOSE_SESSIONS=yes is something missing in current code. 
Question is "what is missing ?".

kloczek
-- 
-----------------------------------------------------------
*Ludzie nie mają problemów, tylko sobie sami je stwarzają*
-----------------------------------------------------------
Tomasz Kłoczko, sys adm @zie.pg.gda.pl|*e-mail: kloczek@rudy.mif.pg.gda.pl*

Message #32 received at 314727-forwarded@bugs.debian.org (full text, mbox, reply):

From: Alexander Gattin <arg@online.com.ua>

To: Tomasz Kłoczko <kloczek@zie.pg.gda.pl>

Cc: 314727-forwarded@bugs.debian.org

Subject: Re: Bug#314727: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Sun, 19 Jun 2005 23:10:59 +0300

Hi!

On Sun, Jun 19, 2005 at 07:40:27PM +0200, Tomasz Kłoczko wrote:
> OK but you probaly also agree it is only kind of simptomatic cure.
> 
> IMO using CLOSE_SESSIONS it is kind of "broken design" (in login and also 
> in newgrp) and it must be solved by use only one variant of this code 
> without use external login.defs::CLOSE_SESSIONS variable.
> Probaly on CLOSE_SESSIONS=yes is something missing in current code. 
> Question is "what is missing ?".

Solution is being developed right now. Please follow
the thread to read my thoughts about the reason.

I think I have found a cure, which is applicable to
upstream, .i.e. it's not a kind of "quick dirty hack",
I hope.

I will add my explanations later, currently you can
read IRC log of my discussion with Nicolas on the
matter:

16:42 < xrgtn> the reasom is that with CLOSE_SESSIONS=yes
16:43 < xrgtn> we have su process _between_ parent she ll and child shell
16:43 < xrgtn> for example:
16:43 < xrgtn> 24943 pts/1    Ss     0:01              |   \_ bash
16:43 < xrgtn>  7410 pts/1    S      0:00              |       \_ su
16:43 < xrgtn>  7412 pts/1    S      0:00              |           \_ bash
16:43 < xrgtn>  7415 pts/1    R+     0:00              |               \_ ps -A f
16:43 < xrgtn> here I make `su` and in new shell run `ps -A f`
16:44 < xrgtn> pid 7410 is su
16:44 < xrgtn> and it's parent of child root shell (pid 7412)
16:44 < xrgtn> and child of parent shell (24943)
16:45 < xrgtn> So when 7412  stops 7410 gets control
16:45 < xrgtn> and not 24943.
16:45 < xrgtn> Do you follow?
16:45 < nekral_> yes
16:45 < xrgtn> When CLOSE_SESSIONS=no
16:45 < xrgtn> su doesn't create and _wait_ for child shell, just exec()s
16:46 < xrgtn> so child shell's image replaces 'su' image.
16:46 < xrgtn> And with CLOSE_SESSIONS=no there will be 'su' between 2 shells.

oops, here I wanted to say that there will be _no_ 'su'
between 2 shells ;)

16:47 < xrgtn> nekral_: IMHO there's no way to impement CLOSE_SESSIONS=yes without having intermediate 'su' process.
16:48 < nekral_> That's also my opinion.
16:48 < xrgtn> But we could wor around the issue by "proxying" of "passing up" the suspend.
16:48 < nekral_> I see what you mean.
16:49 < xrgtn> By handling child's suspend and suspending intermediate su then.
16:49 < xrgtn> We should ask Tomasz for his opinion on this.
16:49 < xrgtn> It's definitely appropriate for upstream.
16:49 < nekral_> Also the SIGCONT must be handled with the same kind of proxy.
16:50 < xrgtn> Yes -- we should pass it down. ;)

P.S. Currently the only problem for me to implement
this is all autoconf-related stuff like RETSIGTYPE
and alike.

-- 
WBR,
xrgtn

Message #37 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Alexander Gattin <arg@online.com.ua>

To: Tomasz Kłoczko <kloczek@zie.pg.gda.pl>, 314727@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#314727: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Mon, 20 Jun 2005 12:26:07 +0300

tags 314727 upstream pending
thanks

Hi!

On Sun, Jun 19, 2005 at 07:40:27PM +0200, Tomasz Kłoczko wrote:
> Probaly on CLOSE_SESSIONS=yes is something missing in current code. 
> Question is "what is missing ?".

Sorry, I checked upstream only 0.5 hour ago. The bug
is fixed there in run_shell function (ripped out of
su.c from sh-utils after the Mandrake pam patch have
been applied) the same way I did in 356th patch.

Differences are: handling of SIGTERM in run_shell,
slightly different loop condition and:
waitpid(-1, ...) instead of waitpid() for specific pid
this also differs with your pre-run_shell() code.

-- 
WBR,
xrgtn

Message #44 received at 314727@bugs.debian.org (full text, mbox, reply):

From: Christian Perrier <bubulle@debian.org>

To: 314727@bugs.debian.org

Subject: Re: Bug#314727: [Pkg-shadow-devel] Bug#314727: login: suspend command from su shell fails to return to parent shell

Date: Mon, 20 Jun 2005 15:50:03 +0200

tags 314727 fixed-upstream
thanks

> Sorry, I checked upstream only 0.5 hour ago. The bug
> is fixed there in run_shell function (ripped out of
> su.c from sh-utils after the Mandrake pam patch have
> been applied) the same way I did in 356th patch.

OK. So patch 356 fixes the problem in out next version and anyway, the
problem is fixed upstream. Hence tagging..:-)

> 
> Differences are: handling of SIGTERM in run_shell,
> slightly different loop condition and:
> waitpid(-1, ...) instead of waitpid() for specific pid
> this also differs with your pre-run_shell() code.


Great job on that one, Alex. ++beer for you

Message #51 received at 314727-close@bugs.debian.org (full text, mbox, reply):

From: Christian Perrier <bubulle@debian.org>

To: 314727-close@bugs.debian.org

Subject: Bug#314727: fixed in shadow 1:4.0.3-36

Date: Tue, 05 Jul 2005 16:02:32 -0400

Source: shadow
Source-Version: 1:4.0.3-36

We believe that the bug you reported is fixed in the latest version of
shadow, which is due to be installed in the Debian FTP archive:

login_4.0.3-36_i386.deb
  to pool/main/s/shadow/login_4.0.3-36_i386.deb
passwd_4.0.3-36_i386.deb
  to pool/main/s/shadow/passwd_4.0.3-36_i386.deb
shadow_4.0.3-36.diff.gz
  to pool/main/s/shadow/shadow_4.0.3-36.diff.gz
shadow_4.0.3-36.dsc
  to pool/main/s/shadow/shadow_4.0.3-36.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 314727@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christian Perrier <bubulle@debian.org> (supplier of updated shadow package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 20 Jun 2005 23:37:56 +0300
Source: shadow
Binary: login passwd
Architecture: source i386
Version: 1:4.0.3-36
Distribution: unstable
Urgency: low
Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
Changed-By: Christian Perrier <bubulle@debian.org>
Description: 
 login      - system login tools
 passwd     - change and administer password and group data
Closes: 75181 78961 87301 109279 192849 219321 244754 245332 248150 256732 261490 266281 269583 276419 286258 286616 287410 288106 288827 290842 298060 298773 304350 309408 312428 312429 312430 312431 312471 314303 314407 314423 314539 314727 315362 315372 315375 315378 315391 315407 315426 315429 315434 315483 315567 315727 315767 315783 315809 315812 315840 315972 316026
Changes: 
 shadow (1:4.0.3-36) unstable; urgency=low
 .
   * Debian specific programs fixes:
     - Re-enable logging and displaying failures on login when login is
       compiled with PAM and when FAILLOG_ENAB is set to yes. And create the
       faillog file if it does not exist on postinst (as on Woody).
       Closes: #192849
     - do not localize login's syslog messages.
   * Debian packaging fixes:
     - Fix FTBFS with new dpkg 1.13 and use a correct dpkg-architecture
       invocation. Closes: #314407
     - Add a comment about potential sensitive information exposure
       when LOG_UNKFAIL_ENAB is set in login.defs
       Closes: #298773
     - Remove limits.5 and limits.conf.5 man pages which do not
       reflect the way we deal with limits in Debian
       Closes: #288106, #244754
     - debian/login.defs:
       - Make SU_PATH and PATH consistent with the values used in /etc/profile
         Closes: #286616
       - Comment the UMASK setting which is more confusing than useful
         as it only affects console logins. Better use pam_umask instead
         Closes: #314539, #248150
       - Add a comment about "appropriate" values for umask
         Closes: #269583
       - Correct the assertion about the variable defined by QMAIL_DIR
         which is MAILDIR, not MAIL
         Closes: #109279
       - Move the PASS_MAX_LEN variable at the end of login.defs as this
         is obsoleted when using PAM
         Closes: #87301
     - debian/passwd.config:
       - Re-enable the password confirmation question at critical priority
         Closes: #304350
       - Do no prompt again for the login name when the two passwords don't
         match while creating a new user
         Closes: #245332
     - debian/add-shell.sh, debian/remove-shell.sh, debian/shadowconfig.sh,
       debian/passwd.config, debian/passwd.postinst:
       - checked for bashisms, replaced "#!/bin/bash" with "#!/bin/sh",
         Closes: #315767
       - replaced "test XXX -a YYY" XSI:isms with "test XXX && test YYY",
         for rationale see:
         http://www.opengroup.org/onlinepubs/009695399/utilities/test.html
       - replaced all unneeded "egrep"s with basic "grep"s
         Closes: #256732
     - debian/rules:
       Remove the setuid bit on login
       Closes: #298060
     - debian/passwd.templates:
       Templates rewrite to shorten them down a little and make them DTSG
       compliant. Give more details about what the user's full name is used
       for.
       Closes: #287410
     - Updated to Standards: 3.6.2 (checked)
   * Debconf translation updates:
     - Estonian added. Closes: #312471
     - Basque updated. Closes: #314303
     - Malagasy updated. Closes: #290842
     - Punjabi updated. Closes: #315372
     - Danish updated. Closes: #315378
     - Polish updated. Closes: #315391
     - Japanese updated. Closes: #315407
     - Brazilian Portuguese updated. Closes: #315426
     - Czech updated. Closes: #315429
     - Spanish updated. Closes: #315434
     - Lithuanian updated. Closes: #315483
     - Galician updated. Closes: #315362
     - Portuguese updated. Closes: #315375
     - Simplified Chinese updated. Closes: #315567
     - French updated
     - Ukrainian updated. Closes: #315727
     - Welsh updated. Closes: #315809
     - Slovak updated. Closes: #315812
     - Romanian updated. Closes: #315783
     - Finnish updated. Closes: #315972
     - Catalan updated. Closes: #316026
   * Man pages translation updates:
     - Remove the too outdated Korean translation of newgrp.1
       which doesn't even mention sg
       Closes: #261490
   * Man pages correction for Debian specific issues:
     - 402_usermod.8-system-users-range-286258:
       Document the system user range from 0 to 999 in Debian
       Closes: #286258
   * Upstream bugs not fixed in upstream releases or CVS:
     - 423_su_pass_args_without_concatenation
       Thanks to Helmut Waitzmann.
       Closes: #276419
       * pass the argument to the shell or command without concatenation
         before the call to exec.
       * If no command is provided, the arguments after the username are for
         the shell, no -c has to be appended.
     - 008_su_ignore_SIGINT
       * Also ignore SIGQUIT in su to avoid defeating the delay.
         The gain in security is very minor.
         Closes: #288827
     - 424_pwck.8_quiet_option
       pwck(8): document the -q option. Closes: #309408
     - 425_lastlog_8_sparse
       lastlog(8): Document that lastlog is a sparse file, and don't need to be
       rotated. Closes: #219321
     - 426_grpck_group-gshadow_members_consistency
       * (grpck) warn for inconsistencies between members in /etc/group and gshadow
         Closes: #75181
       * (pwck and grpck) warn and propose a fix for entries present in the
         regular /etc/group or /etc/passwd files and not in shadow/gshadow.
     - 427_chage_expiry_0
       Fix chage display in the case of null expiry fields (do not display
       Never, but 01 Jan 1970)
       Closes: #78961
   * Upstream bugs already fixed in upstream releases or CVS:
     - Corrected typos in chfn.1. Closes: #312428
     - Corrected typos in gshadow.5. Closes: #312429
     - Corrected typos in shadow.5. Closes: #312430
     - Corrected typos in grpck.8. Closes: #312431
     - Added patch (356th) for su to propagate SIGSTOP up and SIGCONT down.
       Added similar patch (357th) for newgrp. Both changes only affect
       operation with CLOSE_SESSION set to yes (in /etc/login.defs).
       Closes: #314727
   * Translation updates:
     - debian/patches/010_more-i18ned-messages
       - More messages are translatable. We will deal with the translation
         updates after syncing with upstream.
         Closes: #266281
     - debian/patches/114_eu:
       - Basque translation update. Closes: #314423
     - debian/patches/132_vi.dpatch:
       - Vietnamese translation update. Closes: #315840
Files: 
 2b951dfb5a5258b06dbf4cc9c1c10a9b 843 base required shadow_4.0.3-36.dsc
 c282dd24f1a680566120ef684f5c0386 1405333 base required shadow_4.0.3-36.diff.gz
 c3e579b2641ed0587fa4d8a2fb00e56c 504416 base required passwd_4.0.3-36_i386.deb
 9608524e0d057f7cbe832b35bde32f2e 590616 base required login_4.0.3-36_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCyuJO1OXtrMAUPS0RAh8zAKCdD/46/ukzdT+o7jJwPZYJ/ZnP2QCeImF4
ZIx948C5htLynLJrbekYXn4=
=Mslh
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.