FS#13444 - [coreutils 7.1] su doesn't work anymore

Attached to Project: Arch Linux
Opened by Corrado Primier (bardo) - Tuesday, 24 February 2009, 22:26 GMT
Last edited by Aaron Griffin (phrakture) - Friday, 06 March 2009, 22:19 GMT
Task Type Bug Report
Category Packages: Testing
Status Closed
Assigned To Andreas Radke (AndyRTR)
Dan McGee (toofishes)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No


When an unprivileged tries to switch user, su always returns "incorrect password". Since root can su regularly, to me it looks like some kind of incompatibility with the pam_unix.so module: /etc/pam.d/su did not change between the two revisions, and pam_rootok.so works.

Downgrading to 6.12 fixes the problem.
This task depends upon

Closed by  Aaron Griffin (phrakture)
Friday, 06 March 2009, 22:19 GMT
Reason for closing:  Fixed
Additional comments about closing:  In 7.1-1.1
Comment by Pierre Schmitz (Pierre) - Tuesday, 24 February 2009, 23:01 GMT
  • Field changed: Status (Unconfirmed → Assigned)
  • Field changed: Severity (Medium → High)
  • Task assigned to Andreas Radke (AndyRTR)
I can confirm this problem.
Comment by Gerardo Exequiel Pozzi (djgera) - Wednesday, 25 February 2009, 00:21 GMT

Using testing packages, don't have this problem. Under vbox (Fresh install of Arch Linux, default settings)
I can do "su - userX" or "su -" from userZ, without problems, logged from console or ssh.

Are you under X, from a X login manager?
Comment by Sleepy_Coder (Sleepy_Coder) - Wednesday, 25 February 2009, 07:10 GMT
I also experienced the problem with not being able to su from my only other unprivileged user. :> The error was as Corrado stated: "incorrect password" I have an alias for `su` so it becomes `su -l`. I'll try now by supplying the user. :>
Comment by Sleepy_Coder (Sleepy_Coder) - Wednesday, 25 February 2009, 07:12 GMT
Nope, either way doesn't work... :> Bleh, I should have put this in the last comment I left. >.<
Comment by Gerardo Exequiel Pozzi (djgera) - Wednesday, 25 February 2009, 08:10 GMT
Oooh, i686 works OK, but x86_64 fails....

This is because bad perms, su in x86_64 not have SETUID :)
Comment by Jan Spakula (bender02) - Wednesday, 25 February 2009, 13:45 GMT
I can confirm. Doesn't work on x86_64. After setting setuid (chmod +s /bin/su) starts working.
Comment by Andreas Radke (AndyRTR) - Wednesday, 25 February 2009, 16:50 GMT
-r-sr-xr-x 1 root root 51K 25. Feb 16:47 /tmp/coreutils/trunk/pkg/bin/su
Modus von „/tmp/coreutils/trunk/pkg/bin/su“ als 4555 (r-sr-xr-x) erhalten
==> Säubere Installation...
-> Komprimiere Man-Pages...
-> Entferne Debugging-Symbole aus Binär-Dateien und Bibliotheken...
-> Entferne leere Verzeichnisse...
==> Erstelle Paket ...
-> Erstelle .PKGINFO-Datei...
-> Füge Installations-Skript hinzu...
-> Komprimiere Paket ...
==> Verlasse fakeroot-Umgebung.
==> Beendete make: coreutils 7.1-1.1 x86_64 (Mi 25. Feb 16:47:58 UTC 2009)

real 2m46.340s
user 2m13.751s
sys 0m52.420s
[andyrtr@workstation64 trunk]$ ls -lha pkg/bin/su
-rwxr-xr-x 1 andyrtr users 40K 25. Feb 16:47 pkg/bin/su

The permission is ok before leaving the fakechroot. I guess this is either a fakeroot or makepkg bug. Adding Dan to the assignies.
Comment by Aaron Griffin (phrakture) - Wednesday, 25 February 2009, 17:14 GMT
Hasn't there been a lot of fakeroot on x86_64 related bugs recently? Could this be related?
Comment by Gerardo Exequiel Pozzi (djgera) - Wednesday, 25 February 2009, 18:11 GMT
mmm, I compiled the coreutils-7.1 from ABS, and the su have the correct perms.

[djgera@arch64 coreutils]$ tar tvf coreutils-7.1-1-x86_64.pkg.tar.gz | grep "bin/su$"
-r-sr-xr-x root/root 40824 2009-02-25 16:03 bin/su

I will recompile again some times, maybe a random "fakeroot" bug...
Comment by Gerardo Exequiel Pozzi (djgera) - Wednesday, 25 February 2009, 19:13 GMT
Mmm nop, i recompiled five times, and all have su setuid in tar.gz

But maybe a good idea is to put a .install file to ensure te setuid bit.
Comment by Jan Spakula (bender02) - Wednesday, 04 March 2009, 16:23 GMT
Fixed in coreutils-7.1-1.1.