bugTiger UNIX security tool - Bugs: bug #13318, possible POSIX compliance issue in...


bug #13318: possible POSIX compliance issue in /usr/lib/tiger/systems/Linux/2/check_passwdspec

Submitter:  None
Submitted:  Tue 07 Jun 2005 09:39:42 AM UTC
Category:  Security check modules Severity:  5-Critical
Item Group:  Runtime error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  Debian GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup

Tue 07 Jun 2005 09:39:42 AM UTC, original submission:  

After running an update on my Debian GNU/Linux Sarge, the Tiger 3.2.1-24 cron job reported several shell errors of the type

  "[: 104: !: unexpected operator"

in its nightly runs. I tracked it down to the script check_passwdspec that caused that error even if called directly. I examined a little bit and figured out that the problem appeared only since I followed the "dash" package's suggestion to replace /bin/sh with this small and supposedly POSIX compliant shell. The problem in fact disappeared when I ran check_passwdspec in bash. Hence my conclusion is, that either dash or tiger appear not to be fully POSIX compliant. In Tiger this could easily circumvented by either requiring #!/bin/bash in the shebang (which currently does for me but may be a bit dirty in a distribution) or changing the following bit of code

  [ "$pwd" != '!' ]

in line 96 to be something like this

  [ "x$pwd" != 'x!' ]

I hope this helps in further development of a nice piece of software.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.


No changes have been made to this item

Back to the top

Powered by Savane 3.13-4b48.
Corresponding source code