MIME-Version: 1.0
Date: Tue, 21 Jun 2022 10:59:53 +0200
From: Markus Kolb <alpinelinux+develml@tower-net.de>
To: Jakub Jirutka <jakub@jirutka.cz>, Alpine Linux users ML
 <~alpine/users@lists.alpinelinux.org>
Subject: Re: Security problem in how you manage users in package installations
In-Reply-To: <cf311040-21f2-ad8b-4b9c-363f7ad0c9f5@jirutka.cz>
References: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
 <cf311040-21f2-ad8b-4b9c-363f7ad0c9f5@jirutka.cz>
Message-ID: <b1c1278d4461aaf940aea2d24c0e05d6@tower-net.de>
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit

Am 19.06.2022 19:23, schrieb Jakub Jirutka:
>> There is the possibility to allow an unintended (remote) login or 
>> local privilege expansion by unlocking users in apk-executed scripts.
> 
> No, if the user already exists, then adduser(8) does nothing.
> 

But passwd does. Unlocking is happening with passwd and not adduser.
Not sure why you all point to adduser?!
Can you all try to understand the problem and not try to avoid the 
explanations and saying all is fine like it is?!
It is not, you have a package in your repository, where you can get for 
sure a CVE entry for because of how it is installed by apk.

This is all quite exhausting to discuss a problem like there is no 
problem and need to explain things not being part of.
This is no help.