Bug 56630 - debug.sh: Invalid file descriptor 4
debug.sh: Invalid file descriptor 4
Status: NEW
Product: UCS
Classification: Unclassified
Component: Password changes
UCS 4.4
Other Linux
: P5 normal (vote)
: ---
Assigned To: UCS maintainers
UCS maintainers
:
Depends on: 54273
Blocks:
  Show dependency treegraph
 
Reported: 2023-09-20 14:47 CEST by Philipp Hahn
Modified: 2023-09-20 14:47 CEST (History)
8 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 1: Cosmetic issue or missing function but workaround exists
Who will be affected by this bug?: 3: Will affect average number of installed domains
How will those affected feel about the bug?: 1: Nuisance – not a big deal but noticeable
User Pain: 0.017
Enterprise Customer affected?: Yes
School Customer affected?: Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments
shellcheck cleanup (3.02 KB, patch)
2023-09-20 14:47 CEST, Philipp Hahn
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2023-09-20 14:47:25 CEST
Created attachment 11128 [details]
shellcheck cleanup

Bug #54273 added code to add timestamps to the output. It hard-codes file descriptor 4. That FD might also be used by any calling or called process.

base/univention-server/server_password_change:46
> exec 4>>$tmpfile
base/univention-server/debug.sh:
> printf '' … >&4

This clashes with every other code using FD 4 by random chance:

apt install univention-mail-server
...
Calling joinscript 67univention-mail-server.inst ...
2023-09-20 14:06:42.791142503+02:00 (in joinscript_init)
Object exists: cn=services,cn=univention,dc=phahn50,dc=qa
Object created: cn=SMTP,cn=services,cn=univention,dc=phahn50,dc=qa
Object modified: cn=dc20,cn=dc,cn=computers,dc=phahn50,dc=qa
Object exists: cn=mail,dc=phahn50,dc=qa
Object exists: cn=domain,cn=mail,dc=phahn50,dc=qa
Object created: cn=phahn50.qa,cn=domain,cn=mail,dc=phahn50,dc=qa
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 43: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 49: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 43: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 49: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor
/usr/lib/univention-server/lib/server_password_change/debug.sh: Zeile 34: 4: Ungültiger Dateideskriptor


PS: The code contains several cases of unquoted variables and does not delete two files containing the passwords due to wrong quoting. Consult `shellcheck`!

# ucr set server/password/interval=0
# bash -x /usr/lib/univention-server/server_password_change
...
 'mktemp "$MSECRET.XXXXXXXX"'
++ mktemp /etc/machine.secret.XXXXXXXX
+ old_pass=/etc/machine.secret.avX7Sh7j
...
 'mktemp "$MSECRET.XXXXXXXX"'
++ mktemp /etc/machine.secret.XXXXXXXX
+ new_pass=/etc/machine.secret.pzGTdZU2
...
+ '[' -e /etc/machine.secret.pzGTdZU2 ']'
+ rm -f '$new_pass'
        ^         ^
+ '[' -e /etc/machine.secret.avX7Sh7j ']'
+ rm -f '$old_pass'
        ^         ^
# ls -l /etc/machine.secret.*
-rw------- 2 root root 20 Sep 20 14:38 /etc/machine.secret.avX7Sh7j
-rw------- 2 root root 20 Sep 20 14:38 /etc/machine.secret.I5exO3W3
-rw------- 1 root root 66 Sep 20 14:40 /etc/machine.secret.old
-rw------- 2 root root 20 Sep 20 14:40 /etc/machine.secret.pzGTdZU2
-rw------- 1 root root 20 Feb 23  2023 /etc/machine.secret.SKnTLKEu

+++ This bug was initially created as a clone of Bug #54273 +++