3 ms·
it strikes me that the serious bug here is the design of GDM to check accounts-daemon for existing accounts, and if that check times out, start account creation
by cpgxiii 6y ago
it strikes me that the serious bug here is the design of GDM to check accounts-daemon for existing accounts, and if that check times out, start account creation. Regardless of the nominal protections afforded by the system, if you rely on a daemon that accepts unprivileged user input to provide security-critical answers, and fail open if it doesn't respond, that's a bad idea.
- effie 6y agoAgreed, login manager should be saner (less relying on other processes) than that. Also, the very existence of accounts-daemon concept seems to be a mistake from the security and simplicity point of view.
- a-dub 6y agoyup. think it's fine to have a service that manages accounts, but a timeout in contacting it resulting in the start of a process that creates users (with privileges) is definitely no good. would be interesting to understand how it happened. is it a straight up bug? is it some sort of fallback in gdm to work around non-responsive account-service (potentially on new machines)? is it some sort of backwards compatibility thing? i can't imagine that it was coded that way intentionally, would be interesting to understand how it ended up that way...
- steerablesafe 6y agoMaybe GDM shouldn't even have the privilege to create a new account in the first place. Couldn't every privileged operation be requested through accounts-daemon?