HomeDefectsLIN1022-6334
Fixed

LIN1022-6334 : radvd user should not have login shell enabled

Created: Jan 22, 2024    Updated: Mar 7, 2024
Resolved Date: Mar 7, 2024
Found In Version: 10.22.33.15
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Userspace

Description

When radvd is enabled/installed, the created user has login shell enabled:
radvd:x:986:65534::/var/run/radvd/:/bin/sh
This should probably be /bin/false or /sbin/nologin like with other networking daemons.

In radvd.spec for redhat (tmp-glibc/work/core2-64-wrs-linux/radvd/2.19-r0/radvd-2.19/redhat/systemd/radvd.spec), it is defined as nologin:

getent passwd radvd >/dev/null || \
useradd -r -u %RADVD_UID -g radvd -d / -s /sbin/nologin -c "radvd user" radvd
exit 0

But clearly the radvd.spec used by the build does things differently:
perform_useradd () {
<------>local rootdir="$1"
<------>local opts="$2"
<------>bbnote "radvd: Performing useradd with [$opts]"
<------>local username=`echo "$opts" | awk '

{ print $NF }

'`
<------>local user_exists="`grep "^$username:" $rootdir/etc/passwd || true`"
<------>if test "x$user_exists" = "x"; then
<-----{-}><{-}----->eval flock -x $rootdir/etc -c \"$PSEUDO useradd \$opts\" || true
<-----{-}><{-}----->user_exists="`grep "^$username:" $rootdir/etc/passwd || true`"
<-----{-}><{-}----->if test "x$user_exists" = "x"; then
<-----{-}><{-}----{-}><{-}----->bbfatal "radvd: useradd command did not succeed."
<-----{-}><{-}----->fi
<------>else
<-----{-}><{-}----->bbnote "radvd: user $username already exists, not re-creating it"
<------>fi

Unfortunately, I can't follow where the radvd user is assigned with access to a login shell, nor why this is done. This behavior is consistent with 2.19 version of LTS22 and 23.
Why does radvd user have login shell? Can this be modified to be consistent with other networking services that do not have it?

Steps to Reproduce

1. build a qemu project with 
IMAGE_INSTALL:append = " radvd"
2. runqemu qemux86-64 slirp nographic
3. systemctl enable radvd.service && systemctl start radvd.service
4. cat /etc/passwd

Check for radvd user, should look like this:
radvd:x:986:65534::/var/run/radvd/:/bin/sh

Compare with other services:
dhcpcd:x:999:997::/var/lib/dhcpcd:/bin/false
sshd:x:994:991::/var/run/sshd:/bin/false
proxy:x:13:13:proxy:/bin:/sbin/nologin