[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Musings about Usernames in adduser and Debian



* Ben Kallus <benjamin.p.kallus.gr@dartmouth.edu> [241208 21:35]:
> I second calling it "allow-unsafe-names" 

This was never on the table, and shadow upstream might even drop the
entire "support" for having bad names.

> for the following reasons:
[..]

> 2. There's a path traversal bug in useradd (but not adduser) that can
> be triggered by usernames beginning with "../".

It's not a bug if you disable the guard rails.

Chris


Reply to: