From mboxrd@z Thu Jan 1 00:00:00 1970 From: "pelzflorian (Florian Pelz)" Subject: bug#35996: User account password got locked when booting old generation Date: Tue, 4 Jun 2019 14:17:11 +0200 Message-ID: <20190604121710.uqni7cwp5jo4pwmq@pelzflorian.localdomain> References: <20190601145834.f4wgm4oqmdyej7n5@pelzflorian.localdomain> <87r28dc7gw.fsf@gnu.org> <20190602070545.xp2pqlnzsthpjtbw@pelzflorian.localdomain> <87sgss9vj7.fsf@gnu.org> <20190602102122.bzapwt36vg32nmwq@pelzflorian.localdomain> <87o93g9dv5.fsf@gnu.org> <20190603060301.2nu2zqi5j3v3j5ki@pelzflorian.localdomain> <87tvd6erbo.fsf@gnu.org> <20190603145209.ub7663zp7yh7n7i4@pelzflorian.localdomain> <87d0jtemca.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([209.51.188.92]:33855) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hY8OB-0000aS-0w for bug-guix@gnu.org; Tue, 04 Jun 2019 08:18:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hY8OA-0004nz-0E for bug-guix@gnu.org; Tue, 04 Jun 2019 08:18:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:58793) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hY8O9-0004nr-T3 for bug-guix@gnu.org; Tue, 04 Jun 2019 08:18:01 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hY8O9-0008J7-NX for bug-guix@gnu.org; Tue, 04 Jun 2019 08:18:01 -0400 Sender: "Debbugs-submit" Resent-Message-ID: Content-Disposition: inline In-Reply-To: <87d0jtemca.fsf@gnu.org> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 35996@debbugs.gnu.org On Tue, Jun 04, 2019 at 11:22:45AM +0200, Ludovic Courtès wrote: > Hi, > > "pelzflorian (Florian Pelz)" skribis: > > > On Mon, Jun 03, 2019 at 03:22:51PM +0200, Ludovic Courtès wrote: > >> > After multiple reconfigures, it happened again, my /etc/shadow has ! > >> > again in the password field. My recently changed root password became > >> > empty as well, like 35902. I did not even run sudo concurrently. The > >> > password just got locked. > >> > >> What were the differences between your config files when you > >> reconfigured? > >> > > > > For the last reconfigure, there were no differences, although I had > > rebooted into an unbootable, older generation with a different > > syslog.conf and broken Udevd arguments before booting the new > > generation. > > What’s the effect of this brokenness concretely? Is the wrong root file > system mounted, or something like that? > I have multiple broken generation. On one that now for a third time (on old generations without Ludo’s patches) led to a locked /etc/shadow after booting I changed the line (let ((pid (fork+exec-command (list udevd)))) in gnu/services/base.scm to, I believe, this: (let ((pid (fork+exec-command (list udevd "--debug-trace")))) (I am unsure if this is the same broken generation as on my first report of the issue. I may have gotten confused.) This is unbootable, correct would have been --debug and not --debug-trace. I may also have changed my syslog configuration to the incorrect (modify-services %desktop-services (syslog-service-type config => (syslog-configuration (inherit config) (config-file (plain-file "my-syslog.conf" " # Log all error messages, authentication messages of # level notice or higher and anything of level err or # higher to the console. # Don't log private authentication messages! * /var/log/full […]"))))))) Correct would have been *.* instead of * This latter error is without relevant effect I believe. I will try to find the /gnu/store files for this generation. Danny’s suggestion to `chattr +i /etc/shadow` leads to an error with rename-file trying to rename an empty /etc/shadow.Gi… temporary file on both this old broken and on healthy generations. > There really isn’t much to log: the activation code reads > /etc/{shadow,passwd,group}, computes the list of shadow/passwd/group > entries as a function of that, and writes it. > If I cannot find a more deterministic way, I will try making (guix build accounts) print the content of shadow. Regards, Florian