Could dbus possible be doing damage?

[Brandon Allbery]

On Sun, Nov 2, 2014 at 10:25 PM, Lawrence Velázquez <larryv at macports.org>
wrote:

> On Nov 2, 2014, at 9:29 PM, Marcus Calhoun-Lopez <mcalhoun at macports.org>
> wrote:
> > Recently, a user reported having his root account deleted after
> installing the port dbus (Ticket #45737).
> > I do not see how it is possible, but I though that we can not risk such
> a catastrophic result for anyone else.
> > Can anyone image how such a situation could come about?
>
>     unset -nocomplain startup_root
>     if { [variant_isset no_root] } {
>         set dbus_user     ${install.user}
>         set dbus_group    ${install.group}
>     [...]
>     }
>     add_users         ${dbus_user} group=${dbus_group} realname=Message\
> Bus
>
> What happens here if install.user is root?
>

Nothing --- if the user exists it's used as is. And I don't think users are
ever removed, since there's little point and lots of ugly corner cases
(like, indeed, what if someone specified root).

-- 
brandon s allbery kf8nh                               sine nomine associates
allbery.b at gmail.com                                  ballbery at sinenomine.net
unix, openafs, kerberos, infrastructure, xmonad        http://sinenomine.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.macosforge.org/pipermail/macports-dev/attachments/20141102/dbaa7440/attachment.html>