https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #1 from suse-beta@cboltz.de 2006-11-20 11:29 MST ------- Created an attachment (id=106286) --> (https://bugzilla.novell.com/attachment.cgi?id=106286&action=view) german screenshot -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ma@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|ma@novell.com |sh@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #3 from sh@novell.com 2006-11-21 08:40 MST ------- Created an attachment (id=106414) --> (https://bugzilla.novell.com/attachment.cgi?id=106414&action=view) screen shot with translated buttons -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 suse-beta@cboltz.de changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Minor |Major Status|NEEDINFO |ASSIGNED Info Provider|suse-beta@cboltz.de | Summary|"save solver testcase" |kdesu sets locale to POSIX |success dialog: buttons not | |translated | ------- Comment #5 from suse-beta@cboltz.de 2006-11-21 09:25 MST ------- Indeed: 2006-11-21 16:12:19 <2> cboltz(6399) [qt-ui] YQUI_x11.cc(loadPredefinedQtTranslations):434 Can't load translations for predefined Qt dialogs from /usr/lib/qt3/translations/qt_c.qm Huh? Why does it search for qt_c.qm? I just tested a bit: - I hit this bug when starting YOU via opensuse-updater. - I also hit it when running "kdesu yast2" via Alt-F2 - the buttons are translated when I "su" and call "yast2 sw_single" in a xterm My guess is that kdesu resets some locale variables... Wait... "kdesu xterm" shows POSIX for all locale settings! -> probably something for the KDE maintainers -> also reproducable with a fresh user -> renaming the bug and adjusting summary because this hits *all* applications run through kdesu BTW: I just found out that the "Cancel" button has the same effect as "Yes" :-( Since yes and no should be enough in this dialog, simply remove "Cancel" (or fix it so that it does not display the "save file" dialog). -> separate (minor) bugreport for this? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 andreas.hanke@gmx-topmail.de changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andreas.hanke@gmx-topmail.de ------- Comment #6 from andreas.hanke@gmx-topmail.de 2006-11-21 12:19 MST ------- This is not really a bug, but the consequence of a feature. kdesu now uses sudo instead of su as backend and sudo has to clear the environment for security reasons. This isn't necessary with su because it always asks for the password, but it's necessary with sudo because sudo can be configured to work without the password and then a user could change the behaviour of previously approved commands by setting some environment variables. You can change this via /etc/sudoers or visudo or yast2-sudo. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #8 from andreas.hanke@gmx-topmail.de 2006-11-22 08:12 MST ------- (In reply to comment #7)

I think the locale is set because of bug 152077 ?

I don't think that this is related to bug 152077. In fact, it looks like the patch from bug 152077 isn't even part of the kdelibs3 package anymore. At least I'm unable to find it in the current kdelibs3.src.rpm. Switch kdesurc to use su instead of sudo, and the locale isn't reset anymore. So it must have something to do with sudo. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 llunak@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Summary|kdesu sets locale to POSIX |kdesu resets locale -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 llunak@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Fix_is_Ready ------- Comment #11 from llunak@novell.com 2006-11-22 09:29 MST ------- This seems to be several small problems together causing this one (like either yast2 or Qt taking LC_ALL="" as LC_ALL=C which I think is wrong). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 stbinner@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED ------- Comment #13 from stbinner@novell.com 2006-11-22 13:02 MST ------- Added patch to kdelibs3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #15 from coolo@novell.com 2006-11-29 03:59 MST ------- as 224422 is reported against RC2, this might not be fixed -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #17 from andreas.hanke@gmx-topmail.de 2006-11-29 05:15 MST ------- What about the idea that it's sudo and not kdesu which resets the locale here? Can you investigate into this direction? Some information that should be easily reproducible: 1. kdesu does not reset the locale if it's switched from the sudo backend to the su backend. 2. kdesu does not reset the locale if the following is configured in /etc/sudoers: Defaults env_keep = "LANG" (and possibly more env vars if you have a complex setup, e.g. LC_ADDRESS LC_CTYPE LC_COLLATE etc.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #19 from andreas.hanke@gmx-topmail.de 2006-11-29 06:19 MST ------- Removing 'Defaults env_reset' is very insecure. Adding 'Defaults env_keep = "LANG"' should work on systems where LANG is the only actually used locale variable. If you're using more locale-related environment variables, try if adding all of them helps: Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \ LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \ LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS" This should now really work, even without removing 'Defaults env_reset'. It's (a subset of) what Red Hat does. (Note that I do _not_ the security impact of this.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 dmueller@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dmueller@novell.com AssignedTo|kde-maintainers@suse.de |prusnak@novell.com Status|REOPENED |NEW ------- Comment #21 from dmueller@novell.com 2006-11-29 06:36 MST ------- hmm, annoying that I did not notice this by myself. Is it possible to fix sudo according to comment #19 ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #23 from andreas.hanke@gmx-topmail.de 2006-11-29 07:14 MST ------- Just for the records: I think that the kdelibs3 fix from attachment 106611 was never necessary, but don't know if it hurts either. (In reply to comment #22)

Sorry, I don't know how did I tested when I wrote comment #18, but now when I have 'Defaults env_keep = "LANG"' (together with Defaults env_reset) in /etc/sudoers, locale is not reset. So comment #19 fix probably is not necessary

It is necessary on systems with a more complex locale setup where the user wants e.g. English date formats together with Spanish messages and Russian paper size. There is no way to get this set up using LANG only, the LC_* variables are needed. If it's considered acceptable (security-wise) to pass LANG, be consistent and pass all of them. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 prusnak@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|prusnak@novell.com |security-team@suse.de -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #26 from andreas.hanke@gmx-topmail.de 2006-12-13 17:01 MST ------- (In reply to comment #25)

glibc doesn't use those variables when the program runs suid root and the variable contains a slash.

And what does glibc do if the variable contains a slash and the program does _not_ run suid root? It seems that glibc does these sanity checks independently of whether the program runs suid root, with the notable exception of LC_IDENTIFICATION. (=> glibc bug?) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #28 from andreas.hanke@gmx-topmail.de 2006-12-13 17:03 MST ------- Created an attachment (id=109666) --> (https://bugzilla.novell.com/attachment.cgi?id=109666&action=view) strace of /bin/cp with LANG=../../../tmp -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #30 from andreas.hanke@gmx-topmail.de 2006-12-13 17:08 MST ------- Conclusion: LC_MEASUREMENT, LC_TELEPHONE, LC_ADDRESS, LC_NAME, LC_PAPER, LC_MESSAGES, LC_MONETARY, LC_COLLATE, LC_TIME, LC_NUMERIC and LC_CTYPE are not used if they have a suspicious value, even if the program does _not_ run suid root. But LC_IDENTIFICATION is used. Strange glibc behaviour. Why is LC_IDENTIFICATION handled differently than all the others? Unfortunately, removing LC_IDENTIFICATION from the whitelist won't help because if LC_IDENTIFICATION is not set, the value of LANG is taken instead. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #32 from andreas.hanke@gmx-topmail.de 2006-12-13 17:56 MST ------- Created an attachment (id=109670) --> (https://bugzilla.novell.com/attachment.cgi?id=109670&action=view) LANGUAGE problem Difference between: LANG=de_DE.UTF-8 + LANGUAGE unset And: LANG=de_DE.UTF-8 + LANGUAGE=../../../tmp -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 stbinner@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|Fix_is_Ready | ------- Comment #33 from stbinner@novell.com 2007-01-29 03:27 MST ------- Fix_is_Ready was for the patch applied to kdelibs3 on 22th November, I don't see a new patch after this report was reopened. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #35 from jsuchome@novell.com 2007-04-03 06:09 MST ------- *** Bug 259802 has been marked as a duplicate of this bug. *** -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #37 from mfabian@novell.com 2007-04-10 12:44 MST ------- To make input methods work correctly, the following environment variables need to be kept in addition to the locale environment variables: XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #39 from lnussel@novell.com 2007-04-17 05:35 MST ------- AFAIK kdesu has means to propagate settings itself. sudo's default config intentionally limits the propagated environment variables to avoid unintended side effects esp when used with NOPASSWD. Someone has to sufficiently proof that those variables have no unintended side effects like e.g. allowing to load arbitrary code via directory traversal bugs etc before adding them to the sudoers file. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728 ------- Comment #41 from mfabian@novell.com 2007-05-09 06:30 MST ------- If possible, I prefer to have these variables in env_keep because I often use "sudo" directly (not via gnomesu, kdesu, ...) and it is very annoying if the language environment and the input method related variables get lost each time. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

https://bugzilla.novell.com/show_bug.cgi?id=222728#c43 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|security-team@suse.de | --- Comment #43 from Ludwig Nussel 2007-07-17 02:19:25 MST --- Discard the submission or add the line commented out. You can add a note like "uncomment the following line if you need to use special input methods. Note that this may allow users to compromise the root account if they are allowed to run commands without authentication." -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=222728#c45 --- Comment #45 from Ludwig Nussel 2007-07-17 03:16:59 MST --- The variables (LANG, LC_*) honored by glibc are most probably fine as glibc sanitizes them so you can keep them enabled. only the new ones are suspicious. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.