shadow-4.20.0: -bash: cannot set terminal process group (-1): Inappropriate ioctl for device -bash: no job control in this shell

[hdejin]

shadow-4.20.0 gives me the following error when running su - <USERNAME> as root.

-bash: cannot set terminal process group (-1): Inappropriate ioctl for device
-bash: no job control in this shell

Edit: su - as a limited user is fine.

[jubalh]

Probably related to f384b3d, @hallyn.

[alejandro-colomar]

Probably related to f384b3d, @hallyn.

Yup; this seems intended, IIRC.

I think you should use runuser(1) instead, which is provided by util-linux.

Alternatively, you should disable TIOCSTI.

If runuser(1) from util-linux has any issues which make it unusable for you (e.g., it uses PAM, and some users still avoid PAM), we were thinking that we could implement a runuser(1) here in shadow-utils, which wouldn't require PAM.

[alejandro-colomar]

I've linked to this regression in the release notes, so that others can find it easily.

https://github.com/shadow-maint/shadow/releases/tag/4.20.0.

[jubalh]

Instead of just mentioning the issue number there I would at least add some text. Maybe ``su - as root brings inappropriate ioctl for device #1704 or something so users can find it when searching through the changes.

And I'm not so sure that this is planned.

[alejandro-colomar]

Instead of just mentioning the issue number there I would at least add some text. Maybe ``su - as root brings inappropriate ioctl for device #1704 or something so users can find it when searching through the changes.

Done; thanks! Feel free to suggest other improvements if you think the amendment isn't enough.

And I'm not so sure that this is planned.

I'm not sure what you mean.

[jubalh]

I'm not sure what you mean.

What I mean is that I think this is not an intentional change. The "Inappropriate ioctl for device" for "don't run su as root" doesn't sound like a planned message for this use case.

[alejandro-colomar]

I'm not sure what you mean.

What I mean is that I think this is not an intentional change. The "Inappropriate ioctl for device" for "don't run su as root" doesn't sound like a planned message for this use case.

Yeah, the error message seems weird. I don't know exactly where it comes from.

[hallyn]

@zhw2101024 so the easiest way for now to avoid that error message, would be to make sure that /proc/sys/dev/tty/legacy_tiocsti is set to 0, and that the chroot is set up so as to have that file available. That will avoid running that code at all.

But I think @jubalh is right. We need to drill down into why we're getting that error. I'll look into it when I get a chance, but if someone else wants to track it down first, that'll be awesome too.

[zhw2101024]

But I think @jubalh is right. We need to drill down into why we're getting that error. I'll look into it when I get a chance, but if someone else wants to track it down first, that'll be awesome too.

@hallyn I searched the error message in the bash source, and find them in the jobs.c file.
However I'm not familiar with progress group and pid.

[zhw2101024]

@hallyn I found some difference when su - <USERNAME> as root:

1. With shadow 4.19.4 installed, tcgetpgrp(255) returns a positive number.
2. With shadow 4.20.0 installed, tcgetpgrp(255) returns -1.

The bash source determines tcgetpgrp(shell_tty) and output the error message when the return value equals to -1.

[zhw2101024]

I've linked to this regression in the release notes, so that others can find it easily.

https://github.com/shadow-maint/shadow/releases/tag/4.20.0.

@alejandro-colomar AFAICS, su as root won't fail, it just reports an error.

[alejandro-colomar]

I've linked to this regression in the release notes, so that others can find it easily.
https://github.com/shadow-maint/shadow/releases/tag/4.20.0.

@alejandro-colomar AFAICS, su as root won't fail, it just reports an error.

Hmmmm, that could explain the problem. I think the intention was that it should fail. @hallyn do you remember? I'm busy this week, but I'll try to have a look at it ASAP.

[zhw2101024]

Hmmmm, that could explain the problem. I think the intention was that it should fail. @hallyn do you remember? I'm busy this week, but I'll try to have a look at it ASAP.

It won't be allowed to su as root? There may be scripts to run mainly as root, and something as non-root user, they will all broken. I can't find alternatives for this.