[Adduser-devel] Bug#271829: adduser deleted _all_ files on my disk from a 'dpkg --purge command'

[Ernst Kloppenburg]

Package: adduser
Version: 3.53
Severity: important

Hello,

recently _all_ files on my disk were deleted by issuing a 'dpkg
--purge command'.

A few days ago I did 'dpkg --purge amavisd-new'. The package had
already been deinstalled a long time ago (it was the version
20021227p2-5). Now I also wanted to get rid of the remaining config
files.

Instead I ended up with _all_ files on _all_ mounted partitions
deleted, except symlinks.

I now found out the reason: the postrm script calls 'deluser
--remove-home amavis'. And the home directory of the amavis user was set to
'/' in /etc/passwd on my system, I do not know why.

My conclusion would be that either 
- deluser should check that 'home' is reasonable
or
- deluser should always be called with the '--home' option in package
  removal scripts

Therefore this bug maybe does not refer to the package but to policy.


E. Kloppenburg


-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.5-1-k7
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro

Versions of packages adduser depends on:
ii  debconf                     1.4.25       Debian configuration management sy
ii  passwd                      1:4.0.3-28.3 Change and administer password and
ii  perl-base                   5.8.4-2      The Pathologically Eclectic Rubbis

-- debconf information excluded