[Adduser-devel] Bug#293559: deluser removes /bin

[Klaus Ethgen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: adduser
Version: 3.59
Severity: critical

Some users have default /bin as home directory. deluser will remove /bin
if such a user is removed and REMOVE_HOME is set to 1 in the config.
After that the system has to be mostely new installed.

This might be a critical bug in adduser or in the debian policy to
create such cracy users.

The bug might happens if you think of cleaning the system of from
unnecesarry users to hardening it.

Please at least check for such directorys like /bin, /sbin, /usr/bin,
/usr/sbin, /usr or / to not completely remove!!!

- -- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (800, 'unstable'), (700, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.29
Locale: LANG=de_DE, LC_CTYPE=de_DE (charmap=ISO-8859-1) (ignored: LC_ALL set to de_DE)

Versions of packages adduser depends on:
ii  debconf                     1.4.42       Debian configuration management sy
ii  passwd                      1:4.0.3-30.9 change and administer password and
ii  perl-base                   5.8.4-6      The Pathologically Eclectic Rubbis

- -- debconf information:
* adduser/homedir-permission: true

- -- 
Klaus Ethgen                            http://www.ethgen.de/
pub  2048R/D1A4EDE5 2000-02-26 Klaus Ethgen <Klaus@Ethgen.de>
Fingerprint: D7 67 71 C4 99 A6 D4 FE  EA 40 30 57 3C 88 26 2B
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iQEVAwUBQgNfdJ+OKpjRpO3lAQKBMAf+K7Q17rRMa+qXjBK4x1RsM29bEEeIe31n
VT4rp4Z0R+ratPCPpP4jHVBqaw2lTRlwQX+xCwq5sb68X0nQ6IZNC7ZYZ4s8m2O9
LpHzPUEP/SbWOZjnV8PLpkUaS9rn8Cjg9Yn0ZIt7aht/GMdkLZZH0w1kytNQ2MZa
qGRoCDQYTp41WCaAjoLpTxlJmqSc3UewtZGiHvw2r4iJYId7Ip1/bkUhVw3NUBx1
QNQgMa51CEHDjKkz9c6oCR+aR5znra/MrGmq1ErDhuIuRJfsNoRAKUv/7jV9iMZR
FQ6KfkJ7RWUrBkjPhThtNhU6dXqVCpZNfj0XzSvBj3cfx4ghu4Rt5w==
=+s+f
-----END PGP SIGNATURE-----