Received: (at submit) by bugs.debian.org; 13 Apr 1997 06:04:52 +0000 Received: (qmail 22823 invoked from network); 13 Apr 1997 06:04:51 -0000 Received: from mercury.elmailer.net (195.224.76.4) by master.debian.org with SMTP; 13 Apr 1997 06:04:50 -0000 Received: from sfere.greenend.org.uk (sfere.greenend.org.uk [195.224.38.1]) by mercury.elmailer.net with ESMTP id HAA13708 for <submit@bugs.debian.org> (2.2-8.8.5/3.1.13); Sun, 13 Apr 1997 07:03:54 +0100 (BST) Received: (richard@localhost) by sfere.greenend.org.uk id BAA16489 (2.1.1h-8.8.5/2.1b-greenend); Sun, 13 Apr 1997 01:25:16 +0100 From: Richard Kettlewell <richard@greenend.org.uk> Message-Id: <cPk2vI7+v0@sfere.greenend.org.uk> Date: Sun, 13 Apr 97 01:25:16 +0100 (BST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To: submit@bugs.debian.org Subject: lprm can't dequeue job! X-Mailer: VM 6.22 under Emacs 19.34.1 Package: lpr Version: 5.9-13.1 : sfere; lpr /etc/motd : sfere; lpq lp is ready and printing Rank Owner Job Files Total Size active richard 87 /etc/motd 250 bytes : sfere; lprm 87 cfA087Aa16362: Permission denied cfA087Aa16362: Permission denied : sfere; ls -lR /var/spool/lpd/ total 2 drwxrwsr-x 2 root lp 1024 Apr 13 01:17 lp/ drwxrwsr-x 2 root lp 1024 Mar 16 1995 remote/ /var/spool/lpd/lp: total 4 -rw-rw---- 1 daemon lp 111 Apr 13 01:17 cfA087Aa16362 -rw-rw---- 1 richard lp 250 Apr 13 01:17 dfA087Aa16362 -rw-rw-r-- 1 root lp 20 Apr 13 01:17 lock -rw-rw-r-- 1 root lp 25 Apr 13 01:17 status /var/spool/lpd/remote: total 0 : sfere; ls -l `which lpr` `which lprm` `which lpq` -rwsr-sr-x 1 root lp 13320 Feb 12 01:03 /usr/bin/lpq* -rwsr-sr-x 1 root lp 14232 Feb 12 01:03 /usr/bin/lpr* -rwsr-sr-x 1 root lp 13208 Feb 12 01:03 /usr/bin/lprm* Here's some strace from an attempt to lprm the job. Since running lprm as root doesn't exhibit the bug, and strace won't work on setuid programs, it's somewhat fun to obtain this! 16437 mprotect(0x8048000, 10984, PROT_READ|PROT_EXEC) = 0 16437 mprotect(0x4000a000, 528723, PROT_READ|PROT_EXEC) = 0 16437 mprotect(0x40000000, 20301, PROT_READ|PROT_EXEC) = 0 16437 personality(PER_LINUX) = 0 16437 geteuid() = 0 16437 getuid() = 4000 16437 uname({sys="Linux", node="sfere", ...}) = 0 16437 getuid() = 4000 16437 brk(0x804c7d8) = 0x804c7d8 16437 brk(0x804d000) = 0x804d000 16437 open("/etc/passwd", O_RDONLY) = 3 16437 fstat(3, {st_mode=S_IFREG|0644, st_size=1740, ...}) = 0 16437 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40008000 16437 read(3, "root:CuBl5I.g552jw:0:0:The Mgt:/"..., 4096) = 1740 16437 close(3) = 0 16437 munmap(0x40008000, 4096) = 0 16437 open("/etc/printcap", O_RDONLY) = 3 16437 read(3, "# /etc/printcap: printer capabil"..., 1024) = 784 16437 close(3) = 0 16437 chdir("/var/spool/lpd/lp") = 0 16437 stat(".", {st_mode=S_IFDIR|S_ISGID|0775, st_size=1024, ...}) = 0 16437 open(".", O_RDONLY) = 3 16437 fcntl(3, F_SETFD, FD_CLOEXEC) = 0 16437 brk(0x804f000) = 0x804f000 16437 getdents(3, /* 8 entries */, 4096) = 148 16437 getdents(3, /* 0 entries */, 4096) = 0 16437 close(3) = 0 16437 open("lock", O_RDONLY) = 3 16437 fstat(3, {st_mode=S_IFREG|0664, st_size=20, ...}) = 0 16437 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40008000 16437 read(3, "16363\ncfA087Aa16362\n", 4096) = 20 16437 kill(16363, SIG_0) = 0 16437 read(3, "", 4096) = 0 16437 close(3) = 0 16437 munmap(0x40008000, 4096) = 0 16437 open("cfA087Aa16362", O_RDONLY) = 3 16437 fstat(3, {st_mode=S_IFREG|0660, st_size=111, ...}) = 0 16437 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40008000 16437 read(3, "Hsfere.greenend.org.uk\nPrichard"..., 4096) = 111 16437 read(3, "", 4096) = 0 16437 close(3) = 0 16437 munmap(0x40008000, 4096) = 0 16437 fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(4, 194), ...}) = 0 16437 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40008000 16437 ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0 16437 write(1, "cfA087Aa16362: Permission denied"..., 33) = 33 16437 open("cfA087Aa16362", O_RDONLY) = 3 16437 fstat(3, {st_mode=S_IFREG|0660, st_size=111, ...}) = 0 16437 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40009000 16437 read(3, "Hsfere.greenend.org.uk\nPrichard"..., 4096) = 111 16437 read(3, "", 4096) = 0 16437 close(3) = 0 16437 munmap(0x40009000, 4096) = 0 16437 write(1, "cfA087Aa16362: Permission denied"..., 33) = 33 16437 _exit(0) = ? -- Richard Kettlewell http://www.elmail.co.uk/~richard/