UID's too large??

[Matthew Kirkwood]

On Wed, 1 Sep 1999, Matthew Keller wrote:

> 	No, netatalk is correctly mapping the ID's, and so is FTP (the users
> don't have shell access, so I'm not sure about telnet). I haven't
> extensively exhausted this yet, as the system went online Monday, and my
> stop-gap method works. *shrug* I'll post additional findings here at a
> later date. 

On a pretty plain RH6 box (though I am running a 2.3 kernel):

arse:x:120000:100:tmp:/:/bin/bash

# su - arse
su: cannot set user id: Invalid argument
# touch arse
# ls -ln arse
-rw-r--r--   1 0        0               0 Sep  1 21:25 arse
# chown arse arse
# ls -ln arse
-rw-r--r--   1 54464    0               0 Sep  1 21:25 arse

It's possible that netatalk is managing to set the uids to some wrapped
number, or just that it's ignoring the return value of the syscall.

Either way, it's a bug, and one with potential security effects.

Matthew.