security and passwd ordering

[Paul Fox]

let me start by saying this is probably a total non-issue, but
it's surprising to me, so i mention it here.

i have a recent G1G1 machine, running an almost stock 656.  (note
the "almost".)

the original problem symptom was that my brightness keys didn't
work.  the keys themselves are fine, and i could control the
brightness with the /proc node, so it was something in between
that was broken.

i asked on the support list, to find out what controls
brightness, and richard pointed me at sugar.  i found the
keyhandler code in sugar, and that led me to the sugar logfiles.

shell.log contained messages like this:
    <class 'dbus.exceptions.DBusException'>: 
    org.freedesktop.DBus.Error.AccessDenied:  A security policy
    in place prevents this sender from sending this message to
    this recipient, see message bus configuration file (rejected
    message had interface "org.laptop.HardwareManager" member
    "get_display_brightness" error name "(unset)" destination ":1.5")

this led me to thinking about the currently logged in user, which
reminded me that...

 ...i had added myself to the password file.  i did this for two
reasons -- one was because i needed an account with a password so
that i could ssh into the machine, and i wasn't sure what adding a
password to "olpc" might do to the console ui.  the second
reason, we can probably ascribe to vanity -- after all, my
initials are "pgf", not "olpc", and that's who i wanted to be
when i logged in.  so shoot me.  :-)

the "pgf" entry i added shared the 500 uid with "olpc" -- same
user, two names.  when i first added it, i put it after olpc, and
that worked well for ssh, but apparently it didn't satisfy my
vanity -- i moved the "pgf" line in front when the '\u' in my
bash prompt didn't give the right effect.

so:  it turns out that this was the cause of the above dbus
exception, and the reason that my brightness keys didn't work. 
reversing the passwd lines so that my 'pgf' entry comes last
makes everything work again.

so, what's the point?

i guess i'm surprised that the security policy would be
name-based, rather than uid based.  on the other hand, since i
was able to edit the passwd file, security was pretty much
already blown open.  as i say -- probably a non-issue.

i only mention it here so that others won't be surprised if they
do something similar, and because it might (but probably won't)
surprise someone who understands the security model better than i
do.

paul

p.s.  there were some other things that didn't work right, that i
didn't notice at first.  "shutdown" (from the "XO Guy" menu)
doesn't work if my 'pgf' line comes first, for instance -- but i
didn't notice that because i so often ssh in, and use "shutdown
-h now" from the command prompt.

=---------------------
 paul fox, pgf at foxharp.boston.ma.us (arlington, ma, where it's 37.2 degrees)