2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2021-12-05 21:05:27 +05:30
|
|
|
* SPDX-FileCopyrightText: 1991 - 1994, Julianne Frances Haugh
|
|
|
|
* SPDX-FileCopyrightText: 1996 - 2000, Marek Michałkiewicz
|
|
|
|
* SPDX-FileCopyrightText: 2000 - 2006, Tomasz Kłoczko
|
|
|
|
* SPDX-FileCopyrightText: 2007 - 2012, Nicolas François
|
2007-10-07 17:14:02 +05:30
|
|
|
*
|
2021-12-05 21:05:27 +05:30
|
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
2007-11-11 05:16:11 +05:30
|
|
|
#ident "$Id$"
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2007-12-26 18:48:27 +05:30
|
|
|
#include <assert.h>
|
2007-10-07 17:14:02 +05:30
|
|
|
#include <ctype.h>
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <errno.h>
|
2007-10-07 17:14:02 +05:30
|
|
|
#include <fcntl.h>
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <getopt.h>
|
|
|
|
#include <grp.h>
|
|
|
|
#include <lastlog.h>
|
2021-12-29 14:36:39 +05:30
|
|
|
#include <libgen.h>
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <pwd.h>
|
2023-04-26 17:29:51 +05:30
|
|
|
#include <signal.h>
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
2007-10-07 17:17:11 +05:30
|
|
|
#include "pam_defs.h"
|
2007-10-07 17:14:59 +05:30
|
|
|
#endif /* USE_PAM */
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <stdio.h>
|
2009-04-25 04:53:51 +05:30
|
|
|
#include <string.h>
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/types.h>
|
2016-10-19 18:10:59 +05:30
|
|
|
#include <sys/wait.h>
|
2007-10-07 17:16:34 +05:30
|
|
|
#include <time.h>
|
2016-10-19 18:10:59 +05:30
|
|
|
#include <unistd.h>
|
2023-02-05 03:11:18 +05:30
|
|
|
|
|
|
|
#include "alloc.h"
|
2007-10-07 17:16:34 +05:30
|
|
|
#include "chkname.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "defines.h"
|
2007-10-07 17:14:02 +05:30
|
|
|
#include "faillog.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "getdef.h"
|
|
|
|
#include "groupio.h"
|
2007-10-07 17:15:23 +05:30
|
|
|
#include "nscd.h"
|
Flush sssd caches in addition to nscd caches
Some distributions, notably Fedora, have the following order of nsswitch
modules by default:
passwd: sss files
group: sss files
The advantage of serving local users through SSSD is that the nss_sss
module has a fast mmapped-cache that speeds up NSS lookups compared to
accessing the disk an opening the files on each NSS request.
Traditionally, this has been done with the help of nscd, but using nscd
in parallel with sssd is cumbersome, as both SSSD and nscd use their own
independent caching, so using nscd in setups where sssd is also serving
users from some remote domain (LDAP, AD, ...) can result in a bit of
unpredictability.
More details about why Fedora chose to use sss before files can be found
on e.g.:
https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers
or:
https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html
Now, even though sssd watches the passwd and group files with the help
of inotify, there can still be a small window where someone requests a
user or a group, finds that it doesn't exist, adds the entry and checks
again. Without some support in shadow-utils that would explicitly drop
the sssd caches, the inotify watch can fire a little late, so a
combination of commands like this:
getent passwd user || useradd user; getent passwd user
can result in the second getent passwd not finding the newly added user
as the racy behaviour might still return the cached negative hit from
the first getent passwd.
This patch more or less copies the already existing support that
shadow-utils had for dropping nscd caches, except using the "sss_cache"
tool that sssd ships.
2018-09-12 17:52:11 +05:30
|
|
|
#include "sssd.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "prototypes.h"
|
|
|
|
#include "pwauth.h"
|
|
|
|
#include "pwio.h"
|
2020-03-13 02:44:57 +05:30
|
|
|
#include "run_part.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
#include "sgroupio.h"
|
|
|
|
#endif
|
|
|
|
#include "shadowio.h"
|
2021-04-09 21:50:41 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
#include <selinux/selinux.h>
|
|
|
|
#endif /* WITH_SELINUX */
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
#include "subordinateio.h"
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
#ifdef WITH_TCB
|
|
|
|
#include "tcbfuncs.h"
|
|
|
|
#endif
|
2021-11-29 05:07:53 +05:30
|
|
|
#include "shadowlog.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifndef SKEL_DIR
|
|
|
|
#define SKEL_DIR "/etc/skel"
|
|
|
|
#endif
|
2022-11-09 19:11:31 +05:30
|
|
|
#ifndef USRSKELDIR
|
|
|
|
#define USRSKELDIR "/usr/etc/skel"
|
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifndef USER_DEFAULTS_FILE
|
|
|
|
#define USER_DEFAULTS_FILE "/etc/default/useradd"
|
|
|
|
#define NEW_USER_FILE "/etc/default/nuaddXXXXXX"
|
|
|
|
#endif
|
|
|
|
/*
|
|
|
|
* Needed for MkLinux DR1/2/2.1 - J.
|
|
|
|
*/
|
|
|
|
#ifndef LASTLOG_FILE
|
|
|
|
#define LASTLOG_FILE "/var/log/lastlog"
|
|
|
|
#endif
|
2007-10-07 17:17:01 +05:30
|
|
|
/*
|
|
|
|
* Global variables
|
|
|
|
*/
|
* src/newgrp.c, src/userdel.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/pwconv.c, src/chpasswd.c, src/logoutd.c,
src/chfn.c, src/groupmems.c, src/usermod.c, src/pwunconv.c,
src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/chage.c,
src/groupadd.c, src/login.c, src/grpconv.c, src/groups.c,
src/grpunconv.c, src/chsh.c: Prog changed to a constant string.
2010-08-23 01:06:09 +05:30
|
|
|
const char *Prog;
|
* src/newgrp.c, src/userdel.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/pwconv.c, src/chpasswd.c, src/logoutd.c,
src/chfn.c, src/groupmems.c, src/usermod.c, src/pwunconv.c,
src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/grpconv.c,
src/groups.c, src/grpunconv.c, src/chsh.c: Prog is now global (not
static to the file) so that it can be used by the helper functions
of libmisc.
* lib/prototypes.h: Added extern char *Prog.
* libmisc/find_new_gid.c, libmisc/find_new_uid.c: Indicate the
program name with the warning.
2008-09-06 18:21:53 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* These defaults are used if there is no defaults file.
|
|
|
|
*/
|
2020-12-03 22:35:59 +05:30
|
|
|
static gid_t def_group = 1000;
|
2022-10-19 05:00:14 +05:30
|
|
|
static const char *def_groups = "";
|
2007-10-07 17:14:02 +05:30
|
|
|
static const char *def_gname = "other";
|
|
|
|
static const char *def_home = "/home";
|
2020-12-03 22:35:59 +05:30
|
|
|
static const char *def_shell = "/bin/bash";
|
2007-10-07 17:14:02 +05:30
|
|
|
static const char *def_template = SKEL_DIR;
|
2022-11-09 19:11:31 +05:30
|
|
|
static const char *def_usrtemplate = USRSKELDIR;
|
2020-12-03 22:35:59 +05:30
|
|
|
static const char *def_create_mail_spool = "yes";
|
2021-09-21 09:12:21 +05:30
|
|
|
static const char *def_log_init = "yes";
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
static long def_inactive = -1;
|
|
|
|
static const char *def_expire = "";
|
|
|
|
|
|
|
|
#define VALID(s) (strcspn (s, ":\n") == strlen (s))
|
|
|
|
|
|
|
|
static const char *user_name = "";
|
|
|
|
static const char *user_pass = "!";
|
|
|
|
static uid_t user_id;
|
|
|
|
static gid_t user_gid;
|
|
|
|
static const char *user_comment = "";
|
|
|
|
static const char *user_home = "";
|
|
|
|
static const char *user_shell = "";
|
2007-10-07 17:15:40 +05:30
|
|
|
static const char *create_mail_spool = "";
|
2016-05-15 19:19:39 +05:30
|
|
|
|
|
|
|
static const char *prefix = "";
|
|
|
|
static const char *prefix_user_home = NULL;
|
|
|
|
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2011-11-22 03:32:15 +05:30
|
|
|
static /*@notnull@*/const char *user_selinux = "";
|
2023-04-01 18:04:56 +05:30
|
|
|
static const char *user_selinux_range = NULL;
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
#endif /* WITH_SELINUX */
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
static long user_expire = -1;
|
2008-06-10 03:38:08 +05:30
|
|
|
static bool is_shadow_pwd;
|
2007-10-07 17:16:25 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 03:38:08 +05:30
|
|
|
static bool is_shadow_grp;
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
static bool sgr_locked = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
static bool is_sub_uid = false;
|
|
|
|
static bool is_sub_gid = false;
|
|
|
|
static bool sub_uid_locked = false;
|
|
|
|
static bool sub_gid_locked = false;
|
|
|
|
static uid_t sub_uid_start; /* New subordinate uid range */
|
|
|
|
static gid_t sub_gid_start; /* New subordinate gid range */
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
|
|
|
static bool pw_locked = false;
|
|
|
|
static bool gr_locked = false;
|
|
|
|
static bool spw_locked = false;
|
|
|
|
static char **user_groups; /* NULL-terminated list */
|
|
|
|
static long sys_ngroups;
|
|
|
|
static bool do_grp_update = false; /* group files need to be updated */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2019-08-24 02:12:37 +05:30
|
|
|
extern int allow_bad_names;
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
static bool
|
|
|
|
bflg = false, /* new default root of home directory */
|
|
|
|
cflg = false, /* comment (GECOS) field for new account */
|
|
|
|
dflg = false, /* home directory for new account */
|
|
|
|
Dflg = false, /* set/show new user default values */
|
|
|
|
eflg = false, /* days since 1970-01-01 when account is locked */
|
|
|
|
fflg = false, /* days until account with expired password is locked */
|
2022-07-20 07:47:16 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
Fflg = false, /* update /etc/subuid and /etc/subgid even if -r option is given */
|
|
|
|
#endif
|
2008-06-10 03:38:08 +05:30
|
|
|
gflg = false, /* primary group ID for new account */
|
|
|
|
Gflg = false, /* secondary group set for new account */
|
|
|
|
kflg = false, /* specify a directory to fill new user directory */
|
2008-09-05 02:16:00 +05:30
|
|
|
lflg = false, /* do not add user to lastlog/faillog databases */
|
2008-06-10 03:38:08 +05:30
|
|
|
mflg = false, /* create user's home directory if it doesn't exist */
|
2008-09-14 19:12:10 +05:30
|
|
|
Mflg = false, /* do not create user's home directory even if CREATE_HOME is set */
|
2008-06-10 03:38:08 +05:30
|
|
|
Nflg = false, /* do not create a group having the same name as the user, but add the user to def_group (or the group specified with -g) */
|
|
|
|
oflg = false, /* permit non-unique user ID to be specified with -u */
|
|
|
|
rflg = false, /* create a system account */
|
|
|
|
sflg = false, /* shell program for new account */
|
2019-01-21 14:02:36 +05:30
|
|
|
subvolflg = false, /* create subvolume home on BTRFS */
|
2008-06-10 03:38:08 +05:30
|
|
|
uflg = false, /* specify user ID for new account */
|
2011-07-30 07:17:52 +05:30
|
|
|
Uflg = false; /* create a group having the same name as the user */
|
2008-06-10 03:38:08 +05:30
|
|
|
|
2011-11-22 03:32:15 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
#define Zflg ('\0' != *user_selinux)
|
|
|
|
#endif /* WITH_SELINUX */
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
static bool home_added = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* exit status values
|
|
|
|
*/
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
/*@-exitarg@*/
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_SUCCESS 0 /* success */
|
|
|
|
#define E_PW_UPDATE 1 /* can't update password file */
|
2007-10-07 17:15:23 +05:30
|
|
|
#define E_USAGE 2 /* invalid command syntax */
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_BAD_ARG 3 /* invalid argument to option */
|
2007-10-07 17:16:25 +05:30
|
|
|
#define E_UID_IN_USE 4 /* UID already in use (and no -o) */
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_NOTFOUND 6 /* specified group doesn't exist */
|
2022-07-27 23:32:12 +05:30
|
|
|
#define E_NAME_IN_USE 9 /* username or group name already in use */
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_GRP_UPDATE 10 /* can't update group file */
|
|
|
|
#define E_HOMEDIR 12 /* can't create home directory */
|
2020-02-05 19:34:39 +05:30
|
|
|
#define E_MAILBOXFILE 13 /* can't create mailbox file */
|
2012-05-20 17:56:54 +05:30
|
|
|
#define E_SE_UPDATE 14 /* can't update SELinux user mapping */
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
#define E_SUB_UID_UPDATE 16 /* can't update the subordinate uid file */
|
|
|
|
#define E_SUB_GID_UPDATE 18 /* can't update the subordinate gid file */
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:15:23 +05:30
|
|
|
#define DGROUP "GROUP="
|
2022-10-19 05:00:14 +05:30
|
|
|
#define DGROUPS "GROUPS="
|
2009-09-08 18:41:03 +05:30
|
|
|
#define DHOME "HOME="
|
|
|
|
#define DSHELL "SHELL="
|
|
|
|
#define DINACT "INACTIVE="
|
|
|
|
#define DEXPIRE "EXPIRE="
|
|
|
|
#define DSKEL "SKEL="
|
2022-11-09 19:11:31 +05:30
|
|
|
#define DUSRSKEL "USRSKEL="
|
2009-09-08 18:41:03 +05:30
|
|
|
#define DCREATE_MAIL_SPOOL "CREATE_MAIL_SPOOL="
|
2021-09-21 09:12:21 +05:30
|
|
|
#define DLOG_INIT "LOG_INIT="
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/* local function prototypes */
|
2007-10-07 17:14:59 +05:30
|
|
|
static void fail_exit (int);
|
|
|
|
static void get_defaults (void);
|
|
|
|
static void show_defaults (void);
|
|
|
|
static int set_defaults (void);
|
|
|
|
static int get_groups (char *);
|
2020-03-30 12:38:23 +05:30
|
|
|
static struct group * get_local_group (char * grp_name);
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
static void usage (int status);
|
2007-10-07 17:14:59 +05:30
|
|
|
static void new_pwent (struct passwd *);
|
|
|
|
|
|
|
|
static long scale_age (long);
|
|
|
|
static void new_spent (struct spwd *);
|
|
|
|
static void grp_update (void);
|
|
|
|
|
|
|
|
static void process_flags (int argc, char **argv);
|
|
|
|
static void close_files (void);
|
2020-03-30 12:38:23 +05:30
|
|
|
static void close_group_files (void);
|
|
|
|
static void unlock_group_files (void);
|
2007-10-07 17:14:59 +05:30
|
|
|
static void open_files (void);
|
2020-03-30 12:38:23 +05:30
|
|
|
static void open_group_files (void);
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
static void open_shadow (void);
|
2007-10-07 17:14:59 +05:30
|
|
|
static void faillog_reset (uid_t);
|
|
|
|
static void lastlog_reset (uid_t);
|
2019-12-19 02:23:58 +05:30
|
|
|
static void tallylog_reset (const char *);
|
2021-08-10 12:37:03 +05:30
|
|
|
static void usr_update (unsigned long subuid_count, unsigned long subgid_count);
|
2007-10-07 17:14:59 +05:30
|
|
|
static void create_home (void);
|
2007-10-07 17:15:40 +05:30
|
|
|
static void create_mail (void);
|
2020-04-11 20:15:54 +05:30
|
|
|
static void check_uid_range(int rflg, uid_t user_id);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* fail_exit - undo as much as possible
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void fail_exit (int code)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (home_added) {
|
2016-05-15 19:19:39 +05:30
|
|
|
if (rmdir (prefix_user_home) != 0) {
|
2010-03-19 16:31:32 +05:30
|
|
|
fprintf (stderr,
|
2010-03-19 00:27:03 +05:30
|
|
|
_("%s: %s was created, but could not be removed\n"),
|
2016-05-15 19:19:39 +05:30
|
|
|
Prog, prefix_user_home);
|
|
|
|
SYSLOG ((LOG_ERR, "failed to remove %s", prefix_user_home));
|
2010-03-19 00:27:03 +05:30
|
|
|
}
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
if (spw_locked) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (spw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, spw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking shadow file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-03-09 04:14:53 +05:30
|
|
|
}
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
if (pw_locked) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (pw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, pw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking passwd file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-03-09 04:14:53 +05:30
|
|
|
}
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
if (gr_locked) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (gr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking group file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-03-09 04:14:53 +05:30
|
|
|
}
|
|
|
|
#ifdef SHADOWGRP
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
if (sgr_locked) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (sgr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking gshadow file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-03-09 04:14:53 +05:30
|
|
|
}
|
|
|
|
#endif
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
if (sub_uid_locked) {
|
|
|
|
if (sub_uid_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2013-08-07 00:02:59 +05:30
|
|
|
"unlocking subordinate user file",
|
2013-01-22 14:47:30 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (sub_gid_locked) {
|
|
|
|
if (sub_gid_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2013-08-07 00:02:59 +05:30
|
|
|
"unlocking subordinate group file",
|
2013-01-22 14:47:30 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2008-03-09 04:14:53 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2020-11-17 21:28:40 +05:30
|
|
|
SYSLOG ((LOG_INFO, "failed adding user '%s', exit code: %d", user_name, code));
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (code);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
#define MATCH(x,y) (strncmp((x),(y),strlen(y)) == 0)
|
|
|
|
|
|
|
|
/*
|
|
|
|
* get_defaults - read the defaults file
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* get_defaults() reads the defaults file for this command. It sets the
|
|
|
|
* various values from the file, or uses built-in default values if the
|
|
|
|
* file does not exist.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void get_defaults (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
FILE *fp;
|
2018-10-12 13:44:02 +05:30
|
|
|
char *default_file = USER_DEFAULTS_FILE;
|
2007-10-07 17:14:02 +05:30
|
|
|
char buf[1024];
|
2009-04-11 04:05:32 +05:30
|
|
|
char *cp;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
size_t len;
|
|
|
|
int wlen;
|
|
|
|
|
|
|
|
len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
|
2023-02-05 03:11:18 +05:30
|
|
|
default_file = MALLOCARRAY(len, char);
|
2018-10-12 13:44:02 +05:30
|
|
|
if (default_file == NULL)
|
|
|
|
return;
|
2016-05-15 19:19:39 +05:30
|
|
|
wlen = snprintf(default_file, len, "%s/%s", prefix, USER_DEFAULTS_FILE);
|
|
|
|
assert (wlen == (int) len -1);
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Open the defaults file for reading.
|
|
|
|
*/
|
|
|
|
|
2016-05-15 19:19:39 +05:30
|
|
|
fp = fopen (default_file, "r");
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == fp) {
|
2018-10-12 13:44:02 +05:30
|
|
|
goto getdef_err;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Read the file a line at a time. Only the lines that have relevant
|
|
|
|
* values are used, everything else can be ignored.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2023-02-01 18:20:48 +05:30
|
|
|
while (fgets (buf, sizeof buf, fp) == buf) {
|
2008-06-10 03:38:08 +05:30
|
|
|
cp = strrchr (buf, '\n');
|
|
|
|
if (NULL != cp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
*cp = '\0';
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
cp = strchr (buf, '=');
|
|
|
|
if (NULL == cp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
cp++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Primary GROUP identifier
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
if (MATCH (buf, DGROUP)) {
|
2016-05-15 19:19:39 +05:30
|
|
|
const struct group *grp = prefix_getgr_nam_gid (cp);
|
2009-03-09 02:13:15 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-03-09 02:13:15 +05:30
|
|
|
_("%s: group '%s' does not exist\n"),
|
|
|
|
Prog, cp);
|
2009-04-11 04:04:04 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: the %s configuration in %s will be ignored\n"),
|
2016-05-15 19:19:39 +05:30
|
|
|
Prog, DGROUP, default_file);
|
2009-03-09 02:13:15 +05:30
|
|
|
} else {
|
|
|
|
def_group = grp->gr_gid;
|
|
|
|
def_gname = xstrdup (grp->gr_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2022-10-19 05:00:14 +05:30
|
|
|
if (MATCH (buf, DGROUPS)) {
|
|
|
|
if (get_groups (cp) != 0) {
|
|
|
|
fprintf (stderr,
|
2022-12-30 17:21:29 +05:30
|
|
|
_("%s: the '%s' configuration in %s has an invalid group, ignoring the bad group\n"),
|
2022-10-19 05:00:14 +05:30
|
|
|
Prog, DGROUPS, default_file);
|
|
|
|
}
|
|
|
|
if (user_groups[0] != NULL) {
|
|
|
|
do_grp_update = true;
|
|
|
|
def_groups = xstrdup (cp);
|
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Default HOME filesystem
|
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DHOME)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
def_home = xstrdup (cp);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Default Login Shell command
|
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DSHELL)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
def_shell = xstrdup (cp);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:15:23 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Default Password Inactive value
|
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DINACT)) {
|
2009-04-11 04:04:04 +05:30
|
|
|
if ( (getlong (cp, &def_inactive) == 0)
|
|
|
|
|| (def_inactive < -1)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid numeric argument '%s'\n"),
|
2011-09-18 23:30:06 +05:30
|
|
|
Prog, cp);
|
2009-04-11 04:04:04 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: the %s configuration in %s will be ignored\n"),
|
2016-05-15 19:19:39 +05:30
|
|
|
Prog, DINACT, default_file);
|
2007-10-07 17:14:02 +05:30
|
|
|
def_inactive = -1;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Default account expiration date
|
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DEXPIRE)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
def_expire = xstrdup (cp);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Default Skeleton information
|
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DSKEL)) {
|
2008-06-10 03:38:08 +05:30
|
|
|
if ('\0' == *cp) {
|
2007-10-07 17:14:59 +05:30
|
|
|
cp = SKEL_DIR; /* XXX warning: const */
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2021-08-18 23:36:02 +05:30
|
|
|
|
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
size_t len;
|
|
|
|
int wlen;
|
|
|
|
char* _def_template; /* avoid const warning */
|
|
|
|
|
|
|
|
len = strlen(prefix) + strlen(cp) + 2;
|
2023-02-05 03:11:18 +05:30
|
|
|
_def_template = XMALLOCARRAY(len, char);
|
2016-05-15 19:19:39 +05:30
|
|
|
wlen = snprintf(_def_template, len, "%s/%s", prefix, cp);
|
|
|
|
assert (wlen == (int) len -1);
|
|
|
|
def_template = _def_template;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
def_template = xstrdup (cp);
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2022-11-09 19:11:31 +05:30
|
|
|
/*
|
|
|
|
* Default Usr Skeleton information
|
|
|
|
*/
|
|
|
|
else if (MATCH (buf, DUSRSKEL)) {
|
|
|
|
if ('\0' == *cp) {
|
|
|
|
cp = USRSKELDIR; /* XXX warning: const */
|
|
|
|
}
|
|
|
|
|
|
|
|
if(prefix[0]) {
|
|
|
|
size_t len;
|
|
|
|
int wlen;
|
|
|
|
char* _def_usrtemplate; /* avoid const warning */
|
|
|
|
|
|
|
|
len = strlen(prefix) + strlen(cp) + 2;
|
2023-02-05 03:11:18 +05:30
|
|
|
_def_usrtemplate = XMALLOCARRAY(len, char);
|
2022-11-09 19:11:31 +05:30
|
|
|
wlen = snprintf(_def_usrtemplate, len, "%s/%s", prefix, cp);
|
|
|
|
assert (wlen == (int) len -1);
|
|
|
|
def_usrtemplate = _def_usrtemplate;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
def_usrtemplate = xstrdup (cp);
|
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:15:40 +05:30
|
|
|
/*
|
2007-10-07 17:16:52 +05:30
|
|
|
* Create by default user mail spool or not ?
|
2007-10-07 17:15:40 +05:30
|
|
|
*/
|
2009-09-08 18:41:03 +05:30
|
|
|
else if (MATCH (buf, DCREATE_MAIL_SPOOL)) {
|
2008-06-10 03:38:08 +05:30
|
|
|
if (*cp == '\0') {
|
2009-09-08 18:46:58 +05:30
|
|
|
cp = "no"; /* XXX warning: const */
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:15:40 +05:30
|
|
|
|
|
|
|
def_create_mail_spool = xstrdup (cp);
|
|
|
|
}
|
2021-09-21 09:12:21 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* By default do we add the user to the lastlog and faillog databases ?
|
|
|
|
*/
|
|
|
|
else if (MATCH (buf, DLOG_INIT)) {
|
|
|
|
if (*cp == '\0') {
|
|
|
|
cp = def_log_init; /* XXX warning: const */
|
|
|
|
}
|
|
|
|
def_log_init = xstrdup (cp);
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2009-04-11 20:25:49 +05:30
|
|
|
(void) fclose (fp);
|
2018-10-12 13:44:02 +05:30
|
|
|
getdef_err:
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
free(default_file);
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* show_defaults - show the contents of the defaults file
|
|
|
|
*
|
|
|
|
* show_defaults() displays the values that are used from the default
|
|
|
|
* file and the built-in values.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void show_defaults (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:15:49 +05:30
|
|
|
printf ("GROUP=%u\n", (unsigned int) def_group);
|
2022-10-19 05:00:14 +05:30
|
|
|
printf ("GROUPS=%s\n", def_groups);
|
2007-10-07 17:15:49 +05:30
|
|
|
printf ("HOME=%s\n", def_home);
|
|
|
|
printf ("INACTIVE=%ld\n", def_inactive);
|
|
|
|
printf ("EXPIRE=%s\n", def_expire);
|
|
|
|
printf ("SHELL=%s\n", def_shell);
|
|
|
|
printf ("SKEL=%s\n", def_template);
|
2022-11-09 19:11:31 +05:30
|
|
|
printf ("USRSKEL=%s\n", def_usrtemplate);
|
2007-10-07 17:15:49 +05:30
|
|
|
printf ("CREATE_MAIL_SPOOL=%s\n", def_create_mail_spool);
|
2021-09-21 09:12:21 +05:30
|
|
|
printf ("LOG_INIT=%s\n", def_log_init);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* set_defaults - write new defaults file
|
|
|
|
*
|
|
|
|
* set_defaults() re-writes the defaults file using the values that
|
2007-10-07 17:14:59 +05:30
|
|
|
* are currently set. Duplicated lines are pruned, missing lines are
|
2007-10-07 17:14:02 +05:30
|
|
|
* added, and unrecognized lines are copied as is.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static int set_defaults (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
FILE *ifp;
|
|
|
|
FILE *ofp;
|
2009-05-10 19:19:03 +05:30
|
|
|
char buf[1024];
|
2018-10-12 13:44:02 +05:30
|
|
|
char *new_file = NULL;
|
2021-12-29 14:36:39 +05:30
|
|
|
char *new_file_dup = NULL;
|
2018-10-12 13:44:02 +05:30
|
|
|
char *default_file = USER_DEFAULTS_FILE;
|
2007-10-07 17:14:59 +05:30
|
|
|
char *cp;
|
|
|
|
int ofd;
|
2009-04-25 04:53:51 +05:30
|
|
|
int wlen;
|
2008-06-10 03:38:08 +05:30
|
|
|
bool out_group = false;
|
2022-10-19 05:00:14 +05:30
|
|
|
bool out_groups = false;
|
2008-06-10 03:38:08 +05:30
|
|
|
bool out_home = false;
|
|
|
|
bool out_inactive = false;
|
|
|
|
bool out_expire = false;
|
|
|
|
bool out_shell = false;
|
|
|
|
bool out_skel = false;
|
2022-11-09 19:11:31 +05:30
|
|
|
bool out_usrskel = false;
|
2008-06-10 03:38:08 +05:30
|
|
|
bool out_create_mail_spool = false;
|
2021-09-21 09:12:21 +05:30
|
|
|
bool out_log_init = false;
|
2018-10-12 13:44:02 +05:30
|
|
|
size_t len;
|
|
|
|
int ret = -1;
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2016-05-15 19:19:39 +05:30
|
|
|
|
2018-10-12 13:44:02 +05:30
|
|
|
len = strlen(prefix) + strlen(NEW_USER_FILE) + 2;
|
2023-02-05 03:11:18 +05:30
|
|
|
new_file = MALLOCARRAY(len, char);
|
2018-10-12 13:44:02 +05:30
|
|
|
if (new_file == NULL) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot create new defaults file: %s\n"),
|
|
|
|
Prog, strerror(errno));
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
wlen = snprintf(new_file, len, "%s%s%s", prefix, prefix[0]?"/":"", NEW_USER_FILE);
|
|
|
|
assert (wlen <= (int) len -1);
|
2016-05-15 19:19:39 +05:30
|
|
|
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
|
2023-02-05 03:11:18 +05:30
|
|
|
default_file = MALLOCARRAY(len, char);
|
2018-10-12 13:44:02 +05:30
|
|
|
if (default_file == NULL) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot create new defaults file: %s\n"),
|
|
|
|
Prog, strerror(errno));
|
|
|
|
goto setdef_err;
|
|
|
|
}
|
2016-05-15 19:19:39 +05:30
|
|
|
wlen = snprintf(default_file, len, "%s/%s", prefix, USER_DEFAULTS_FILE);
|
|
|
|
assert (wlen == (int) len -1);
|
|
|
|
}
|
|
|
|
|
2021-12-29 14:36:39 +05:30
|
|
|
new_file_dup = strdup(new_file);
|
|
|
|
if (new_file_dup == NULL) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot create directory for defaults file\n"),
|
|
|
|
Prog);
|
|
|
|
goto setdef_err;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = mkdir(dirname(new_file_dup), 0755);
|
2021-07-26 02:49:56 +05:30
|
|
|
if (-1 == ret && EEXIST != errno) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot create directory for defaults file\n"),
|
|
|
|
Prog);
|
2021-12-29 14:36:39 +05:30
|
|
|
free(new_file_dup);
|
2021-07-26 02:49:56 +05:30
|
|
|
goto setdef_err;
|
|
|
|
}
|
2021-12-29 14:36:39 +05:30
|
|
|
free(new_file_dup);
|
2021-07-26 02:49:56 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Create a temporary file to copy the new output to.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
ofd = mkstemp (new_file);
|
|
|
|
if (-1 == ofd) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: cannot create new defaults file\n"),
|
|
|
|
Prog);
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2007-10-07 17:14:59 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
ofp = fdopen (ofd, "w");
|
|
|
|
if (NULL == ofp) {
|
2009-04-11 04:03:57 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot open new defaults file\n"),
|
|
|
|
Prog);
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Open the existing defaults file and copy the lines to the
|
2007-10-07 17:14:59 +05:30
|
|
|
* temporary file, using any new values. Each line is checked
|
2007-10-07 17:14:02 +05:30
|
|
|
* to insure that it is not output more than once.
|
|
|
|
*/
|
2016-05-15 19:19:39 +05:30
|
|
|
ifp = fopen (default_file, "r");
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == ifp) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (ofp, "# useradd defaults file\n");
|
2007-10-07 17:14:02 +05:30
|
|
|
goto skip;
|
|
|
|
}
|
|
|
|
|
2023-02-01 18:20:48 +05:30
|
|
|
while (fgets (buf, sizeof buf, ifp) == buf) {
|
2008-06-10 03:38:08 +05:30
|
|
|
cp = strrchr (buf, '\n');
|
|
|
|
if (NULL != cp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
*cp = '\0';
|
2009-05-10 19:19:03 +05:30
|
|
|
} else {
|
|
|
|
/* A line which does not end with \n is only valid
|
|
|
|
* at the end of the file.
|
|
|
|
*/
|
|
|
|
if (feof (ifp) == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: line too long in %s: %s..."),
|
2016-05-15 19:19:39 +05:30
|
|
|
Prog, default_file, buf);
|
* src/newgrp.c: Limit the scope of variable pid.
* src/login_nopam.c: Limit the scope of variables end, lineno, i,
str_len.
* src/logoutd.c: Limit the scope of variable c.
* src/vipw.c: Re-indent.
* src/vipw.c: Close the file after the creation of the backup.
* src/useradd.c (set_default): Close input file on failure.
* src/useradd.c: Limit the scope of variables spool, file, fd, gr,
gid, mode.
* src/passwd.c: Limit the scope of variables last and ok.
* src/chage.c: Fix typo (non breaking space).
* src/login.c: Limit the scope of variables erasechar killchar, c,
failed.
* src/groups.c: Limit the scope of variable ngroups, pri_grp, i.
* src/id.c: Limit the scope of variable i.
2010-03-23 16:56:34 +05:30
|
|
|
(void) fclose (ifp);
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2009-05-10 19:19:03 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
if (!out_group && MATCH (buf, DGROUP)) {
|
2007-10-07 17:16:07 +05:30
|
|
|
fprintf (ofp, DGROUP "%u\n", (unsigned int) def_group);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_group = true;
|
2022-10-19 05:00:14 +05:30
|
|
|
} else if (!out_groups && MATCH (buf, DGROUPS)) {
|
|
|
|
fprintf (ofp, DGROUPS "%s\n", def_groups);
|
|
|
|
out_groups = true;
|
2009-09-08 18:41:03 +05:30
|
|
|
} else if (!out_home && MATCH (buf, DHOME)) {
|
|
|
|
fprintf (ofp, DHOME "%s\n", def_home);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_home = true;
|
2009-09-08 18:41:03 +05:30
|
|
|
} else if (!out_inactive && MATCH (buf, DINACT)) {
|
|
|
|
fprintf (ofp, DINACT "%ld\n", def_inactive);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_inactive = true;
|
2009-09-08 18:41:03 +05:30
|
|
|
} else if (!out_expire && MATCH (buf, DEXPIRE)) {
|
|
|
|
fprintf (ofp, DEXPIRE "%s\n", def_expire);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_expire = true;
|
2009-09-08 18:41:03 +05:30
|
|
|
} else if (!out_shell && MATCH (buf, DSHELL)) {
|
|
|
|
fprintf (ofp, DSHELL "%s\n", def_shell);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_shell = true;
|
2009-09-08 18:41:03 +05:30
|
|
|
} else if (!out_skel && MATCH (buf, DSKEL)) {
|
|
|
|
fprintf (ofp, DSKEL "%s\n", def_template);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_skel = true;
|
2022-11-09 19:11:31 +05:30
|
|
|
} else if (!out_usrskel && MATCH (buf, DUSRSKEL)) {
|
|
|
|
fprintf (ofp, DUSRSKEL "%s\n", def_usrtemplate);
|
|
|
|
out_usrskel = true;
|
2007-10-07 17:15:40 +05:30
|
|
|
} else if (!out_create_mail_spool
|
2009-09-08 18:41:03 +05:30
|
|
|
&& MATCH (buf, DCREATE_MAIL_SPOOL)) {
|
2009-04-11 04:03:57 +05:30
|
|
|
fprintf (ofp,
|
2009-09-08 18:41:03 +05:30
|
|
|
DCREATE_MAIL_SPOOL "%s\n",
|
2009-04-11 04:03:57 +05:30
|
|
|
def_create_mail_spool);
|
2008-06-10 03:38:08 +05:30
|
|
|
out_create_mail_spool = true;
|
2021-09-21 09:12:21 +05:30
|
|
|
} else if (!out_log_init
|
|
|
|
&& MATCH (buf, DLOG_INIT)) {
|
|
|
|
fprintf (ofp,
|
|
|
|
DLOG_INIT "%s\n",
|
|
|
|
def_log_init);
|
|
|
|
out_log_init = true;
|
2007-10-07 17:14:59 +05:30
|
|
|
} else
|
|
|
|
fprintf (ofp, "%s\n", buf);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
(void) fclose (ifp);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
skip:
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Check each line to insure that every line was output. This
|
2007-10-07 17:14:02 +05:30
|
|
|
* causes new values to be added to a file which did not previously
|
|
|
|
* have an entry for that value.
|
|
|
|
*/
|
|
|
|
if (!out_group)
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (ofp, DGROUP "%u\n", (unsigned int) def_group);
|
2022-10-19 05:00:14 +05:30
|
|
|
if (!out_groups)
|
|
|
|
fprintf (ofp, DGROUPS "%s\n", def_groups);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!out_home)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DHOME "%s\n", def_home);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!out_inactive)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DINACT "%ld\n", def_inactive);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!out_expire)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DEXPIRE "%s\n", def_expire);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!out_shell)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DSHELL "%s\n", def_shell);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!out_skel)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DSKEL "%s\n", def_template);
|
2022-11-09 19:11:31 +05:30
|
|
|
if (!out_usrskel)
|
|
|
|
fprintf (ofp, DUSRSKEL "%s\n", def_usrtemplate);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:15:40 +05:30
|
|
|
if (!out_create_mail_spool)
|
2009-09-08 18:41:03 +05:30
|
|
|
fprintf (ofp, DCREATE_MAIL_SPOOL "%s\n", def_create_mail_spool);
|
2021-09-21 09:12:21 +05:30
|
|
|
if (!out_log_init)
|
|
|
|
fprintf (ofp, DLOG_INIT "%s\n", def_log_init);
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Flush and close the file. Check for errors to make certain
|
2007-10-07 17:14:02 +05:30
|
|
|
* the new file is intact.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
(void) fflush (ofp);
|
2009-03-22 00:48:06 +05:30
|
|
|
if ( (ferror (ofp) != 0)
|
|
|
|
|| (fsync (fileno (ofp)) != 0)
|
|
|
|
|| (fclose (ofp) != 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
unlink (new_file);
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Rename the current default file to its backup name.
|
|
|
|
*/
|
2016-05-15 19:19:39 +05:30
|
|
|
wlen = snprintf (buf, sizeof buf, "%s-", default_file);
|
2009-05-10 23:56:33 +05:30
|
|
|
assert (wlen < (int) sizeof buf);
|
2012-05-19 01:58:16 +05:30
|
|
|
unlink (buf);
|
2016-05-15 19:19:39 +05:30
|
|
|
if ((link (default_file, buf) != 0) && (ENOENT != errno)) {
|
2009-04-25 04:53:51 +05:30
|
|
|
int err = errno;
|
|
|
|
fprintf (stderr,
|
2012-05-19 01:58:16 +05:30
|
|
|
_("%s: Cannot create backup file (%s): %s\n"),
|
|
|
|
Prog, buf, strerror (err));
|
2007-10-07 17:14:59 +05:30
|
|
|
unlink (new_file);
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Rename the new default file to its correct name.
|
|
|
|
*/
|
2016-05-15 19:19:39 +05:30
|
|
|
if (rename (new_file, default_file) != 0) {
|
2009-04-25 04:53:51 +05:30
|
|
|
int err = errno;
|
|
|
|
fprintf (stderr,
|
2011-09-18 23:30:06 +05:30
|
|
|
_("%s: rename: %s: %s\n"),
|
2009-04-25 04:53:51 +05:30
|
|
|
Prog, new_file, strerror (err));
|
2018-10-12 13:44:02 +05:30
|
|
|
goto setdef_err;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_USYS_CONFIG, Prog,
|
|
|
|
"changing useradd defaults",
|
2008-09-05 01:05:48 +05:30
|
|
|
NULL, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_SUCCESS);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:57 +05:30
|
|
|
"useradd defaults: GROUP=%u, HOME=%s, SHELL=%s, INACTIVE=%ld, "
|
2021-09-21 09:12:21 +05:30
|
|
|
"EXPIRE=%s, SKEL=%s, CREATE_MAIL_SPOOL=%s, LOG_INIT=%s",
|
2009-04-11 04:03:57 +05:30
|
|
|
(unsigned int) def_group, def_home, def_shell,
|
|
|
|
def_inactive, def_expire, def_template,
|
2021-09-21 09:12:21 +05:30
|
|
|
def_create_mail_spool, def_log_init));
|
2018-10-12 13:44:02 +05:30
|
|
|
ret = 0;
|
|
|
|
setdef_err:
|
|
|
|
free(new_file);
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
free(default_file);
|
|
|
|
}
|
|
|
|
|
2018-10-12 13:44:02 +05:30
|
|
|
return ret;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* get_groups - convert a list of group names to an array of group IDs
|
|
|
|
*
|
|
|
|
* get_groups() takes a comma-separated list of group names and
|
2007-10-07 17:14:59 +05:30
|
|
|
* converts it to a NULL-terminated array. Any unknown group
|
2007-10-07 17:14:02 +05:30
|
|
|
* names are reported as errors.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static int get_groups (char *list)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
char *cp;
|
2020-10-27 16:05:53 +05:30
|
|
|
struct group *grp;
|
2007-10-07 17:14:02 +05:30
|
|
|
int errors = 0;
|
|
|
|
int ngroups = 0;
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
if ('\0' == *list) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return 0;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
/*
|
|
|
|
* Open the group files
|
|
|
|
*/
|
|
|
|
open_group_files ();
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* So long as there is some data to be converted, strip off
|
2007-10-07 17:14:59 +05:30
|
|
|
* each name and look it up. A mix of numerical and string
|
2007-10-07 17:14:02 +05:30
|
|
|
* values for group identifiers is permitted.
|
|
|
|
*/
|
|
|
|
do {
|
|
|
|
/*
|
|
|
|
* Strip off a single name from the list
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
cp = strchr (list, ',');
|
|
|
|
if (NULL != cp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
*cp++ = '\0';
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Names starting with digits are treated as numerical
|
|
|
|
* GID values, otherwise the string is looked up as is.
|
|
|
|
*/
|
2020-03-30 12:38:23 +05:30
|
|
|
grp = get_local_group (list);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* There must be a match, either by GID value or by
|
|
|
|
* string name.
|
2011-09-18 23:30:06 +05:30
|
|
|
* FIXME: It should exist according to gr_locate,
|
|
|
|
* otherwise, we can't change its members
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == grp) {
|
2009-04-11 04:03:57 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: group '%s' does not exist\n"),
|
|
|
|
Prog, list);
|
2007-10-07 17:14:02 +05:30
|
|
|
errors++;
|
|
|
|
}
|
|
|
|
list = cp;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the group doesn't exist, don't dump core...
|
|
|
|
* Instead, try the next one. --marekm
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
#ifdef USE_NIS
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Don't add this group if they are an NIS group. Tell
|
2007-10-07 17:14:02 +05:30
|
|
|
* the user to go to the server for this group.
|
|
|
|
*/
|
|
|
|
if (__isgrNIS ()) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: group '%s' is a NIS group.\n"),
|
|
|
|
Prog, grp->gr_name);
|
2020-12-17 13:57:15 +05:30
|
|
|
gr_free(grp);
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:14:51 +05:30
|
|
|
if (ngroups == sys_ngroups) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: too many groups specified (max %d).\n"),
|
|
|
|
Prog, ngroups);
|
2020-12-17 13:57:15 +05:30
|
|
|
gr_free(grp);
|
2007-10-07 17:14:02 +05:30
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Add the group name to the user's list of groups.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
user_groups[ngroups++] = xstrdup (grp->gr_name);
|
2020-12-17 13:57:15 +05:30
|
|
|
gr_free (grp);
|
2008-06-10 03:38:08 +05:30
|
|
|
} while (NULL != list);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
close_group_files ();
|
|
|
|
unlock_group_files ();
|
|
|
|
|
2023-02-01 07:20:14 +05:30
|
|
|
user_groups[ngroups] = NULL;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Any errors in finding group names are fatal
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (0 != errors) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return -1;
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
/*
|
|
|
|
* get_local_group - checks if a given group name exists locally
|
|
|
|
*
|
|
|
|
* get_local_group() checks if a given group name exists locally.
|
|
|
|
* If the name exists the group information is returned, otherwise NULL is
|
|
|
|
* returned.
|
|
|
|
*/
|
|
|
|
static struct group * get_local_group(char * grp_name)
|
|
|
|
{
|
|
|
|
const struct group *grp;
|
|
|
|
struct group *result_grp = NULL;
|
|
|
|
long long int gid;
|
|
|
|
char *endptr;
|
|
|
|
|
|
|
|
gid = strtoll (grp_name, &endptr, 10);
|
|
|
|
if ( ('\0' != *grp_name)
|
|
|
|
&& ('\0' == *endptr)
|
|
|
|
&& (ERANGE != errno)
|
|
|
|
&& (gid == (gid_t)gid)) {
|
2023-02-01 18:20:48 +05:30
|
|
|
grp = gr_locate_gid (gid);
|
2020-03-30 12:38:23 +05:30
|
|
|
}
|
|
|
|
else {
|
|
|
|
grp = gr_locate(grp_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (grp != NULL) {
|
|
|
|
result_grp = __gr_dup (grp);
|
|
|
|
if (NULL == result_grp) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: Out of memory. Cannot find group '%s'.\n"),
|
|
|
|
Prog, grp_name);
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return result_grp;
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* usage - display usage message and exit
|
|
|
|
*/
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
static void usage (int status)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
* src/userdel.c, src/lastlog.c, src/gpasswd.c, src/newusers.c,
src/chpasswd.c, src/groupmems.c, src/usermod.c, src/chgpasswd.c,
src/vipw.c, src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c,
src/groupadd.c, src/chage.c, src/faillog.c, src/chsh.c: Use
booleans for tests.
* src/userdel.c, src/gpasswd.c, src/groupmems.c, src/usermod.c,
src/groupmod.c, src/passwd.c: Use a break even after usage().
2009-09-06 04:01:29 +05:30
|
|
|
FILE *usageout = (E_SUCCESS != status) ? stderr : stdout;
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
(void) fprintf (usageout,
|
2009-09-05 03:39:58 +05:30
|
|
|
_("Usage: %s [options] LOGIN\n"
|
2011-09-18 23:30:06 +05:30
|
|
|
" %s -D\n"
|
|
|
|
" %s -D [options]\n"
|
2009-06-06 03:46:56 +05:30
|
|
|
"\n"
|
|
|
|
"Options:\n"),
|
2011-10-19 01:43:37 +05:30
|
|
|
Prog, Prog, Prog);
|
2022-05-04 13:03:59 +05:30
|
|
|
(void) fputs (_(" --badname do not check for bad names\n"), usageout);
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -b, --base-dir BASE_DIR base directory for the home directory of the\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" new account\n"), usageout);
|
2019-01-23 20:47:05 +05:30
|
|
|
#ifdef WITH_BTRFS
|
2019-01-21 14:02:36 +05:30
|
|
|
(void) fputs (_(" --btrfs-subvolume-home use BTRFS subvolume for home directory\n"), usageout);
|
2019-01-23 20:47:05 +05:30
|
|
|
#endif
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
(void) fputs (_(" -c, --comment COMMENT GECOS field of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -d, --home-dir HOME_DIR home directory of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -D, --defaults print or change default useradd configuration\n"), usageout);
|
|
|
|
(void) fputs (_(" -e, --expiredate EXPIRE_DATE expiration date of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -f, --inactive INACTIVE password inactivity period of the new account\n"), usageout);
|
2022-07-20 07:47:16 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
(void) fputs (_(" -F, --add-subids-for-system add entries to sub[ud]id even when adding a system user\n"), usageout);
|
|
|
|
#endif
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -g, --gid GROUP name or ID of the primary group of the new\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" account\n"), usageout);
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -G, --groups GROUPS list of supplementary groups of the new\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" account\n"), usageout);
|
|
|
|
(void) fputs (_(" -h, --help display this help message and exit\n"), usageout);
|
|
|
|
(void) fputs (_(" -k, --skel SKEL_DIR use this alternative skeleton directory\n"), usageout);
|
|
|
|
(void) fputs (_(" -K, --key KEY=VALUE override /etc/login.defs defaults\n"), usageout);
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -l, --no-log-init do not add the user to the lastlog and\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" faillog databases\n"), usageout);
|
|
|
|
(void) fputs (_(" -m, --create-home create the user's home directory\n"), usageout);
|
|
|
|
(void) fputs (_(" -M, --no-create-home do not create the user's home directory\n"), usageout);
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -N, --no-user-group do not create a group with the same name as\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" the user\n"), usageout);
|
2009-06-06 03:46:56 +05:30
|
|
|
(void) fputs (_(" -o, --non-unique allow to create users with duplicate\n"
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
" (non-unique) UID\n"), usageout);
|
|
|
|
(void) fputs (_(" -p, --password PASSWORD encrypted password of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -r, --system create a system account\n"), usageout);
|
2011-11-07 00:07:25 +05:30
|
|
|
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
|
2016-05-15 19:19:39 +05:30
|
|
|
(void) fputs (_(" -P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files\n"), usageout);
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
(void) fputs (_(" -s, --shell SHELL login shell of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -u, --uid UID user ID of the new account\n"), usageout);
|
|
|
|
(void) fputs (_(" -U, --user-group create a group with the same name as the user\n"), usageout);
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
(void) fputs (_(" -Z, --selinux-user SEUSER use a specific SEUSER for the SELinux user mapping\n"), usageout);
|
2023-04-01 18:04:56 +05:30
|
|
|
(void) fputs (_(" --selinux-range SERANGE use a specific MLS range for the SELinux user mapping\n"), usageout);
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
#endif /* WITH_SELINUX */
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
(void) fputs ("\n", usageout);
|
|
|
|
exit (status);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* new_pwent - initialize the values in a password file entry
|
|
|
|
*
|
|
|
|
* new_pwent() takes all of the values that have been entered and
|
|
|
|
* fills in a (struct passwd) with them.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void new_pwent (struct passwd *pwent)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
memzero (pwent, sizeof *pwent);
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_name = (char *) user_name;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (is_shadow_pwd) {
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_passwd = (char *) SHADOW_PASSWD_STRING;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
} else {
|
2007-10-07 17:14:59 +05:30
|
|
|
pwent->pw_passwd = (char *) user_pass;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
pwent->pw_uid = user_id;
|
|
|
|
pwent->pw_gid = user_gid;
|
|
|
|
pwent->pw_gecos = (char *) user_comment;
|
|
|
|
pwent->pw_dir = (char *) user_home;
|
|
|
|
pwent->pw_shell = (char *) user_shell;
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
static long scale_age (long x)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (x <= 0) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return x;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
return x * (DAY / SCALE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* new_spent - initialize the values in a shadow password file entry
|
|
|
|
*
|
|
|
|
* new_spent() takes all of the values that have been entered and
|
|
|
|
* fills in a (struct spwd) with them.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void new_spent (struct spwd *spent)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
memzero (spent, sizeof *spent);
|
2007-10-07 17:14:02 +05:30
|
|
|
spent->sp_namp = (char *) user_name;
|
|
|
|
spent->sp_pwdp = (char *) user_pass;
|
2023-02-01 18:20:48 +05:30
|
|
|
spent->sp_lstchg = gettime () / SCALE;
|
* libmisc/pwd2spwd.c, src/chpasswd.c, src/newusers.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/useradd.c,
src/usermod.c: On Jan 01, 1970, do not set the sp_lstchg field to
0 (which means that the password shall be changed during the next
login), but use -1 (password aging disabled).
* src/passwd.c: Do not check sp_min if sp_lstchg is null or -1.
2009-04-06 02:53:27 +05:30
|
|
|
if (0 == spent->sp_lstchg) {
|
|
|
|
/* Better disable aging than requiring a password change */
|
|
|
|
spent->sp_lstchg = -1;
|
|
|
|
}
|
2008-02-20 02:31:38 +05:30
|
|
|
if (!rflg) {
|
2008-05-20 02:01:48 +05:30
|
|
|
spent->sp_min = scale_age (getdef_num ("PASS_MIN_DAYS", -1));
|
|
|
|
spent->sp_max = scale_age (getdef_num ("PASS_MAX_DAYS", -1));
|
|
|
|
spent->sp_warn = scale_age (getdef_num ("PASS_WARN_AGE", -1));
|
|
|
|
spent->sp_inact = scale_age (def_inactive);
|
|
|
|
spent->sp_expire = scale_age (user_expire);
|
2008-02-20 02:31:38 +05:30
|
|
|
} else {
|
2011-09-18 23:30:06 +05:30
|
|
|
spent->sp_min = -1;
|
|
|
|
spent->sp_max = -1;
|
|
|
|
spent->sp_warn = -1;
|
|
|
|
spent->sp_inact = -1;
|
|
|
|
spent->sp_expire = -1;
|
2008-02-20 02:31:38 +05:30
|
|
|
}
|
2008-06-14 02:36:04 +05:30
|
|
|
spent->sp_flag = SHADOW_SP_FLAG_UNSET;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* grp_update - add user to secondary group set
|
|
|
|
*
|
|
|
|
* grp_update() takes the secondary group set given in user_groups
|
|
|
|
* and adds the user to each group given by that set.
|
2007-11-18 04:41:02 +05:30
|
|
|
*
|
|
|
|
* The group files are opened and locked in open_files().
|
|
|
|
*
|
|
|
|
* close_files() should be called afterwards to commit the changes
|
|
|
|
* and unlocking the group files.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void grp_update (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
const struct group *grp;
|
|
|
|
struct group *ngrp;
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
const struct sgrp *sgrp;
|
|
|
|
struct sgrp *nsgrp;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Scan through the entire group file looking for the groups that
|
|
|
|
* the user is a member of.
|
2011-09-18 23:30:06 +05:30
|
|
|
* FIXME: we currently do not check that all groups of user_groups
|
|
|
|
* were completed with the new user.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
for (gr_rewind (), grp = gr_next (); NULL != grp; grp = gr_next ()) {
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if the user specified this group as one of their
|
|
|
|
* concurrent groups.
|
|
|
|
*/
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (!is_on_list (user_groups, grp->gr_name)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Make a copy - gr_update() will free() everything
|
|
|
|
* from the old entry, and we need it later.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
ngrp = __gr_dup (grp);
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == ngrp) {
|
2007-11-17 05:09:42 +05:30
|
|
|
fprintf (stderr,
|
2008-08-30 23:57:59 +05:30
|
|
|
_("%s: Out of memory. Cannot update %s.\n"),
|
|
|
|
Prog, gr_dbname ());
|
2008-09-04 02:32:32 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to prepare the new %s entry '%s'", gr_dbname (), user_name));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"adding user to group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_GRP_UPDATE); /* XXX */
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2021-08-18 23:36:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:02 +05:30
|
|
|
* Add the username to the list of group members and
|
|
|
|
* update the group entry to reflect the change.
|
|
|
|
*/
|
|
|
|
ngrp->gr_mem = add_list (ngrp->gr_mem, user_name);
|
2008-06-10 03:38:08 +05:30
|
|
|
if (gr_update (ngrp) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, gr_dbname (), ngrp->gr_name);
|
2008-09-04 02:32:32 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to prepare the new %s entry '%s'", gr_dbname (), user_name));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"adding user to group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user to group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_SUCCESS);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2009-04-11 04:03:57 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
|
|
|
"add '%s' to group '%s'",
|
|
|
|
user_name, ngrp->gr_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (!is_shadow_grp)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Scan through the entire shadow group file looking for the groups
|
2007-10-07 17:14:59 +05:30
|
|
|
* that the user is a member of. The administrative list isn't
|
2007-10-07 17:14:02 +05:30
|
|
|
* modified.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
for (sgr_rewind (), sgrp = sgr_next (); NULL != sgrp; sgrp = sgr_next ()) {
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if the user specified this group as one of their
|
|
|
|
* concurrent groups.
|
2011-09-18 23:30:06 +05:30
|
|
|
* FIXME: is it really needed?
|
|
|
|
* This would be important only if the group is in
|
|
|
|
* user_groups. All these groups should be checked
|
|
|
|
* for existence with gr_locate already.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (gr_locate (sgrp->sg_name) == NULL) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (!is_on_list (user_groups, sgrp->sg_name)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Make a copy - sgr_update() will free() everything
|
|
|
|
* from the old entry, and we need it later.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
nsgrp = __sgr_dup (sgrp);
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == nsgrp) {
|
2007-11-17 05:09:42 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: Out of memory. Cannot update %s.\n"),
|
|
|
|
Prog, sgr_dbname ());
|
2008-09-04 02:32:32 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to prepare the new %s entry '%s'", sgr_dbname (), user_name));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"adding user to shadow group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_GRP_UPDATE); /* XXX */
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2021-08-18 23:36:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:02 +05:30
|
|
|
* Add the username to the list of group members and
|
|
|
|
* update the group entry to reflect the change.
|
|
|
|
*/
|
|
|
|
nsgrp->sg_mem = add_list (nsgrp->sg_mem, user_name);
|
2008-06-10 03:38:08 +05:30
|
|
|
if (sgr_update (nsgrp) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, sgr_dbname (), nsgrp->sg_name);
|
2008-09-04 02:32:32 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to prepare the new %s entry '%s'", sgr_dbname (), user_name));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"adding user to shadow group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user to shadow group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_SUCCESS);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2009-04-11 04:03:57 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
|
|
|
"add '%s' to shadow group '%s'",
|
|
|
|
user_name, nsgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
#endif /* SHADOWGRP */
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* process_flags - perform command line argument setting
|
|
|
|
*
|
|
|
|
* process_flags() interprets the command line arguments and sets
|
2007-10-07 17:14:59 +05:30
|
|
|
* the values that the user will be created with accordingly. The
|
2007-10-07 17:14:02 +05:30
|
|
|
* values are checked for sanity.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void process_flags (int argc, char **argv)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
const struct group *grp;
|
2008-06-10 03:38:08 +05:30
|
|
|
bool anyflag = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
char *cp;
|
2019-11-11 17:40:51 +05:30
|
|
|
struct stat st;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:16:34 +05:30
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Parse the command line options.
|
|
|
|
*/
|
|
|
|
int c;
|
|
|
|
static struct option long_options[] = {
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/faillog.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmems.c, src/groupmod.c, src/grpconv.c, src/grpunconv.c,
src/lastlog.c, src/newusers.c, src/passwd.c, src/pwconv.c,
src/pwunconv.c, src/su.c, src/useradd.c, src/userdel.c,
src/usermod.c, src/vipw.c: Align and sort options.
2011-11-07 00:09:59 +05:30
|
|
|
{"base-dir", required_argument, NULL, 'b'},
|
2019-01-23 20:47:05 +05:30
|
|
|
#ifdef WITH_BTRFS
|
2019-01-21 14:02:36 +05:30
|
|
|
{"btrfs-subvolume-home", no_argument, NULL, 200},
|
2019-01-23 20:47:05 +05:30
|
|
|
#endif
|
2022-05-04 13:03:59 +05:30
|
|
|
{"badname", no_argument, NULL, 201},
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/faillog.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmems.c, src/groupmod.c, src/grpconv.c, src/grpunconv.c,
src/lastlog.c, src/newusers.c, src/passwd.c, src/pwconv.c,
src/pwunconv.c, src/su.c, src/useradd.c, src/userdel.c,
src/usermod.c, src/vipw.c: Align and sort options.
2011-11-07 00:09:59 +05:30
|
|
|
{"comment", required_argument, NULL, 'c'},
|
|
|
|
{"home-dir", required_argument, NULL, 'd'},
|
|
|
|
{"defaults", no_argument, NULL, 'D'},
|
|
|
|
{"expiredate", required_argument, NULL, 'e'},
|
|
|
|
{"inactive", required_argument, NULL, 'f'},
|
2022-07-20 07:47:16 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
{"add-subids-for-system", no_argument,NULL, 'F'},
|
|
|
|
#endif
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/faillog.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmems.c, src/groupmod.c, src/grpconv.c, src/grpunconv.c,
src/lastlog.c, src/newusers.c, src/passwd.c, src/pwconv.c,
src/pwunconv.c, src/su.c, src/useradd.c, src/userdel.c,
src/usermod.c, src/vipw.c: Align and sort options.
2011-11-07 00:09:59 +05:30
|
|
|
{"gid", required_argument, NULL, 'g'},
|
|
|
|
{"groups", required_argument, NULL, 'G'},
|
|
|
|
{"help", no_argument, NULL, 'h'},
|
|
|
|
{"skel", required_argument, NULL, 'k'},
|
|
|
|
{"key", required_argument, NULL, 'K'},
|
|
|
|
{"no-log-init", no_argument, NULL, 'l'},
|
|
|
|
{"create-home", no_argument, NULL, 'm'},
|
|
|
|
{"no-create-home", no_argument, NULL, 'M'},
|
|
|
|
{"no-user-group", no_argument, NULL, 'N'},
|
|
|
|
{"non-unique", no_argument, NULL, 'o'},
|
|
|
|
{"password", required_argument, NULL, 'p'},
|
|
|
|
{"system", no_argument, NULL, 'r'},
|
|
|
|
{"root", required_argument, NULL, 'R'},
|
2016-05-15 19:19:39 +05:30
|
|
|
{"prefix", required_argument, NULL, 'P'},
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/faillog.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmems.c, src/groupmod.c, src/grpconv.c, src/grpunconv.c,
src/lastlog.c, src/newusers.c, src/passwd.c, src/pwconv.c,
src/pwunconv.c, src/su.c, src/useradd.c, src/userdel.c,
src/usermod.c, src/vipw.c: Align and sort options.
2011-11-07 00:09:59 +05:30
|
|
|
{"shell", required_argument, NULL, 's'},
|
|
|
|
{"uid", required_argument, NULL, 'u'},
|
|
|
|
{"user-group", no_argument, NULL, 'U'},
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/faillog.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmems.c, src/groupmod.c, src/grpconv.c, src/grpunconv.c,
src/lastlog.c, src/newusers.c, src/passwd.c, src/pwconv.c,
src/pwunconv.c, src/su.c, src/useradd.c, src/userdel.c,
src/usermod.c, src/vipw.c: Align and sort options.
2011-11-07 00:09:59 +05:30
|
|
|
{"selinux-user", required_argument, NULL, 'Z'},
|
2023-04-01 18:04:56 +05:30
|
|
|
{"selinux-range", required_argument, NULL, 202},
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
#endif /* WITH_SELINUX */
|
2007-10-07 17:16:34 +05:30
|
|
|
{NULL, 0, NULL, '\0'}
|
|
|
|
};
|
2009-04-11 04:04:04 +05:30
|
|
|
while ((c = getopt_long (argc, argv,
|
2022-07-20 07:13:02 +05:30
|
|
|
"b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U"
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2022-07-20 07:13:02 +05:30
|
|
|
"Z:"
|
|
|
|
#endif /* WITH_SELINUX */
|
2022-07-20 07:47:16 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
"F"
|
|
|
|
#endif /* ENABLE_SUBIDS */
|
2022-07-20 07:13:02 +05:30
|
|
|
"",
|
2009-04-11 04:05:32 +05:30
|
|
|
long_options, NULL)) != -1) {
|
2007-10-07 17:16:34 +05:30
|
|
|
switch (c) {
|
|
|
|
case 'b':
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if ( ( !VALID (optarg) )
|
|
|
|
|| ( optarg[0] != '/' )) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid base directory '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
def_home = optarg;
|
2008-06-10 03:38:08 +05:30
|
|
|
bflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2019-01-21 14:02:36 +05:30
|
|
|
case 200:
|
|
|
|
subvolflg = true;
|
|
|
|
break;
|
2019-08-24 02:12:37 +05:30
|
|
|
case 201:
|
|
|
|
allow_bad_names = true;
|
|
|
|
break;
|
2007-10-07 17:16:34 +05:30
|
|
|
case 'c':
|
|
|
|
if (!VALID (optarg)) {
|
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid comment '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
user_comment = optarg;
|
2008-06-10 03:38:08 +05:30
|
|
|
cflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'd':
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if ( ( !VALID (optarg) )
|
|
|
|
|| ( optarg[0] != '/' )) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid home directory '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
user_home = optarg;
|
2008-06-10 03:38:08 +05:30
|
|
|
dflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'D':
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (anyflag) {
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
Dflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'e':
|
2008-06-10 03:38:08 +05:30
|
|
|
if ('\0' != *optarg) {
|
2007-10-07 17:16:34 +05:30
|
|
|
user_expire = strtoday (optarg);
|
2010-03-18 17:23:49 +05:30
|
|
|
if (user_expire < -1) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid date '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
} else {
|
2007-10-07 17:16:34 +05:30
|
|
|
user_expire = -1;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
|
|
|
|
/*
|
2011-09-18 23:30:06 +05:30
|
|
|
* -e "" is allowed without /etc/shadow
|
|
|
|
* (it's a no-op in such case)
|
2007-10-07 17:16:34 +05:30
|
|
|
*/
|
2011-09-18 23:30:06 +05:30
|
|
|
if ((-1 != user_expire) && !is_shadow_pwd) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: shadow passwords required for -e\n"),
|
|
|
|
Prog);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (Dflg) {
|
2007-10-07 17:16:34 +05:30
|
|
|
def_expire = optarg;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
eflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'f':
|
2009-04-11 04:03:50 +05:30
|
|
|
if ( (getlong (optarg, &def_inactive) == 0)
|
|
|
|
|| (def_inactive < -1)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid numeric argument '%s'\n"),
|
|
|
|
Prog, optarg);
|
2011-09-18 23:30:06 +05:30
|
|
|
exit (E_BAD_ARG);
|
2009-04-11 04:03:50 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
/*
|
2009-04-11 04:03:50 +05:30
|
|
|
* -f -1 is allowed
|
|
|
|
* it's a no-op without /etc/shadow
|
2007-10-07 17:16:34 +05:30
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if ((-1 != def_inactive) && !is_shadow_pwd) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:50 +05:30
|
|
|
_("%s: shadow passwords required for -f\n"),
|
|
|
|
Prog);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
fflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2022-07-20 07:47:16 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
case 'F':
|
|
|
|
Fflg = true;
|
|
|
|
break;
|
|
|
|
#endif
|
2007-10-07 17:16:34 +05:30
|
|
|
case 'g':
|
2016-05-15 19:19:39 +05:30
|
|
|
grp = prefix_getgr_nam_gid (optarg);
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
2008-08-30 23:57:59 +05:30
|
|
|
_("%s: group '%s' does not exist\n"),
|
2009-04-11 04:03:57 +05:30
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_NOTFOUND);
|
|
|
|
}
|
|
|
|
if (Dflg) {
|
|
|
|
def_group = grp->gr_gid;
|
|
|
|
def_gname = optarg;
|
|
|
|
} else {
|
|
|
|
user_gid = grp->gr_gid;
|
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
gflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'G':
|
2008-06-10 03:38:08 +05:30
|
|
|
if (get_groups (optarg) != 0) {
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_NOTFOUND);
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
|
|
|
if (NULL != user_groups[0]) {
|
|
|
|
do_grp_update = true;
|
|
|
|
}
|
|
|
|
Gflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'h':
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_SUCCESS);
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'k':
|
|
|
|
def_template = optarg;
|
2008-06-10 03:38:08 +05:30
|
|
|
kflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'K':
|
|
|
|
/*
|
|
|
|
* override login.defs defaults (-K name=value)
|
|
|
|
* example: -K UID_MIN=100 -K UID_MAX=499
|
|
|
|
* note: -K UID_MIN=10,UID_MAX=499 doesn't work yet
|
|
|
|
*/
|
|
|
|
cp = strchr (optarg, '=');
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == cp) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: -K requires KEY=VALUE\n"),
|
|
|
|
Prog);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
/* terminate name, point to value */
|
2008-06-10 03:38:08 +05:30
|
|
|
*cp = '\0';
|
|
|
|
cp++;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (putdef_str (optarg, cp) < 0) {
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2007-12-26 15:45:20 +05:30
|
|
|
case 'l':
|
2008-06-10 03:38:08 +05:30
|
|
|
lflg = true;
|
2007-12-26 15:45:20 +05:30
|
|
|
break;
|
2007-10-07 17:16:34 +05:30
|
|
|
case 'm':
|
2008-06-10 03:38:08 +05:30
|
|
|
mflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2008-09-13 17:25:41 +05:30
|
|
|
case 'M':
|
|
|
|
Mflg = true;
|
|
|
|
break;
|
2008-02-26 02:33:46 +05:30
|
|
|
case 'N':
|
2008-06-10 03:38:08 +05:30
|
|
|
Nflg = true;
|
2008-02-26 02:33:46 +05:30
|
|
|
break;
|
2007-10-07 17:16:34 +05:30
|
|
|
case 'o':
|
2008-06-10 03:38:08 +05:30
|
|
|
oflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'p': /* set encrypted password */
|
|
|
|
if (!VALID (optarg)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid field '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_BAD_ARG);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
user_pass = optarg;
|
|
|
|
break;
|
2008-02-20 02:31:38 +05:30
|
|
|
case 'r':
|
2008-06-10 03:38:08 +05:30
|
|
|
rflg = true;
|
2008-02-20 02:31:38 +05:30
|
|
|
break;
|
2011-11-07 00:07:25 +05:30
|
|
|
case 'R': /* no-op, handled in process_root_flag () */
|
|
|
|
break;
|
2016-05-15 19:19:39 +05:30
|
|
|
case 'P': /* no-op, handled in process_prefix_flag () */
|
|
|
|
break;
|
2007-10-07 17:16:34 +05:30
|
|
|
case 's':
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if ( ( !VALID (optarg) )
|
2008-06-10 03:38:08 +05:30
|
|
|
|| ( ('\0' != optarg[0])
|
|
|
|
&& ('/' != optarg[0])
|
2020-01-16 17:25:30 +05:30
|
|
|
&& ('*' != optarg[0]) )) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: invalid shell '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:16:34 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
2020-01-16 17:25:30 +05:30
|
|
|
if ( '\0' != optarg[0]
|
|
|
|
&& '*' != optarg[0]
|
|
|
|
&& strcmp(optarg, "/sbin/nologin") != 0
|
|
|
|
&& ( stat(optarg, &st) != 0
|
|
|
|
|| S_ISDIR(st.st_mode)
|
|
|
|
|| access(optarg, X_OK) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: Warning: missing or non-executable shell '%s'\n"),
|
|
|
|
Prog, optarg);
|
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
user_shell = optarg;
|
|
|
|
def_shell = optarg;
|
2008-06-10 03:38:08 +05:30
|
|
|
sflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
|
|
|
case 'u':
|
2009-03-09 02:13:15 +05:30
|
|
|
if ( (get_uid (optarg, &user_id) == 0)
|
|
|
|
|| (user_id == (gid_t)-1)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid user ID '%s'\n"),
|
|
|
|
Prog, optarg);
|
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
uflg = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2008-02-26 02:33:46 +05:30
|
|
|
case 'U':
|
2008-06-10 03:38:08 +05:30
|
|
|
Uflg = true;
|
2008-02-26 02:33:46 +05:30
|
|
|
break;
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
case 'Z':
|
2016-05-15 19:19:39 +05:30
|
|
|
if (prefix[0]) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: -Z cannot be used with --prefix\n"),
|
|
|
|
Prog);
|
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
2009-04-11 21:04:10 +05:30
|
|
|
if (is_selinux_enabled () > 0) {
|
|
|
|
user_selinux = optarg;
|
|
|
|
} else {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: -Z requires SELinux enabled kernel\n"),
|
|
|
|
Prog);
|
|
|
|
|
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
break;
|
2023-04-01 18:04:56 +05:30
|
|
|
case 202:
|
|
|
|
user_selinux_range = optarg;
|
|
|
|
break;
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
#endif /* WITH_SELINUX */
|
2007-10-07 17:16:34 +05:30
|
|
|
default:
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
anyflag = true;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2008-05-20 02:01:48 +05:30
|
|
|
if (!gflg && !Nflg && !Uflg) {
|
2008-02-26 02:33:46 +05:30
|
|
|
/* Get the settings from login.defs */
|
|
|
|
Uflg = getdef_bool ("USERGROUPS_ENAB");
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Certain options are only valid in combination with others.
|
|
|
|
* Check it here so that they can be specified in any order.
|
|
|
|
*/
|
2008-02-26 02:33:46 +05:30
|
|
|
if (oflg && !uflg) {
|
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
2008-02-26 02:33:46 +05:30
|
|
|
Prog, "-o", "-u");
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2008-02-26 02:33:46 +05:30
|
|
|
}
|
|
|
|
if (kflg && !mflg) {
|
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
2008-02-26 02:33:46 +05:30
|
|
|
Prog, "-k", "-m");
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2008-02-26 02:33:46 +05:30
|
|
|
}
|
|
|
|
if (Uflg && gflg) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: options %s and %s conflict\n"),
|
|
|
|
Prog, "-U", "-g");
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2008-02-26 02:33:46 +05:30
|
|
|
}
|
|
|
|
if (Uflg && Nflg) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: options %s and %s conflict\n"),
|
|
|
|
Prog, "-U", "-N");
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2008-02-26 02:33:46 +05:30
|
|
|
}
|
2008-09-13 17:25:41 +05:30
|
|
|
if (mflg && Mflg) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: options %s and %s conflict\n"),
|
|
|
|
Prog, "-m", "-M");
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
2008-09-13 17:25:41 +05:30
|
|
|
}
|
2023-04-01 18:04:56 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
if (user_selinux_range && !Zflg) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
|
|
|
Prog, "--selinux-range", "--selinux-user");
|
|
|
|
usage (E_USAGE);
|
|
|
|
}
|
|
|
|
#endif /* WITH_SELINUX */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Either -D or username is required. Defaults can be set with -D
|
2007-10-07 17:14:02 +05:30
|
|
|
* for the -b, -e, -f, -g, -s options only.
|
|
|
|
*/
|
|
|
|
if (Dflg) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (optind != argc) {
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2011-09-18 23:30:06 +05:30
|
|
|
if (uflg || Gflg || dflg || cflg || mflg) {
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
} else {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (optind != argc - 1) {
|
* NEWS, src/userdel.c, src/lastlog.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/groupmems.c, src/usermod.c,
src/chgpasswd.c, src/vipw.c, src/su.c, src/useradd.c,
src/groupmod.c, src/passwd.c, src/groupadd.c, src/chage.c,
src/faillog.c, src/chsh.c: If someone uses the -h/--help options,
the usage should not go to stderr nor should the utility exit with
non-zero status. All of the shadow utils do just this
unfortunately, so convert them over to sanity.
* man/groupmems.8.xml, man/gpasswd.1.xml: Added option -h/--help.
2009-09-05 04:32:33 +05:30
|
|
|
usage (E_USAGE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
user_name = argv[optind];
|
2008-05-26 02:28:16 +05:30
|
|
|
if (!is_valid_user_name (user_name)) {
|
2007-10-07 17:16:34 +05:30
|
|
|
fprintf (stderr,
|
2020-08-01 07:59:21 +05:30
|
|
|
_("%s: invalid user name '%s': use --badname to ignore\n"),
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
Prog, user_name);
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_BAD_ARG);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (!dflg) {
|
|
|
|
char *uh;
|
2009-04-25 04:53:51 +05:30
|
|
|
size_t len = strlen (def_home) + strlen (user_name) + 2;
|
|
|
|
int wlen;
|
|
|
|
|
2023-02-05 03:11:18 +05:30
|
|
|
uh = XMALLOCARRAY (len, char);
|
2009-04-25 04:53:51 +05:30
|
|
|
wlen = snprintf (uh, len, "%s/%s", def_home, user_name);
|
|
|
|
assert (wlen == (int) len -1);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
user_home = uh;
|
|
|
|
}
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0]) {
|
2016-05-15 19:19:39 +05:30
|
|
|
size_t len = strlen(prefix) + strlen(user_home) + 2;
|
|
|
|
int wlen;
|
|
|
|
char* _prefix_user_home; /* to avoid const warning */
|
2023-02-05 03:11:18 +05:30
|
|
|
_prefix_user_home = XMALLOCARRAY(len, char);
|
2016-05-15 19:19:39 +05:30
|
|
|
wlen = snprintf(_prefix_user_home, len, "%s/%s", prefix, user_home);
|
|
|
|
assert (wlen == (int) len -1);
|
|
|
|
prefix_user_home = _prefix_user_home;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
prefix_user_home = user_home;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (!eflg) {
|
2007-10-07 17:14:59 +05:30
|
|
|
user_expire = strtoday (def_expire);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (!gflg) {
|
2007-10-07 17:14:02 +05:30
|
|
|
user_gid = def_group;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (!sflg) {
|
2007-10-07 17:14:02 +05:30
|
|
|
user_shell = def_shell;
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:17:45 +05:30
|
|
|
|
|
|
|
create_mail_spool = def_create_mail_spool;
|
2008-09-13 17:25:41 +05:30
|
|
|
|
2021-09-21 09:12:21 +05:30
|
|
|
if (!lflg) {
|
|
|
|
/* If we are missing the flag lflg aka -l, check the defaults
|
|
|
|
* file to see if we need to disable it as a default*/
|
|
|
|
if (strcmp (def_log_init, "no") == 0) {
|
|
|
|
lflg = true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-09-13 17:25:41 +05:30
|
|
|
if (!rflg) {
|
2009-04-11 04:03:57 +05:30
|
|
|
/* for system accounts defaults are ignored and we
|
|
|
|
* do not create a home dir */
|
2010-03-17 00:44:54 +05:30
|
|
|
if (getdef_bool ("CREATE_HOME")) {
|
2008-09-13 17:25:41 +05:30
|
|
|
mflg = true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (Mflg) {
|
|
|
|
/* absolutely sure that we do not create home dirs */
|
|
|
|
mflg = false;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* close_files - close all of the files that were opened
|
|
|
|
*
|
|
|
|
* close_files() closes all of the files that were opened for this
|
2007-10-07 17:14:59 +05:30
|
|
|
* new user. This causes any modified entries to be written out.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void close_files (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 03:38:08 +05:30
|
|
|
if (pw_close () == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr, _("%s: failure while writing changes to %s\n"), Prog, pw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", pw_dbname ()));
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
if (is_shadow_pwd && (spw_close () == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: failure while writing changes to %s\n"), Prog, spw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", spw_dbname ()));
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2020-03-30 12:38:23 +05:30
|
|
|
|
|
|
|
close_group_files ();
|
|
|
|
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
if (is_sub_uid && (sub_uid_close () == 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"), Prog, sub_uid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_uid_dbname ()));
|
|
|
|
fail_exit (E_SUB_UID_UPDATE);
|
|
|
|
}
|
|
|
|
if (is_sub_gid && (sub_gid_close () == 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"), Prog, sub_gid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", sub_gid_dbname ()));
|
|
|
|
fail_exit (E_SUB_GID_UPDATE);
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2008-03-09 04:14:53 +05:30
|
|
|
if (is_shadow_pwd) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (spw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, spw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking shadow file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
spw_locked = false;
|
2008-03-09 04:14:53 +05:30
|
|
|
}
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (pw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, pw_dbname ());
|
* src/chfn.c: Do not exit on pw_unlock failures.
* src/grpconv.c, src/grpunconv.c, src/pwconv.c, src/pwunconv.c,
src/vipw.c: Open syslog with the right identification name.
* src/vipw.c: Log unlock errors to syslog.
* src/vipw.c: Log edits to syslog.
* src/chage.c, src/chfn.c, src/chsh.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmod.c, src/grpconv.c,
src/grpunconv.c, src/passwd.c, src/pwck.c, src/pwunconv.c,
src/useradd.c, src/usermod.c: Harmonize the syslog levels. Failure
to close or unlock are errors. Failure to open files are warnings.
2008-08-22 08:00:33 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
"unlocking passwd file",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
pw_locked = false;
|
2020-03-30 12:38:23 +05:30
|
|
|
|
|
|
|
unlock_group_files ();
|
|
|
|
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
if (is_sub_uid) {
|
|
|
|
if (sub_uid_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_uid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sub_uid_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"unlocking subordinate user file",
|
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
sub_uid_locked = false;
|
|
|
|
}
|
|
|
|
if (is_sub_gid) {
|
|
|
|
if (sub_gid_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sub_gid_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sub_gid_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"unlocking subordinate group file",
|
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
sub_gid_locked = false;
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
/*
|
|
|
|
* close_group_files - close all of the files that were opened
|
|
|
|
*
|
|
|
|
* close_group_files() closes all of the files that were opened related
|
|
|
|
* with groups. This causes any modified entries to be written out.
|
|
|
|
*/
|
|
|
|
static void close_group_files (void)
|
|
|
|
{
|
|
|
|
if (do_grp_update) {
|
|
|
|
if (gr_close () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (is_shadow_grp && (sgr_close () == 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"),
|
|
|
|
Prog, sgr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* unlock_group_files - unlock all of the files that were locked
|
|
|
|
*
|
|
|
|
* unlock_group_files() unlocks all of the files that were locked related
|
|
|
|
* with groups. This causes any modified entries to be written out.
|
|
|
|
*/
|
|
|
|
static void unlock_group_files (void)
|
|
|
|
{
|
|
|
|
if (gr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"unlocking-group-file",
|
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif /* WITH_AUDIT */
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
gr_locked = false;
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (is_shadow_grp) {
|
|
|
|
if (sgr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"unlocking-gshadow-file",
|
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
|
|
|
#endif /* WITH_AUDIT */
|
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
sgr_locked = false;
|
|
|
|
}
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* open_files - lock and open the password files
|
|
|
|
*
|
|
|
|
* open_files() opens the two password files.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void open_files (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 03:38:08 +05:30
|
|
|
if (pw_lock () == 0) {
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/gpasswd.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c: In
case of a lock failure, indicate to the user that she can try
again later. Do not log to syslog.
2008-08-22 07:50:53 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, pw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
* src/chfn.c, src/chgpasswd.c, src/chpasswd.c, src/gpasswd.c,
src/groupadd.c, src/groupdel.c, src/groupmems.c, src/groupmod.c,
src/grpconv.c, src/grpunconv.c, src/newusers.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c: Harmonize the name
of the variables keeping the lock status, to match the shadow
library prefixes.
2008-08-22 07:52:34 +05:30
|
|
|
pw_locked = true;
|
2015-02-27 18:47:25 +05:30
|
|
|
if (pw_open (O_CREAT | O_RDWR) == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr, _("%s: cannot open %s\n"), Prog, pw_dbname ());
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
|
|
|
|
/* shadow file will be opened by open_shadow(); */
|
2008-03-09 04:14:53 +05:30
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
open_group_files ();
|
|
|
|
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2013-01-22 14:47:30 +05:30
|
|
|
if (is_sub_uid) {
|
|
|
|
if (sub_uid_lock () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, sub_uid_dbname ());
|
|
|
|
fail_exit (E_SUB_UID_UPDATE);
|
|
|
|
}
|
|
|
|
sub_uid_locked = true;
|
2015-02-27 18:47:25 +05:30
|
|
|
if (sub_uid_open (O_CREAT | O_RDWR) == 0) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, sub_uid_dbname ());
|
|
|
|
fail_exit (E_SUB_UID_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (is_sub_gid) {
|
|
|
|
if (sub_gid_lock () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, sub_gid_dbname ());
|
|
|
|
fail_exit (E_SUB_GID_UPDATE);
|
|
|
|
}
|
|
|
|
sub_gid_locked = true;
|
2015-02-27 18:47:25 +05:30
|
|
|
if (sub_gid_open (O_CREAT | O_RDWR) == 0) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, sub_gid_dbname ());
|
|
|
|
fail_exit (E_SUB_GID_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2007-10-07 17:17:11 +05:30
|
|
|
}
|
|
|
|
|
2020-03-30 12:38:23 +05:30
|
|
|
static void open_group_files (void)
|
|
|
|
{
|
|
|
|
if (gr_lock () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, gr_dbname ());
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
gr_locked = true;
|
|
|
|
if (gr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
|
fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
if (is_shadow_grp) {
|
|
|
|
if (sgr_lock () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, sgr_dbname ());
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
sgr_locked = true;
|
|
|
|
if (sgr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, sgr_dbname ());
|
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
}
|
|
|
|
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
static void open_shadow (void)
|
|
|
|
{
|
2010-03-12 03:33:45 +05:30
|
|
|
if (!is_shadow_pwd) {
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
return;
|
2010-03-12 03:33:45 +05:30
|
|
|
}
|
|
|
|
if (spw_lock () == 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, spw_dbname ());
|
|
|
|
fail_exit (E_PW_UPDATE);
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
}
|
|
|
|
spw_locked = true;
|
2015-02-27 18:47:25 +05:30
|
|
|
if (spw_open (O_CREAT | O_RDWR) == 0) {
|
2010-03-12 03:33:45 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, spw_dbname ());
|
|
|
|
fail_exit (E_PW_UPDATE);
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
static char *empty_list = NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* new_grent - initialize the values in a group file entry
|
|
|
|
*
|
|
|
|
* new_grent() takes all of the values that have been entered and fills
|
|
|
|
* in a (struct group) with them.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static void new_grent (struct group *grent)
|
|
|
|
{
|
|
|
|
memzero (grent, sizeof *grent);
|
|
|
|
grent->gr_name = (char *) user_name;
|
2011-11-17 01:03:51 +05:30
|
|
|
#ifdef SHADOWGRP
|
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/newusers.c, src/useradd.c, src/userdel.c,
src/usermod.c: Provide the PAM error
message instead of our own, and log error to syslog.
* src/groupmems.c: Exit with exit rather than fail_exit in usage().
* src/newusers.c: Check the number of arguments.
* src/newusers.c: Do not create the home directory when it is not
changed.
* src/useradd.c: Set the group password to "!" rather "x" if there
are no gshadow file.
2011-11-13 21:54:57 +05:30
|
|
|
if (is_shadow_grp) {
|
|
|
|
grent->gr_passwd = SHADOW_PASSWD_STRING; /* XXX warning: const */
|
2011-11-17 01:03:51 +05:30
|
|
|
} else
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
{
|
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/newusers.c, src/useradd.c, src/userdel.c,
src/usermod.c: Provide the PAM error
message instead of our own, and log error to syslog.
* src/groupmems.c: Exit with exit rather than fail_exit in usage().
* src/newusers.c: Check the number of arguments.
* src/newusers.c: Do not create the home directory when it is not
changed.
* src/useradd.c: Set the group password to "!" rather "x" if there
are no gshadow file.
2011-11-13 21:54:57 +05:30
|
|
|
grent->gr_passwd = "!"; /* XXX warning: const */
|
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
grent->gr_gid = user_gid;
|
|
|
|
grent->gr_mem = &empty_list;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
/*
|
|
|
|
* new_sgent - initialize the values in a shadow group file entry
|
|
|
|
*
|
|
|
|
* new_sgent() takes all of the values that have been entered and fills
|
|
|
|
* in a (struct sgrp) with them.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static void new_sgent (struct sgrp *sgent)
|
|
|
|
{
|
|
|
|
memzero (sgent, sizeof *sgent);
|
|
|
|
sgent->sg_name = (char *) user_name;
|
|
|
|
sgent->sg_passwd = "!"; /* XXX warning: const */
|
|
|
|
sgent->sg_adm = &empty_list;
|
|
|
|
sgent->sg_mem = &empty_list;
|
|
|
|
}
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* grp_add - add new group file entries
|
|
|
|
*
|
|
|
|
* grp_add() writes the new records to the group files.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static void grp_add (void)
|
|
|
|
{
|
|
|
|
struct group grp;
|
|
|
|
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
struct sgrp sgrp;
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Create the initial entries for this new group.
|
|
|
|
*/
|
|
|
|
new_grent (&grp);
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
new_sgent (&sgrp);
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Write out the new group file entry.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (gr_update (&grp) == 0) {
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, gr_dbname (), grp.gr_name);
|
2008-09-04 02:32:32 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_GROUP, Prog,
|
|
|
|
"adding group",
|
2008-09-05 01:05:48 +05:30
|
|
|
grp.gr_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:17:11 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
/*
|
|
|
|
* Write out the new shadow group entries as well.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (is_shadow_grp && (sgr_update (&sgrp) == 0)) {
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, sgr_dbname (), sgrp.sg_name);
|
2008-09-04 02:32:32 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_GROUP, Prog,
|
|
|
|
"adding group",
|
2008-09-05 01:05:48 +05:30
|
|
|
grp.gr_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2007-10-07 17:17:11 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#endif /* SHADOWGRP */
|
|
|
|
SYSLOG ((LOG_INFO, "new group: name=%s, GID=%u", user_name, user_gid));
|
2008-09-04 02:32:32 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_GROUP, Prog,
|
|
|
|
"adding group",
|
2008-09-05 01:05:48 +05:30
|
|
|
grp.gr_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_SUCCESS);
|
2008-09-04 02:32:32 +05:30
|
|
|
#endif
|
2008-06-10 03:38:08 +05:30
|
|
|
do_grp_update = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
static void faillog_reset (uid_t uid)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
struct faillog fl;
|
|
|
|
int fd;
|
2008-06-16 03:55:51 +05:30
|
|
|
off_t offset_uid = (off_t) (sizeof fl) * uid;
|
2022-08-24 16:51:01 +05:30
|
|
|
struct stat st;
|
2008-06-16 03:55:51 +05:30
|
|
|
|
2022-08-24 16:51:01 +05:30
|
|
|
if (stat (FAILLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
|
2008-06-16 03:55:51 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
memzero (&fl, sizeof (fl));
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
fd = open (FAILLOG_FILE, O_RDWR);
|
2021-06-10 16:35:03 +05:30
|
|
|
if (-1 == fd) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to open the faillog file for UID %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
|
|
|
SYSLOG ((LOG_WARN, "failed to open the faillog file for UID %lu", (unsigned long) uid));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
2008-06-16 03:55:51 +05:30
|
|
|
|| (write (fd, &fl, sizeof (fl)) != (ssize_t) sizeof (fl))
|
2021-06-10 16:35:03 +05:30
|
|
|
|| (fsync (fd) != 0)) {
|
2008-06-16 03:55:51 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to reset the faillog entry of UID %lu: %s\n"),
|
2008-06-18 03:30:36 +05:30
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
SYSLOG ((LOG_WARN, "failed to reset the faillog entry of UID %lu", (unsigned long) uid));
|
2021-06-10 16:35:03 +05:30
|
|
|
}
|
|
|
|
if (close (fd) != 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to close the faillog file for UID %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
|
|
|
SYSLOG ((LOG_WARN, "failed to close the faillog file for UID %lu", (unsigned long) uid));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
static void lastlog_reset (uid_t uid)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
struct lastlog ll;
|
|
|
|
int fd;
|
2008-06-16 03:55:51 +05:30
|
|
|
off_t offset_uid = (off_t) (sizeof ll) * uid;
|
2018-11-28 19:27:16 +05:30
|
|
|
uid_t max_uid;
|
2022-08-24 16:51:01 +05:30
|
|
|
struct stat st;
|
2008-06-16 03:55:51 +05:30
|
|
|
|
2022-08-24 16:51:01 +05:30
|
|
|
if (stat (LASTLOG_FILE, &st) != 0 || st.st_size <= offset_uid) {
|
2008-06-16 03:55:51 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2023-02-01 18:20:48 +05:30
|
|
|
max_uid = getdef_ulong ("LASTLOG_UID_MAX", 0xFFFFFFFFUL);
|
2018-11-28 19:27:16 +05:30
|
|
|
if (uid > max_uid) {
|
|
|
|
/* do not touch lastlog for large uids */
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2008-06-16 03:55:51 +05:30
|
|
|
memzero (&ll, sizeof (ll));
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
fd = open (LASTLOG_FILE, O_RDWR);
|
2021-06-10 16:35:03 +05:30
|
|
|
if (-1 == fd) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to open the lastlog file for UID %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
|
|
|
SYSLOG ((LOG_WARN, "failed to open the lastlog file for UID %lu", (unsigned long) uid));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
2008-06-16 03:55:51 +05:30
|
|
|
|| (write (fd, &ll, sizeof (ll)) != (ssize_t) sizeof (ll))
|
2021-06-10 16:35:03 +05:30
|
|
|
|| (fsync (fd) != 0)) {
|
2008-06-16 03:55:51 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to reset the lastlog entry of UID %lu: %s\n"),
|
2008-06-18 03:30:36 +05:30
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
SYSLOG ((LOG_WARN, "failed to reset the lastlog entry of UID %lu", (unsigned long) uid));
|
|
|
|
/* continue */
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2021-06-10 16:35:03 +05:30
|
|
|
if (close (fd) != 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to close the lastlog file for UID %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) uid, strerror (errno));
|
|
|
|
SYSLOG ((LOG_WARN, "failed to close the lastlog file for UID %lu", (unsigned long) uid));
|
|
|
|
/* continue */
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2019-12-19 02:23:58 +05:30
|
|
|
static void tallylog_reset (const char *user_name)
|
2016-10-19 18:10:59 +05:30
|
|
|
{
|
2017-02-20 19:16:18 +05:30
|
|
|
const char pam_tally2[] = "/sbin/pam_tally2";
|
2016-10-19 18:10:59 +05:30
|
|
|
const char *pname;
|
|
|
|
pid_t childpid;
|
|
|
|
int failed;
|
|
|
|
int status;
|
|
|
|
|
|
|
|
if (access(pam_tally2, X_OK) == -1)
|
|
|
|
return;
|
|
|
|
|
2023-04-26 17:29:51 +05:30
|
|
|
/* set SIGCHLD to default for waitpid */
|
|
|
|
signal(SIGCHLD, SIG_DFL);
|
|
|
|
|
2016-10-19 18:10:59 +05:30
|
|
|
failed = 0;
|
|
|
|
switch (childpid = fork())
|
|
|
|
{
|
|
|
|
case -1: /* error */
|
|
|
|
failed = 1;
|
|
|
|
break;
|
|
|
|
case 0: /* child */
|
|
|
|
pname = strrchr(pam_tally2, '/');
|
|
|
|
if (pname == NULL)
|
|
|
|
pname = pam_tally2;
|
|
|
|
else
|
|
|
|
pname++; /* Skip the '/' */
|
|
|
|
execl(pam_tally2, pname, "--user", user_name, "--reset", "--quiet", NULL);
|
|
|
|
/* If we come here, something has gone terribly wrong */
|
2017-02-20 19:02:37 +05:30
|
|
|
perror(pam_tally2);
|
|
|
|
exit(42); /* don't continue, we now have 2 processes running! */
|
|
|
|
/* NOTREACHED */
|
2016-10-19 18:10:59 +05:30
|
|
|
break;
|
|
|
|
default: /* parent */
|
|
|
|
if (waitpid(childpid, &status, 0) == -1 || !WIFEXITED(status) || WEXITSTATUS(status) != 0)
|
|
|
|
failed = 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2017-02-10 19:22:26 +05:30
|
|
|
if (failed)
|
2016-10-19 18:10:59 +05:30
|
|
|
{
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to reset the tallylog entry of user \"%s\"\n"),
|
|
|
|
Prog, user_name);
|
|
|
|
SYSLOG ((LOG_WARN, "failed to reset the tallylog entry of user \"%s\"", user_name));
|
|
|
|
}
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* usr_update - create the user entries
|
|
|
|
*
|
|
|
|
* usr_update() creates the password file entries for this user
|
|
|
|
* and will update the group entries if required.
|
|
|
|
*/
|
2021-08-10 12:37:03 +05:30
|
|
|
static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
struct passwd pwent;
|
|
|
|
struct spwd spent;
|
2019-12-19 02:23:58 +05:30
|
|
|
char *tty;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Fill in the password structure with any new fields, making
|
|
|
|
* copies of strings.
|
|
|
|
*/
|
|
|
|
new_pwent (&pwent);
|
|
|
|
new_spent (&spent);
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Create a syslog entry. We need to do this now in case anything
|
2007-10-07 17:14:02 +05:30
|
|
|
* happens so we know what we were trying to accomplish.
|
|
|
|
*/
|
2019-12-19 02:23:58 +05:30
|
|
|
tty=ttyname (STDIN_FILENO);
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2019-12-19 02:23:58 +05:30
|
|
|
"new user: name=%s, UID=%u, GID=%u, home=%s, shell=%s, from=%s",
|
2009-04-11 04:03:57 +05:30
|
|
|
user_name, (unsigned int) user_id,
|
2019-12-19 02:23:58 +05:30
|
|
|
(unsigned int) user_gid, user_home, user_shell,
|
|
|
|
tty ? tty : "none" ));
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize faillog and lastlog entries for this UID in case
|
2007-10-07 17:14:59 +05:30
|
|
|
* it belongs to a previously deleted user. We do it only if
|
2007-10-07 17:14:02 +05:30
|
|
|
* no user with this UID exists yet (entries for shared UIDs
|
|
|
|
* are left unchanged). --marekm
|
|
|
|
*/
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
/* local, no need for xgetpwuid */
|
2016-05-15 19:19:39 +05:30
|
|
|
if ((!lflg) && (prefix_getpwuid (user_id) == NULL)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
faillog_reset (user_id);
|
|
|
|
lastlog_reset (user_id);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Put the new (struct passwd) in the table.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (pw_update (&pwent) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, pw_dbname (), pwent.pw_name);
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Put the new (struct spwd) in the table.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (is_shadow_pwd && (spw_update (&spent) == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, spw_dbname (), spent.sp_namp);
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding shadow password",
|
2023-02-01 18:20:48 +05:30
|
|
|
user_name, user_id, SHADOW_AUDIT_FAILURE);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2022-10-24 14:16:36 +05:30
|
|
|
if (is_sub_uid && !local_sub_uid_assigned(user_name) &&
|
2021-08-10 12:37:03 +05:30
|
|
|
(sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to prepare the new %s entry\n"),
|
|
|
|
Prog, sub_uid_dbname ());
|
|
|
|
fail_exit (E_SUB_UID_UPDATE);
|
|
|
|
}
|
2022-10-24 14:16:36 +05:30
|
|
|
if (is_sub_gid && !local_sub_gid_assigned(user_name) &&
|
2021-08-10 12:37:03 +05:30
|
|
|
(sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to prepare the new %s entry\n"),
|
|
|
|
Prog, sub_uid_dbname ());
|
|
|
|
fail_exit (E_SUB_GID_UPDATE);
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2013-01-22 14:47:30 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2022-12-15 16:22:58 +05:30
|
|
|
/*
|
|
|
|
* Even though we have the ID of the user, we won't send it now
|
|
|
|
* because its not written to disk yet. After close_files it is
|
|
|
|
* and we can use the real ID thereafter.
|
|
|
|
*/
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user",
|
2022-12-15 16:22:58 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
2008-09-05 01:05:48 +05:30
|
|
|
SHADOW_AUDIT_SUCCESS);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Do any group file updates for this user.
|
|
|
|
*/
|
2008-06-10 03:38:08 +05:30
|
|
|
if (do_grp_update) {
|
2007-10-07 17:14:59 +05:30
|
|
|
grp_update ();
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* create_home - create the user's home directory
|
|
|
|
*
|
|
|
|
* create_home() creates the user's home directory if it does not
|
2007-10-07 17:14:59 +05:30
|
|
|
* already exist. It will be created mode 755 owned by the user
|
2007-10-07 17:14:02 +05:30
|
|
|
* with the user's default group.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void create_home (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2016-05-15 19:19:39 +05:30
|
|
|
if (access (prefix_user_home, F_OK) != 0) {
|
2018-05-15 20:55:52 +05:30
|
|
|
char path[strlen (prefix_user_home) + 2];
|
|
|
|
char *bhome, *cp;
|
|
|
|
|
|
|
|
path[0] = '\0';
|
|
|
|
bhome = strdup (prefix_user_home);
|
|
|
|
if (!bhome) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: error while duplicating string %s\n"),
|
|
|
|
Prog, user_home);
|
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
|
|
|
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2021-04-09 21:51:00 +05:30
|
|
|
if (set_selinux_file_context (prefix_user_home, S_IFDIR) != 0) {
|
2016-11-15 20:30:51 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot set SELinux context for home directory %s\n"),
|
|
|
|
Prog, user_home);
|
2010-08-29 01:28:00 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
2009-04-11 21:04:10 +05:30
|
|
|
#endif
|
2018-05-15 20:55:52 +05:30
|
|
|
|
|
|
|
/* Check for every part of the path, if the directory
|
|
|
|
exists. If not, create it with permissions 755 and
|
|
|
|
owner root:root.
|
|
|
|
*/
|
|
|
|
cp = strtok (bhome, "/");
|
|
|
|
while (cp) {
|
fix: create relative home path correctly
Currently, supplying a relative path via the --prefix flag to the
useradd command triggers a bug in the creation of home directories. The
code seems to unintentionally prepend a leading "/" to all paths,
quietly transforming a relative prefixed home path into an absolute
path. This can be seen in the following strace logs from running
"useradd --create-home --prefix tmp/root squat":
```
access("tmp/root//home/squat", F_OK) = -1 ENOENT (No such file or directory)
access("/mp", F_OK) = 0
access("/mp/root", F_OK) = 0
access("/mp/root/home", F_OK) = 0
access("/mp/root/home/squat", F_OK) = -1 ENOENT (No such file or directory)
mkdir("/mp/root/home/squat", 000) = 0
chown("/mp/root/home/squat", 0, 0) = 0
chmod("/mp/root/home/squat", 0755) = 0
chown("tmp/root//home/squat", 1000, 1000) = -1 ENOENT (No such file or directory)
chmod("tmp/root//home/squat", 0700) = -1 ENOENT (No such file or directory)
```
Note that the relative path is correctly probed in the beginning and it
is only during the recursive creation that the path is turned into an
absolute path. This invocation results in the creation of a "/mp"
hierarchy in the root of the filesystem.
Similar problems occur when using `--prefix ./tmp/root`.
This commit fixes the handling of relative paths by not assuming that
the given path is anchored with a "/".
Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
2021-04-29 17:39:31 +05:30
|
|
|
/* Avoid turning a relative path into an absolute path.
|
|
|
|
*/
|
|
|
|
if (bhome[0] == '/' || strlen (path) != 0) {
|
|
|
|
strcat (path, "/");
|
|
|
|
}
|
2018-05-15 20:55:52 +05:30
|
|
|
strcat (path, cp);
|
|
|
|
if (access (path, F_OK) != 0) {
|
2019-01-21 14:02:36 +05:30
|
|
|
/* Check if parent directory is BTRFS, fail if requesting
|
2022-12-30 17:21:29 +05:30
|
|
|
subvolume but no BTRFS. The paths could be different by the
|
2019-01-21 14:02:36 +05:30
|
|
|
trailing slash
|
|
|
|
*/
|
2019-01-23 20:47:05 +05:30
|
|
|
#if WITH_BTRFS
|
2019-01-21 14:02:36 +05:30
|
|
|
if (subvolflg && (strlen(prefix_user_home) - (int)strlen(path)) <= 1) {
|
|
|
|
char *btrfs_check = strdup(path);
|
|
|
|
|
|
|
|
if (!btrfs_check) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: error while duplicating string in BTRFS check %s\n"),
|
|
|
|
Prog, path);
|
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
|
|
|
btrfs_check[strlen(path) - strlen(cp) - 1] = '\0';
|
|
|
|
if (is_btrfs(btrfs_check) <= 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: home directory \"%s\" must be mounted on BTRFS\n"),
|
|
|
|
Prog, path);
|
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
|
|
|
// make subvolume to mount for user instead of directory
|
|
|
|
if (btrfs_create_subvolume(path)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to create BTRFS subvolume: %s\n"),
|
|
|
|
Prog, path);
|
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
|
|
|
}
|
2019-01-23 20:47:05 +05:30
|
|
|
else
|
|
|
|
#endif
|
|
|
|
if (mkdir (path, 0) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2018-05-15 20:55:52 +05:30
|
|
|
_("%s: cannot create directory %s\n"),
|
|
|
|
Prog, path);
|
2007-10-07 20:06:51 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2023-02-01 18:20:48 +05:30
|
|
|
"adding home directory",
|
|
|
|
user_name, user_id, SHADOW_AUDIT_FAILURE);
|
2007-10-07 20:06:51 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2018-05-15 20:55:52 +05:30
|
|
|
if (chown (path, 0, 0) < 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: warning: chown on `%s' failed: %m\n"),
|
|
|
|
Prog, path);
|
|
|
|
}
|
|
|
|
if (chmod (path, 0755) < 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: warning: chmod on `%s' failed: %m\n"),
|
|
|
|
Prog, path);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
cp = strtok (NULL, "/");
|
|
|
|
}
|
2021-06-10 16:35:03 +05:30
|
|
|
free (bhome);
|
2018-05-15 20:55:52 +05:30
|
|
|
|
2016-05-15 19:19:39 +05:30
|
|
|
(void) chown (prefix_user_home, user_id, user_gid);
|
2020-01-12 02:49:37 +05:30
|
|
|
mode_t mode = getdef_num ("HOME_MODE",
|
|
|
|
0777 & ~getdef_num ("UMASK", GETDEF_DEFAULT_UMASK));
|
2020-08-10 15:14:00 +05:30
|
|
|
if (chmod (prefix_user_home, mode)) {
|
|
|
|
fprintf (stderr, _("%s: warning: chown on '%s' failed: %m\n"),
|
|
|
|
Prog, path);
|
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
home_added = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding home directory",
|
2023-02-01 18:20:48 +05:30
|
|
|
user_name, user_id, SHADOW_AUDIT_SUCCESS);
|
2009-04-11 21:04:10 +05:30
|
|
|
#endif
|
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
/* Reset SELinux to create files with default contexts */
|
2010-08-29 01:28:00 +05:30
|
|
|
if (reset_selinux_file_context () != 0) {
|
2016-11-15 20:30:51 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot reset SELinux file creation context\n"),
|
|
|
|
Prog);
|
2010-08-29 01:28:00 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:15:40 +05:30
|
|
|
/*
|
|
|
|
* create_mail - create the user's mail spool
|
|
|
|
*
|
|
|
|
* create_mail() creates the user's mail spool if it does not already
|
|
|
|
* exist. It will be created mode 660 owned by the user and group
|
|
|
|
* 'mail'
|
|
|
|
*/
|
|
|
|
static void create_mail (void)
|
|
|
|
{
|
|
|
|
if (strcasecmp (create_mail_spool, "yes") == 0) {
|
2010-04-05 02:25:46 +05:30
|
|
|
const char *spool;
|
|
|
|
char *file;
|
* src/newgrp.c: Limit the scope of variable pid.
* src/login_nopam.c: Limit the scope of variables end, lineno, i,
str_len.
* src/logoutd.c: Limit the scope of variable c.
* src/vipw.c: Re-indent.
* src/vipw.c: Close the file after the creation of the backup.
* src/useradd.c (set_default): Close input file on failure.
* src/useradd.c: Limit the scope of variables spool, file, fd, gr,
gid, mode.
* src/passwd.c: Limit the scope of variables last and ok.
* src/chage.c: Fix typo (non breaking space).
* src/login.c: Limit the scope of variables erasechar killchar, c,
failed.
* src/groups.c: Limit the scope of variable ngroups, pri_grp, i.
* src/id.c: Limit the scope of variable i.
2010-03-23 16:56:34 +05:30
|
|
|
int fd;
|
|
|
|
struct group *gr;
|
|
|
|
gid_t gid;
|
|
|
|
mode_t mode;
|
|
|
|
|
2008-01-01 20:04:07 +05:30
|
|
|
spool = getdef_str ("MAIL_DIR");
|
2020-02-13 01:51:21 +05:30
|
|
|
#ifdef MAIL_SPOOL_DIR
|
|
|
|
if ((NULL == spool) && (getdef_str ("MAIL_FILE") == NULL)) {
|
|
|
|
spool = MAIL_SPOOL_DIR;
|
|
|
|
}
|
|
|
|
#endif /* MAIL_SPOOL_DIR */
|
2008-01-01 20:04:07 +05:30
|
|
|
if (NULL == spool) {
|
2020-02-13 01:51:21 +05:30
|
|
|
return;
|
2008-01-01 20:04:07 +05:30
|
|
|
}
|
2023-02-05 03:11:18 +05:30
|
|
|
file = ALLOCARRAY (strlen (prefix) + strlen (spool) + strlen (user_name) + 3, char);
|
2021-08-18 23:36:02 +05:30
|
|
|
if (prefix[0])
|
2016-05-15 19:19:39 +05:30
|
|
|
sprintf (file, "%s/%s/%s", prefix, spool, user_name);
|
|
|
|
else
|
|
|
|
sprintf (file, "%s/%s", spool, user_name);
|
2020-02-05 19:34:39 +05:30
|
|
|
|
|
|
|
#ifdef WITH_SELINUX
|
2021-04-09 21:51:00 +05:30
|
|
|
if (set_selinux_file_context (file, S_IFREG) != 0) {
|
2020-02-05 19:34:39 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot set SELinux context for mailbox file %s\n"),
|
|
|
|
Prog, file);
|
|
|
|
fail_exit (E_MAILBOXFILE);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:17:33 +05:30
|
|
|
fd = open (file, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0);
|
|
|
|
if (fd < 0) {
|
|
|
|
perror (_("Creating mailbox file"));
|
|
|
|
return;
|
2007-10-07 17:17:45 +05:30
|
|
|
}
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2016-05-15 19:19:39 +05:30
|
|
|
gr = prefix_getgrnam ("mail"); /* local, no need for xgetgrnam */
|
2008-06-10 03:38:08 +05:30
|
|
|
if (NULL == gr) {
|
2008-01-25 02:12:12 +05:30
|
|
|
fputs (_("Group 'mail' not found. Creating the user mailbox file with 0600 mode.\n"),
|
|
|
|
stderr);
|
2007-10-07 17:17:45 +05:30
|
|
|
gid = user_gid;
|
|
|
|
mode = 0600;
|
|
|
|
} else {
|
|
|
|
gid = gr->gr_gid;
|
|
|
|
mode = 0660;
|
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
if ( (fchown (fd, user_id, gid) != 0)
|
|
|
|
|| (fchmod (fd, mode) != 0)) {
|
2007-10-07 17:17:45 +05:30
|
|
|
perror (_("Setting mailbox file permissions"));
|
2008-06-10 03:38:08 +05:30
|
|
|
}
|
2007-10-07 17:17:33 +05:30
|
|
|
|
2009-03-22 00:48:06 +05:30
|
|
|
fsync (fd);
|
2007-10-07 17:17:45 +05:30
|
|
|
close (fd);
|
2020-02-05 19:34:39 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
/* Reset SELinux to create files with default contexts */
|
|
|
|
if (reset_selinux_file_context () != 0) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: cannot reset SELinux file creation context\n"),
|
|
|
|
Prog);
|
|
|
|
fail_exit (E_MAILBOXFILE);
|
|
|
|
}
|
|
|
|
#endif
|
2007-10-07 17:15:40 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-11 20:15:54 +05:30
|
|
|
static void check_uid_range(int rflg, uid_t user_id)
|
|
|
|
{
|
|
|
|
uid_t uid_min ;
|
|
|
|
uid_t uid_max ;
|
2021-08-18 23:36:02 +05:30
|
|
|
if (rflg) {
|
2023-02-01 18:20:48 +05:30
|
|
|
uid_max = getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
|
2022-01-04 17:36:00 +05:30
|
|
|
if (user_id > uid_max) {
|
|
|
|
fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
|
2020-04-11 20:15:54 +05:30
|
|
|
}
|
|
|
|
}else{
|
2023-02-01 18:20:48 +05:30
|
|
|
uid_min = getdef_ulong("UID_MIN", 1000UL);
|
|
|
|
uid_max = getdef_ulong("UID_MAX", 6000UL);
|
2021-08-18 23:36:02 +05:30
|
|
|
if (uid_min <= uid_max) {
|
|
|
|
if (user_id < uid_min || user_id >uid_max)
|
2020-04-20 07:46:19 +05:30
|
|
|
fprintf(stderr, _("%s warning: %s's uid %d outside of the UID_MIN %d and UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
|
2020-04-11 20:15:54 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* main - useradd command
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
int main (int argc, char **argv)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
|
|
|
pam_handle_t *pamh = NULL;
|
|
|
|
int retval;
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* USE_PAM */
|
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2016-02-16 04:41:10 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2017-02-09 05:18:36 +05:30
|
|
|
uid_t uid_min;
|
|
|
|
uid_t uid_max;
|
2016-02-16 04:41:10 +05:30
|
|
|
#endif
|
2021-08-15 05:55:51 +05:30
|
|
|
unsigned long subuid_count = 0;
|
|
|
|
unsigned long subgid_count = 0;
|
2016-02-16 04:41:10 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Get my name so that I can use it to report errors.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
Prog = Basename (argv[0]);
|
2021-11-29 05:07:53 +05:30
|
|
|
log_set_progname(Prog);
|
|
|
|
log_set_logfd(stderr);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
(void) setlocale (LC_ALL, "");
|
|
|
|
(void) bindtextdomain (PACKAGE, LOCALEDIR);
|
|
|
|
(void) textdomain (PACKAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2011-11-07 00:07:25 +05:30
|
|
|
process_root_flag ("-R", argc, argv);
|
|
|
|
|
2016-05-15 19:19:39 +05:30
|
|
|
prefix = process_prefix_flag("-P", argc, argv);
|
|
|
|
|
2007-10-07 17:16:07 +05:30
|
|
|
OPENLOG ("useradd");
|
2011-11-07 00:07:25 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_help_open ();
|
|
|
|
#endif
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2007-10-07 17:16:07 +05:30
|
|
|
sys_ngroups = sysconf (_SC_NGROUPS_MAX);
|
2023-02-05 03:11:18 +05:30
|
|
|
user_groups = XMALLOCARRAY (1 + sys_ngroups, char *);
|
2007-10-07 17:17:11 +05:30
|
|
|
/*
|
|
|
|
* Initialize the list to be empty
|
|
|
|
*/
|
2023-02-01 07:20:14 +05:30
|
|
|
user_groups[0] = NULL;
|
2007-10-07 17:17:11 +05:30
|
|
|
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2007-10-07 17:16:07 +05:30
|
|
|
is_shadow_pwd = spw_file_present ();
|
2007-10-07 17:15:40 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-10-07 17:16:07 +05:30
|
|
|
is_shadow_grp = sgr_file_present ();
|
2007-10-07 17:15:40 +05:30
|
|
|
#endif
|
2016-02-18 22:50:43 +05:30
|
|
|
|
2016-08-25 14:50:34 +05:30
|
|
|
get_defaults ();
|
|
|
|
|
2016-02-18 22:50:43 +05:30
|
|
|
process_flags (argc, argv);
|
|
|
|
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2023-02-01 18:20:48 +05:30
|
|
|
uid_min = getdef_ulong ("UID_MIN", 1000UL);
|
|
|
|
uid_max = getdef_ulong ("UID_MAX", 60000UL);
|
2021-05-22 22:12:02 +05:30
|
|
|
subuid_count = getdef_ulong ("SUB_UID_COUNT", 65536);
|
|
|
|
subgid_count = getdef_ulong ("SUB_GID_COUNT", 65536);
|
2022-07-20 07:47:16 +05:30
|
|
|
is_sub_uid = subuid_count > 0 && sub_uid_file_present () &&
|
|
|
|
(!rflg || Fflg) &&
|
2016-02-16 04:41:10 +05:30
|
|
|
(!user_id || (user_id <= uid_max && user_id >= uid_min));
|
2022-07-20 07:47:16 +05:30
|
|
|
is_sub_gid = subgid_count > 0 && sub_gid_file_present () &&
|
|
|
|
(!rflg || Fflg) &&
|
2016-02-16 04:41:10 +05:30
|
|
|
(!user_id || (user_id <= uid_max && user_id >= uid_min));
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
2007-10-07 17:15:40 +05:30
|
|
|
|
2022-01-03 17:01:49 +05:30
|
|
|
if (run_parts ("/etc/shadow-maint/useradd-pre.d", user_name,
|
2020-03-13 02:44:57 +05:30
|
|
|
"useradd")) {
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
{
|
|
|
|
struct passwd *pampw;
|
|
|
|
pampw = getpwuid (getuid ()); /* local, no need for xgetpwuid */
|
2021-11-30 21:44:14 +05:30
|
|
|
if (pampw == NULL && getuid ()) {
|
Additional PAM cleanup:
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: If the username cannot be determined, report it as
such (not a PAM authentication failure).
2008-09-07 05:16:44 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: Cannot determine your user name.\n"),
|
|
|
|
Prog);
|
|
|
|
fail_exit (1);
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
}
|
Additional PAM cleanup:
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: If the username cannot be determined, report it as
such (not a PAM authentication failure).
2008-09-07 05:16:44 +05:30
|
|
|
|
2021-11-30 21:44:14 +05:30
|
|
|
retval = pam_start ("useradd", pampw?pampw->pw_name:"root", &conv, &pamh);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
if (PAM_SUCCESS == retval) {
|
2007-10-07 17:14:59 +05:30
|
|
|
retval = pam_authenticate (pamh, 0);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 03:38:08 +05:30
|
|
|
if (PAM_SUCCESS == retval) {
|
2007-10-07 17:14:59 +05:30
|
|
|
retval = pam_acct_mgmt (pamh, 0);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: Simplify the PAM error handling. Do not keep the pamh
handle, but terminate the PAM transaction as soon as possible if
there are no PAM session opened.
2008-09-06 18:58:02 +05:30
|
|
|
if (PAM_SUCCESS != retval) {
|
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/newusers.c, src/useradd.c, src/userdel.c,
src/usermod.c: Provide the PAM error
message instead of our own, and log error to syslog.
* src/groupmems.c: Exit with exit rather than fail_exit in usage().
* src/newusers.c: Check the number of arguments.
* src/newusers.c: Do not create the home directory when it is not
changed.
* src/useradd.c: Set the group password to "!" rather "x" if there
are no gshadow file.
2011-11-13 21:54:57 +05:30
|
|
|
fprintf (stderr, _("%s: PAM: %s\n"),
|
|
|
|
Prog, pam_strerror (pamh, retval));
|
|
|
|
SYSLOG((LOG_ERR, "%s", pam_strerror (pamh, retval)));
|
|
|
|
if (NULL != pamh) {
|
|
|
|
(void) pam_end (pamh, retval);
|
|
|
|
}
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (1);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/newusers.c, src/useradd.c, src/userdel.c,
src/usermod.c: Provide the PAM error
message instead of our own, and log error to syslog.
* src/groupmems.c: Exit with exit rather than fail_exit in usage().
* src/newusers.c: Check the number of arguments.
* src/newusers.c: Do not create the home directory when it is not
changed.
* src/useradd.c: Set the group password to "!" rather "x" if there
are no gshadow file.
2011-11-13 21:54:57 +05:30
|
|
|
(void) pam_end (pamh, retval);
|
2007-10-07 17:15:40 +05:30
|
|
|
#endif /* USE_PAM */
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if we are messing with the defaults file, or creating
|
|
|
|
* a new user.
|
|
|
|
*/
|
|
|
|
if (Dflg) {
|
2008-06-10 03:38:08 +05:30
|
|
|
if (gflg || bflg || fflg || eflg || sflg) {
|
|
|
|
exit ((set_defaults () != 0) ? 1 : 0);
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
show_defaults ();
|
|
|
|
exit (E_SUCCESS);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Start with a quick check to see if the user exists.
|
|
|
|
*/
|
2016-05-15 19:19:39 +05:30
|
|
|
if (prefix_getpwnam (user_name) != NULL) { /* local, no need for xgetpwnam */
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr, _("%s: user '%s' already exists\n"), Prog, user_name);
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_NAME_IN_USE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:38 +05:30
|
|
|
/*
|
|
|
|
* Don't blindly overwrite a group when a user is added...
|
|
|
|
* If you already have a group username, and want to add the user
|
|
|
|
* to that group, use useradd -g username username.
|
|
|
|
* --bero
|
|
|
|
*/
|
2008-02-26 02:33:46 +05:30
|
|
|
if (Uflg) {
|
2008-06-10 03:38:08 +05:30
|
|
|
/* local, no need for xgetgrnam */
|
2016-05-15 19:19:39 +05:30
|
|
|
if (prefix_getgrnam (user_name) != NULL) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: group %s exists - if you want to add this user to that group, use -g.\n"),
|
|
|
|
Prog, user_name);
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding group",
|
2008-09-05 01:05:48 +05:30
|
|
|
user_name, AUDIT_NO_ID,
|
|
|
|
SHADOW_AUDIT_FAILURE);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_NAME_IN_USE);
|
2007-10-07 17:14:59 +05:30
|
|
|
}
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:15:23 +05:30
|
|
|
* Do the hard stuff:
|
|
|
|
* - open the files,
|
|
|
|
* - create the user entries,
|
|
|
|
* - create the home directory,
|
2007-10-07 17:16:52 +05:30
|
|
|
* - create user mail spool,
|
2007-10-07 17:15:23 +05:30
|
|
|
* - flush nscd caches for passwd and group services,
|
|
|
|
* - then close and update the files.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
open_files ();
|
|
|
|
|
2007-10-07 17:17:22 +05:30
|
|
|
if (!oflg) {
|
|
|
|
/* first, seek for a valid uid to use for this user.
|
|
|
|
* We do this because later we can use the uid we found as
|
|
|
|
* gid too ... --gafton */
|
2008-02-03 22:26:23 +05:30
|
|
|
if (!uflg) {
|
2008-02-20 02:31:38 +05:30
|
|
|
if (find_new_uid (rflg, &user_id, NULL) < 0) {
|
2008-02-03 22:26:23 +05:30
|
|
|
fprintf (stderr, _("%s: can't create user\n"), Prog);
|
|
|
|
fail_exit (E_UID_IN_USE);
|
|
|
|
}
|
|
|
|
} else {
|
2016-05-15 19:19:39 +05:30
|
|
|
if (prefix_getpwuid (user_id) != NULL) {
|
2008-06-14 02:36:04 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: UID %lu is not unique\n"),
|
|
|
|
Prog, (unsigned long) user_id);
|
2007-12-26 18:48:27 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-09-04 02:32:32 +05:30
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
2008-06-14 02:36:04 +05:30
|
|
|
"adding user",
|
2023-02-01 18:20:48 +05:30
|
|
|
user_name, user_id,
|
2008-09-05 01:05:48 +05:30
|
|
|
SHADOW_AUDIT_FAILURE);
|
2007-12-26 18:48:27 +05:30
|
|
|
#endif
|
2008-03-09 04:14:53 +05:30
|
|
|
fail_exit (E_UID_IN_USE);
|
2007-12-26 18:48:27 +05:30
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:17:22 +05:30
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
|
2021-08-18 23:36:02 +05:30
|
|
|
if (uflg)
|
2020-04-11 20:15:54 +05:30
|
|
|
check_uid_range(rflg,user_id);
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
#ifdef WITH_TCB
|
2010-03-17 00:44:54 +05:30
|
|
|
if (getdef_bool ("USE_TCB")) {
|
2010-03-18 14:51:27 +05:30
|
|
|
if (shadowtcb_create (user_name, user_id) == SHADOWTCB_FAILURE) {
|
2010-03-17 00:44:54 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: Failed to create tcb directory for %s\n"),
|
|
|
|
Prog, user_name);
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
fail_exit (E_UID_IN_USE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
2010-03-17 00:44:54 +05:30
|
|
|
open_shadow ();
|
2010-01-30 Paweł Hajdan, Jr. <phajdan.jr@gentoo.org>
* NEWS: Add support for TCB.
* lib/tcbfuncs.h, lib/tcbfuncs.c, lib/Makefile.am: New library to
support TCB.
* lib/prototypes, libmisc/copydir.c (remove_tree): Add boolean
parameter remove_root.
* configure.in: Add conditional WITH_TCB.
* src/userdel.c, src/usermod.c: Add support for TCB. Update call to
remove_tree().
* src/pwconv.c, src/pwunconv.c: Should not be used with TCB enabled.
* src/vipw.c: Add support for TCB. Update call to remove_tree().
* src/useradd.c: Add support for TCB. Open the shadow file outside
of open_files().
* src/chage.c: Add support for TCB.
* src/Makefile.am: Install passwd sgid shadow when TCB is enabled.
* lib/getdefs.c, man/vipw.8.xml, man/login.defs.5.xml,
man/login.defs/TCB_AUTH_GROUP.xml, man/login.defs/USE_TCB.xml,
man/login.defs/TCB_SYMLINKS.xml, man/generate_mans.mak,
man/generate_mans.deps, man/Makefile.am: New configuration
parameters: TCB_AUTH_GROUP, TCB_SYMLINKS, USE_TCB.
* lib/shadowio.c, lib/commonio.c: Add support for TCB.
2010-03-04 23:41:13 +05:30
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
/* do we have to add a group for that user? This is why we need to
|
|
|
|
* open the group files in the open_files() function --gafton */
|
2008-02-26 02:33:46 +05:30
|
|
|
if (Uflg) {
|
2008-02-20 02:31:38 +05:30
|
|
|
if (find_new_gid (rflg, &user_gid, &user_id) < 0) {
|
2008-02-03 22:26:23 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:57 +05:30
|
|
|
_("%s: can't create group\n"),
|
|
|
|
Prog);
|
2008-02-03 22:26:23 +05:30
|
|
|
fail_exit (4);
|
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
grp_add ();
|
|
|
|
}
|
|
|
|
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#ifdef ENABLE_SUBIDS
|
2021-08-10 12:37:03 +05:30
|
|
|
if (is_sub_uid && subuid_count != 0) {
|
|
|
|
if (find_new_sub_uids(&sub_uid_start, &subuid_count) < 0) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
2013-08-13 03:43:12 +05:30
|
|
|
_("%s: can't create subordinate user IDs\n"),
|
|
|
|
Prog);
|
2013-01-22 14:47:30 +05:30
|
|
|
fail_exit(E_SUB_UID_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
2021-08-10 12:37:03 +05:30
|
|
|
if (is_sub_gid && subgid_count != 0) {
|
|
|
|
if (find_new_sub_gids(&sub_gid_start, &subgid_count) < 0) {
|
2013-01-22 14:47:30 +05:30
|
|
|
fprintf (stderr,
|
2013-08-13 03:43:12 +05:30
|
|
|
_("%s: can't create subordinate group IDs\n"),
|
|
|
|
Prog);
|
2013-01-22 14:47:30 +05:30
|
|
|
fail_exit(E_SUB_GID_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
Allow disabling of subordinate IDs.
* configure.in: Add configure options --enable-subordinate-ids /
--disable-subordinate-ids. Enabled by default.
* lib/prototypes.h: Include <config.h> before using its macros.
* lib/commonio.h, lib/commonio.c: Define commonio_append only when
ENABLE_SUBIDS is defined.
* lib/prototypes.h, libmisc/find_new_sub_gids.c,
libmisc/find_new_sub_uids.c: Likewise.
* lib/subordinateio.h, lib/subordinateio.c: Likewise.
* libmisc/user_busy.c: Only check if subordinate IDs are in use if
ENABLE_SUBIDS is defined.
* src/Makefile.am: Create newgidmap and newuidmap only if
ENABLE_SUBIDS is defined.
* src/newusers.c: Check for ENABLE_SUBIDS to enable support for
subordinate IDs.
* src/useradd.c: Likewise.
* src/userdel.c: Likewise.
* src/usermod.c: Likewise.
* man/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 only if ENABLE_SUBIDS is defined.
* man/fr/Makefile.am: Install man1/newgidmap.1, man1/newuidmap.1,
man5/subgid.5, and man5/subuid.5 (not translated yet).
* man/generate_mans.mak: Add xsltproc conditionals
subids/no_subids.
* man/login.defs.d/SUB_GID_COUNT.xml: Add dependency on subids
condition.
* man/login.defs.d/SUB_UID_COUNT.xml: Likewise.
* man/usermod.8.xml: Document options for subordinate IDs and
reference subgid(5) / subuid(5) depending on the subids condition.
2013-08-11 18:24:22 +05:30
|
|
|
#endif /* ENABLE_SUBIDS */
|
|
|
|
|
2021-08-10 12:37:03 +05:30
|
|
|
usr_update (subuid_count, subgid_count);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 20:06:51 +05:30
|
|
|
close_files ();
|
|
|
|
|
2021-10-08 16:39:59 +05:30
|
|
|
nscd_flush_cache ("passwd");
|
|
|
|
nscd_flush_cache ("group");
|
|
|
|
sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
|
|
|
|
|
2016-10-19 18:10:59 +05:30
|
|
|
/*
|
|
|
|
* tallylog_reset needs to be able to lookup
|
|
|
|
* a valid existing user name,
|
2017-10-22 13:35:45 +05:30
|
|
|
* so we cannot call it before close_files()
|
2016-10-19 18:10:59 +05:30
|
|
|
*/
|
2017-02-20 19:19:30 +05:30
|
|
|
if (!lflg && getpwuid (user_id) != NULL) {
|
2016-10-19 18:10:59 +05:30
|
|
|
tallylog_reset (user_name);
|
|
|
|
}
|
|
|
|
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2011-11-22 03:32:15 +05:30
|
|
|
if (Zflg) {
|
2023-04-01 18:04:56 +05:30
|
|
|
if (set_seuser (user_name, user_selinux, user_selinux_range) != 0) {
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
|
|
|
|
Prog, user_name, user_selinux);
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
|
"adding SELinux user mapping",
|
2023-02-01 18:20:48 +05:30
|
|
|
user_name, user_id, 0);
|
* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
safe_system().
* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
lib/Makefile.am: Added helper functions for semanage.
* README, src/useradd.c, src/usermod.c, src/userdel.c,
configure.in: Use libsemanage instead of semanage.
2011-11-18 03:21:07 +05:30
|
|
|
#endif /* WITH_AUDIT */
|
|
|
|
fail_exit (E_SE_UPDATE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif /* WITH_SELINUX */
|
2009-04-11 21:04:10 +05:30
|
|
|
|
2021-10-08 16:39:59 +05:30
|
|
|
if (mflg) {
|
|
|
|
create_home ();
|
|
|
|
if (home_added) {
|
2021-11-12 19:53:30 +05:30
|
|
|
copy_tree (def_template, prefix_user_home, false, true,
|
2021-10-08 16:39:59 +05:30
|
|
|
(uid_t)-1, user_id, (gid_t)-1, user_gid);
|
2022-11-09 19:11:31 +05:30
|
|
|
copy_tree (def_usrtemplate, prefix_user_home, false, false,
|
|
|
|
(uid_t)-1, user_id, (gid_t)-1, user_gid);
|
2021-10-08 16:39:59 +05:30
|
|
|
} else {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: warning: the home directory %s already exists.\n"
|
|
|
|
"%s: Not copying any file from skel directory into it.\n"),
|
|
|
|
Prog, user_home, Prog);
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Do not create mail directory for system accounts */
|
|
|
|
if (!rflg) {
|
|
|
|
create_mail ();
|
|
|
|
}
|
|
|
|
|
2022-01-03 17:01:49 +05:30
|
|
|
if (run_parts ("/etc/shadow-maint/useradd-post.d", user_name,
|
2020-03-13 02:44:57 +05:30
|
|
|
"useradd")) {
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
|
2008-03-09 04:14:53 +05:30
|
|
|
return E_SUCCESS;
|
2007-10-07 17:15:23 +05:30
|
|
|
}
|
2008-06-10 03:38:08 +05:30
|
|
|
|