pw_group.c revision 285411
1/*- 2 * Copyright (C) 1996 3 * David L. Nugent. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27#ifndef lint 28static const char rcsid[] = 29 "$FreeBSD: head/usr.sbin/pw/pw_group.c 285411 2015-07-11 22:35:07Z bapt $"; 30#endif /* not lint */ 31 32#include <ctype.h> 33#include <err.h> 34#include <termios.h> 35#include <stdbool.h> 36#include <unistd.h> 37#include <grp.h> 38#include <libutil.h> 39 40#include "pw.h" 41#include "bitmap.h" 42 43 44static struct passwd *lookup_pwent(const char *user); 45static void delete_members(struct group *grp, char *list); 46static int print_group(struct group * grp); 47static gid_t gr_gidpolicy(struct userconf * cnf, long id); 48 49static void 50set_passwd(struct group *grp, bool update) 51{ 52 int b; 53 int istty; 54 struct termios t, n; 55 char *p, line[256]; 56 57 if (conf.fd == '-') { 58 grp->gr_passwd = "*"; /* No access */ 59 return; 60 } 61 62 if ((istty = isatty(conf.fd))) { 63 n = t; 64 /* Disable echo */ 65 n.c_lflag &= ~(ECHO); 66 tcsetattr(conf.fd, TCSANOW, &n); 67 printf("%sassword for group %s:", update ? "New p" : "P", 68 grp->gr_name); 69 fflush(stdout); 70 } 71 b = read(conf.fd, line, sizeof(line) - 1); 72 if (istty) { /* Restore state */ 73 tcsetattr(conf.fd, TCSANOW, &t); 74 fputc('\n', stdout); 75 fflush(stdout); 76 } 77 if (b < 0) 78 err(EX_OSERR, "-h file descriptor"); 79 line[b] = '\0'; 80 if ((p = strpbrk(line, " \t\r\n")) != NULL) 81 *p = '\0'; 82 if (!*line) 83 errx(EX_DATAERR, "empty password read on file descriptor %d", 84 conf.fd); 85 if (conf.precrypted) { 86 if (strchr(line, ':') != 0) 87 errx(EX_DATAERR, "wrong encrypted passwrd"); 88 grp->gr_passwd = line; 89 } else 90 grp->gr_passwd = pw_pwcrypt(line); 91} 92 93int 94pw_groupnext(struct userconf *cnf, bool quiet) 95{ 96 gid_t next = gr_gidpolicy(cnf, -1); 97 98 if (quiet) 99 return (next); 100 printf("%u\n", next); 101 102 return (EXIT_SUCCESS); 103} 104 105static int 106pw_groupshow(const char *name, long id, struct group *fakegroup) 107{ 108 struct group *grp = NULL; 109 110 if (id < 0 && name == NULL && !conf.all) 111 errx(EX_DATAERR, "groupname or id or '-a' required"); 112 113 if (conf.all) { 114 SETGRENT(); 115 while ((grp = GETGRENT()) != NULL) 116 print_group(grp); 117 ENDGRENT(); 118 119 return (EXIT_SUCCESS); 120 } 121 122 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 123 if (grp == NULL) { 124 if (conf.force) { 125 grp = fakegroup; 126 } else { 127 if (name == NULL) 128 errx(EX_DATAERR, "unknown gid `%ld'", id); 129 errx(EX_DATAERR, "unknown group `%s'", name); 130 } 131 } 132 133 return (print_group(grp)); 134} 135 136static int 137pw_groupdel(const char *name, long id) 138{ 139 struct group *grp = NULL; 140 int rc; 141 142 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 143 if (grp == NULL) { 144 if (name == NULL) 145 errx(EX_DATAERR, "unknown gid `%ld'", id); 146 errx(EX_DATAERR, "unknown group `%s'", name); 147 } 148 149 rc = delgrent(grp); 150 if (rc == -1) 151 err(EX_IOERR, "group '%s' not available (NIS?)", name); 152 else if (rc != 0) 153 err(EX_IOERR, "group update"); 154 pw_log(conf.userconf, M_DELETE, W_GROUP, "%s(%ld) removed", name, id); 155 156 return (EXIT_SUCCESS); 157} 158 159int 160pw_group(int mode, char *name, long id, struct cargs * args) 161{ 162 int rc; 163 struct carg *arg; 164 struct group *grp = NULL; 165 char **members = NULL; 166 struct userconf *cnf = conf.userconf; 167 168 static struct group fakegroup = 169 { 170 "nogroup", 171 "*", 172 -1, 173 NULL 174 }; 175 176 if (mode == M_NEXT) 177 return (pw_groupnext(cnf, conf.quiet)); 178 179 if (mode == M_PRINT) 180 return (pw_groupshow(name, id, &fakegroup)); 181 182 if (mode == M_DELETE) 183 return (pw_groupdel(name, id)); 184 185 if (mode == M_LOCK || mode == M_UNLOCK) 186 errx(EX_USAGE, "'lock' command is not available for groups"); 187 188 if (id < 0 && name == NULL) 189 errx(EX_DATAERR, "group name or id required"); 190 191 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 192 193 if (mode == M_UPDATE) { 194 if (name == NULL && grp == NULL) /* Try harder */ 195 grp = GETGRGID(id); 196 197 if (grp == NULL) { 198 if (name == NULL) 199 errx(EX_DATAERR, "unknown group `%s'", name); 200 else 201 errx(EX_DATAERR, "unknown group `%ld'", id); 202 } 203 if (name == NULL) /* Needed later */ 204 name = grp->gr_name; 205 206 if (id > 0) 207 grp->gr_gid = (gid_t) id; 208 209 if (conf.newname != NULL) 210 grp->gr_name = pw_checkname(conf.newname, 0); 211 } else { 212 if (name == NULL) /* Required */ 213 errx(EX_DATAERR, "group name required"); 214 else if (grp != NULL) /* Exists */ 215 errx(EX_DATAERR, "group name `%s' already exists", name); 216 217 grp = &fakegroup; 218 grp->gr_name = pw_checkname(name, 0); 219 grp->gr_passwd = "*"; 220 grp->gr_gid = gr_gidpolicy(cnf, id); 221 grp->gr_mem = NULL; 222 } 223 224 /* 225 * This allows us to set a group password Group passwords is an 226 * antique idea, rarely used and insecure (no secure database) Should 227 * be discouraged, but it is apparently still supported by some 228 * software. 229 */ 230 231 if (conf.which == W_GROUP && conf.fd != -1) 232 set_passwd(grp, mode == M_UPDATE); 233 234 if (((arg = getarg(args, 'M')) != NULL || 235 (arg = getarg(args, 'd')) != NULL || 236 (arg = getarg(args, 'm')) != NULL) && arg->val) { 237 char *p; 238 struct passwd *pwd; 239 240 /* Make sure this is not stay NULL with -M "" */ 241 if (arg->ch == 'd') 242 delete_members(grp, arg->val); 243 else if (arg->ch == 'M') 244 grp->gr_mem = NULL; 245 246 for (p = strtok(arg->val, ", \t"); arg->ch != 'd' && p != NULL; 247 p = strtok(NULL, ", \t")) { 248 int j; 249 250 /* 251 * Check for duplicates 252 */ 253 pwd = lookup_pwent(p); 254 for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++) { 255 if (strcmp(grp->gr_mem[j], pwd->pw_name) == 0) 256 break; 257 } 258 if (grp->gr_mem != NULL && grp->gr_mem[j] != NULL) 259 continue; 260 grp = gr_add(grp, pwd->pw_name); 261 } 262 } 263 264 if (conf.dryrun) 265 return print_group(grp); 266 267 if (mode == M_ADD && (rc = addgrent(grp)) != 0) { 268 if (rc == -1) 269 errx(EX_IOERR, "group '%s' already exists", 270 grp->gr_name); 271 else 272 err(EX_IOERR, "group update"); 273 } else if (mode == M_UPDATE && (rc = chggrent(name, grp)) != 0) { 274 if (rc == -1) 275 errx(EX_IOERR, "group '%s' not available (NIS?)", 276 grp->gr_name); 277 else 278 err(EX_IOERR, "group update"); 279 } 280 281 if (conf.newname != NULL) 282 name = conf.newname; 283 /* grp may have been invalidated */ 284 if ((grp = GETGRNAM(name)) == NULL) 285 errx(EX_SOFTWARE, "group disappeared during update"); 286 287 pw_log(cnf, mode, W_GROUP, "%s(%u)", grp->gr_name, grp->gr_gid); 288 289 free(members); 290 291 return EXIT_SUCCESS; 292} 293 294 295/* 296 * Lookup a passwd entry using a name or UID. 297 */ 298static struct passwd * 299lookup_pwent(const char *user) 300{ 301 struct passwd *pwd; 302 303 if ((pwd = GETPWNAM(user)) == NULL && 304 (!isdigit((unsigned char)*user) || 305 (pwd = getpwuid((uid_t) atoi(user))) == NULL)) 306 errx(EX_NOUSER, "user `%s' does not exist", user); 307 308 return (pwd); 309} 310 311 312/* 313 * Delete requested members from a group. 314 */ 315static void 316delete_members(struct group *grp, char *list) 317{ 318 char *p; 319 int k; 320 321 if (grp->gr_mem == NULL) 322 return; 323 324 for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) { 325 for (k = 0; grp->gr_mem[k] != NULL; k++) { 326 if (strcmp(grp->gr_mem[k], p) == 0) 327 break; 328 } 329 if (grp->gr_mem[k] == NULL) /* No match */ 330 continue; 331 332 for (; grp->gr_mem[k] != NULL; k++) 333 grp->gr_mem[k] = grp->gr_mem[k+1]; 334 } 335} 336 337 338static gid_t 339gr_gidpolicy(struct userconf * cnf, long id) 340{ 341 struct group *grp; 342 gid_t gid = (gid_t) - 1; 343 344 /* 345 * Check the given gid, if any 346 */ 347 if (id > 0) { 348 gid = (gid_t) id; 349 350 if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate) 351 errx(EX_DATAERR, "gid `%u' has already been allocated", grp->gr_gid); 352 } else { 353 struct bitmap bm; 354 355 /* 356 * We need to allocate the next available gid under one of 357 * two policies a) Grab the first unused gid b) Grab the 358 * highest possible unused gid 359 */ 360 if (cnf->min_gid >= cnf->max_gid) { /* Sanity claus^H^H^H^Hheck */ 361 cnf->min_gid = 1000; 362 cnf->max_gid = 32000; 363 } 364 bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1); 365 366 /* 367 * Now, let's fill the bitmap from the password file 368 */ 369 SETGRENT(); 370 while ((grp = GETGRENT()) != NULL) 371 if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid && 372 (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid) 373 bm_setbit(&bm, grp->gr_gid - cnf->min_gid); 374 ENDGRENT(); 375 376 /* 377 * Then apply the policy, with fallback to reuse if necessary 378 */ 379 if (cnf->reuse_gids) 380 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 381 else { 382 gid = (gid_t) (bm_lastset(&bm) + 1); 383 if (!bm_isset(&bm, gid)) 384 gid += cnf->min_gid; 385 else 386 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 387 } 388 389 /* 390 * Another sanity check 391 */ 392 if (gid < cnf->min_gid || gid > cnf->max_gid) 393 errx(EX_SOFTWARE, "unable to allocate a new gid - range fully used"); 394 bm_dealloc(&bm); 395 } 396 return gid; 397} 398 399 400static int 401print_group(struct group * grp) 402{ 403 if (!conf.pretty) { 404 char *buf = NULL; 405 406 buf = gr_make(grp); 407 printf("%s\n", buf); 408 free(buf); 409 } else { 410 int i; 411 412 printf("Group Name: %-15s #%lu\n" 413 " Members: ", 414 grp->gr_name, (long) grp->gr_gid); 415 if (grp->gr_mem != NULL) { 416 for (i = 0; grp->gr_mem[i]; i++) 417 printf("%s%s", i ? "," : "", grp->gr_mem[i]); 418 } 419 fputs("\n\n", stdout); 420 } 421 return EXIT_SUCCESS; 422} 423