pw_group.c revision 286259 
1/*-
2 * Copyright (C) 1996
3 *	David L. Nugent.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#ifndef lint
28static const char rcsid[] =
29  "$FreeBSD: head/usr.sbin/pw/pw_group.c 286259 2015-08-03 22:07:50Z ed $";
30#endif /* not lint */
31
32#include <ctype.h>
33#include <err.h>
34#include <grp.h>
35#include <libutil.h>
36#include <paths.h>
37#include <string.h>
38#include <sysexits.h>
39#include <termios.h>
40#include <unistd.h>
41
42#include "pw.h"
43#include "bitmap.h"
44
45static struct passwd *lookup_pwent(const char *user);
46static void	delete_members(struct group *grp, char *list);
47static int	print_group(struct group * grp, bool pretty);
48static gid_t	gr_gidpolicy(struct userconf * cnf, intmax_t id);
49
50static void
51grp_set_passwd(struct group *grp, bool update, int fd, bool precrypted)
52{
53	int		 b;
54	int		 istty;
55	struct termios	 t, n;
56	char		*p, line[256];
57
58	if (fd == -1)
59		return;
60
61	if (fd == '-') {
62		grp->gr_passwd = "*";	/* No access */
63		return;
64	}
65
66	if ((istty = isatty(fd))) {
67		n = t;
68		/* Disable echo */
69		n.c_lflag &= ~(ECHO);
70		tcsetattr(fd, TCSANOW, &n);
71		printf("%sassword for group %s:", update ? "New p" : "P",
72		    grp->gr_name);
73		fflush(stdout);
74	}
75	b = read(fd, line, sizeof(line) - 1);
76	if (istty) {	/* Restore state */
77		tcsetattr(fd, TCSANOW, &t);
78		fputc('\n', stdout);
79		fflush(stdout);
80	}
81	if (b < 0)
82		err(EX_OSERR, "-h file descriptor");
83	line[b] = '\0';
84	if ((p = strpbrk(line, " \t\r\n")) != NULL)
85		*p = '\0';
86	if (!*line)
87		errx(EX_DATAERR, "empty password read on file descriptor %d",
88		    conf.fd);
89	if (precrypted) {
90		if (strchr(line, ':') != 0)
91			errx(EX_DATAERR, "wrong encrypted passwrd");
92		grp->gr_passwd = line;
93	} else
94		grp->gr_passwd = pw_pwcrypt(line);
95}
96
97int
98pw_groupnext(struct userconf *cnf, bool quiet)
99{
100	gid_t next = gr_gidpolicy(cnf, -1);
101
102	if (quiet)
103		return (next);
104	printf("%ju\n", (uintmax_t)next);
105
106	return (EXIT_SUCCESS);
107}
108
109static struct group *
110getgroup(char *name, intmax_t id, bool fatal)
111{
112	struct group *grp;
113
114	if (id < 0 && name == NULL)
115		errx(EX_DATAERR, "groupname or id required");
116	grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
117	if (grp == NULL) {
118		if (!fatal)
119			return (NULL);
120		if (name == NULL)
121			errx(EX_DATAERR, "unknown gid `%ju'", id);
122		errx(EX_DATAERR, "unknown group `%s'", name);
123	}
124	return (grp);
125}
126
127/*
128 * Lookup a passwd entry using a name or UID.
129 */
130static struct passwd *
131lookup_pwent(const char *user)
132{
133	struct passwd *pwd;
134
135	if ((pwd = GETPWNAM(user)) == NULL &&
136	    (!isdigit((unsigned char)*user) ||
137	    (pwd = getpwuid((uid_t) atoi(user))) == NULL))
138		errx(EX_NOUSER, "user `%s' does not exist", user);
139
140	return (pwd);
141}
142
143
144/*
145 * Delete requested members from a group.
146 */
147static void
148delete_members(struct group *grp, char *list)
149{
150	char *p;
151	int k;
152
153	if (grp->gr_mem == NULL)
154		return;
155
156	for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
157		for (k = 0; grp->gr_mem[k] != NULL; k++) {
158			if (strcmp(grp->gr_mem[k], p) == 0)
159				break;
160		}
161		if (grp->gr_mem[k] == NULL) /* No match */
162			continue;
163
164		for (; grp->gr_mem[k] != NULL; k++)
165			grp->gr_mem[k] = grp->gr_mem[k+1];
166	}
167}
168
169static gid_t
170gr_gidpolicy(struct userconf * cnf, intmax_t id)
171{
172	struct group   *grp;
173	struct bitmap   bm;
174	gid_t           gid = (gid_t) - 1;
175
176	/*
177	 * Check the given gid, if any
178	 */
179	if (id > 0) {
180		gid = (gid_t) id;
181
182		if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate)
183			errx(EX_DATAERR, "gid `%ju' has already been allocated",
184			    (uintmax_t)grp->gr_gid);
185		return (gid);
186	}
187
188	/*
189	 * We need to allocate the next available gid under one of
190	 * two policies a) Grab the first unused gid b) Grab the
191	 * highest possible unused gid
192	 */
193	if (cnf->min_gid >= cnf->max_gid) {	/* Sanity claus^H^H^H^Hheck */
194		cnf->min_gid = 1000;
195		cnf->max_gid = 32000;
196	}
197	bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1);
198
199	/*
200	 * Now, let's fill the bitmap from the password file
201	 */
202	SETGRENT();
203	while ((grp = GETGRENT()) != NULL)
204		if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid &&
205		    (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid)
206			bm_setbit(&bm, grp->gr_gid - cnf->min_gid);
207	ENDGRENT();
208
209	/*
210	 * Then apply the policy, with fallback to reuse if necessary
211	 */
212	if (cnf->reuse_gids)
213		gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
214	else {
215		gid = (gid_t) (bm_lastset(&bm) + 1);
216		if (!bm_isset(&bm, gid))
217			gid += cnf->min_gid;
218		else
219			gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
220	}
221
222	/*
223	 * Another sanity check
224	 */
225	if (gid < cnf->min_gid || gid > cnf->max_gid)
226		errx(EX_SOFTWARE, "unable to allocate a new gid - range fully "
227		    "used");
228	bm_dealloc(&bm);
229	return (gid);
230}
231
232static int
233print_group(struct group * grp, bool pretty)
234{
235	char *buf = NULL;
236	int i;
237
238	if (pretty) {
239		printf("Group Name: %-15s   #%lu\n"
240		       "   Members: ",
241		       grp->gr_name, (long) grp->gr_gid);
242		if (grp->gr_mem != NULL) {
243			for (i = 0; grp->gr_mem[i]; i++)
244				printf("%s%s", i ? "," : "", grp->gr_mem[i]);
245		}
246		fputs("\n\n", stdout);
247		return (EXIT_SUCCESS);
248	}
249
250	buf = gr_make(grp);
251	printf("%s\n", buf);
252	free(buf);
253	return (EXIT_SUCCESS);
254}
255
256int
257pw_group_next(int argc, char **argv, char *arg1 __unused)
258{
259	struct userconf *cnf;
260	const char *cfg = NULL;
261	int ch;
262	bool quiet;
263
264	while ((ch = getopt(argc, argv, "Cq")) != -1) {
265		switch (ch) {
266		case 'C':
267			cfg = optarg;
268			break;
269		case 'q':
270			quiet = true;
271			break;
272		}
273	}
274
275	if (quiet)
276		freopen(_PATH_DEVNULL, "w", stderr);
277	cnf = get_userconfig(cfg);
278	return (pw_groupnext(cnf, quiet));
279}
280
281int
282pw_group_show(int argc, char **argv, char *arg1)
283{
284	struct group *grp = NULL;
285	char *name;
286	intmax_t id = -1;
287	int ch;
288	bool all, force, quiet, pretty;
289
290	all = force = quiet = pretty = false;
291
292	struct group fakegroup = {
293		"nogroup",
294		"*",
295		-1,
296		NULL
297	};
298
299	if (arg1 != NULL) {
300		if (arg1[strspn(arg1, "0123456789")] == '\0')
301			id = pw_checkid(arg1, GID_MAX);
302		else
303			name = arg1;
304	}
305
306	while ((ch = getopt(argc, argv, "C:qn:g:FPa")) != -1) {
307		switch (ch) {
308		case 'C':
309			/* ignore compatibility */
310			break;
311		case 'q':
312			quiet = true;
313			break;
314		case 'n':
315			name = optarg;
316			break;
317		case 'g':
318			id = pw_checkid(optarg, GID_MAX);
319			break;
320		case 'F':
321			force = true;
322			break;
323		case 'P':
324			pretty = true;
325			break;
326		case 'a':
327			all = true;
328			break;
329		}
330	}
331
332	if (quiet)
333		freopen(_PATH_DEVNULL, "w", stderr);
334
335	if (all) {
336		SETGRENT();
337		while ((grp = GETGRENT()) != NULL)
338			print_group(grp, pretty);
339		ENDGRENT();
340		return (EXIT_SUCCESS);
341	}
342
343	grp = getgroup(name, id, !force);
344	if (grp == NULL)
345		grp = &fakegroup;
346
347	return (print_group(grp, pretty));
348}
349
350int
351pw_group_del(int argc, char **argv, char *arg1)
352{
353	struct userconf *cnf = NULL;
354	struct group *grp = NULL;
355	char *name;
356	const char *cfg = NULL;
357	intmax_t id = -1;
358	int ch, rc;
359	bool quiet = false;
360	bool nis = false;
361
362	if (arg1 != NULL) {
363		if (arg1[strspn(arg1, "0123456789")] == '\0')
364			id = pw_checkid(arg1, GID_MAX);
365		else
366			name = arg1;
367	}
368
369	while ((ch = getopt(argc, argv, "C:qn:g:Y")) != -1) {
370		switch (ch) {
371		case 'C':
372			cfg = optarg;
373			break;
374		case 'q':
375			quiet = true;
376			break;
377		case 'n':
378			name = optarg;
379			break;
380		case 'g':
381			id = pw_checkid(optarg, GID_MAX);
382			break;
383		case 'Y':
384			nis = true;
385			break;
386		}
387	}
388
389	if (quiet)
390		freopen(_PATH_DEVNULL, "w", stderr);
391	grp = getgroup(name, id, true);
392	cnf = get_userconfig(cfg);
393	rc = delgrent(grp);
394	if (rc == -1)
395		err(EX_IOERR, "group '%s' not available (NIS?)", name);
396	else if (rc != 0)
397		err(EX_IOERR, "group update");
398	pw_log(cnf, M_DELETE, W_GROUP, "%s(%ju) removed", name,
399	    (uintmax_t)id);
400
401	if (nis && nis_update() == 0)
402		pw_log(cnf, M_DELETE, W_GROUP, "NIS maps updated");
403
404	return (EXIT_SUCCESS);
405}
406
407static bool
408grp_has_member(struct group *grp, const char *name)
409{
410	int j;
411
412	for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++)
413		if (strcmp(grp->gr_mem[j], name) == 0)
414			return (true);
415	return (false);
416}
417
418static void
419grp_add_members(struct group **grp, char *members)
420{
421	struct passwd *pwd;
422	char *p;
423	char tok[] = ", \t";
424
425	if (members == NULL)
426		return;
427	for (p = strtok(members, tok); p != NULL; p = strtok(NULL, tok)) {
428		pwd = lookup_pwent(p);
429		if (grp_has_member(*grp, pwd->pw_name))
430			continue;
431		*grp = gr_add(*grp, pwd->pw_name);
432	}
433}
434
435int
436groupadd(struct userconf *cnf, char *name, gid_t id, char *members, int fd,
437    bool dryrun, bool pretty, bool precrypted)
438{
439	struct group *grp;
440	int rc;
441
442	struct group fakegroup = {
443		"nogroup",
444		"*",
445		-1,
446		NULL
447	};
448
449	grp = &fakegroup;
450	grp->gr_name = pw_checkname(name, 0);
451	grp->gr_passwd = "*";
452	grp->gr_gid = gr_gidpolicy(cnf, id);
453	grp->gr_mem = NULL;
454
455	/*
456	 * This allows us to set a group password Group passwords is an
457	 * antique idea, rarely used and insecure (no secure database) Should
458	 * be discouraged, but it is apparently still supported by some
459	 * software.
460	 */
461	grp_set_passwd(grp, false, fd, precrypted);
462	grp_add_members(&grp, members);
463	if (dryrun)
464		return (print_group(grp, pretty));
465
466	if ((rc = addgrent(grp)) != 0) {
467		if (rc == -1)
468			errx(EX_IOERR, "group '%s' already exists",
469			    grp->gr_name);
470		else
471			err(EX_IOERR, "group update");
472	}
473
474	pw_log(cnf, M_ADD, W_GROUP, "%s(%ju)", grp->gr_name,
475	    (uintmax_t)grp->gr_gid);
476
477	return (EXIT_SUCCESS);
478}
479
480int
481pw_group_add(int argc, char **argv, char *arg1)
482{
483	struct userconf *cnf = NULL;
484	char *name = NULL;
485	char *members = NULL;
486	const char *cfg = NULL;
487	intmax_t id = -1;
488	int ch, rc, fd = -1;
489	bool quiet, precrypted, dryrun, pretty, nis;
490
491	quiet = precrypted = dryrun = pretty = nis = false;
492
493	if (arg1 != NULL) {
494		if (arg1[strspn(arg1, "0123456789")] == '\0')
495			id = pw_checkid(arg1, GID_MAX);
496		else
497			name = arg1;
498	}
499
500	while ((ch = getopt(argc, argv, "C:qn:g:h:H:M:oNPY")) != -1) {
501		switch (ch) {
502		case 'C':
503			cfg = optarg;
504			break;
505		case 'q':
506			quiet = true;
507			break;
508		case 'n':
509			name = optarg;
510			break;
511		case 'g':
512			id = pw_checkid(optarg, GID_MAX);
513			break;
514		case 'H':
515			if (fd != -1)
516				errx(EX_USAGE, "'-h' and '-H' are mutually "
517				    "exclusive options");
518			fd = pw_checkfd(optarg);
519			precrypted = true;
520			if (fd == '-')
521				errx(EX_USAGE, "-H expects a file descriptor");
522			break;
523		case 'h':
524			if (fd != -1)
525				errx(EX_USAGE, "'-h' and '-H' are mutually "
526				    "exclusive options");
527			fd = pw_checkfd(optarg);
528			break;
529		case 'M':
530			members = optarg;
531			break;
532		case 'o':
533			conf.checkduplicate = false;
534			break;
535		case 'N':
536			dryrun = true;
537			break;
538		case 'P':
539			pretty = true;
540			break;
541		case 'Y':
542			nis = true;
543			break;
544		}
545	}
546
547	if (quiet)
548		freopen(_PATH_DEVNULL, "w", stderr);
549	if (name == NULL)
550		errx(EX_DATAERR, "group name required");
551	if (GETGRNAM(name) != NULL)
552		errx(EX_DATAERR, "group name `%s' already exists", name);
553	cnf = get_userconfig(cfg);
554	rc = groupadd(cnf, name, gr_gidpolicy(cnf, id), members, fd, dryrun,
555	    pretty, precrypted);
556	if (nis && rc == EXIT_SUCCESS && nis_update() == 0)
557		pw_log(cnf, M_ADD, W_GROUP, "NIS maps updated");
558
559	return (rc);
560}
561
562int
563pw_group_mod(int argc, char **argv, char *arg1)
564{
565	struct userconf *cnf;
566	struct group *grp = NULL;
567	const char *cfg = NULL;
568	char *oldmembers = NULL;
569	char *members = NULL;
570	char *newmembers = NULL;
571	char *newname = NULL;
572	char *name = NULL;
573	intmax_t id = -1;
574	int ch, rc, fd = -1;
575	bool quiet, pretty, dryrun, nis, precrypted;
576
577	quiet = pretty = dryrun = nis = precrypted = false;
578
579	if (arg1 != NULL) {
580		if (arg1[strspn(arg1, "0123456789")] == '\0')
581			id = pw_checkid(arg1, GID_MAX);
582		else
583			name = arg1;
584	}
585
586	while ((ch = getopt(argc, argv, "C:qn:d:g:l:h:H:M:m:NPY")) != -1) {
587		switch (ch) {
588		case 'C':
589			cfg = optarg;
590			break;
591		case 'q':
592			quiet = true;
593			break;
594		case 'n':
595			name = optarg;
596			break;
597		case 'g':
598			id = pw_checkid(optarg, GID_MAX);
599			break;
600		case 'd':
601			oldmembers = optarg;
602			break;
603		case 'l':
604			newname = optarg;
605			break;
606		case 'H':
607			if (fd != -1)
608				errx(EX_USAGE, "'-h' and '-H' are mutually "
609				    "exclusive options");
610			fd = pw_checkfd(optarg);
611			precrypted = true;
612			if (fd == '-')
613				errx(EX_USAGE, "-H expects a file descriptor");
614			break;
615		case 'h':
616			if (fd != -1)
617				errx(EX_USAGE, "'-h' and '-H' are mutually "
618				    "exclusive options");
619			fd = pw_checkfd(optarg);
620			break;
621		case 'M':
622			members = optarg;
623			break;
624		case 'm':
625			newmembers = optarg;
626			break;
627		case 'N':
628			dryrun = true;
629			break;
630		case 'P':
631			pretty = true;
632			break;
633		case 'Y':
634			nis = true;
635			break;
636		}
637	}
638	if (quiet)
639		freopen(_PATH_DEVNULL, "w", stderr);
640	cnf = get_userconfig(cfg);
641	grp = getgroup(name, id, true);
642	if (name == NULL)
643		name = grp->gr_name;
644	if (id > 0)
645		grp->gr_gid = id;
646
647	if (newname != NULL)
648		grp->gr_name = pw_checkname(newname, 0);
649
650	grp_set_passwd(grp, true, fd, precrypted);
651	/*
652	 * Keep the same logic as old code for now:
653	 * if -M is passed, -d and -m are ignored
654	 * then id -d, -m is ignored
655	 * last is -m
656	 */
657
658	if (members) {
659		grp->gr_mem = NULL;
660		grp_add_members(&grp, members);
661	} else if (oldmembers) {
662		delete_members(grp, oldmembers);
663	} else if (newmembers) {
664		grp_add_members(&grp, newmembers);
665	}
666
667	if ((rc = chggrent(name, grp)) != 0) {
668		if (rc == -1)
669			errx(EX_IOERR, "group '%s' not available (NIS?)",
670			    grp->gr_name);
671		else
672			err(EX_IOERR, "group update");
673	}
674
675	if (newname)
676		name = newname;
677
678	/* grp may have been invalidated */
679	if ((grp = GETGRNAM(name)) == NULL)
680		errx(EX_SOFTWARE, "group disappeared during update");
681
682	pw_log(cnf, M_UPDATE, W_GROUP, "%s(%ju)", grp->gr_name,
683	    (uintmax_t)grp->gr_gid);
684
685	if (nis && nis_update() == 0)
686		pw_log(cnf, M_UPDATE, W_GROUP, "NIS maps updated");
687
688	return (EXIT_SUCCESS);
689}
690