2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2008-04-27 06:10:09 +05:30
|
|
|
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
|
|
|
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
|
|
|
* Copyright (c) 2000 - 2006, Tomasz Kłoczko
|
2009-03-09 02:13:15 +05:30
|
|
|
* Copyright (c) 2007 - 2009, Nicolas François
|
2007-10-07 17:14:02 +05:30
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2008-04-27 06:10:09 +05:30
|
|
|
* 3. The name of the copyright holders or contributors may not be used to
|
|
|
|
* endorse or promote products derived from this software without
|
|
|
|
* specific prior written permission.
|
2007-10-07 17:14:02 +05:30
|
|
|
*
|
2008-04-27 06:10:09 +05:30
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
|
|
|
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
|
|
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
2007-11-11 05:16:11 +05:30
|
|
|
#ident "$Id$"
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#include <ctype.h>
|
2007-10-07 17:17:01 +05:30
|
|
|
#include <errno.h>
|
2007-10-07 17:14:02 +05:30
|
|
|
#include <fcntl.h>
|
2007-10-07 17:17:11 +05:30
|
|
|
#include <getopt.h>
|
2007-10-07 17:17:01 +05:30
|
|
|
#include <grp.h>
|
|
|
|
#include <lastlog.h>
|
|
|
|
#include <pwd.h>
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
2007-10-07 17:17:11 +05:30
|
|
|
#include "pam_defs.h"
|
2007-10-07 17:14:59 +05:30
|
|
|
#endif /* USE_PAM */
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:17:01 +05:30
|
|
|
#include <stdio.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <time.h>
|
2007-10-07 17:14:02 +05:30
|
|
|
#include "chkname.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "defines.h"
|
2007-10-07 17:14:02 +05:30
|
|
|
#include "faillog.h"
|
|
|
|
#include "getdef.h"
|
2007-10-07 17:16:34 +05:30
|
|
|
#include "groupio.h"
|
|
|
|
#include "nscd.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "prototypes.h"
|
|
|
|
#include "pwauth.h"
|
2007-10-07 17:16:34 +05:30
|
|
|
#include "pwio.h"
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
#include "sgroupio.h"
|
|
|
|
#endif
|
|
|
|
#include "shadowio.h"
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* exit status values
|
|
|
|
* for E_GRP_UPDATE and E_NOSPACE (not used yet), other update requests
|
|
|
|
* will be implemented (as documented in the Solaris 2.x man page).
|
|
|
|
*/
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
/*@-exitarg@*/
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_SUCCESS 0 /* success */
|
|
|
|
#define E_PW_UPDATE 1 /* can't update password file */
|
|
|
|
#define E_USAGE 2 /* invalid command syntax */
|
|
|
|
#define E_BAD_ARG 3 /* invalid argument to option */
|
2007-10-07 17:16:25 +05:30
|
|
|
#define E_UID_IN_USE 4 /* UID already in use (and no -o) */
|
2007-10-07 17:17:57 +05:30
|
|
|
/* #define E_BAD_PWFILE 5 passwd file contains errors */
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_NOTFOUND 6 /* specified user/group doesn't exist */
|
|
|
|
#define E_USER_BUSY 8 /* user to modify is logged in */
|
|
|
|
#define E_NAME_IN_USE 9 /* username already in use */
|
|
|
|
#define E_GRP_UPDATE 10 /* can't update group file */
|
2007-10-07 17:17:57 +05:30
|
|
|
/* #define E_NOSPACE 11 insufficient space to move home dir */
|
2007-10-07 17:14:02 +05:30
|
|
|
#define E_HOMEDIR 12 /* unable to complete home dir move */
|
|
|
|
#define VALID(s) (strcspn (s, ":\n") == strlen (s))
|
2007-10-07 17:17:01 +05:30
|
|
|
/*
|
|
|
|
* Global variables
|
|
|
|
*/
|
* src/newgrp.c, src/userdel.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/pwconv.c, src/chpasswd.c, src/logoutd.c,
src/chfn.c, src/groupmems.c, src/usermod.c, src/pwunconv.c,
src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/grpconv.c,
src/groups.c, src/grpunconv.c, src/chsh.c: Prog is now global (not
static to the file) so that it can be used by the helper functions
of libmisc.
* lib/prototypes.h: Added extern char *Prog.
* libmisc/find_new_gid.c, libmisc/find_new_uid.c: Indicate the
program name with the warning.
2008-09-06 18:21:53 +05:30
|
|
|
char *Prog;
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
static char *user_name;
|
|
|
|
static char *user_newname;
|
|
|
|
static char *user_pass;
|
|
|
|
static uid_t user_id;
|
|
|
|
static uid_t user_newid;
|
|
|
|
static gid_t user_gid;
|
|
|
|
static gid_t user_newgid;
|
|
|
|
static char *user_comment;
|
2008-01-24 02:49:08 +05:30
|
|
|
static char *user_newcomment;
|
2007-10-07 17:14:02 +05:30
|
|
|
static char *user_home;
|
|
|
|
static char *user_newhome;
|
|
|
|
static char *user_shell;
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
static const char *user_selinux = "";
|
|
|
|
#endif
|
2008-01-24 02:49:08 +05:30
|
|
|
static char *user_newshell;
|
2007-10-07 17:14:02 +05:30
|
|
|
static long user_expire;
|
2008-01-24 02:49:08 +05:30
|
|
|
static long user_newexpire;
|
2007-10-07 17:14:02 +05:30
|
|
|
static long user_inactive;
|
2008-01-24 02:49:08 +05:30
|
|
|
static long user_newinactive;
|
2007-10-07 17:14:51 +05:30
|
|
|
static long sys_ngroups;
|
2007-10-07 17:14:59 +05:30
|
|
|
static char **user_groups; /* NULL-terminated list */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
static bool
|
|
|
|
aflg = false, /* append to existing secondary group set */
|
|
|
|
cflg = false, /* new comment (GECOS) field */
|
|
|
|
dflg = false, /* new home directory */
|
|
|
|
eflg = false, /* days since 1970-01-01 when account becomes expired */
|
|
|
|
fflg = false, /* days until account with expired password is locked */
|
|
|
|
gflg = false, /* new primary group ID */
|
|
|
|
Gflg = false, /* new secondary group set */
|
|
|
|
Lflg = false, /* lock the password */
|
|
|
|
lflg = false, /* new user name */
|
|
|
|
mflg = false, /* create user's home directory if it doesn't exist */
|
|
|
|
oflg = false, /* permit non-unique user ID to be specified with -u */
|
|
|
|
pflg = false, /* new encrypted password */
|
|
|
|
sflg = false, /* new shell program */
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
Zflg = false, /* new selinux user */
|
|
|
|
#endif
|
2008-06-10 01:47:48 +05:30
|
|
|
uflg = false, /* specify new user ID */
|
|
|
|
Uflg = false; /* unlock the password */
|
|
|
|
|
|
|
|
static bool is_shadow_pwd;
|
2007-10-07 17:16:25 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
static bool is_shadow_grp;
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
static bool pw_locked = false;
|
|
|
|
static bool spw_locked = false;
|
|
|
|
static bool gr_locked = false;
|
2007-11-17 17:12:47 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
static bool sgr_locked = false;
|
2007-11-17 17:12:47 +05:30
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/* local function prototypes */
|
2008-02-04 03:00:47 +05:30
|
|
|
static void date_to_str (char *buf, size_t maxsize,
|
|
|
|
long int date, const char *negativ);
|
2007-10-07 17:14:59 +05:30
|
|
|
static int get_groups (char *);
|
|
|
|
static void usage (void);
|
|
|
|
static void new_pwent (struct passwd *);
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
static void selinux_update_mapping (void);
|
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
|
|
|
|
static void new_spent (struct spwd *);
|
|
|
|
static void fail_exit (int);
|
2007-11-17 17:12:47 +05:30
|
|
|
static void update_group (void);
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2007-11-17 17:12:47 +05:30
|
|
|
static void update_gshadow (void);
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
2007-11-17 17:12:47 +05:30
|
|
|
static void grp_update (void);
|
2007-10-07 17:14:59 +05:30
|
|
|
|
|
|
|
static void process_flags (int, char **);
|
|
|
|
static void close_files (void);
|
|
|
|
static void open_files (void);
|
|
|
|
static void usr_update (void);
|
|
|
|
static void move_home (void);
|
2008-07-12 02:22:44 +05:30
|
|
|
static void update_lastlog (void);
|
|
|
|
static void update_faillog (void);
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifndef NO_MOVE_MAILBOX
|
2007-10-07 17:14:59 +05:30
|
|
|
static void move_mailbox (void);
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
|
|
|
|
2008-02-04 03:00:47 +05:30
|
|
|
static void date_to_str (char *buf, size_t maxsize,
|
|
|
|
long int date, const char *negativ)
|
|
|
|
{
|
|
|
|
struct tm *tp;
|
|
|
|
|
2008-02-04 03:12:08 +05:30
|
|
|
if ((negativ != NULL) && (date < 0)) {
|
2008-02-04 03:00:47 +05:30
|
|
|
strncpy (buf, negativ, maxsize);
|
|
|
|
} else {
|
2008-06-14 02:10:04 +05:30
|
|
|
time_t t = (time_t) date;
|
2008-02-04 03:00:47 +05:30
|
|
|
tp = gmtime (&t);
|
|
|
|
#ifdef HAVE_STRFTIME
|
|
|
|
strftime (buf, maxsize, "%Y-%m-%d", tp);
|
|
|
|
#else
|
|
|
|
snprintf (buf, maxsize, "%04d-%02d-%02d",
|
|
|
|
tp->tm_year + 1900, tp->tm_mon + 1, tp->tm_mday);
|
|
|
|
#endif /* HAVE_STRFTIME */
|
|
|
|
}
|
|
|
|
buf[maxsize - 1] = '\0';
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* get_groups - convert a list of group names to an array of group IDs
|
|
|
|
*
|
|
|
|
* get_groups() takes a comma-separated list of group names and
|
2007-10-07 17:14:59 +05:30
|
|
|
* converts it to a NULL-terminated array. Any unknown group names are
|
|
|
|
* reported as errors.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static int get_groups (char *list)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
char *cp;
|
|
|
|
const struct group *grp;
|
|
|
|
int errors = 0;
|
|
|
|
int ngroups = 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the list to be empty
|
|
|
|
*/
|
|
|
|
user_groups[0] = (char *) 0;
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if ('\0' == *list) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return 0;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* So long as there is some data to be converted, strip off each
|
|
|
|
* name and look it up. A mix of numerical and string values for
|
|
|
|
* group identifiers is permitted.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
do {
|
|
|
|
/*
|
|
|
|
* Strip off a single name from the list
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
cp = strchr (list, ',');
|
|
|
|
if (NULL != cp) {
|
|
|
|
*cp = '\0';
|
|
|
|
cp++;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Names starting with digits are treated as numerical GID
|
|
|
|
* values, otherwise the string is looked up as is.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
grp = getgr_nam_gid (list);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* There must be a match, either by GID value or by
|
|
|
|
* string name.
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == grp) {
|
2008-08-30 23:57:59 +05:30
|
|
|
fprintf (stderr, _("%s: group '%s' does not exist\n"),
|
|
|
|
Prog, list);
|
2007-10-07 17:14:02 +05:30
|
|
|
errors++;
|
|
|
|
}
|
|
|
|
list = cp;
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* If the group doesn't exist, don't dump core. Instead,
|
|
|
|
* try the next one. --marekm
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
#ifdef USE_NIS
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Don't add this group if they are an NIS group. Tell the
|
|
|
|
* user to go to the server for this group.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
if (__isgrNIS ()) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: group '%s' is a NIS group.\n"),
|
|
|
|
Prog, grp->gr_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:14:51 +05:30
|
|
|
if (ngroups == sys_ngroups) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: too many groups specified (max %d).\n"),
|
|
|
|
Prog, ngroups);
|
2007-10-07 17:14:02 +05:30
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Add the group name to the user's list of groups.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
user_groups[ngroups++] = xstrdup (grp->gr_name);
|
2008-06-10 01:47:48 +05:30
|
|
|
} while (NULL != list);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
user_groups[ngroups] = (char *) 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Any errors in finding group names are fatal
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (0 != errors) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return -1;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* usage - display usage message and exit
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void usage (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2009-04-12 00:09:56 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("Usage: usermod [options] LOGIN\n"
|
2008-01-25 02:24:42 +05:30
|
|
|
"\n"
|
|
|
|
"Options:\n"
|
|
|
|
" -c, --comment COMMENT new value of the GECOS field\n"
|
|
|
|
" -d, --home HOME_DIR new home directory for the user account\n"
|
|
|
|
" -e, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE\n"
|
|
|
|
" -f, --inactive INACTIVE set password inactive after expiration\n"
|
|
|
|
" to INACTIVE\n"
|
|
|
|
" -g, --gid GROUP force use GROUP as new primary group\n"
|
|
|
|
" -G, --groups GROUPS new list of supplementary GROUPS\n"
|
|
|
|
" -a, --append append the user to the supplemental GROUPS\n"
|
|
|
|
" mentioned by the -G option without removing\n"
|
|
|
|
" him/her from other groups\n"
|
|
|
|
" -h, --help display this help message and exit\n"
|
|
|
|
" -l, --login NEW_LOGIN new value of the login name\n"
|
|
|
|
" -L, --lock lock the user account\n"
|
|
|
|
" -m, --move-home move contents of the home directory to the\n"
|
|
|
|
" new location (use only with -d)\n"
|
|
|
|
" -o, --non-unique allow using duplicate (non-unique) UID\n"
|
|
|
|
" -p, --password PASSWORD use encrypted password for the new password\n"
|
|
|
|
" -s, --shell SHELL new login shell for the user account\n"
|
|
|
|
" -u, --uid UID new UID for the user account\n"
|
|
|
|
" -U, --unlock unlock the user account\n"
|
2009-04-12 00:09:56 +05:30
|
|
|
"%s"
|
|
|
|
"\n"),
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2009-04-12 00:09:56 +05:30
|
|
|
_(" -Z, --selinux-user new SELinux user mapping for the user account\n")
|
|
|
|
#else
|
|
|
|
""
|
2009-04-11 21:04:10 +05:30
|
|
|
#endif
|
2009-04-12 00:09:56 +05:30
|
|
|
);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_USAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
/*
|
|
|
|
* update encrypted password string (for both shadow and non-shadow
|
|
|
|
* passwords)
|
|
|
|
*/
|
2008-01-06 18:20:22 +05:30
|
|
|
static char *new_pw_passwd (char *pw_pass)
|
2007-10-07 17:14:32 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
if (Lflg && ('!' != pw_pass[0])) {
|
2007-10-07 17:14:59 +05:30
|
|
|
char *buf = xmalloc (strlen (pw_pass) + 2);
|
2007-10-07 17:14:32 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"updating passwd",
|
|
|
|
user_newname, (unsigned int) user_newid, 0);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
SYSLOG ((LOG_INFO, "lock user '%s' password", user_newname));
|
2007-10-07 17:14:59 +05:30
|
|
|
strcpy (buf, "!");
|
|
|
|
strcat (buf, pw_pass);
|
2007-10-07 17:14:32 +05:30
|
|
|
pw_pass = buf;
|
|
|
|
} else if (Uflg && pw_pass[0] == '!') {
|
|
|
|
char *s;
|
|
|
|
|
2007-11-18 03:32:22 +05:30
|
|
|
if (pw_pass[1] == '\0') {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: unlocking the user's password would result in a passwordless account.\n"
|
|
|
|
"You should set a password with usermod -p to unlock this user's password.\n"),
|
|
|
|
Prog);
|
2007-11-18 03:32:22 +05:30
|
|
|
return pw_pass;
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"updating password",
|
|
|
|
user_newname, (unsigned int) user_newid, 0);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
|
2007-10-07 17:14:32 +05:30
|
|
|
s = pw_pass;
|
2008-06-10 01:47:48 +05:30
|
|
|
while ('\0' != *s) {
|
2007-10-07 17:14:32 +05:30
|
|
|
*s = *(s + 1);
|
|
|
|
s++;
|
|
|
|
}
|
|
|
|
} else if (pflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"changing password",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
SYSLOG ((LOG_INFO, "change user '%s' password", user_newname));
|
2007-10-07 17:14:59 +05:30
|
|
|
pw_pass = xstrdup (user_pass);
|
2007-10-07 17:14:32 +05:30
|
|
|
}
|
|
|
|
return pw_pass;
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* new_pwent - initialize the values in a password file entry
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* new_pwent() takes all of the values that have been entered and fills
|
|
|
|
* in a (struct passwd) with them.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void new_pwent (struct passwd *pwent)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
if (lflg) {
|
2009-03-16 03:04:20 +05:30
|
|
|
if (pw_locate (user_newname) != NULL) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user '%s' already exists in %s\n"),
|
|
|
|
Prog, user_newname, pw_dbname ());
|
|
|
|
fail_exit (E_NAME_IN_USE);
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"changing name",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
|
|
|
"change user name '%s' to '%s'",
|
|
|
|
pwent->pw_name, user_newname));
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_name = xstrdup (user_newname);
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!is_shadow_pwd) {
|
2009-03-16 03:04:20 +05:30
|
|
|
pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:32 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
if (uflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"changing uid",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change user '%s' UID from '%d' to '%d'",
|
|
|
|
pwent->pw_name, pwent->pw_uid, user_newid));
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_uid = user_newid;
|
|
|
|
}
|
|
|
|
if (gflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing primary group",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change user '%s' GID from '%d' to '%d'",
|
|
|
|
pwent->pw_name, pwent->pw_gid, user_newgid));
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_gid = user_newgid;
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
if (cflg) {
|
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"changing comment",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2008-01-24 02:49:08 +05:30
|
|
|
pwent->pw_gecos = user_newcomment;
|
2007-10-07 17:17:01 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
if (dflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing home directory",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change user '%s' home from '%s' to '%s'",
|
|
|
|
pwent->pw_name, pwent->pw_dir, user_newhome));
|
2007-10-07 17:14:02 +05:30
|
|
|
pwent->pw_dir = user_newhome;
|
|
|
|
}
|
|
|
|
if (sflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"changing user shell",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2008-01-24 02:49:08 +05:30
|
|
|
#endif
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
|
|
|
"change user '%s' shell from '%s' to '%s'",
|
|
|
|
pwent->pw_name, pwent->pw_shell, user_newshell));
|
2007-10-07 17:17:01 +05:30
|
|
|
pwent->pw_shell = user_newshell;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* new_spent - initialize the values in a shadow password file entry
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* new_spent() takes all of the values that have been entered and fills
|
|
|
|
* in a (struct spwd) with them.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void new_spent (struct spwd *spent)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
if (lflg) {
|
2009-03-16 03:04:20 +05:30
|
|
|
if (spw_locate (user_newname) != NULL) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user '%s' already exists in %s\n"),
|
|
|
|
Prog, user_newname, spw_dbname ());
|
|
|
|
fail_exit (E_NAME_IN_USE);
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
spent->sp_namp = xstrdup (user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
if (fflg) {
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing inactive days",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2008-01-24 02:49:08 +05:30
|
|
|
#endif
|
2007-10-07 17:17:01 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change user '%s' inactive from '%ld' to '%ld'",
|
|
|
|
spent->sp_namp, spent->sp_inact, user_newinactive));
|
2007-10-07 17:17:01 +05:30
|
|
|
spent->sp_inact = user_newinactive;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (eflg) {
|
2008-02-04 03:07:45 +05:30
|
|
|
/* log dates rather than numbers of days. */
|
|
|
|
char new_exp[16], old_exp[16];
|
2008-02-04 03:23:30 +05:30
|
|
|
date_to_str (new_exp, sizeof(new_exp),
|
2008-02-04 03:07:45 +05:30
|
|
|
user_newexpire * DAY, "never");
|
2008-02-04 03:23:30 +05:30
|
|
|
date_to_str (old_exp, sizeof(old_exp),
|
2008-02-04 03:07:45 +05:30
|
|
|
user_expire * DAY, "never");
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-02-04 03:10:01 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing expiration date",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2008-01-24 02:49:08 +05:30
|
|
|
#endif
|
2007-10-07 17:17:01 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change user '%s' expiration from '%s' to '%s'",
|
|
|
|
spent->sp_namp, old_exp, new_exp));
|
2007-10-07 17:17:01 +05:30
|
|
|
spent->sp_expire = user_newexpire;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-01-06 18:20:22 +05:30
|
|
|
spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
|
2008-06-10 01:47:48 +05:30
|
|
|
if (pflg) {
|
2008-06-14 02:10:04 +05:30
|
|
|
spent->sp_lstchg = (long) time ((time_t *) 0) / SCALE;
|
* libmisc/pwd2spwd.c, src/chpasswd.c, src/newusers.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/useradd.c,
src/usermod.c: On Jan 01, 1970, do not set the sp_lstchg field to
0 (which means that the password shall be changed during the next
login), but use -1 (password aging disabled).
* src/passwd.c: Do not check sp_min if sp_lstchg is null or -1.
2009-04-06 02:53:27 +05:30
|
|
|
if (0 == spent->sp_lstchg) {
|
|
|
|
/* Better disable aging than requiring a password
|
|
|
|
* change */
|
|
|
|
spent->sp_lstchg = -1;
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* fail_exit - exit with an error code after unlocking files
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void fail_exit (int code)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
if (gr_locked) {
|
2008-08-07 13:33:38 +05:30
|
|
|
if (gr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
if (sgr_locked) {
|
2008-08-07 13:33:38 +05:30
|
|
|
if (sgr_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
2008-06-10 01:47:48 +05:30
|
|
|
if (spw_locked) {
|
2008-08-07 13:33:38 +05:30
|
|
|
if (spw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, spw_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
|
|
|
if (pw_locked) {
|
2008-08-07 13:33:38 +05:30
|
|
|
if (pw_unlock () == 0) {
|
|
|
|
fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, pw_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
|
|
|
|
/* continue */
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 02:10:04 +05:30
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"modifying account",
|
|
|
|
user_name, AUDIT_NO_ID, 0);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (code);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
|
2007-11-17 17:12:47 +05:30
|
|
|
static void update_group (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
bool is_member;
|
|
|
|
bool was_member;
|
|
|
|
bool changed;
|
2007-10-07 17:14:02 +05:30
|
|
|
const struct group *grp;
|
|
|
|
struct group *ngrp;
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Scan through the entire group file looking for the groups that
|
|
|
|
* the user is a member of.
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
while ((grp = gr_next ()) != NULL) {
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* See if the user specified this group as one of their
|
|
|
|
* concurrent groups.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
was_member = is_on_list (grp->gr_mem, user_name);
|
2008-02-11 01:55:39 +05:30
|
|
|
is_member = Gflg && ( (was_member && aflg)
|
|
|
|
|| is_on_list (user_groups, grp->gr_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!was_member && !is_member) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
ngrp = __gr_dup (grp);
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == ngrp) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: Out of memory. Cannot update %s.\n"),
|
|
|
|
Prog, gr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
if (was_member && (!Gflg || is_member)) {
|
|
|
|
if (lflg) {
|
2007-10-07 17:14:59 +05:30
|
|
|
ngrp->gr_mem = del_list (ngrp->gr_mem,
|
2009-04-11 04:03:43 +05:30
|
|
|
user_name);
|
2007-10-07 17:14:59 +05:30
|
|
|
ngrp->gr_mem = add_list (ngrp->gr_mem,
|
2009-04-11 04:03:43 +05:30
|
|
|
user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing group member",
|
|
|
|
user_newname, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change '%s' to '%s' in group '%s'",
|
|
|
|
user_name, user_newname,
|
|
|
|
ngrp->gr_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
} else if (was_member && !aflg && Gflg && !is_member) {
|
2007-10-07 17:14:02 +05:30
|
|
|
ngrp->gr_mem = del_list (ngrp->gr_mem, user_name);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"removing group member",
|
|
|
|
user_name, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
|
|
|
"delete '%s' from group '%s'",
|
|
|
|
user_name, ngrp->gr_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
} else if (!was_member && Gflg && is_member) {
|
2008-01-24 02:49:08 +05:30
|
|
|
ngrp->gr_mem = add_list (ngrp->gr_mem, user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"adding user to group",
|
|
|
|
user_name, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
SYSLOG ((LOG_INFO, "add '%s' to group '%s'",
|
2008-01-24 02:49:08 +05:30
|
|
|
user_newname, ngrp->gr_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-07-12 02:22:44 +05:30
|
|
|
if (!changed) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-07-12 02:22:44 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = false;
|
|
|
|
if (gr_update (ngrp) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, gr_dbname (), ngrp->gr_name);
|
|
|
|
SYSLOG ((LOG_WARN, "failed to prepare the new %s entry '%s'", gr_dbname (), ngrp->gr_name));
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef SHADOWGRP
|
2007-11-17 17:12:47 +05:30
|
|
|
static void update_gshadow (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
bool is_member;
|
|
|
|
bool was_member;
|
|
|
|
bool was_admin;
|
|
|
|
bool changed;
|
2007-10-07 17:14:02 +05:30
|
|
|
const struct sgrp *sgrp;
|
|
|
|
struct sgrp *nsgrp;
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Scan through the entire shadow group file looking for the groups
|
|
|
|
* that the user is a member of.
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
while ((sgrp = sgr_next ()) != NULL) {
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if the user was a member of this group
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
was_member = is_on_list (sgrp->sg_mem, user_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if the user was an administrator of this group
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
was_admin = is_on_list (sgrp->sg_adm, user_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* See if the user specified this group as one of their
|
|
|
|
* concurrent groups.
|
|
|
|
*/
|
2007-10-07 17:16:07 +05:30
|
|
|
is_member = Gflg && is_on_list (user_groups, sgrp->sg_name);
|
2008-02-11 01:55:39 +05:30
|
|
|
is_member = Gflg && ( (was_member && aflg)
|
|
|
|
|| is_on_list (user_groups, sgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!was_member && !was_admin && !is_member) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
nsgrp = __sgr_dup (sgrp);
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == nsgrp) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: Out of memory. Cannot update %s.\n"),
|
|
|
|
Prog, sgr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
if (was_admin && lflg) {
|
2007-10-07 17:16:07 +05:30
|
|
|
nsgrp->sg_adm = del_list (nsgrp->sg_adm, user_name);
|
|
|
|
nsgrp->sg_adm = add_list (nsgrp->sg_adm, user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing admin name in shadow group",
|
|
|
|
user_name, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change admin '%s' to '%s' in shadow group '%s'",
|
|
|
|
user_name, user_newname, nsgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (was_member && (!Gflg || is_member)) {
|
|
|
|
if (lflg) {
|
|
|
|
nsgrp->sg_mem = del_list (nsgrp->sg_mem,
|
2009-04-11 04:03:43 +05:30
|
|
|
user_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
nsgrp->sg_mem = add_list (nsgrp->sg_mem,
|
2009-04-11 04:03:43 +05:30
|
|
|
user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing member in shadow group",
|
|
|
|
user_name, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"change '%s' to '%s' in shadow group '%s'",
|
|
|
|
user_name, user_newname,
|
|
|
|
nsgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
} else if (was_member && !aflg && Gflg && !is_member) {
|
2007-10-07 17:16:07 +05:30
|
|
|
nsgrp->sg_mem = del_list (nsgrp->sg_mem, user_name);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"removing user from shadow group",
|
|
|
|
user_name, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
2009-04-11 04:03:43 +05:30
|
|
|
"delete '%s' from shadow group '%s'",
|
|
|
|
user_name, nsgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
} else if (!was_member && Gflg && is_member) {
|
2008-01-24 02:49:08 +05:30
|
|
|
nsgrp->sg_mem = add_list (nsgrp->sg_mem, user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = true;
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"adding user to shadow group",
|
|
|
|
user_newname, AUDIT_NO_ID, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
SYSLOG ((LOG_INFO, "add '%s' to shadow group '%s'",
|
2008-01-24 02:49:08 +05:30
|
|
|
user_newname, nsgrp->sg_name));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!changed) {
|
2007-10-07 17:14:02 +05:30
|
|
|
continue;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
changed = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Update the group entry to reflect the changes.
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (sgr_update (nsgrp) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, sgr_dbname (), nsgrp->sg_name);
|
|
|
|
SYSLOG ((LOG_WARN, "failed to prepare the new %s entry '%s'",
|
|
|
|
sgr_dbname (), nsgrp->sg_name));
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
#endif /* SHADOWGRP */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* grp_update - add user to secondary group set
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* grp_update() takes the secondary group set given in user_groups and
|
|
|
|
* adds the user to each group given by that set.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-11-17 17:12:47 +05:30
|
|
|
static void grp_update (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-11-17 17:12:47 +05:30
|
|
|
update_group ();
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_grp) {
|
2007-11-17 17:12:47 +05:30
|
|
|
update_gshadow ();
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* process_flags - perform command line argument setting
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* process_flags() interprets the command line arguments and sets the
|
|
|
|
* values that the user will be created with accordingly. The values
|
|
|
|
* are checked for sanity.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void process_flags (int argc, char **argv)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
const struct group *grp;
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
bool anyflag = false;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 02:02:17 +05:30
|
|
|
if ((1 == argc) || ('-' == argv[argc - 1][0])) {
|
2007-10-07 17:14:02 +05:30
|
|
|
usage ();
|
2008-06-10 02:02:17 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
{
|
|
|
|
const struct passwd *pwd;
|
|
|
|
/* local, no need for xgetpwnam */
|
2008-06-10 01:47:48 +05:30
|
|
|
pwd = getpwnam (argv[argc - 1]);
|
|
|
|
if (NULL == pwd) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user '%s' does not exist\n"),
|
|
|
|
Prog, argv[argc - 1]);
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
exit (E_NOTFOUND);
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
user_name = argv[argc - 1];
|
|
|
|
user_id = pwd->pw_uid;
|
|
|
|
user_gid = pwd->pw_gid;
|
|
|
|
user_comment = xstrdup (pwd->pw_gecos);
|
|
|
|
user_home = xstrdup (pwd->pw_dir);
|
|
|
|
user_shell = xstrdup (pwd->pw_shell);
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
user_newname = user_name;
|
|
|
|
user_newid = user_id;
|
|
|
|
user_newgid = user_gid;
|
|
|
|
user_newcomment = user_comment;
|
|
|
|
user_newhome = user_home;
|
|
|
|
user_newshell = user_shell;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
#ifdef USE_NIS
|
|
|
|
/*
|
|
|
|
* Now make sure it isn't an NIS user.
|
|
|
|
*/
|
|
|
|
if (__ispwNIS ()) {
|
2007-10-07 17:14:59 +05:30
|
|
|
char *nis_domain;
|
|
|
|
char *nis_master;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user %s is a NIS user\n"),
|
|
|
|
Prog, user_name);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if ( !yp_get_default_domain (&nis_domain)
|
|
|
|
&& !yp_master (nis_domain, "passwd.byname", &nis_master)) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: %s is the NIS master\n"),
|
|
|
|
Prog, nis_master);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_NOTFOUND);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
{
|
|
|
|
const struct spwd *spwd = NULL;
|
|
|
|
/* local, no need for xgetspnam */
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_pwd && ((spwd = getspnam (user_name)) != NULL)) {
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
user_expire = spwd->sp_expire;
|
|
|
|
user_inactive = spwd->sp_inact;
|
|
|
|
user_newexpire = user_expire;
|
|
|
|
user_newinactive = user_inactive;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:16:25 +05:30
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Parse the command line options.
|
|
|
|
*/
|
|
|
|
int c;
|
|
|
|
static struct option long_options[] = {
|
2007-10-07 20:06:51 +05:30
|
|
|
{"append", no_argument, NULL, 'a'},
|
2007-10-07 17:17:11 +05:30
|
|
|
{"comment", required_argument, NULL, 'c'},
|
|
|
|
{"home", required_argument, NULL, 'd'},
|
|
|
|
{"expiredate", required_argument, NULL, 'e'},
|
|
|
|
{"inactive", required_argument, NULL, 'f'},
|
|
|
|
{"gid", required_argument, NULL, 'g'},
|
|
|
|
{"groups", required_argument, NULL, 'G'},
|
|
|
|
{"help", no_argument, NULL, 'h'},
|
|
|
|
{"login", required_argument, NULL, 'l'},
|
|
|
|
{"lock", no_argument, NULL, 'L'},
|
|
|
|
{"move-home", no_argument, NULL, 'm'},
|
|
|
|
{"non-unique", no_argument, NULL, 'o'},
|
|
|
|
{"password", required_argument, NULL, 'p'},
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
{"selinux-user", required_argument, NULL, 'Z'},
|
|
|
|
#endif
|
2007-10-07 17:17:11 +05:30
|
|
|
{"shell", required_argument, NULL, 's'},
|
|
|
|
{"uid", required_argument, NULL, 'u'},
|
|
|
|
{"unlock", no_argument, NULL, 'U'},
|
|
|
|
{NULL, 0, NULL, '\0'}
|
|
|
|
};
|
2009-04-11 04:03:43 +05:30
|
|
|
while ((c = getopt_long (argc, argv,
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
"ac:d:e:f:g:G:hl:Lmop:s:u:UZ:",
|
|
|
|
#else
|
2009-04-11 04:03:43 +05:30
|
|
|
"ac:d:e:f:g:G:hl:Lmop:s:u:U",
|
2009-04-11 21:04:10 +05:30
|
|
|
#endif
|
2009-04-11 04:03:43 +05:30
|
|
|
long_options, NULL)) != -1) {
|
2007-10-07 17:17:11 +05:30
|
|
|
switch (c) {
|
|
|
|
case 'a':
|
2008-06-10 01:47:48 +05:30
|
|
|
aflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'c':
|
|
|
|
if (!VALID (optarg)) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: invalid field '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
user_newcomment = optarg;
|
2008-06-10 01:47:48 +05:30
|
|
|
cflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'd':
|
|
|
|
if (!VALID (optarg)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: invalid field '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_BAD_ARG);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
dflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
user_newhome = optarg;
|
|
|
|
break;
|
|
|
|
case 'e':
|
2008-06-10 01:47:48 +05:30
|
|
|
if ('\0' != *optarg) {
|
2007-10-07 17:17:11 +05:30
|
|
|
user_newexpire = strtoday (optarg);
|
|
|
|
if (user_newexpire == -1) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: invalid date '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
user_newexpire *= DAY / SCALE;
|
2008-06-10 01:47:48 +05:30
|
|
|
} else {
|
2007-10-07 17:17:11 +05:30
|
|
|
user_newexpire = -1;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
|
|
|
eflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'f':
|
2009-04-11 04:03:43 +05:30
|
|
|
if ( (getlong (optarg, &user_newinactive) == 0)
|
|
|
|
|| (user_newinactive < -1)) {
|
2009-03-16 03:04:20 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid numeric argument '%s'\n"),
|
|
|
|
Prog, optarg);
|
|
|
|
usage ();
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
fflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'g':
|
|
|
|
grp = getgr_nam_gid (optarg);
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:17:11 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: group '%s' does not exist\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_NOTFOUND);
|
|
|
|
}
|
|
|
|
user_newgid = grp->gr_gid;
|
2008-06-10 01:47:48 +05:30
|
|
|
gflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'G':
|
2008-06-10 01:47:48 +05:30
|
|
|
if (get_groups (optarg) != 0) {
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_NOTFOUND);
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
|
|
|
Gflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'l':
|
2008-05-26 02:28:16 +05:30
|
|
|
if (!is_valid_user_name (optarg)) {
|
2007-10-07 17:17:11 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: invalid field '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
lflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
user_newname = optarg;
|
|
|
|
break;
|
|
|
|
case 'L':
|
2008-06-10 01:47:48 +05:30
|
|
|
Lflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'm':
|
2008-06-10 01:47:48 +05:30
|
|
|
mflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'o':
|
2008-06-10 01:47:48 +05:30
|
|
|
oflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'p':
|
|
|
|
user_pass = optarg;
|
2008-06-10 01:47:48 +05:30
|
|
|
pflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 's':
|
|
|
|
if (!VALID (optarg)) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: invalid field '%s'\n"),
|
|
|
|
Prog, optarg);
|
2007-10-07 17:17:11 +05:30
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
user_newshell = optarg;
|
2008-06-10 01:47:48 +05:30
|
|
|
sflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'u':
|
2009-03-09 02:13:15 +05:30
|
|
|
if ( (get_uid (optarg, &user_newid) ==0)
|
|
|
|
|| (user_newid == (uid_t)-1)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: invalid user ID '%s'\n"),
|
|
|
|
Prog, optarg);
|
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
uflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
|
|
|
case 'U':
|
2008-06-10 01:47:48 +05:30
|
|
|
Uflg = true;
|
2007-10-07 17:17:11 +05:30
|
|
|
break;
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
case 'Z':
|
|
|
|
if (is_selinux_enabled () > 0) {
|
|
|
|
user_selinux = optarg;
|
|
|
|
Zflg = true;
|
|
|
|
} else {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: -Z requires SELinux enabled kernel\n"),
|
|
|
|
Prog);
|
|
|
|
exit (E_BAD_ARG);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
#endif
|
2007-10-07 17:17:11 +05:30
|
|
|
default:
|
2007-10-07 17:14:32 +05:30
|
|
|
usage ();
|
2007-10-07 17:17:11 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
anyflag = true;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!anyflag) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr, _("%s: no flags given\n"), Prog);
|
|
|
|
exit (E_USAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-01-24 03:20:27 +05:30
|
|
|
|
|
|
|
if (user_newid == user_id) {
|
2008-06-10 01:47:48 +05:30
|
|
|
uflg = false;
|
|
|
|
oflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (user_newgid == user_gid) {
|
2008-06-10 01:47:48 +05:30
|
|
|
gflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (strcmp (user_newshell, user_shell) == 0) {
|
2008-06-10 01:47:48 +05:30
|
|
|
sflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (strcmp (user_newname, user_name) == 0) {
|
2008-06-10 01:47:48 +05:30
|
|
|
lflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (user_newinactive == user_inactive) {
|
2008-06-10 01:47:48 +05:30
|
|
|
fflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (user_newexpire == user_expire) {
|
2008-06-10 01:47:48 +05:30
|
|
|
eflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (strcmp (user_newhome, user_home) == 0) {
|
2008-06-10 01:47:48 +05:30
|
|
|
dflg = false;
|
|
|
|
mflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
if (strcmp (user_newcomment, user_comment) == 0) {
|
2008-06-10 01:47:48 +05:30
|
|
|
cflg = false;
|
2008-01-24 03:20:27 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (!(Uflg || uflg || sflg || pflg || oflg || mflg || Lflg ||
|
2009-04-11 21:04:10 +05:30
|
|
|
lflg || Gflg || gflg || fflg || eflg || dflg || cflg
|
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
|| Zflg
|
|
|
|
#endif
|
|
|
|
)) {
|
2008-01-24 03:20:27 +05:30
|
|
|
fprintf (stderr, _("%s: no changes\n"), Prog);
|
|
|
|
exit (E_SUCCESS);
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
if (!is_shadow_pwd && (eflg || fflg)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: shadow passwords required for -e and -f\n"),
|
|
|
|
Prog);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_USAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2008-07-12 02:22:44 +05:30
|
|
|
if (optind != argc - 1) {
|
2007-10-07 17:14:02 +05:30
|
|
|
usage ();
|
2008-07-12 02:22:44 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:16:34 +05:30
|
|
|
if (aflg && (!Gflg)) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
|
|
|
Prog, "-a", "-G");
|
2007-10-07 17:16:34 +05:30
|
|
|
usage ();
|
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
|
|
|
|
2007-11-17 20:03:26 +05:30
|
|
|
if ((Lflg && (pflg || Uflg)) || (pflg && Uflg)) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: the -L, -p, and -U flags are exclusive\n"),
|
|
|
|
Prog);
|
2007-11-17 20:03:26 +05:30
|
|
|
usage ();
|
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
|
|
|
|
2007-11-17 20:10:54 +05:30
|
|
|
if (oflg && !uflg) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
|
|
|
Prog, "-o", "-u");
|
2007-11-17 20:10:54 +05:30
|
|
|
usage ();
|
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
|
|
|
|
2007-11-17 19:51:05 +05:30
|
|
|
if (mflg && !dflg) {
|
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: %s flag is only allowed with the %s flag\n"),
|
|
|
|
Prog, "-m", "-d");
|
2007-11-17 19:51:05 +05:30
|
|
|
usage ();
|
|
|
|
exit (E_USAGE);
|
|
|
|
}
|
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
/* local, no need for xgetpwnam */
|
2008-06-10 01:47:48 +05:30
|
|
|
if (lflg && (getpwnam (user_newname) != NULL)) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user '%s' already exists\n"),
|
|
|
|
Prog, user_newname);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_NAME_IN_USE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
/* local, no need for xgetpwuid */
|
2008-06-10 01:47:48 +05:30
|
|
|
if (uflg && !oflg && (getpwuid (user_newid) != NULL)) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: UID '%lu' already exists\n"),
|
|
|
|
Prog, (unsigned long) user_newid);
|
2007-10-07 17:14:59 +05:30
|
|
|
exit (E_UID_IN_USE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* close_files - close all of the files that were opened
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* close_files() closes all of the files that were opened for this new
|
|
|
|
* user. This causes any modified entries to be written out.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void close_files (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
if (pw_close () == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
2008-08-22 08:04:04 +05:30
|
|
|
_("%s: failure while writing changes to %s\n"),
|
|
|
|
Prog, pw_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR, "failure while writing changes to %s", pw_dbname ()));
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_pwd && (spw_close () == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2008-08-22 08:04:04 +05:30
|
|
|
_("%s: failure while writing changes to %s\n"),
|
|
|
|
Prog, spw_dbname ());
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failure while writing changes to %s",
|
|
|
|
spw_dbname ()));
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
|
|
|
|
if (Gflg || lflg) {
|
2008-06-10 01:47:48 +05:30
|
|
|
if (gr_close () == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"),
|
|
|
|
Prog, gr_dbname ());
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failure while writing changes to %s",
|
|
|
|
gr_dbname ()));
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#ifdef SHADOWGRP
|
2008-08-07 13:33:38 +05:30
|
|
|
if (is_shadow_grp) {
|
|
|
|
if (sgr_close () == 0) {
|
2008-08-22 08:04:04 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failure while writing changes to %s\n"),
|
|
|
|
Prog, sgr_dbname ());
|
2009-04-11 04:03:43 +05:30
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failure while writing changes to %s",
|
|
|
|
sgr_dbname ()));
|
2008-08-22 08:04:04 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
2008-08-07 13:33:38 +05:30
|
|
|
if (sgr_unlock () == 0) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to unlock %s\n"),
|
|
|
|
Prog, sgr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failed to unlock %s",
|
|
|
|
sgr_dbname ()));
|
2008-08-07 13:33:38 +05:30
|
|
|
/* continue */
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
#endif
|
2008-08-07 13:33:38 +05:30
|
|
|
if (gr_unlock () == 0) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to unlock %s\n"),
|
|
|
|
Prog, gr_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failed to unlock %s",
|
|
|
|
gr_dbname ()));
|
2008-08-07 13:33:38 +05:30
|
|
|
/* continue */
|
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_pwd) {
|
2008-08-07 13:33:38 +05:30
|
|
|
if (spw_unlock () == 0) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to unlock %s\n"),
|
|
|
|
Prog, spw_dbname ());
|
|
|
|
SYSLOG ((LOG_ERR,
|
|
|
|
"failed to unlock %s",
|
|
|
|
spw_dbname ()));
|
2008-08-07 13:33:38 +05:30
|
|
|
/* continue */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (pw_unlock () == 0) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to unlock %s\n"),
|
|
|
|
Prog, pw_dbname ());
|
2008-08-07 13:33:38 +05:30
|
|
|
SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
|
|
|
|
/* continue */
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
pw_locked = false;
|
|
|
|
spw_locked = false;
|
|
|
|
gr_locked = false;
|
2008-01-26 23:11:20 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
sgr_locked = false;
|
2008-01-26 23:11:20 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Close the DBM and/or flat files
|
|
|
|
*/
|
|
|
|
endpwent ();
|
|
|
|
endspent ();
|
|
|
|
endgrent ();
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
endsgent ();
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* open_files - lock and open the password files
|
|
|
|
*
|
|
|
|
* open_files() opens the two password files.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void open_files (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-10 01:47:48 +05:30
|
|
|
if (pw_lock () == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/gpasswd.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c: In
case of a lock failure, indicate to the user that she can try
again later. Do not log to syslog.
2008-08-22 07:50:53 +05:30
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, pw_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
pw_locked = true;
|
|
|
|
if (pw_open (O_RDWR) == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, pw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_pwd && (spw_lock () == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/gpasswd.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c: In
case of a lock failure, indicate to the user that she can try
again later. Do not log to syslog.
2008-08-22 07:50:53 +05:30
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, spw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
spw_locked = true;
|
|
|
|
if (is_shadow_pwd && (spw_open (O_RDWR) == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, spw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
|
|
|
|
if (Gflg || lflg) {
|
|
|
|
/*
|
|
|
|
* Lock and open the group file. This will load all of the
|
|
|
|
* group entries.
|
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (gr_lock () == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/gpasswd.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c: In
case of a lock failure, indicate to the user that she can try
again later. Do not log to syslog.
2008-08-22 07:50:53 +05:30
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, gr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
gr_locked = true;
|
|
|
|
if (gr_open (O_RDWR) == 0) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, gr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#ifdef SHADOWGRP
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_grp && (sgr_lock () == 0)) {
|
2007-11-17 17:12:47 +05:30
|
|
|
fprintf (stderr,
|
* src/chage.c, src/chgpasswd.c, src/chpasswd.c, src/chsh.c,
src/gpasswd.c, src/groupadd.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c: In
case of a lock failure, indicate to the user that she can try
again later. Do not log to syslog.
2008-08-22 07:50:53 +05:30
|
|
|
_("%s: cannot lock %s; try again later.\n"),
|
|
|
|
Prog, sgr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
sgr_locked = true;
|
|
|
|
if (is_shadow_grp && (sgr_open (O_RDWR) == 0)) {
|
2007-11-17 17:12:47 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: cannot open %s\n"),
|
|
|
|
Prog, sgr_dbname ());
|
2007-11-17 17:12:47 +05:30
|
|
|
fail_exit (E_GRP_UPDATE);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* usr_update - create the user entries
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* usr_update() creates the password file entries for this user and
|
|
|
|
* will update the group entries if required.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void usr_update (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
struct passwd pwent;
|
|
|
|
const struct passwd *pwd;
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
struct spwd spent;
|
|
|
|
const struct spwd *spwd = NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Locate the entry in /etc/passwd, which MUST exist.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
pwd = pw_locate (user_name);
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == pwd) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user '%s' does not exist in %s\n"),
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
Prog, user_name, pw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_NOTFOUND);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
pwent = *pwd;
|
|
|
|
new_pwent (&pwent);
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Locate the entry in /etc/shadow. It doesn't have to exist, and
|
|
|
|
* won't be created if it doesn't.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-10 01:47:48 +05:30
|
|
|
if (is_shadow_pwd && ((spwd = spw_locate (user_name)) != NULL)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
spent = *spwd;
|
|
|
|
new_spent (&spent);
|
|
|
|
}
|
|
|
|
|
2007-10-07 17:15:23 +05:30
|
|
|
if (lflg || uflg || gflg || cflg || dflg || sflg || pflg
|
2007-10-07 17:14:59 +05:30
|
|
|
|| Lflg || Uflg) {
|
2008-06-10 01:47:48 +05:30
|
|
|
if (pw_update (&pwent) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, pw_dbname (), pwent.pw_name);
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (lflg && (pw_remove (user_name) == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: cannot remove entry '%s' from %s\n"),
|
|
|
|
Prog, user_name, pw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if ((NULL != spwd) && (lflg || eflg || fflg || pflg || Lflg || Uflg)) {
|
|
|
|
if (spw_update (&spent) == 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* src/groupmems.c: Check the return value of gr_update().
* src/chage.c, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/passwd.c, src/pwck.c, src/pwconv.c, src/pwunconv.c,
src/useradd.c, src/userdel.c, src/usermod.c: Harmonize the error
message sent to stderr in case of *_update () failure.
* src/chage.c, src/chsh.c, src/groupadd.c, src/passwd.c: Do not
log to syslog when pw_update() or spw_update() fail.
* src/newusers.c: Do not log specific error message to stderr when
sgr_update() fails.
* src/pwconv.c: Remove duplicated definition of Prog.
2008-08-30 23:57:34 +05:30
|
|
|
_("%s: failed to prepare the new %s entry '%s'\n"),
|
|
|
|
Prog, spw_dbname (), spent.sp_namp);
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (lflg && (spw_remove (user_name) == 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: cannot remove entry '%s' from %s\n"),
|
|
|
|
Prog, user_name, spw_dbname ());
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_PW_UPDATE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* move_home - move the user's home directory
|
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* move_home() moves the user's home directory to a new location. The
|
|
|
|
* files will be copied if the directory cannot simply be renamed.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void move_home (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
struct stat sb;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (mflg && (stat (user_home, &sb) == 0)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Don't try to move it if it is not a directory
|
|
|
|
* (but /dev/null for example). --marekm
|
|
|
|
*/
|
2008-07-12 02:22:44 +05:30
|
|
|
if (!S_ISDIR (sb.st_mode)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
2008-07-12 02:22:44 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
if (access (user_newhome, F_OK) == 0) {
|
2009-04-11 04:03:43 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: directory %s exists\n"),
|
|
|
|
Prog, user_newhome);
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
2008-06-10 01:47:48 +05:30
|
|
|
} else if (rename (user_home, user_newhome) != 0) {
|
2007-10-07 17:14:02 +05:30
|
|
|
if (errno == EXDEV) {
|
2008-06-10 01:47:48 +05:30
|
|
|
if (mkdir (user_newhome, sb.st_mode & 0777) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: can't create %s\n"),
|
|
|
|
Prog, user_newhome);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (chown (user_newhome, sb.st_uid, sb.st_gid) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: can't chown %s\n"),
|
|
|
|
Prog, user_newhome);
|
2007-10-07 17:14:02 +05:30
|
|
|
rmdir (user_newhome);
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (copy_tree (user_home, user_newhome,
|
2009-04-11 04:03:43 +05:30
|
|
|
uflg ? (long int)user_newid : -1,
|
|
|
|
gflg ? (long int)user_newgid : -1) == 0) {
|
2008-05-24 21:05:15 +05:30
|
|
|
if (remove_tree (user_home) != 0) {
|
2007-10-07 17:16:25 +05:30
|
|
|
fprintf (stderr,
|
2009-04-11 04:03:43 +05:30
|
|
|
_("%s: warning: failed to completely remove old home directory %s"),
|
|
|
|
Prog, user_home);
|
2008-05-24 21:05:15 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK,
|
2008-06-14 02:10:04 +05:30
|
|
|
Prog,
|
|
|
|
"moving home directory",
|
|
|
|
user_newname,
|
|
|
|
(unsigned int) user_newid,
|
|
|
|
1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
2007-10-07 17:16:25 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-05-24 21:05:15 +05:30
|
|
|
/* TODO: do some cleanup if the copy
|
|
|
|
* was started */
|
2007-10-07 17:14:02 +05:30
|
|
|
(void) remove_tree (user_newhome);
|
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr,
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
_("%s: cannot rename directory %s to %s\n"),
|
|
|
|
Prog, user_home, user_newhome);
|
2007-10-07 17:14:59 +05:30
|
|
|
fail_exit (E_HOMEDIR);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"moving home directory",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
if (uflg || gflg) {
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing home directory owner",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
#endif
|
2007-10-07 17:14:59 +05:30
|
|
|
chown (dflg ? user_newhome : user_home,
|
|
|
|
uflg ? user_newid : user_id,
|
|
|
|
gflg ? user_newgid : user_gid);
|
2007-10-07 17:17:01 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2008-07-12 02:22:44 +05:30
|
|
|
* update_lastlog - update the lastlog file
|
|
|
|
*
|
|
|
|
* Relocate the "lastlog" entries for the user. The old entry is
|
|
|
|
* left alone in case the UID was shared. It doesn't hurt anything
|
|
|
|
* to just leave it be.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-07-12 02:22:44 +05:30
|
|
|
static void update_lastlog (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2007-10-07 17:14:59 +05:30
|
|
|
struct lastlog ll;
|
|
|
|
int fd;
|
2008-07-12 02:22:44 +05:30
|
|
|
off_t off_uid = (off_t) user_id * sizeof ll;
|
|
|
|
off_t off_newuid = (off_t) user_newid * sizeof ll;
|
|
|
|
|
|
|
|
if (access (LASTLOG_FILE, F_OK) != 0) {
|
|
|
|
return;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
fd = open (LASTLOG_FILE, O_RDWR);
|
2008-07-12 02:22:44 +05:30
|
|
|
|
|
|
|
if (-1 == fd) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the lastlog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ( (lseek (fd, off_uid, SEEK_SET) == off_uid)
|
|
|
|
&& (read (fd, &ll, sizeof ll) == (ssize_t) sizeof ll)) {
|
|
|
|
/* Copy the old entry to its new location */
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) != off_newuid)
|
|
|
|
|| (write (fd, &ll, sizeof ll) != (ssize_t) sizeof ll)
|
2009-03-22 00:55:02 +05:30
|
|
|
|| (fsync (fd) != 0)
|
2008-07-12 02:22:44 +05:30
|
|
|
|| (close (fd) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the lastlog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-07-12 02:22:44 +05:30
|
|
|
} else {
|
|
|
|
/* Assume lseek or read failed because there is
|
|
|
|
* no entry for the old UID */
|
|
|
|
|
|
|
|
/* Check if the new UID already has an entry */
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) == off_newuid)
|
|
|
|
&& (read (fd, &ll, sizeof ll) == (ssize_t) sizeof ll)) {
|
|
|
|
/* Reset the new uid's lastlog entry */
|
|
|
|
memzero (&ll, sizeof (ll));
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) != off_newuid)
|
|
|
|
|| (write (fd, &ll, sizeof ll) != (ssize_t) sizeof ll)
|
2009-03-22 00:55:02 +05:30
|
|
|
|| (fsync (fd) != 0)
|
2008-07-12 02:22:44 +05:30
|
|
|
|| (close (fd) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the lastlog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
(void) close (fd);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* update_faillog - update the faillog file
|
|
|
|
*
|
|
|
|
* Relocate the "faillog" entries for the user. The old entry is
|
|
|
|
* left alone in case the UID was shared. It doesn't hurt anything
|
|
|
|
* to just leave it be.
|
|
|
|
*/
|
|
|
|
static void update_faillog (void)
|
|
|
|
{
|
|
|
|
struct faillog fl;
|
|
|
|
int fd;
|
|
|
|
off_t off_uid = (off_t) user_id * sizeof fl;
|
|
|
|
off_t off_newuid = (off_t) user_newid * sizeof fl;
|
|
|
|
|
|
|
|
if (access (FAILLOG_FILE, F_OK) != 0) {
|
|
|
|
return;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
fd = open (FAILLOG_FILE, O_RDWR);
|
2008-07-12 02:22:44 +05:30
|
|
|
|
|
|
|
if (-1 == fd) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the faillog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ( (lseek (fd, off_uid, SEEK_SET) == off_uid)
|
|
|
|
&& (read (fd, (char *) &fl, sizeof fl) == (ssize_t) sizeof fl)) {
|
|
|
|
/* Copy the old entry to its new location */
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) != off_newuid)
|
|
|
|
|| (write (fd, &fl, sizeof fl) != (ssize_t) sizeof fl)
|
2009-03-22 00:55:02 +05:30
|
|
|
|| (fsync (fd) != 0)
|
2008-07-12 02:22:44 +05:30
|
|
|
|| (close (fd) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the faillog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* Assume lseek or read failed because there is
|
|
|
|
* no entry for the old UID */
|
|
|
|
|
|
|
|
/* Check if the new UID already has an entry */
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) == off_newuid)
|
|
|
|
&& (read (fd, &fl, sizeof fl) == (ssize_t) sizeof fl)) {
|
|
|
|
/* Reset the new uid's lastlog entry */
|
|
|
|
memzero (&fl, sizeof (fl));
|
|
|
|
if ( (lseek (fd, off_newuid, SEEK_SET) != off_newuid)
|
|
|
|
|| (write (fd, &fl, sizeof fl) != (ssize_t) sizeof fl)
|
|
|
|
|| (close (fd) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: failed to copy the faillog entry of user %lu to user %lu: %s\n"),
|
|
|
|
Prog, (unsigned long) user_id, (unsigned long) user_newid, strerror (errno));
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
(void) close (fd);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifndef NO_MOVE_MAILBOX
|
|
|
|
/*
|
|
|
|
* This is the new and improved code to carefully chown/rename the user's
|
2007-10-07 17:14:59 +05:30
|
|
|
* mailbox. Maybe I am too paranoid but the mail spool dir sometimes
|
2007-10-07 17:14:02 +05:30
|
|
|
* happens to be mode 1777 (this makes mail user agents work without
|
|
|
|
* being setgid mail, but is NOT recommended; they all should be fixed
|
|
|
|
* to use movemail). --marekm
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void move_mailbox (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
|
|
|
const char *maildir;
|
|
|
|
char mailfile[1024], newmailfile[1024];
|
|
|
|
int fd;
|
|
|
|
struct stat st;
|
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
maildir = getdef_str ("MAIL_DIR");
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef MAIL_SPOOL_DIR
|
2008-06-10 01:47:48 +05:30
|
|
|
if ((NULL == maildir) && (getdef_str ("MAIL_FILE") == NULL)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
maildir = MAIL_SPOOL_DIR;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
2008-06-10 01:47:48 +05:30
|
|
|
if (NULL == maildir) {
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* O_NONBLOCK is to make sure open won't hang on mandatory locks.
|
|
|
|
* We do fstat/fchown to make sure there are no races (someone
|
|
|
|
* replacing /var/spool/mail/luser with a hard link to /etc/passwd
|
|
|
|
* between stat and chown). --marekm
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
snprintf (mailfile, sizeof mailfile, "%s/%s", maildir, user_name);
|
|
|
|
fd = open (mailfile, O_RDONLY | O_NONBLOCK, 0);
|
2007-10-07 17:14:02 +05:30
|
|
|
if (fd < 0) {
|
|
|
|
/* no need for warnings if the mailbox doesn't exist */
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
if (errno != ENOENT) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror (mailfile);
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
if (fstat (fd, &st) < 0) {
|
|
|
|
perror ("fstat");
|
|
|
|
close (fd);
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (st.st_uid != user_id) {
|
|
|
|
/* better leave it alone */
|
2007-10-07 17:14:59 +05:30
|
|
|
fprintf (stderr, _("%s: warning: %s not owned by %s\n"),
|
2009-04-11 04:03:43 +05:30
|
|
|
Prog, mailfile, user_name);
|
2007-10-07 17:14:59 +05:30
|
|
|
close (fd);
|
2007-10-07 17:14:02 +05:30
|
|
|
return;
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
if (uflg) {
|
|
|
|
if (fchown (fd, user_newid, (gid_t) - 1) < 0) {
|
|
|
|
perror (_("failed to change mailbox owner"));
|
|
|
|
}
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
else {
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing mail file owner",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
close (fd);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
if (lflg) {
|
2007-10-07 17:14:59 +05:30
|
|
|
snprintf (newmailfile, sizeof newmailfile, "%s/%s",
|
2009-04-11 04:03:43 +05:30
|
|
|
maildir, user_newname);
|
2008-06-10 01:47:48 +05:30
|
|
|
if ( (link (mailfile, newmailfile) != 0)
|
|
|
|
|| (unlink (mailfile) != 0)) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror (_("failed to rename mailbox"));
|
2007-10-07 17:17:01 +05:30
|
|
|
}
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
else {
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
2008-06-14 02:10:04 +05:30
|
|
|
"changing mail file name",
|
|
|
|
user_newname, (unsigned int) user_newid, 1);
|
2007-10-07 17:17:01 +05:30
|
|
|
}
|
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* main - usermod command
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
int main (int argc, char **argv)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
|
|
|
pam_handle_t *pamh = NULL;
|
|
|
|
int retval;
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* USE_PAM */
|
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_help_open ();
|
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* Get my name so that I can use it to report errors.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
Prog = Basename (argv[0]);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
(void) setlocale (LC_ALL, "");
|
|
|
|
(void) bindtextdomain (PACKAGE, LOCALEDIR);
|
|
|
|
(void) textdomain (PACKAGE);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:15:40 +05:30
|
|
|
sys_ngroups = sysconf (_SC_NGROUPS_MAX);
|
2008-06-14 02:10:04 +05:30
|
|
|
user_groups = (char **) malloc (sizeof (char *) * (1 + sys_ngroups));
|
2007-10-07 17:15:40 +05:30
|
|
|
user_groups[0] = (char *) 0;
|
|
|
|
|
2007-10-07 17:16:07 +05:30
|
|
|
OPENLOG ("usermod");
|
2007-10-07 17:15:40 +05:30
|
|
|
|
|
|
|
is_shadow_pwd = spw_file_present ();
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
is_shadow_grp = sgr_file_present ();
|
|
|
|
#endif
|
|
|
|
|
|
|
|
process_flags (argc, argv);
|
|
|
|
|
2009-05-19 00:07:16 +05:30
|
|
|
/*
|
|
|
|
* The home directory, the username and the user's UID should not
|
|
|
|
* be changed while the user is logged in.
|
|
|
|
*/
|
|
|
|
if ( (uflg || lflg || dflg)
|
|
|
|
&& (user_busy (user_name, user_id) != 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: user %s is currently logged in\n"),
|
|
|
|
Prog, user_name);
|
|
|
|
exit (E_USER_BUSY);
|
|
|
|
}
|
|
|
|
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#ifdef ACCT_TOOLS_SETUID
|
2007-10-07 17:14:38 +05:30
|
|
|
#ifdef USE_PAM
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
{
|
|
|
|
struct passwd *pampw;
|
|
|
|
pampw = getpwuid (getuid ()); /* local, no need for xgetpwuid */
|
|
|
|
if (pampw == NULL) {
|
Additional PAM cleanup:
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: If the username cannot be determined, report it as
such (not a PAM authentication failure).
2008-09-07 05:16:44 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: Cannot determine your user name.\n"),
|
|
|
|
Prog);
|
|
|
|
exit (1);
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
}
|
Additional PAM cleanup:
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: If the username cannot be determined, report it as
such (not a PAM authentication failure).
2008-09-07 05:16:44 +05:30
|
|
|
|
|
|
|
retval = pam_start ("usermod", pampw->pw_name, &conv, &pamh);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (PAM_SUCCESS == retval) {
|
2007-10-07 17:14:59 +05:30
|
|
|
retval = pam_authenticate (pamh, 0);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (PAM_SUCCESS == retval) {
|
2007-10-07 17:14:59 +05:30
|
|
|
retval = pam_acct_mgmt (pamh, 0);
|
2007-10-07 17:14:38 +05:30
|
|
|
}
|
|
|
|
|
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: Simplify the PAM error handling. Do not keep the pamh
handle, but terminate the PAM transaction as soon as possible if
there are no PAM session opened.
2008-09-06 18:58:02 +05:30
|
|
|
if (NULL != pamh) {
|
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
Added *_dbname() functions to retrieve the name of the databases.
* lib/groupio.c, lib/groupio.h, lib/pwio.c, lib/pwio.h,
lib/sgroupio.c, lib/sgroupio.h, lib/shadowio.c, lib/shadowio.h:
*_name() functions renamed *setname().
* src/grpck.c, src/pwck.c: Likewise.
* lib/groupio.h, lib/pwio.h, lib/sgroupio.h, lib/shadowio.h: Added
the name of the arguments to the prototypes.
* src/chage, src/chfn.c, src/chgpasswd.c, src/chpasswd.c,
src/chsh.c, src/gpasswd.c, src/groupadd.c, src/groupdel.c,
src/groupmod.c, src/grpck.c, src/grpconv.c, src/grpunconv.c,
src/newusers.c, src/passwd.c, src/pwck.c, src/pwconv.c,
src/pwunconv.c, src/useradd.c, src/userdel.c, src/usermod.c:
Harmonize the erro & syslog messages in case of failure of the
*_lock(), *_open(), *_close(), *_unlock(), *_remove() functions.
* src/chgpasswd.c, src/chpasswd.c, src/usermod.c: Avoid
capitalized messages.
* src/chpasswd.c, src/useradd.c, src/usermod.c: Harmonize messages
in case of inexistent entries.
* src/usermod.c: Harmonize messages in case of already existing
entries.
* src/newusers.c, src/useradd.c: Simplify PAM error handling.
* src/useradd.c: Report failures to unlock files (stderr, syslog,
and audit). But do not fail (continue).
* src/useradd.c (open_files): Do not report to syslog & audit
failures to lock or open the databases. This might be harmless,
and the logs were not already informed that a change was
requested.
* src/usermod.c: It's not the account which is unlocked, but its
password.
2008-08-06 21:27:31 +05:30
|
|
|
(void) pam_end (pamh, retval);
|
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/chfn.c,
src/groupmems.c, src/usermod.c, src/groupdel.c, src/chgpasswd.c,
src/useradd.c, src/groupmod.c, src/groupadd.c, src/chage.c,
src/chsh.c: Simplify the PAM error handling. Do not keep the pamh
handle, but terminate the PAM transaction as soon as possible if
there are no PAM session opened.
2008-09-06 18:58:02 +05:30
|
|
|
}
|
|
|
|
if (PAM_SUCCESS != retval) {
|
2007-10-07 17:16:07 +05:30
|
|
|
fprintf (stderr, _("%s: PAM authentication failed\n"), Prog);
|
2007-10-07 17:14:38 +05:30
|
|
|
exit (1);
|
|
|
|
}
|
2007-10-07 17:15:40 +05:30
|
|
|
#endif /* USE_PAM */
|
* configure.in: Added option --enable-account-tools-setuid to
enable/disable the usage of PAM to authenticate the callers of
account management tools: chage, chgpasswd, chpasswd, groupadd,
groupdel, groupmod, useradd, userdel, usermod.
* src/Makefile.am: Do not link the above tools with libpam if
account-tools-setuid is disabled.
* src/userdel.c, src/newusers.c, src/chpasswd.c, src/usermod.c,
src/groupdel.c, src/chgpasswd.c, src/useradd.c, src/groupmod.c,
src/groupadd.c, src/chage.c: Implement ACCT_TOOLS_SETUID
(--enable-account-tools-setuid).
* etc/pam.d/Makefile.am: Install the pam service file for the
above tools only when needed.
* src/useradd.c, src/userdel.c, src/usermod.c: It is no more
needed to initialize retval to PAM_SUCCESS.
2008-09-07 03:05:37 +05:30
|
|
|
#endif /* ACCT_TOOLS_SETUID */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Do the hard stuff - open the files, change the user entries,
|
|
|
|
* change the home directory, then close and update the files.
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
open_files ();
|
2008-07-12 03:20:05 +05:30
|
|
|
if ( cflg || dflg || eflg || fflg || gflg || Lflg || lflg || pflg
|
|
|
|
|| sflg || uflg || Uflg) {
|
|
|
|
usr_update ();
|
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
if (Gflg || lflg) {
|
2007-11-17 17:12:47 +05:30
|
|
|
grp_update ();
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-11-17 17:12:47 +05:30
|
|
|
close_files ();
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-11-17 04:59:41 +05:30
|
|
|
nscd_flush_cache ("passwd");
|
|
|
|
nscd_flush_cache ("group");
|
|
|
|
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
2009-04-11 22:17:32 +05:30
|
|
|
if (Zflg) {
|
|
|
|
selinux_update_mapping ();
|
|
|
|
}
|
2009-04-11 21:04:10 +05:30
|
|
|
#endif
|
|
|
|
|
2008-06-10 01:47:48 +05:30
|
|
|
if (mflg) {
|
2007-10-07 17:14:59 +05:30
|
|
|
move_home ();
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
#ifndef NO_MOVE_MAILBOX
|
2008-06-10 01:47:48 +05:30
|
|
|
if (lflg || uflg) {
|
2007-10-07 17:14:59 +05:30
|
|
|
move_mailbox ();
|
2008-06-10 01:47:48 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
|
|
|
|
|
|
|
if (uflg) {
|
2008-07-12 02:22:44 +05:30
|
|
|
update_lastlog ();
|
|
|
|
update_faillog ();
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Change the UID on all of the files owned by `user_id' to
|
|
|
|
* `user_newid' in the user's home directory.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
chown_tree (dflg ? user_newhome : user_home,
|
|
|
|
user_id, user_newid,
|
|
|
|
user_gid, gflg ? user_newgid : user_gid);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
return E_SUCCESS;
|
2007-10-07 17:15:23 +05:30
|
|
|
}
|
2008-06-10 01:47:48 +05:30
|
|
|
|
2009-04-11 21:04:10 +05:30
|
|
|
#ifdef WITH_SELINUX
|
|
|
|
static void selinux_update_mapping (void) {
|
|
|
|
const char *argv[7];
|
|
|
|
|
|
|
|
if (is_selinux_enabled () <= 0) return;
|
|
|
|
|
|
|
|
if (*user_selinux) {
|
|
|
|
argv[0] = "/usr/sbin/semanage";
|
|
|
|
argv[1] = "login";
|
|
|
|
argv[2] = "-m";
|
|
|
|
argv[3] = "-s";
|
|
|
|
argv[4] = user_selinux;
|
|
|
|
argv[5] = user_name;
|
|
|
|
argv[6] = NULL;
|
|
|
|
if (safe_system (argv[0], argv, NULL, 1)) {
|
|
|
|
argv[2] = "-a";
|
|
|
|
if (safe_system (argv[0], argv, NULL, 0)) {
|
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
|
|
|
|
Prog, user_name, user_selinux);
|
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
|
|
|
|
"modifying User mapping ",
|
|
|
|
user_name, (unsigned int) user_id, 0);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|