2 * SPDX-License-Identifier: BSD-2-Clause
5 * David L. Nugent. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 static const char rcsid[] =
47 static struct passwd *lookup_pwent(const char *user);
48 static void delete_members(struct group *grp, char *list);
49 static int print_group(struct group * grp, bool pretty);
50 static gid_t gr_gidpolicy(struct userconf * cnf, intmax_t id);
53 grp_set_passwd(struct group *grp, bool update, int fd, bool precrypted)
58 static char line[256];
65 grp->gr_passwd = "*"; /* No access */
69 if ((istty = isatty(fd))) {
70 if (tcgetattr(fd, &t) == -1)
76 tcsetattr(fd, TCSANOW, &n);
77 printf("%sassword for group %s:",
78 update ? "New p" : "P",
83 b = read(fd, line, sizeof(line) - 1);
84 if (istty) { /* Restore state */
85 tcsetattr(fd, TCSANOW, &t);
90 err(EX_OSERR, "-h file descriptor");
92 if ((p = strpbrk(line, " \t\r\n")) != NULL)
95 errx(EX_DATAERR, "empty password read on file descriptor %d",
98 if (strchr(line, ':') != 0)
99 errx(EX_DATAERR, "wrong encrypted passwrd");
100 grp->gr_passwd = line;
102 grp->gr_passwd = pw_pwcrypt(line);
106 pw_groupnext(struct userconf *cnf, bool quiet)
108 gid_t next = gr_gidpolicy(cnf, -1);
112 printf("%ju\n", (uintmax_t)next);
114 return (EXIT_SUCCESS);
117 static struct group *
118 getgroup(char *name, intmax_t id, bool fatal)
122 if (id < 0 && name == NULL)
123 errx(EX_DATAERR, "groupname or id required");
124 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
129 errx(EX_DATAERR, "unknown gid `%ju'", id);
130 errx(EX_DATAERR, "unknown group `%s'", name);
136 * Lookup a passwd entry using a name or UID.
138 static struct passwd *
139 lookup_pwent(const char *user)
143 if ((pwd = GETPWNAM(user)) == NULL &&
144 (!isdigit((unsigned char)*user) ||
145 (pwd = getpwuid((uid_t) atoi(user))) == NULL))
146 errx(EX_NOUSER, "user `%s' does not exist", user);
153 * Delete requested members from a group.
156 delete_members(struct group *grp, char *list)
161 if (grp->gr_mem == NULL)
164 for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
165 for (k = 0; grp->gr_mem[k] != NULL; k++) {
166 if (strcmp(grp->gr_mem[k], p) == 0)
169 if (grp->gr_mem[k] == NULL) /* No match */
172 for (; grp->gr_mem[k] != NULL; k++)
173 grp->gr_mem[k] = grp->gr_mem[k+1];
178 gr_gidpolicy(struct userconf * cnf, intmax_t id)
182 gid_t gid = (gid_t) - 1;
185 * Check the given gid, if any
190 if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate)
191 errx(EX_DATAERR, "gid `%ju' has already been allocated",
192 (uintmax_t)grp->gr_gid);
197 * We need to allocate the next available gid under one of
198 * two policies a) Grab the first unused gid b) Grab the
199 * highest possible unused gid
201 if (cnf->min_gid >= cnf->max_gid) { /* Sanity claus^H^H^H^Hheck */
203 cnf->max_gid = 32000;
205 bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1);
208 * Now, let's fill the bitmap from the password file
211 while ((grp = GETGRENT()) != NULL)
212 if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid &&
213 (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid)
214 bm_setbit(&bm, grp->gr_gid - cnf->min_gid);
218 * Then apply the policy, with fallback to reuse if necessary
221 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
223 gid = (gid_t) (bm_lastset(&bm) + 1);
224 if (!bm_isset(&bm, gid))
227 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
231 * Another sanity check
233 if (gid < cnf->min_gid || gid > cnf->max_gid)
234 errx(EX_SOFTWARE, "unable to allocate a new gid - range fully "
241 print_group(struct group * grp, bool pretty)
247 printf("Group Name: %-15s #%lu\n"
249 grp->gr_name, (long) grp->gr_gid);
250 if (grp->gr_mem != NULL) {
251 for (i = 0; grp->gr_mem[i]; i++)
252 printf("%s%s", i ? "," : "", grp->gr_mem[i]);
254 fputs("\n\n", stdout);
255 return (EXIT_SUCCESS);
261 return (EXIT_SUCCESS);
265 pw_group_next(int argc, char **argv, char *arg1 __unused)
267 struct userconf *cnf;
268 const char *cfg = NULL;
272 while ((ch = getopt(argc, argv, "C:q")) != -1) {
286 freopen(_PATH_DEVNULL, "w", stderr);
287 cnf = get_userconfig(cfg);
288 return (pw_groupnext(cnf, quiet));
292 pw_group_show(int argc, char **argv, char *arg1)
294 struct group *grp = NULL;
298 bool all, force, quiet, pretty;
300 all = force = quiet = pretty = false;
302 struct group fakegroup = {
310 if (arg1[strspn(arg1, "0123456789")] == '\0')
311 id = pw_checkid(arg1, GID_MAX);
316 while ((ch = getopt(argc, argv, "C:qn:g:FPa")) != -1) {
319 /* ignore compatibility */
328 id = pw_checkid(optarg, GID_MAX);
345 freopen(_PATH_DEVNULL, "w", stderr);
349 while ((grp = GETGRENT()) != NULL)
350 print_group(grp, pretty);
352 return (EXIT_SUCCESS);
355 grp = getgroup(name, id, !force);
359 return (print_group(grp, pretty));
363 pw_group_del(int argc, char **argv, char *arg1)
365 struct userconf *cnf = NULL;
366 struct group *grp = NULL;
368 const char *cfg = NULL;
375 if (arg1[strspn(arg1, "0123456789")] == '\0')
376 id = pw_checkid(arg1, GID_MAX);
381 while ((ch = getopt(argc, argv, "C:qn:g:Y")) != -1) {
393 id = pw_checkid(optarg, GID_MAX);
404 freopen(_PATH_DEVNULL, "w", stderr);
405 grp = getgroup(name, id, true);
406 cnf = get_userconfig(cfg);
409 err(EX_IOERR, "group '%s' not available (NIS?)", name);
411 err(EX_IOERR, "group update");
412 pw_log(cnf, M_DELETE, W_GROUP, "%s(%ju) removed", name,
415 if (nis && nis_update() == 0)
416 pw_log(cnf, M_DELETE, W_GROUP, "NIS maps updated");
418 return (EXIT_SUCCESS);
422 grp_has_member(struct group *grp, const char *name)
426 for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++)
427 if (strcmp(grp->gr_mem[j], name) == 0)
433 grp_add_members(struct group **grp, char *members)
441 for (p = strtok(members, tok); p != NULL; p = strtok(NULL, tok)) {
442 pwd = lookup_pwent(p);
443 if (grp_has_member(*grp, pwd->pw_name))
445 *grp = gr_add(*grp, pwd->pw_name);
450 groupadd(struct userconf *cnf, char *name, gid_t id, char *members, int fd,
451 bool dryrun, bool pretty, bool precrypted)
456 struct group fakegroup = {
464 grp->gr_name = pw_checkname(name, 0);
465 grp->gr_passwd = "*";
466 grp->gr_gid = gr_gidpolicy(cnf, id);
470 * This allows us to set a group password Group passwords is an
471 * antique idea, rarely used and insecure (no secure database) Should
472 * be discouraged, but it is apparently still supported by some
475 grp_set_passwd(grp, false, fd, precrypted);
476 grp_add_members(&grp, members);
478 return (print_group(grp, pretty));
480 if ((rc = addgrent(grp)) != 0) {
482 errx(EX_IOERR, "group '%s' already exists",
485 err(EX_IOERR, "group update");
488 pw_log(cnf, M_ADD, W_GROUP, "%s(%ju)", grp->gr_name,
489 (uintmax_t)grp->gr_gid);
491 return (EXIT_SUCCESS);
495 pw_group_add(int argc, char **argv, char *arg1)
497 struct userconf *cnf = NULL;
499 char *members = NULL;
500 const char *cfg = NULL;
503 bool quiet, precrypted, dryrun, pretty, nis;
505 quiet = precrypted = dryrun = pretty = nis = false;
508 if (arg1[strspn(arg1, "0123456789")] == '\0')
509 id = pw_checkid(arg1, GID_MAX);
514 while ((ch = getopt(argc, argv, "C:qn:g:h:H:M:oNPY")) != -1) {
526 id = pw_checkid(optarg, GID_MAX);
530 errx(EX_USAGE, "'-h' and '-H' are mutually "
531 "exclusive options");
532 fd = pw_checkfd(optarg);
535 errx(EX_USAGE, "-H expects a file descriptor");
539 errx(EX_USAGE, "'-h' and '-H' are mutually "
540 "exclusive options");
541 fd = pw_checkfd(optarg);
547 conf.checkduplicate = false;
564 freopen(_PATH_DEVNULL, "w", stderr);
566 errx(EX_DATAERR, "group name required");
567 if (GETGRNAM(name) != NULL)
568 errx(EX_DATAERR, "group name `%s' already exists", name);
569 cnf = get_userconfig(cfg);
570 rc = groupadd(cnf, name, gr_gidpolicy(cnf, id), members, fd, dryrun,
572 if (nis && rc == EXIT_SUCCESS && nis_update() == 0)
573 pw_log(cnf, M_ADD, W_GROUP, "NIS maps updated");
579 pw_group_mod(int argc, char **argv, char *arg1)
581 struct userconf *cnf;
582 struct group *grp = NULL;
583 const char *cfg = NULL;
584 char *oldmembers = NULL;
585 char *members = NULL;
586 char *newmembers = NULL;
587 char *newname = NULL;
591 bool quiet, pretty, dryrun, nis, precrypted;
593 quiet = pretty = dryrun = nis = precrypted = false;
596 if (arg1[strspn(arg1, "0123456789")] == '\0')
597 id = pw_checkid(arg1, GID_MAX);
602 while ((ch = getopt(argc, argv, "C:qn:d:g:l:h:H:M:m:NPY")) != -1) {
614 id = pw_checkid(optarg, GID_MAX);
624 errx(EX_USAGE, "'-h' and '-H' are mutually "
625 "exclusive options");
626 fd = pw_checkfd(optarg);
629 errx(EX_USAGE, "-H expects a file descriptor");
633 errx(EX_USAGE, "'-h' and '-H' are mutually "
634 "exclusive options");
635 fd = pw_checkfd(optarg);
657 freopen(_PATH_DEVNULL, "w", stderr);
658 cnf = get_userconfig(cfg);
659 grp = getgroup(name, id, true);
666 grp->gr_name = pw_checkname(newname, 0);
668 grp_set_passwd(grp, true, fd, precrypted);
670 * Keep the same logic as old code for now:
671 * if -M is passed, -d and -m are ignored
672 * then id -d, -m is ignored
678 grp_add_members(&grp, members);
679 } else if (oldmembers) {
680 delete_members(grp, oldmembers);
681 } else if (newmembers) {
682 grp_add_members(&grp, newmembers);
686 print_group(grp, pretty);
687 return (EXIT_SUCCESS);
690 if ((rc = chggrent(name, grp)) != 0) {
692 errx(EX_IOERR, "group '%s' not available (NIS?)",
695 err(EX_IOERR, "group update");
701 /* grp may have been invalidated */
702 if ((grp = GETGRNAM(name)) == NULL)
703 errx(EX_SOFTWARE, "group disappeared during update");
705 pw_log(cnf, M_UPDATE, W_GROUP, "%s(%ju)", grp->gr_name,
706 (uintmax_t)grp->gr_gid);
708 if (nis && nis_update() == 0)
709 pw_log(cnf, M_UPDATE, W_GROUP, "NIS maps updated");
711 return (EXIT_SUCCESS);