3 * David L. Nugent. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 static const char rcsid[] =
44 static struct passwd *lookup_pwent(const char *user);
45 static void delete_members(struct group *grp, char *list);
46 static int print_group(struct group * grp);
47 static gid_t gr_gidpolicy(struct userconf * cnf, long id);
50 set_passwd(struct group *grp, bool update)
58 grp->gr_passwd = "*"; /* No access */
62 if ((istty = isatty(conf.fd))) {
66 tcsetattr(conf.fd, TCSANOW, &n);
67 printf("%sassword for group %s:", update ? "New p" : "P",
71 b = read(conf.fd, line, sizeof(line) - 1);
72 if (istty) { /* Restore state */
73 tcsetattr(conf.fd, TCSANOW, &t);
78 err(EX_OSERR, "-h file descriptor");
80 if ((p = strpbrk(line, " \t\r\n")) != NULL)
83 errx(EX_DATAERR, "empty password read on file descriptor %d",
85 if (conf.precrypted) {
86 if (strchr(line, ':') != 0)
87 errx(EX_DATAERR, "wrong encrypted passwrd");
88 grp->gr_passwd = line;
90 grp->gr_passwd = pw_pwcrypt(line);
94 pw_groupnext(struct userconf *cnf, bool quiet)
96 gid_t next = gr_gidpolicy(cnf, -1);
100 printf("%u\n", next);
102 return (EXIT_SUCCESS);
106 pw_groupshow(const char *name, long id, struct group *fakegroup)
108 struct group *grp = NULL;
110 if (id < 0 && name == NULL && !conf.all)
111 errx(EX_DATAERR, "groupname or id or '-a' required");
115 while ((grp = GETGRENT()) != NULL)
119 return (EXIT_SUCCESS);
122 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
128 errx(EX_DATAERR, "unknown gid `%ld'", id);
129 errx(EX_DATAERR, "unknown group `%s'", name);
133 return (print_group(grp));
137 pw_groupdel(const char *name, long id)
139 struct group *grp = NULL;
142 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
145 errx(EX_DATAERR, "unknown gid `%ld'", id);
146 errx(EX_DATAERR, "unknown group `%s'", name);
151 err(EX_IOERR, "group '%s' not available (NIS?)", name);
153 err(EX_IOERR, "group update");
154 pw_log(conf.userconf, M_DELETE, W_GROUP, "%s(%ld) removed", name, id);
156 return (EXIT_SUCCESS);
160 pw_group(int mode, char *name, long id, struct cargs * args)
164 struct group *grp = NULL;
165 struct userconf *cnf = conf.userconf;
167 static struct group fakegroup =
176 return (pw_groupnext(cnf, conf.quiet));
179 return (pw_groupshow(name, id, &fakegroup));
181 if (mode == M_DELETE)
182 return (pw_groupdel(name, id));
184 if (mode == M_LOCK || mode == M_UNLOCK)
185 errx(EX_USAGE, "'lock' command is not available for groups");
187 if (id < 0 && name == NULL)
188 errx(EX_DATAERR, "group name or id required");
190 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
192 if (mode == M_UPDATE) {
193 if (name == NULL && grp == NULL) /* Try harder */
198 errx(EX_DATAERR, "unknown group `%s'", name);
200 errx(EX_DATAERR, "unknown group `%ld'", id);
202 if (name == NULL) /* Needed later */
206 grp->gr_gid = (gid_t) id;
208 if (conf.newname != NULL)
209 grp->gr_name = pw_checkname(conf.newname, 0);
211 if (name == NULL) /* Required */
212 errx(EX_DATAERR, "group name required");
213 else if (grp != NULL) /* Exists */
214 errx(EX_DATAERR, "group name `%s' already exists", name);
217 grp->gr_name = pw_checkname(name, 0);
218 grp->gr_passwd = "*";
219 grp->gr_gid = gr_gidpolicy(cnf, id);
224 * This allows us to set a group password Group passwords is an
225 * antique idea, rarely used and insecure (no secure database) Should
226 * be discouraged, but it is apparently still supported by some
230 if (conf.which == W_GROUP && conf.fd != -1)
231 set_passwd(grp, mode == M_UPDATE);
233 if (((arg = getarg(args, 'M')) != NULL ||
234 (arg = getarg(args, 'd')) != NULL ||
235 (arg = getarg(args, 'm')) != NULL) && arg->val) {
239 /* Make sure this is not stay NULL with -M "" */
241 delete_members(grp, arg->val);
242 else if (arg->ch == 'M')
245 for (p = strtok(arg->val, ", \t"); arg->ch != 'd' && p != NULL;
246 p = strtok(NULL, ", \t")) {
250 * Check for duplicates
252 pwd = lookup_pwent(p);
253 for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++) {
254 if (strcmp(grp->gr_mem[j], pwd->pw_name) == 0)
257 if (grp->gr_mem != NULL && grp->gr_mem[j] != NULL)
259 grp = gr_add(grp, pwd->pw_name);
264 return print_group(grp);
266 if (mode == M_ADD && (rc = addgrent(grp)) != 0) {
268 errx(EX_IOERR, "group '%s' already exists",
271 err(EX_IOERR, "group update");
272 } else if (mode == M_UPDATE && (rc = chggrent(name, grp)) != 0) {
274 errx(EX_IOERR, "group '%s' not available (NIS?)",
277 err(EX_IOERR, "group update");
280 if (conf.newname != NULL)
282 /* grp may have been invalidated */
283 if ((grp = GETGRNAM(name)) == NULL)
284 errx(EX_SOFTWARE, "group disappeared during update");
286 pw_log(cnf, mode, W_GROUP, "%s(%u)", grp->gr_name, grp->gr_gid);
293 * Lookup a passwd entry using a name or UID.
295 static struct passwd *
296 lookup_pwent(const char *user)
300 if ((pwd = GETPWNAM(user)) == NULL &&
301 (!isdigit((unsigned char)*user) ||
302 (pwd = getpwuid((uid_t) atoi(user))) == NULL))
303 errx(EX_NOUSER, "user `%s' does not exist", user);
310 * Delete requested members from a group.
313 delete_members(struct group *grp, char *list)
318 if (grp->gr_mem == NULL)
321 for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
322 for (k = 0; grp->gr_mem[k] != NULL; k++) {
323 if (strcmp(grp->gr_mem[k], p) == 0)
326 if (grp->gr_mem[k] == NULL) /* No match */
329 for (; grp->gr_mem[k] != NULL; k++)
330 grp->gr_mem[k] = grp->gr_mem[k+1];
336 gr_gidpolicy(struct userconf * cnf, long id)
339 gid_t gid = (gid_t) - 1;
342 * Check the given gid, if any
347 if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate)
348 errx(EX_DATAERR, "gid `%u' has already been allocated", grp->gr_gid);
353 * We need to allocate the next available gid under one of
354 * two policies a) Grab the first unused gid b) Grab the
355 * highest possible unused gid
357 if (cnf->min_gid >= cnf->max_gid) { /* Sanity claus^H^H^H^Hheck */
359 cnf->max_gid = 32000;
361 bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1);
364 * Now, let's fill the bitmap from the password file
367 while ((grp = GETGRENT()) != NULL)
368 if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid &&
369 (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid)
370 bm_setbit(&bm, grp->gr_gid - cnf->min_gid);
374 * Then apply the policy, with fallback to reuse if necessary
377 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
379 gid = (gid_t) (bm_lastset(&bm) + 1);
380 if (!bm_isset(&bm, gid))
383 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
387 * Another sanity check
389 if (gid < cnf->min_gid || gid > cnf->max_gid)
390 errx(EX_SOFTWARE, "unable to allocate a new gid - range fully used");
398 print_group(struct group * grp)
409 printf("Group Name: %-15s #%lu\n"
411 grp->gr_name, (long) grp->gr_gid);
412 if (grp->gr_mem != NULL) {
413 for (i = 0; grp->gr_mem[i]; i++)
414 printf("%s%s", i ? "," : "", grp->gr_mem[i]);
416 fputs("\n\n", stdout);