1 /*- 2 * Copyright (C) 1996 3 * David L. Nugent. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #ifndef lint 28 static const char rcsid[] = 29 "$FreeBSD$"; 30 #endif /* not lint */ 31 32 #include <ctype.h> 33 #include <err.h> 34 #include <termios.h> 35 #include <stdbool.h> 36 #include <unistd.h> 37 #include <grp.h> 38 #include <libutil.h> 39 40 #include "pw.h" 41 #include "bitmap.h" 42 43 44 static struct passwd *lookup_pwent(const char *user); 45 static void delete_members(struct group *grp, char *list); 46 static int print_group(struct group * grp); 47 static gid_t gr_gidpolicy(struct userconf * cnf, long id); 48 49 static void 50 set_passwd(struct group *grp, bool update) 51 { 52 int b; 53 int istty; 54 struct termios t, n; 55 char *p, line[256]; 56 57 if (conf.fd == '-') { 58 grp->gr_passwd = "*"; /* No access */ 59 return; 60 } 61 62 if ((istty = isatty(conf.fd))) { 63 n = t; 64 /* Disable echo */ 65 n.c_lflag &= ~(ECHO); 66 tcsetattr(conf.fd, TCSANOW, &n); 67 printf("%sassword for group %s:", update ? "New p" : "P", 68 grp->gr_name); 69 fflush(stdout); 70 } 71 b = read(conf.fd, line, sizeof(line) - 1); 72 if (istty) { /* Restore state */ 73 tcsetattr(conf.fd, TCSANOW, &t); 74 fputc('\n', stdout); 75 fflush(stdout); 76 } 77 if (b < 0) 78 err(EX_OSERR, "-h file descriptor"); 79 line[b] = '\0'; 80 if ((p = strpbrk(line, " \t\r\n")) != NULL) 81 *p = '\0'; 82 if (!*line) 83 errx(EX_DATAERR, "empty password read on file descriptor %d", 84 conf.fd); 85 if (conf.precrypted) { 86 if (strchr(line, ':') != 0) 87 errx(EX_DATAERR, "wrong encrypted passwrd"); 88 grp->gr_passwd = line; 89 } else 90 grp->gr_passwd = pw_pwcrypt(line); 91 } 92 93 int 94 pw_groupnext(struct userconf *cnf, bool quiet) 95 { 96 gid_t next = gr_gidpolicy(cnf, -1); 97 98 if (quiet) 99 return (next); 100 printf("%u\n", next); 101 102 return (EXIT_SUCCESS); 103 } 104 105 static int 106 pw_groupshow(const char *name, long id, struct group *fakegroup) 107 { 108 struct group *grp = NULL; 109 110 if (id < 0 && name == NULL && !conf.all) 111 errx(EX_DATAERR, "groupname or id or '-a' required"); 112 113 if (conf.all) { 114 SETGRENT(); 115 while ((grp = GETGRENT()) != NULL) 116 print_group(grp); 117 ENDGRENT(); 118 119 return (EXIT_SUCCESS); 120 } 121 122 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 123 if (grp == NULL) { 124 if (conf.force) { 125 grp = fakegroup; 126 } else { 127 if (name == NULL) 128 errx(EX_DATAERR, "unknown gid `%ld'", id); 129 errx(EX_DATAERR, "unknown group `%s'", name); 130 } 131 } 132 133 return (print_group(grp)); 134 } 135 136 static int 137 pw_groupdel(const char *name, long id) 138 { 139 struct group *grp = NULL; 140 int rc; 141 142 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 143 if (grp == NULL) { 144 if (name == NULL) 145 errx(EX_DATAERR, "unknown gid `%ld'", id); 146 errx(EX_DATAERR, "unknown group `%s'", name); 147 } 148 149 rc = delgrent(grp); 150 if (rc == -1) 151 err(EX_IOERR, "group '%s' not available (NIS?)", name); 152 else if (rc != 0) 153 err(EX_IOERR, "group update"); 154 pw_log(conf.userconf, M_DELETE, W_GROUP, "%s(%ld) removed", name, id); 155 156 return (EXIT_SUCCESS); 157 } 158 159 int 160 pw_group(int mode, char *name, long id, struct cargs * args) 161 { 162 int rc; 163 struct carg *arg; 164 struct group *grp = NULL; 165 struct userconf *cnf = conf.userconf; 166 167 static struct group fakegroup = 168 { 169 "nogroup", 170 "*", 171 -1, 172 NULL 173 }; 174 175 if (mode == M_NEXT) 176 return (pw_groupnext(cnf, conf.quiet)); 177 178 if (mode == M_PRINT) 179 return (pw_groupshow(name, id, &fakegroup)); 180 181 if (mode == M_DELETE) 182 return (pw_groupdel(name, id)); 183 184 if (mode == M_LOCK || mode == M_UNLOCK) 185 errx(EX_USAGE, "'lock' command is not available for groups"); 186 187 if (id < 0 && name == NULL) 188 errx(EX_DATAERR, "group name or id required"); 189 190 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 191 192 if (mode == M_UPDATE) { 193 if (name == NULL && grp == NULL) /* Try harder */ 194 grp = GETGRGID(id); 195 196 if (grp == NULL) { 197 if (name == NULL) 198 errx(EX_DATAERR, "unknown group `%s'", name); 199 else 200 errx(EX_DATAERR, "unknown group `%ld'", id); 201 } 202 if (name == NULL) /* Needed later */ 203 name = grp->gr_name; 204 205 if (id > 0) 206 grp->gr_gid = (gid_t) id; 207 208 if (conf.newname != NULL) 209 grp->gr_name = pw_checkname(conf.newname, 0); 210 } else { 211 if (name == NULL) /* Required */ 212 errx(EX_DATAERR, "group name required"); 213 else if (grp != NULL) /* Exists */ 214 errx(EX_DATAERR, "group name `%s' already exists", name); 215 216 grp = &fakegroup; 217 grp->gr_name = pw_checkname(name, 0); 218 grp->gr_passwd = "*"; 219 grp->gr_gid = gr_gidpolicy(cnf, id); 220 grp->gr_mem = NULL; 221 } 222 223 /* 224 * This allows us to set a group password Group passwords is an 225 * antique idea, rarely used and insecure (no secure database) Should 226 * be discouraged, but it is apparently still supported by some 227 * software. 228 */ 229 230 if (conf.which == W_GROUP && conf.fd != -1) 231 set_passwd(grp, mode == M_UPDATE); 232 233 if (((arg = getarg(args, 'M')) != NULL || 234 (arg = getarg(args, 'd')) != NULL || 235 (arg = getarg(args, 'm')) != NULL) && arg->val) { 236 char *p; 237 struct passwd *pwd; 238 239 /* Make sure this is not stay NULL with -M "" */ 240 if (arg->ch == 'd') 241 delete_members(grp, arg->val); 242 else if (arg->ch == 'M') 243 grp->gr_mem = NULL; 244 245 for (p = strtok(arg->val, ", \t"); arg->ch != 'd' && p != NULL; 246 p = strtok(NULL, ", \t")) { 247 int j; 248 249 /* 250 * Check for duplicates 251 */ 252 pwd = lookup_pwent(p); 253 for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++) { 254 if (strcmp(grp->gr_mem[j], pwd->pw_name) == 0) 255 break; 256 } 257 if (grp->gr_mem != NULL && grp->gr_mem[j] != NULL) 258 continue; 259 grp = gr_add(grp, pwd->pw_name); 260 } 261 } 262 263 if (conf.dryrun) 264 return print_group(grp); 265 266 if (mode == M_ADD && (rc = addgrent(grp)) != 0) { 267 if (rc == -1) 268 errx(EX_IOERR, "group '%s' already exists", 269 grp->gr_name); 270 else 271 err(EX_IOERR, "group update"); 272 } else if (mode == M_UPDATE && (rc = chggrent(name, grp)) != 0) { 273 if (rc == -1) 274 errx(EX_IOERR, "group '%s' not available (NIS?)", 275 grp->gr_name); 276 else 277 err(EX_IOERR, "group update"); 278 } 279 280 if (conf.newname != NULL) 281 name = conf.newname; 282 /* grp may have been invalidated */ 283 if ((grp = GETGRNAM(name)) == NULL) 284 errx(EX_SOFTWARE, "group disappeared during update"); 285 286 pw_log(cnf, mode, W_GROUP, "%s(%u)", grp->gr_name, grp->gr_gid); 287 288 return EXIT_SUCCESS; 289 } 290 291 292 /* 293 * Lookup a passwd entry using a name or UID. 294 */ 295 static struct passwd * 296 lookup_pwent(const char *user) 297 { 298 struct passwd *pwd; 299 300 if ((pwd = GETPWNAM(user)) == NULL && 301 (!isdigit((unsigned char)*user) || 302 (pwd = getpwuid((uid_t) atoi(user))) == NULL)) 303 errx(EX_NOUSER, "user `%s' does not exist", user); 304 305 return (pwd); 306 } 307 308 309 /* 310 * Delete requested members from a group. 311 */ 312 static void 313 delete_members(struct group *grp, char *list) 314 { 315 char *p; 316 int k; 317 318 if (grp->gr_mem == NULL) 319 return; 320 321 for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) { 322 for (k = 0; grp->gr_mem[k] != NULL; k++) { 323 if (strcmp(grp->gr_mem[k], p) == 0) 324 break; 325 } 326 if (grp->gr_mem[k] == NULL) /* No match */ 327 continue; 328 329 for (; grp->gr_mem[k] != NULL; k++) 330 grp->gr_mem[k] = grp->gr_mem[k+1]; 331 } 332 } 333 334 335 static gid_t 336 gr_gidpolicy(struct userconf * cnf, long id) 337 { 338 struct group *grp; 339 gid_t gid = (gid_t) - 1; 340 341 /* 342 * Check the given gid, if any 343 */ 344 if (id > 0) { 345 gid = (gid_t) id; 346 347 if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate) 348 errx(EX_DATAERR, "gid `%u' has already been allocated", grp->gr_gid); 349 } else { 350 struct bitmap bm; 351 352 /* 353 * We need to allocate the next available gid under one of 354 * two policies a) Grab the first unused gid b) Grab the 355 * highest possible unused gid 356 */ 357 if (cnf->min_gid >= cnf->max_gid) { /* Sanity claus^H^H^H^Hheck */ 358 cnf->min_gid = 1000; 359 cnf->max_gid = 32000; 360 } 361 bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1); 362 363 /* 364 * Now, let's fill the bitmap from the password file 365 */ 366 SETGRENT(); 367 while ((grp = GETGRENT()) != NULL) 368 if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid && 369 (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid) 370 bm_setbit(&bm, grp->gr_gid - cnf->min_gid); 371 ENDGRENT(); 372 373 /* 374 * Then apply the policy, with fallback to reuse if necessary 375 */ 376 if (cnf->reuse_gids) 377 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 378 else { 379 gid = (gid_t) (bm_lastset(&bm) + 1); 380 if (!bm_isset(&bm, gid)) 381 gid += cnf->min_gid; 382 else 383 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 384 } 385 386 /* 387 * Another sanity check 388 */ 389 if (gid < cnf->min_gid || gid > cnf->max_gid) 390 errx(EX_SOFTWARE, "unable to allocate a new gid - range fully used"); 391 bm_dealloc(&bm); 392 } 393 return gid; 394 } 395 396 397 static int 398 print_group(struct group * grp) 399 { 400 if (!conf.pretty) { 401 char *buf = NULL; 402 403 buf = gr_make(grp); 404 printf("%s\n", buf); 405 free(buf); 406 } else { 407 int i; 408 409 printf("Group Name: %-15s #%lu\n" 410 " Members: ", 411 grp->gr_name, (long) grp->gr_gid); 412 if (grp->gr_mem != NULL) { 413 for (i = 0; grp->gr_mem[i]; i++) 414 printf("%s%s", i ? "," : "", grp->gr_mem[i]); 415 } 416 fputs("\n\n", stdout); 417 } 418 return EXIT_SUCCESS; 419 } 420