1 /*- 2 * Copyright (C) 1996 3 * David L. Nugent. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #ifndef lint 28 static const char rcsid[] = 29 "$FreeBSD$"; 30 #endif /* not lint */ 31 32 #include <ctype.h> 33 #include <err.h> 34 #include <inttypes.h> 35 #include <termios.h> 36 #include <stdbool.h> 37 #include <unistd.h> 38 #include <grp.h> 39 #include <libutil.h> 40 41 #include "pw.h" 42 #include "bitmap.h" 43 44 45 static struct passwd *lookup_pwent(const char *user); 46 static void delete_members(struct group *grp, char *list); 47 static int print_group(struct group * grp); 48 static gid_t gr_gidpolicy(struct userconf * cnf, long id); 49 50 static void 51 set_passwd(struct group *grp, bool update) 52 { 53 int b; 54 int istty; 55 struct termios t, n; 56 char *p, line[256]; 57 58 if (conf.fd == '-') { 59 grp->gr_passwd = "*"; /* No access */ 60 return; 61 } 62 63 if ((istty = isatty(conf.fd))) { 64 n = t; 65 /* Disable echo */ 66 n.c_lflag &= ~(ECHO); 67 tcsetattr(conf.fd, TCSANOW, &n); 68 printf("%sassword for group %s:", update ? "New p" : "P", 69 grp->gr_name); 70 fflush(stdout); 71 } 72 b = read(conf.fd, line, sizeof(line) - 1); 73 if (istty) { /* Restore state */ 74 tcsetattr(conf.fd, TCSANOW, &t); 75 fputc('\n', stdout); 76 fflush(stdout); 77 } 78 if (b < 0) 79 err(EX_OSERR, "-h file descriptor"); 80 line[b] = '\0'; 81 if ((p = strpbrk(line, " \t\r\n")) != NULL) 82 *p = '\0'; 83 if (!*line) 84 errx(EX_DATAERR, "empty password read on file descriptor %d", 85 conf.fd); 86 if (conf.precrypted) { 87 if (strchr(line, ':') != 0) 88 errx(EX_DATAERR, "wrong encrypted passwrd"); 89 grp->gr_passwd = line; 90 } else 91 grp->gr_passwd = pw_pwcrypt(line); 92 } 93 94 int 95 pw_groupnext(struct userconf *cnf, bool quiet) 96 { 97 gid_t next = gr_gidpolicy(cnf, -1); 98 99 if (quiet) 100 return (next); 101 printf("%ju\n", (uintmax_t)next); 102 103 return (EXIT_SUCCESS); 104 } 105 106 static int 107 pw_groupshow(const char *name, long id, struct group *fakegroup) 108 { 109 struct group *grp = NULL; 110 111 if (id < 0 && name == NULL && !conf.all) 112 errx(EX_DATAERR, "groupname or id or '-a' required"); 113 114 if (conf.all) { 115 SETGRENT(); 116 while ((grp = GETGRENT()) != NULL) 117 print_group(grp); 118 ENDGRENT(); 119 120 return (EXIT_SUCCESS); 121 } 122 123 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 124 if (grp == NULL) { 125 if (conf.force) { 126 grp = fakegroup; 127 } else { 128 if (name == NULL) 129 errx(EX_DATAERR, "unknown gid `%ld'", id); 130 errx(EX_DATAERR, "unknown group `%s'", name); 131 } 132 } 133 134 return (print_group(grp)); 135 } 136 137 static int 138 pw_groupdel(const char *name, long id) 139 { 140 struct group *grp = NULL; 141 int rc; 142 143 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 144 if (grp == NULL) { 145 if (name == NULL) 146 errx(EX_DATAERR, "unknown gid `%ld'", id); 147 errx(EX_DATAERR, "unknown group `%s'", name); 148 } 149 150 rc = delgrent(grp); 151 if (rc == -1) 152 err(EX_IOERR, "group '%s' not available (NIS?)", name); 153 else if (rc != 0) 154 err(EX_IOERR, "group update"); 155 pw_log(conf.userconf, M_DELETE, W_GROUP, "%s(%ld) removed", name, id); 156 157 return (EXIT_SUCCESS); 158 } 159 160 int 161 pw_group(int mode, char *name, long id, struct cargs * args) 162 { 163 int rc; 164 struct carg *arg; 165 struct group *grp = NULL; 166 struct userconf *cnf = conf.userconf; 167 168 static struct group fakegroup = 169 { 170 "nogroup", 171 "*", 172 -1, 173 NULL 174 }; 175 176 if (mode == M_NEXT) 177 return (pw_groupnext(cnf, conf.quiet)); 178 179 if (mode == M_PRINT) 180 return (pw_groupshow(name, id, &fakegroup)); 181 182 if (mode == M_DELETE) 183 return (pw_groupdel(name, id)); 184 185 if (mode == M_LOCK || mode == M_UNLOCK) 186 errx(EX_USAGE, "'lock' command is not available for groups"); 187 188 if (id < 0 && name == NULL) 189 errx(EX_DATAERR, "group name or id required"); 190 191 grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id); 192 193 if (mode == M_UPDATE) { 194 if (name == NULL && grp == NULL) /* Try harder */ 195 grp = GETGRGID(id); 196 197 if (grp == NULL) { 198 if (name == NULL) 199 errx(EX_DATAERR, "unknown group `%s'", name); 200 else 201 errx(EX_DATAERR, "unknown group `%ld'", id); 202 } 203 if (name == NULL) /* Needed later */ 204 name = grp->gr_name; 205 206 if (id > 0) 207 grp->gr_gid = (gid_t) id; 208 209 if (conf.newname != NULL) 210 grp->gr_name = pw_checkname(conf.newname, 0); 211 } else { 212 if (name == NULL) /* Required */ 213 errx(EX_DATAERR, "group name required"); 214 else if (grp != NULL) /* Exists */ 215 errx(EX_DATAERR, "group name `%s' already exists", name); 216 217 grp = &fakegroup; 218 grp->gr_name = pw_checkname(name, 0); 219 grp->gr_passwd = "*"; 220 grp->gr_gid = gr_gidpolicy(cnf, id); 221 grp->gr_mem = NULL; 222 } 223 224 /* 225 * This allows us to set a group password Group passwords is an 226 * antique idea, rarely used and insecure (no secure database) Should 227 * be discouraged, but it is apparently still supported by some 228 * software. 229 */ 230 231 if (conf.which == W_GROUP && conf.fd != -1) 232 set_passwd(grp, mode == M_UPDATE); 233 234 if (((arg = getarg(args, 'M')) != NULL || 235 (arg = getarg(args, 'd')) != NULL || 236 (arg = getarg(args, 'm')) != NULL) && arg->val) { 237 char *p; 238 struct passwd *pwd; 239 240 /* Make sure this is not stay NULL with -M "" */ 241 if (arg->ch == 'd') 242 delete_members(grp, arg->val); 243 else if (arg->ch == 'M') 244 grp->gr_mem = NULL; 245 246 for (p = strtok(arg->val, ", \t"); arg->ch != 'd' && p != NULL; 247 p = strtok(NULL, ", \t")) { 248 int j; 249 250 /* 251 * Check for duplicates 252 */ 253 pwd = lookup_pwent(p); 254 for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++) { 255 if (strcmp(grp->gr_mem[j], pwd->pw_name) == 0) 256 break; 257 } 258 if (grp->gr_mem != NULL && grp->gr_mem[j] != NULL) 259 continue; 260 grp = gr_add(grp, pwd->pw_name); 261 } 262 } 263 264 if (conf.dryrun) 265 return print_group(grp); 266 267 if (mode == M_ADD && (rc = addgrent(grp)) != 0) { 268 if (rc == -1) 269 errx(EX_IOERR, "group '%s' already exists", 270 grp->gr_name); 271 else 272 err(EX_IOERR, "group update"); 273 } else if (mode == M_UPDATE && (rc = chggrent(name, grp)) != 0) { 274 if (rc == -1) 275 errx(EX_IOERR, "group '%s' not available (NIS?)", 276 grp->gr_name); 277 else 278 err(EX_IOERR, "group update"); 279 } 280 281 if (conf.newname != NULL) 282 name = conf.newname; 283 /* grp may have been invalidated */ 284 if ((grp = GETGRNAM(name)) == NULL) 285 errx(EX_SOFTWARE, "group disappeared during update"); 286 287 pw_log(cnf, mode, W_GROUP, "%s(%ju)", grp->gr_name, (uintmax_t)grp->gr_gid); 288 289 return EXIT_SUCCESS; 290 } 291 292 293 /* 294 * Lookup a passwd entry using a name or UID. 295 */ 296 static struct passwd * 297 lookup_pwent(const char *user) 298 { 299 struct passwd *pwd; 300 301 if ((pwd = GETPWNAM(user)) == NULL && 302 (!isdigit((unsigned char)*user) || 303 (pwd = getpwuid((uid_t) atoi(user))) == NULL)) 304 errx(EX_NOUSER, "user `%s' does not exist", user); 305 306 return (pwd); 307 } 308 309 310 /* 311 * Delete requested members from a group. 312 */ 313 static void 314 delete_members(struct group *grp, char *list) 315 { 316 char *p; 317 int k; 318 319 if (grp->gr_mem == NULL) 320 return; 321 322 for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) { 323 for (k = 0; grp->gr_mem[k] != NULL; k++) { 324 if (strcmp(grp->gr_mem[k], p) == 0) 325 break; 326 } 327 if (grp->gr_mem[k] == NULL) /* No match */ 328 continue; 329 330 for (; grp->gr_mem[k] != NULL; k++) 331 grp->gr_mem[k] = grp->gr_mem[k+1]; 332 } 333 } 334 335 336 static gid_t 337 gr_gidpolicy(struct userconf * cnf, long id) 338 { 339 struct group *grp; 340 gid_t gid = (gid_t) - 1; 341 342 /* 343 * Check the given gid, if any 344 */ 345 if (id > 0) { 346 gid = (gid_t) id; 347 348 if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate) 349 errx(EX_DATAERR, "gid `%ju' has already been allocated", (uintmax_t)grp->gr_gid); 350 } else { 351 struct bitmap bm; 352 353 /* 354 * We need to allocate the next available gid under one of 355 * two policies a) Grab the first unused gid b) Grab the 356 * highest possible unused gid 357 */ 358 if (cnf->min_gid >= cnf->max_gid) { /* Sanity claus^H^H^H^Hheck */ 359 cnf->min_gid = 1000; 360 cnf->max_gid = 32000; 361 } 362 bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1); 363 364 /* 365 * Now, let's fill the bitmap from the password file 366 */ 367 SETGRENT(); 368 while ((grp = GETGRENT()) != NULL) 369 if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid && 370 (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid) 371 bm_setbit(&bm, grp->gr_gid - cnf->min_gid); 372 ENDGRENT(); 373 374 /* 375 * Then apply the policy, with fallback to reuse if necessary 376 */ 377 if (cnf->reuse_gids) 378 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 379 else { 380 gid = (gid_t) (bm_lastset(&bm) + 1); 381 if (!bm_isset(&bm, gid)) 382 gid += cnf->min_gid; 383 else 384 gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid); 385 } 386 387 /* 388 * Another sanity check 389 */ 390 if (gid < cnf->min_gid || gid > cnf->max_gid) 391 errx(EX_SOFTWARE, "unable to allocate a new gid - range fully used"); 392 bm_dealloc(&bm); 393 } 394 return gid; 395 } 396 397 398 static int 399 print_group(struct group * grp) 400 { 401 if (!conf.pretty) { 402 char *buf = NULL; 403 404 buf = gr_make(grp); 405 printf("%s\n", buf); 406 free(buf); 407 } else { 408 int i; 409 410 printf("Group Name: %-15s #%lu\n" 411 " Members: ", 412 grp->gr_name, (long) grp->gr_gid); 413 if (grp->gr_mem != NULL) { 414 for (i = 0; grp->gr_mem[i]; i++) 415 printf("%s%s", i ? "," : "", grp->gr_mem[i]); 416 } 417 fputs("\n\n", stdout); 418 } 419 return EXIT_SUCCESS; 420 } 421