|
|
00319f |
From 140510de9de4771feb3af1d859c09604043a4c9b Mon Sep 17 00:00:00 2001
|
|
|
00319f |
From: ikerexxe <ipedrosa@redhat.com>
|
|
|
00319f |
Date: Fri, 27 Mar 2020 14:23:02 +0100
|
|
|
00319f |
Subject: [PATCH 1/2] usermod: check only local groups with -G option
|
|
|
00319f |
|
|
|
00319f |
Check only local groups when adding new supplementary groups to a user
|
|
|
00319f |
|
|
|
00319f |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1727236
|
|
|
00319f |
---
|
|
|
00319f |
src/usermod.c | 220 ++++++++++++++++++++++++++++++++------------------
|
|
|
00319f |
1 file changed, 143 insertions(+), 77 deletions(-)
|
|
|
00319f |
|
|
|
00319f |
diff --git a/src/usermod.c b/src/usermod.c
|
|
|
00319f |
index 05b98715..ef430296 100644
|
|
|
00319f |
--- a/src/usermod.c
|
|
|
00319f |
+++ b/src/usermod.c
|
|
|
00319f |
@@ -183,6 +183,7 @@ static bool sub_gid_locked = false;
|
|
|
00319f |
static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
|
|
|
00319f |
long int date);
|
|
|
00319f |
static int get_groups (char *);
|
|
|
00319f |
+static struct group * get_local_group (char * grp_name);
|
|
|
00319f |
static /*@noreturn@*/void usage (int status);
|
|
|
00319f |
static void new_pwent (struct passwd *);
|
|
|
00319f |
static void new_spent (struct spwd *);
|
|
|
00319f |
@@ -196,7 +197,9 @@ static void grp_update (void);
|
|
|
00319f |
|
|
|
00319f |
static void process_flags (int, char **);
|
|
|
00319f |
static void close_files (void);
|
|
|
00319f |
+static void close_group_files (void);
|
|
|
00319f |
static void open_files (void);
|
|
|
00319f |
+static void open_group_files (void);
|
|
|
00319f |
static void usr_update (void);
|
|
|
00319f |
static void move_home (void);
|
|
|
00319f |
static void update_lastlog (void);
|
|
|
00319f |
@@ -253,6 +256,11 @@ static int get_groups (char *list)
|
|
|
00319f |
return 0;
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+ /*
|
|
|
00319f |
+ * Open the group files
|
|
|
00319f |
+ */
|
|
|
00319f |
+ open_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* So long as there is some data to be converted, strip off each
|
|
|
00319f |
* name and look it up. A mix of numerical and string values for
|
|
|
00319f |
@@ -272,7 +280,7 @@ static int get_groups (char *list)
|
|
|
00319f |
* Names starting with digits are treated as numerical GID
|
|
|
00319f |
* values, otherwise the string is looked up as is.
|
|
|
00319f |
*/
|
|
|
00319f |
- grp = prefix_getgr_nam_gid (list);
|
|
|
00319f |
+ grp = get_local_group (list);
|
|
|
00319f |
|
|
|
00319f |
/*
|
|
|
00319f |
* There must be a match, either by GID value or by
|
|
|
00319f |
@@ -322,6 +330,8 @@ static int get_groups (char *list)
|
|
|
00319f |
gr_free ((struct group *)grp);
|
|
|
00319f |
} while (NULL != list);
|
|
|
00319f |
|
|
|
00319f |
+ close_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
user_groups[ngroups] = (char *) 0;
|
|
|
00319f |
|
|
|
00319f |
/*
|
|
|
00319f |
@@ -334,6 +344,44 @@ static int get_groups (char *list)
|
|
|
00319f |
return 0;
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * get_local_group - checks if a given group name exists locally
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * get_local_group() checks if a given group name exists locally.
|
|
|
00319f |
+ * If the name exists the group information is returned, otherwise NULL is
|
|
|
00319f |
+ * returned.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static struct group * get_local_group(char * grp_name)
|
|
|
00319f |
+{
|
|
|
00319f |
+ const struct group *grp;
|
|
|
00319f |
+ struct group *result_grp = NULL;
|
|
|
00319f |
+ long long int gid;
|
|
|
00319f |
+ char *endptr;
|
|
|
00319f |
+
|
|
|
00319f |
+ gid = strtoll (grp_name, &endptr, 10);
|
|
|
00319f |
+ if ( ('\0' != *grp_name)
|
|
|
00319f |
+ && ('\0' == *endptr)
|
|
|
00319f |
+ && (ERANGE != errno)
|
|
|
00319f |
+ && (gid == (gid_t)gid)) {
|
|
|
00319f |
+ grp = gr_locate_gid ((gid_t) gid);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ else {
|
|
|
00319f |
+ grp = gr_locate(grp_name);
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+ if (grp != NULL) {
|
|
|
00319f |
+ result_grp = __gr_dup (grp);
|
|
|
00319f |
+ if (NULL == result_grp) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: Out of memory. Cannot find group '%s'.\n"),
|
|
|
00319f |
+ Prog, grp_name);
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+ return result_grp;
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
#ifdef ENABLE_SUBIDS
|
|
|
00319f |
struct ulong_range
|
|
|
00319f |
{
|
|
|
00319f |
@@ -1447,50 +1495,7 @@ static void close_files (void)
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
if (Gflg || lflg) {
|
|
|
00319f |
- if (gr_close () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
- Prog, gr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR,
|
|
|
00319f |
- "failure while writing changes to %s",
|
|
|
00319f |
- gr_dbname ()));
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp) {
|
|
|
00319f |
- if (sgr_close () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR,
|
|
|
00319f |
- "failure while writing changes to %s",
|
|
|
00319f |
- sgr_dbname ()));
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp) {
|
|
|
00319f |
- if (sgr_unlock () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failed to unlock %s\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR,
|
|
|
00319f |
- "failed to unlock %s",
|
|
|
00319f |
- sgr_dbname ()));
|
|
|
00319f |
- /* continue */
|
|
|
00319f |
- }
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
- if (gr_unlock () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failed to unlock %s\n"),
|
|
|
00319f |
- Prog, gr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR,
|
|
|
00319f |
- "failed to unlock %s",
|
|
|
00319f |
- gr_dbname ()));
|
|
|
00319f |
- /* continue */
|
|
|
00319f |
- }
|
|
|
00319f |
+ close_group_files ();
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
if (is_shadow_pwd) {
|
|
|
00319f |
@@ -1559,6 +1564,60 @@ static void close_files (void)
|
|
|
00319f |
#endif
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * close_group_files - close all of the files that were opened
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * close_group_files() closes all of the files that were opened related
|
|
|
00319f |
+ * with groups. This causes any modified entries to be written out.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static void close_group_files (void)
|
|
|
00319f |
+{
|
|
|
00319f |
+ if (gr_close () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
+ Prog, gr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR,
|
|
|
00319f |
+ "failure while writing changes to %s",
|
|
|
00319f |
+ gr_dbname ()));
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp) {
|
|
|
00319f |
+ if (sgr_close () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR,
|
|
|
00319f |
+ "failure while writing changes to %s",
|
|
|
00319f |
+ sgr_dbname ()));
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp) {
|
|
|
00319f |
+ if (sgr_unlock () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failed to unlock %s\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR,
|
|
|
00319f |
+ "failed to unlock %s",
|
|
|
00319f |
+ sgr_dbname ()));
|
|
|
00319f |
+ /* continue */
|
|
|
00319f |
+ }
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif
|
|
|
00319f |
+ if (gr_unlock () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failed to unlock %s\n"),
|
|
|
00319f |
+ Prog, gr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR,
|
|
|
00319f |
+ "failed to unlock %s",
|
|
|
00319f |
+ gr_dbname ()));
|
|
|
00319f |
+ /* continue */
|
|
|
00319f |
+ }
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* open_files - lock and open the password files
|
|
|
00319f |
*
|
|
|
00319f |
@@ -1594,38 +1653,7 @@ static void open_files (void)
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
if (Gflg || lflg) {
|
|
|
00319f |
- /*
|
|
|
00319f |
- * Lock and open the group file. This will load all of the
|
|
|
00319f |
- * group entries.
|
|
|
00319f |
- */
|
|
|
00319f |
- if (gr_lock () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
- Prog, gr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- gr_locked = true;
|
|
|
00319f |
- if (gr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot open %s\n"),
|
|
|
00319f |
- Prog, gr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp && (sgr_lock () == 0)) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- sgr_locked = true;
|
|
|
00319f |
- if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot open %s\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
+ open_group_files ();
|
|
|
00319f |
}
|
|
|
00319f |
#ifdef ENABLE_SUBIDS
|
|
|
00319f |
if (vflg || Vflg) {
|
|
|
00319f |
@@ -1661,6 +1689,44 @@ static void open_files (void)
|
|
|
00319f |
#endif /* ENABLE_SUBIDS */
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * open_group_files - lock and open the group files
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * open_group_files() loads all of the group entries.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static void open_group_files (void)
|
|
|
00319f |
+{
|
|
|
00319f |
+ if (gr_lock () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
+ Prog, gr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ gr_locked = true;
|
|
|
00319f |
+ if (gr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot open %s\n"),
|
|
|
00319f |
+ Prog, gr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp && (sgr_lock () == 0)) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ sgr_locked = true;
|
|
|
00319f |
+ if (is_shadow_grp && (sgr_open (O_CREAT | O_RDWR) == 0)) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot open %s\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* usr_update - create the user entries
|
|
|
00319f |
*
|
|
|
00319f |
--
|
|
|
00319f |
2.25.4
|
|
|
00319f |
|
|
|
00319f |
|
|
|
00319f |
From 8762f465d487a52bf68f9c0b7c3c1eb3caea7bc9 Mon Sep 17 00:00:00 2001
|
|
|
00319f |
From: ikerexxe <ipedrosa@redhat.com>
|
|
|
00319f |
Date: Mon, 30 Mar 2020 09:08:23 +0200
|
|
|
00319f |
Subject: [PATCH 2/2] useradd: check only local groups with -G option
|
|
|
00319f |
|
|
|
00319f |
Check only local groups when adding new supplementary groups to a user
|
|
|
00319f |
|
|
|
00319f |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1727236
|
|
|
00319f |
---
|
|
|
00319f |
src/useradd.c | 234 +++++++++++++++++++++++++++++++++-----------------
|
|
|
00319f |
1 file changed, 157 insertions(+), 77 deletions(-)
|
|
|
00319f |
|
|
|
00319f |
diff --git a/src/useradd.c b/src/useradd.c
|
|
|
00319f |
index 645d4a40..90210233 100644
|
|
|
00319f |
--- a/src/useradd.c
|
|
|
00319f |
+++ b/src/useradd.c
|
|
|
00319f |
@@ -211,6 +211,7 @@ static void get_defaults (void);
|
|
|
00319f |
static void show_defaults (void);
|
|
|
00319f |
static int set_defaults (void);
|
|
|
00319f |
static int get_groups (char *);
|
|
|
00319f |
+static struct group * get_local_group (char * grp_name);
|
|
|
00319f |
static void usage (int status);
|
|
|
00319f |
static void new_pwent (struct passwd *);
|
|
|
00319f |
|
|
|
00319f |
@@ -220,7 +221,10 @@ static void grp_update (void);
|
|
|
00319f |
|
|
|
00319f |
static void process_flags (int argc, char **argv);
|
|
|
00319f |
static void close_files (void);
|
|
|
00319f |
+static void close_group_files (void);
|
|
|
00319f |
+static void unlock_group_files (void);
|
|
|
00319f |
static void open_files (void);
|
|
|
00319f |
+static void open_group_files (void);
|
|
|
00319f |
static void open_shadow (void);
|
|
|
00319f |
static void faillog_reset (uid_t);
|
|
|
00319f |
static void lastlog_reset (uid_t);
|
|
|
00319f |
@@ -731,6 +735,11 @@ static int get_groups (char *list)
|
|
|
00319f |
return 0;
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+ /*
|
|
|
00319f |
+ * Open the group files
|
|
|
00319f |
+ */
|
|
|
00319f |
+ open_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* So long as there is some data to be converted, strip off
|
|
|
00319f |
* each name and look it up. A mix of numerical and string
|
|
|
00319f |
@@ -749,7 +758,7 @@ static int get_groups (char *list)
|
|
|
00319f |
* Names starting with digits are treated as numerical
|
|
|
00319f |
* GID values, otherwise the string is looked up as is.
|
|
|
00319f |
*/
|
|
|
00319f |
- grp = prefix_getgr_nam_gid (list);
|
|
|
00319f |
+ grp = get_local_group (list);
|
|
|
00319f |
|
|
|
00319f |
/*
|
|
|
00319f |
* There must be a match, either by GID value or by
|
|
|
00319f |
@@ -799,6 +808,9 @@ static int get_groups (char *list)
|
|
|
00319f |
user_groups[ngroups++] = xstrdup (grp->gr_name);
|
|
|
00319f |
} while (NULL != list);
|
|
|
00319f |
|
|
|
00319f |
+ close_group_files ();
|
|
|
00319f |
+ unlock_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
user_groups[ngroups] = (char *) 0;
|
|
|
00319f |
|
|
|
00319f |
/*
|
|
|
00319f |
@@ -811,6 +823,44 @@ static int get_groups (char *list)
|
|
|
00319f |
return 0;
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * get_local_group - checks if a given group name exists locally
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * get_local_group() checks if a given group name exists locally.
|
|
|
00319f |
+ * If the name exists the group information is returned, otherwise NULL is
|
|
|
00319f |
+ * returned.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static struct group * get_local_group(char * grp_name)
|
|
|
00319f |
+{
|
|
|
00319f |
+ const struct group *grp;
|
|
|
00319f |
+ struct group *result_grp = NULL;
|
|
|
00319f |
+ long long int gid;
|
|
|
00319f |
+ char *endptr;
|
|
|
00319f |
+
|
|
|
00319f |
+ gid = strtoll (grp_name, &endptr, 10);
|
|
|
00319f |
+ if ( ('\0' != *grp_name)
|
|
|
00319f |
+ && ('\0' == *endptr)
|
|
|
00319f |
+ && (ERANGE != errno)
|
|
|
00319f |
+ && (gid == (gid_t)gid)) {
|
|
|
00319f |
+ grp = gr_locate_gid ((gid_t) gid);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ else {
|
|
|
00319f |
+ grp = gr_locate(grp_name);
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+ if (grp != NULL) {
|
|
|
00319f |
+ result_grp = __gr_dup (grp);
|
|
|
00319f |
+ if (NULL == result_grp) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: Out of memory. Cannot find group '%s'.\n"),
|
|
|
00319f |
+ Prog, grp_name);
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+ return result_grp;
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* usage - display usage message and exit
|
|
|
00319f |
*/
|
|
|
00319f |
@@ -1530,23 +1580,9 @@ static void close_files (void)
|
|
|
00319f |
SYSLOG ((LOG_ERR, "failure while writing changes to %s", spw_dbname ()));
|
|
|
00319f |
fail_exit (E_PW_UPDATE);
|
|
|
00319f |
}
|
|
|
00319f |
- if (do_grp_update) {
|
|
|
00319f |
- if (gr_close () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp && (sgr_close () == 0)) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
- }
|
|
|
00319f |
+
|
|
|
00319f |
+ close_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
#ifdef ENABLE_SUBIDS
|
|
|
00319f |
if (is_sub_uid && (sub_uid_close () == 0)) {
|
|
|
00319f |
fprintf (stderr,
|
|
|
00319f |
@@ -1587,34 +1623,9 @@ static void close_files (void)
|
|
|
00319f |
/* continue */
|
|
|
00319f |
}
|
|
|
00319f |
pw_locked = false;
|
|
|
00319f |
- if (gr_unlock () == 0) {
|
|
|
00319f |
- fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
|
|
00319f |
-#ifdef WITH_AUDIT
|
|
|
00319f |
- audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
00319f |
- "unlocking-group-file",
|
|
|
00319f |
- user_name, AUDIT_NO_ID,
|
|
|
00319f |
- SHADOW_AUDIT_FAILURE);
|
|
|
00319f |
-#endif
|
|
|
00319f |
- /* continue */
|
|
|
00319f |
- }
|
|
|
00319f |
- gr_locked = false;
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp) {
|
|
|
00319f |
- if (sgr_unlock () == 0) {
|
|
|
00319f |
- fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
|
|
00319f |
- SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
|
|
00319f |
-#ifdef WITH_AUDIT
|
|
|
00319f |
- audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
00319f |
- "unlocking-gshadow-file",
|
|
|
00319f |
- user_name, AUDIT_NO_ID,
|
|
|
00319f |
- SHADOW_AUDIT_FAILURE);
|
|
|
00319f |
-#endif
|
|
|
00319f |
- /* continue */
|
|
|
00319f |
- }
|
|
|
00319f |
- sgr_locked = false;
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
+
|
|
|
00319f |
+ unlock_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
#ifdef ENABLE_SUBIDS
|
|
|
00319f |
if (is_sub_uid) {
|
|
|
00319f |
if (sub_uid_unlock () == 0) {
|
|
|
00319f |
@@ -1647,6 +1658,71 @@ static void close_files (void)
|
|
|
00319f |
#endif /* ENABLE_SUBIDS */
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * close_group_files - close all of the files that were opened
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * close_group_files() closes all of the files that were opened related
|
|
|
00319f |
+ * with groups. This causes any modified entries to be written out.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static void close_group_files (void)
|
|
|
00319f |
+{
|
|
|
00319f |
+ if (do_grp_update) {
|
|
|
00319f |
+ if (gr_close () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failure while writing changes to %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR, "failure while writing changes to %s", gr_dbname ()));
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp && (sgr_close () == 0)) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: failure while writing changes to %s\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR, "failure while writing changes to %s", sgr_dbname ()));
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif /* SHADOWGRP */
|
|
|
00319f |
+ }
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
+/*
|
|
|
00319f |
+ * unlock_group_files - unlock all of the files that were locked
|
|
|
00319f |
+ *
|
|
|
00319f |
+ * unlock_group_files() unlocks all of the files that were locked related
|
|
|
00319f |
+ * with groups. This causes any modified entries to be written out.
|
|
|
00319f |
+ */
|
|
|
00319f |
+static void unlock_group_files (void)
|
|
|
00319f |
+{
|
|
|
00319f |
+ if (gr_unlock () == 0) {
|
|
|
00319f |
+ fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
|
|
00319f |
+#ifdef WITH_AUDIT
|
|
|
00319f |
+ audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
00319f |
+ "unlocking-group-file",
|
|
|
00319f |
+ user_name, AUDIT_NO_ID,
|
|
|
00319f |
+ SHADOW_AUDIT_FAILURE);
|
|
|
00319f |
+#endif /* WITH_AUDIT */
|
|
|
00319f |
+ /* continue */
|
|
|
00319f |
+ }
|
|
|
00319f |
+ gr_locked = false;
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp) {
|
|
|
00319f |
+ if (sgr_unlock () == 0) {
|
|
|
00319f |
+ fprintf (stderr, _("%s: failed to unlock %s\n"), Prog, sgr_dbname ());
|
|
|
00319f |
+ SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
|
|
00319f |
+#ifdef WITH_AUDIT
|
|
|
00319f |
+ audit_logger (AUDIT_ADD_USER, Prog,
|
|
|
00319f |
+ "unlocking-gshadow-file",
|
|
|
00319f |
+ user_name, AUDIT_NO_ID,
|
|
|
00319f |
+ SHADOW_AUDIT_FAILURE);
|
|
|
00319f |
+#endif /* WITH_AUDIT */
|
|
|
00319f |
+ /* continue */
|
|
|
00319f |
+ }
|
|
|
00319f |
+ sgr_locked = false;
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif /* SHADOWGRP */
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
/*
|
|
|
00319f |
* open_files - lock and open the password files
|
|
|
00319f |
*
|
|
|
00319f |
@@ -1668,37 +1744,8 @@ static void open_files (void)
|
|
|
00319f |
|
|
|
00319f |
/* shadow file will be opened by open_shadow(); */
|
|
|
00319f |
|
|
|
00319f |
- /*
|
|
|
00319f |
- * Lock and open the group file.
|
|
|
00319f |
- */
|
|
|
00319f |
- if (gr_lock () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
- Prog, gr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- gr_locked = true;
|
|
|
00319f |
- if (gr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
- fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
-#ifdef SHADOWGRP
|
|
|
00319f |
- if (is_shadow_grp) {
|
|
|
00319f |
- if (sgr_lock () == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- sgr_locked = true;
|
|
|
00319f |
- if (sgr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
- fprintf (stderr,
|
|
|
00319f |
- _("%s: cannot open %s\n"),
|
|
|
00319f |
- Prog, sgr_dbname ());
|
|
|
00319f |
- fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
- }
|
|
|
00319f |
- }
|
|
|
00319f |
-#endif
|
|
|
00319f |
+ open_group_files ();
|
|
|
00319f |
+
|
|
|
00319f |
#ifdef ENABLE_SUBIDS
|
|
|
00319f |
if (is_sub_uid) {
|
|
|
00319f |
if (sub_uid_lock () == 0) {
|
|
|
00319f |
@@ -1733,6 +1780,39 @@ static void open_files (void)
|
|
|
00319f |
#endif /* ENABLE_SUBIDS */
|
|
|
00319f |
}
|
|
|
00319f |
|
|
|
00319f |
+static void open_group_files (void)
|
|
|
00319f |
+{
|
|
|
00319f |
+ if (gr_lock () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
+ Prog, gr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ gr_locked = true;
|
|
|
00319f |
+ if (gr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
+ fprintf (stderr, _("%s: cannot open %s\n"), Prog, gr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+
|
|
|
00319f |
+#ifdef SHADOWGRP
|
|
|
00319f |
+ if (is_shadow_grp) {
|
|
|
00319f |
+ if (sgr_lock () == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot lock %s; try again later.\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ sgr_locked = true;
|
|
|
00319f |
+ if (sgr_open (O_CREAT | O_RDWR) == 0) {
|
|
|
00319f |
+ fprintf (stderr,
|
|
|
00319f |
+ _("%s: cannot open %s\n"),
|
|
|
00319f |
+ Prog, sgr_dbname ());
|
|
|
00319f |
+ fail_exit (E_GRP_UPDATE);
|
|
|
00319f |
+ }
|
|
|
00319f |
+ }
|
|
|
00319f |
+#endif /* SHADOWGRP */
|
|
|
00319f |
+}
|
|
|
00319f |
+
|
|
|
00319f |
static void open_shadow (void)
|
|
|
00319f |
{
|
|
|
00319f |
if (!is_shadow_pwd) {
|
|
|
00319f |
--
|
|
|
00319f |
2.25.4
|
|
|
00319f |
|