|
 |
b8f1b8 |
diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
|
|
|
b8f1b8 |
--- shadow-4.8/libmisc/chkname.c.goodname 2020-01-13 09:44:41.968507996 +0100
|
|
|
b8f1b8 |
+++ shadow-4.8/libmisc/chkname.c 2020-01-13 09:46:27.863727732 +0100
|
|
|
b8f1b8 |
@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
/*
|
|
|
b8f1b8 |
- * User/group names must match [a-z_][a-z0-9_-]*[$]
|
|
|
b8f1b8 |
- */
|
|
|
b8f1b8 |
+ * User/group names must match gnu e-regex:
|
|
|
b8f1b8 |
+ * [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
|
|
|
b8f1b8 |
+ *
|
|
|
b8f1b8 |
+ * as a non-POSIX, extension, allow "$" as the last char for
|
|
|
b8f1b8 |
+ * sake of Samba 3.x "add machine script"
|
|
|
b8f1b8 |
+ *
|
|
|
b8f1b8 |
+ * Also do not allow fully numeric names or just "." or "..".
|
|
|
b8f1b8 |
+ */
|
|
|
b8f1b8 |
+ int numeric;
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
- if (('\0' == *name) ||
|
|
|
b8f1b8 |
- !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
|
|
|
b8f1b8 |
+ if ('\0' == *name ||
|
|
|
b8f1b8 |
+ ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
|
|
|
b8f1b8 |
+ '\0' == name[1])) ||
|
|
|
b8f1b8 |
+ !((*name >= 'a' && *name <= 'z') ||
|
|
|
b8f1b8 |
+ (*name >= 'A' && *name <= 'Z') ||
|
|
|
b8f1b8 |
+ (*name >= '0' && *name <= '9') ||
|
|
|
b8f1b8 |
+ *name == '_' ||
|
|
|
b8f1b8 |
+ *name == '.')) {
|
|
|
b8f1b8 |
return false;
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
+ numeric = isdigit(*name);
|
|
|
b8f1b8 |
+
|
|
|
b8f1b8 |
while ('\0' != *++name) {
|
|
|
b8f1b8 |
- if (!(( ('a' <= *name) && ('z' >= *name) ) ||
|
|
|
b8f1b8 |
- ( ('0' <= *name) && ('9' >= *name) ) ||
|
|
|
b8f1b8 |
- ('_' == *name) ||
|
|
|
b8f1b8 |
- ('-' == *name) ||
|
|
|
b8f1b8 |
- ( ('$' == *name) && ('\0' == *(name + 1)) )
|
|
|
b8f1b8 |
+ if (!((*name >= 'a' && *name <= 'z') ||
|
|
|
b8f1b8 |
+ (*name >= 'A' && *name <= 'Z') ||
|
|
|
b8f1b8 |
+ (*name >= '0' && *name <= '9') ||
|
|
|
b8f1b8 |
+ *name == '_' ||
|
|
|
b8f1b8 |
+ *name == '.' ||
|
|
|
b8f1b8 |
+ *name == '-' ||
|
|
|
b8f1b8 |
+ (*name == '$' && name[1] == '\0')
|
|
|
b8f1b8 |
)) {
|
|
|
b8f1b8 |
return false;
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
+ numeric &= isdigit(*name);
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
- return true;
|
|
|
b8f1b8 |
+ return !numeric;
|
|
|
b8f1b8 |
}
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
bool is_valid_user_name (const char *name)
|
|
|
b8f1b8 |
diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
|
|
|
b8f1b8 |
--- shadow-4.8/man/groupadd.8.xml.goodname 2019-07-23 17:26:08.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/man/groupadd.8.xml 2020-01-13 09:44:41.968507996 +0100
|
|
|
b8f1b8 |
@@ -273,10 +273,12 @@
|
|
|
b8f1b8 |
<refsect1 id='caveats'>
|
|
|
b8f1b8 |
<title>CAVEATS</title>
|
|
|
b8f1b8 |
<para>
|
|
|
b8f1b8 |
- Groupnames must start with a lower case letter or an underscore,
|
|
|
b8f1b8 |
- followed by lower case letters, digits, underscores, or dashes.
|
|
|
b8f1b8 |
- They can end with a dollar sign.
|
|
|
b8f1b8 |
- In regular expression terms: [a-z_][a-z0-9_-]*[$]?
|
|
|
b8f1b8 |
+ Groupnames may contain only lower and upper case letters, digits,
|
|
|
b8f1b8 |
+ underscores, or dashes. They can end with a dollar sign.
|
|
|
b8f1b8 |
+
|
|
|
b8f1b8 |
+ Dashes are not allowed at the beginning of the groupname.
|
|
|
b8f1b8 |
+ Fully numeric groupnames and groupnames . or .. are
|
|
|
b8f1b8 |
+ also disallowed.
|
|
|
b8f1b8 |
</para>
|
|
|
b8f1b8 |
<para>
|
|
|
b8f1b8 |
Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
|
|
|
b8f1b8 |
diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
|
|
|
b8f1b8 |
--- shadow-4.8/man/useradd.8.xml.goodname 2019-10-05 03:23:58.000000000 +0200
|
|
|
b8f1b8 |
+++ shadow-4.8/man/useradd.8.xml 2020-01-13 09:44:41.968507996 +0100
|
|
|
b8f1b8 |
@@ -661,10 +661,14 @@
|
|
|
b8f1b8 |
</para>
|
|
|
b8f1b8 |
|
|
|
b8f1b8 |
<para>
|
|
|
b8f1b8 |
- Usernames must start with a lower case letter or an underscore,
|
|
|
b8f1b8 |
- followed by lower case letters, digits, underscores, or dashes.
|
|
|
b8f1b8 |
- They can end with a dollar sign.
|
|
|
b8f1b8 |
- In regular expression terms: [a-z_][a-z0-9_-]*[$]?
|
|
|
b8f1b8 |
+ Usernames may contain only lower and upper case letters, digits,
|
|
|
b8f1b8 |
+ underscores, or dashes. They can end with a dollar sign.
|
|
|
b8f1b8 |
+
|
|
|
b8f1b8 |
+ Dashes are not allowed at the beginning of the username.
|
|
|
b8f1b8 |
+ Fully numeric usernames and usernames . or .. are
|
|
|
b8f1b8 |
+ also disallowed. It is not recommended to use usernames beginning
|
|
|
b8f1b8 |
+ with . character as their home directories will be hidden in
|
|
|
b8f1b8 |
+ the <command>ls</command> output.
|
|
|
b8f1b8 |
</para>
|
|
|
b8f1b8 |
<para>
|
|
|
b8f1b8 |
Usernames may only be up to 32 characters long.
|