]> git.cameronkatri.com Git - pw-darwin.git/blobdiff - pw/pw_user.c
Revert the libcrypt/libmd stuff back to how it was. This should not have
[pw-darwin.git] / pw / pw_user.c
index 87ec76c7716c1b90e90b681300d08797ddd7cfc1..cf9a267bea35e11edf7f4228edb8d31023a71b76 100644 (file)
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ * 
  */
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: pw_user.c,v 1.24 1999/01/02 04:37:46 billf Exp $";
+  "$FreeBSD$";
 #endif /* not lint */
 
 #include <ctype.h>
@@ -46,7 +47,6 @@ static const char rcsid[] =
 #endif
 #include "pw.h"
 #include "bitmap.h"
-#include "pwupd.h"
 
 #if (MAXLOGNAME-1) > UT_NAMESIZE
 #define LOGNAMESIZE UT_NAMESIZE
@@ -54,9 +54,10 @@ static const char rcsid[] =
 #define LOGNAMESIZE (MAXLOGNAME-1)
 #endif
 
-static          randinit;
+static          int randinit;
+static         char locked_str[] = "*LOCKED*";
 
-static int      print_user(struct passwd * pwd, int pretty);
+static int      print_user(struct passwd * pwd, int pretty, int v7);
 static uid_t    pw_uidpolicy(struct userconf * cnf, struct cargs * args);
 static uid_t    pw_gidpolicy(struct userconf * cnf, struct cargs * args, char *nam, gid_t prefer);
 static time_t   pw_pwdpolicy(struct userconf * cnf, struct cargs * args);
@@ -102,8 +103,9 @@ static void rmskey(char const * name);
 int
 pw_user(struct userconf * cnf, int mode, struct cargs * args)
 {
-       int             r, r1;
+       int             rc, edited = 0;
        char           *p = NULL;
+       char                                     *passtmp;
        struct carg    *a_name;
        struct carg    *a_uid;
        struct carg    *arg;
@@ -123,9 +125,11 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                "User &",
                "/bin/sh",
                0,
+               0,
                0
        };
 
+
        /*
         * With M_NEXT, we only need to return the
         * next uid to stdout
@@ -203,7 +207,6 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        errx(EX_OSFILE, "root home `%s' is not a directory", cnf->home);
        }
 
-
        if ((arg = getarg(args, 'e')) != NULL)
                cnf->expire_days = atoi(arg->val);
 
@@ -215,8 +218,8 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
 
        if ((arg = getarg(args, 'g')) != NULL) {
                p = arg->val;
-               if ((grp = getgrnam(p)) == NULL) {
-                       if (!isdigit(*p) || (grp = getgrgid((gid_t) atoi(p))) == NULL)
+               if ((grp = GETGRNAM(p)) == NULL) {
+                       if (!isdigit(*p) || (grp = GETGRGID((gid_t) atoi(p))) == NULL)
                                errx(EX_NOUSER, "group `%s' does not exist", p);
                }
                cnf->default_group = newstr(grp->gr_name);
@@ -225,11 +228,11 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                cnf->default_class = pw_checkname((u_char *)arg->val, 0);
 
        if ((arg = getarg(args, 'G')) != NULL && arg->val) {
-               int             i = 0;
+               int i = 0;
 
                for (p = strtok(arg->val, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
-                       if ((grp = getgrnam(p)) == NULL) {
-                               if (!isdigit(*p) || (grp = getgrgid((gid_t) atoi(p))) == NULL)
+                       if ((grp = GETGRNAM(p)) == NULL) {
+                               if (!isdigit(*p) || (grp = GETGRGID((gid_t) atoi(p))) == NULL)
                                        errx(EX_NOUSER, "group `%s' does not exist", p);
                        }
                        if (extendarray(&cnf->groups, &cnf->numgroups, i + 2) != -1)
@@ -238,10 +241,12 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                while (i < cnf->numgroups)
                        cnf->groups[i++] = NULL;
        }
+
        if ((arg = getarg(args, 'k')) != NULL) {
                if (stat(cnf->dotdir = arg->val, &st) == -1 || !S_ISDIR(st.st_mode))
                        errx(EX_OSFILE, "skeleton `%s' is not a directory or does not exist", cnf->dotdir);
        }
+
        if ((arg = getarg(args, 's')) != NULL)
                cnf->shell_default = arg->val;
 
@@ -269,17 +274,20 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                warn("config update");
                return EX_IOERR;
        }
+
        if (mode == M_PRINT && getarg(args, 'a')) {
                int             pretty = getarg(args, 'P') != NULL;
+               int             v7 = getarg(args, '7') != NULL;
 
-               setpwent();
-               while ((pwd = getpwent()) != NULL)
-                       print_user(pwd, pretty);
-               endpwent();
+               SETPWENT();
+               while ((pwd = GETPWENT()) != NULL)
+                       print_user(pwd, pretty, v7);
+               ENDPWENT();
                return EXIT_SUCCESS;
        }
+
        if ((a_name = getarg(args, 'n')) != NULL)
-               pwd = getpwnam(pw_checkname((u_char *)a_name->val, 0));
+               pwd = GETPWNAM(pw_checkname((u_char *)a_name->val, 0));
        a_uid = getarg(args, 'u');
 
        if (a_uid == NULL) {
@@ -291,35 +299,68 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                 * really don't really care which we have, but we need to
                 * know.
                 */
-               if (mode != M_ADD && pwd == NULL && isdigit(*a_name->val) && atoi(a_name->val) > 0) {   /* Assume uid */
+               if (mode != M_ADD && pwd == NULL
+                   && strspn(a_name->val, "0123456789") == strlen(a_name->val)
+                   && atoi(a_name->val) > 0) { /* Assume uid */
                        (a_uid = a_name)->ch = 'u';
                        a_name = NULL;
                }
        }
+
        /*
         * Update, delete & print require that the user exists
         */
-       if (mode == M_UPDATE || mode == M_DELETE || mode == M_PRINT) {
+       if (mode == M_UPDATE || mode == M_DELETE ||
+           mode == M_PRINT  || mode == M_LOCK   || mode == M_UNLOCK) {
+
                if (a_name == NULL && pwd == NULL)      /* Try harder */
-                       pwd = getpwuid(atoi(a_uid->val));
+                       pwd = GETPWUID(atoi(a_uid->val));
 
                if (pwd == NULL) {
                        if (mode == M_PRINT && getarg(args, 'F')) {
                                fakeuser.pw_name = a_name ? a_name->val : "nouser";
                                fakeuser.pw_uid = a_uid ? (uid_t) atol(a_uid->val) : -1;
-                               return print_user(&fakeuser, getarg(args, 'P') != NULL);
+                               return print_user(&fakeuser,
+                                                 getarg(args, 'P') != NULL,
+                                                 getarg(args, '7') != NULL);
                        }
                        if (a_name == NULL)
                                errx(EX_NOUSER, "no such uid `%s'", a_uid->val);
                        errx(EX_NOUSER, "no such user `%s'", a_name->val);
                }
+
                if (a_name == NULL)     /* May be needed later */
                        a_name = addarg(args, 'n', newstr(pwd->pw_name));
 
                /*
-                * Handle deletions now
+                * The M_LOCK and M_UNLOCK functions simply add or remove
+                * a "*LOCKED*" prefix from in front of the password to
+                * prevent it decoding correctly, and therefore prevents
+                * access. Of course, this only prevents access via
+                * password authentication (not ssh, kerberos or any
+                * other method that does not use the UNIX password) but
+                * that is a known limitation.
                 */
-               if (mode == M_DELETE) {
+
+               if (mode == M_LOCK) {
+                       if (strncmp(pwd->pw_passwd, locked_str, sizeof(locked_str)-1) == 0)
+                               errx(EX_DATAERR, "user '%s' is already locked", pwd->pw_name);
+                       passtmp = malloc(strlen(pwd->pw_passwd) + sizeof(locked_str));
+                       if (passtmp == NULL)    /* disaster */
+                               errx(EX_UNAVAILABLE, "out of memory");
+                       strcpy(passtmp, locked_str);
+                       strcat(passtmp, pwd->pw_passwd);
+                       pwd->pw_passwd = passtmp;
+                       edited = 1;
+               } else if (mode == M_UNLOCK) {
+                       if (strncmp(pwd->pw_passwd, locked_str, sizeof(locked_str)-1) != 0)
+                               errx(EX_DATAERR, "user '%s' is not locked", pwd->pw_name);
+                       pwd->pw_passwd += sizeof(locked_str)-1;
+                       edited = 1;
+               } else if (mode == M_DELETE) {
+                       /*
+                        * Handle deletions now
+                        */
                        char            file[MAXPATHLEN];
                        char            home[MAXPATHLEN];
                        uid_t           uid = pwd->pw_uid;
@@ -327,19 +368,21 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        if (strcmp(pwd->pw_name, "root") == 0)
                                errx(EX_DATAERR, "cannot remove user 'root'");
 
-                       /*
-                        * Remove skey record from /etc/skeykeys
-                        */
+                       if (!PWALTDIR()) {
+                               /*
+                                * Remove skey record from /etc/skeykeys
+                                */
 
-                       rmskey(pwd->pw_name);
+                               rmskey(pwd->pw_name);
 
-                       /*
-                        * Remove crontabs
-                        */
-                       sprintf(file, "/var/cron/tabs/%s", pwd->pw_name);
-                       if (access(file, F_OK) == 0) {
-                               sprintf(file, "crontab -u %s -r", pwd->pw_name);
-                               system(file);
+                               /*
+                                * Remove crontabs
+                                */
+                               sprintf(file, "/var/cron/tabs/%s", pwd->pw_name);
+                               if (access(file, F_OK) == 0) {
+                                       sprintf(file, "crontab -u %s -r", pwd->pw_name);
+                                       system(file);
+                               }
                        }
                        /*
                         * Save these for later, since contents of pwd may be
@@ -349,41 +392,56 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        strncpy(home, pwd->pw_dir, sizeof home);
                        home[sizeof home - 1] = '\0';
 
-                       if (!delpwent(pwd))
-                               err(EX_IOERR, "error updating passwd file");
+                       rc = delpwent(pwd);
+                       if (rc == -1)
+                               err(EX_IOERR, "user '%s' does not exist", pwd->pw_name);
+                       else if (rc != 0) {
+                               warnc(rc, "passwd update");
+                               return EX_IOERR;
+                       }
+
+                       if (cnf->nispasswd && *cnf->nispasswd=='/') {
+                               rc = delnispwent(cnf->nispasswd, a_name->val);
+                               if (rc == -1)
+                                       warnx("WARNING: user '%s' does not exist in NIS passwd", pwd->pw_name);
+                               else if (rc != 0)
+                                       warnc(rc, "WARNING: NIS passwd update");
+                               /* non-fatal */
+                       }
 
-                       if (cnf->nispasswd && *cnf->nispasswd=='/' && !delnispwent(cnf->nispasswd, a_name->val))
-                               warn("WARNING: NIS passwd update");
-                               
                        editgroups(a_name->val, NULL);
 
                        pw_log(cnf, mode, W_USER, "%s(%ld) account removed", a_name->val, (long) uid);
 
-                       /*
-                        * Remove mail file
-                        */
-                       remove(file);
-
-                       /*
-                        * Remove at jobs
-                        */
-                       if (getpwuid(uid) == NULL)
-                               rmat(uid);
-
-                       /*
-                        * Remove home directory and contents
-                        */
-                       if (getarg(args, 'r') != NULL && *home == '/' && getpwuid(uid) == NULL) {
-                               if (stat(home, &st) != -1) {
-                                       rm_r(home, uid);
-                                       pw_log(cnf, mode, W_USER, "%s(%ld) home '%s' %sremoved",
-                                              a_name->val, (long) uid, home,
-                                              stat(home, &st) == -1 ? "" : "not completely ");
+                       if (!PWALTDIR()) {
+                               /*
+                                * Remove mail file
+                                */
+                               remove(file);
+
+                               /*
+                                * Remove at jobs
+                                */
+                               if (getpwuid(uid) == NULL)
+                                       rmat(uid);
+
+                               /*
+                                * Remove home directory and contents
+                                */
+                               if (getarg(args, 'r') != NULL && *home == '/' && getpwuid(uid) == NULL) {
+                                       if (stat(home, &st) != -1) {
+                                               rm_r(home, uid);
+                                               pw_log(cnf, mode, W_USER, "%s(%ld) home '%s' %sremoved",
+                                                      a_name->val, (long) uid, home,
+                                                      stat(home, &st) == -1 ? "" : "not completely ");
+                                       }
                                }
                        }
                        return EXIT_SUCCESS;
                } else if (mode == M_PRINT)
-                       return print_user(pwd, getarg(args, 'P') != NULL);
+                       return print_user(pwd,
+                                         getarg(args, 'P') != NULL,
+                                         getarg(args, '7') != NULL);
 
                /*
                 * The rest is edit code
@@ -392,46 +450,84 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        if (strcmp(pwd->pw_name, "root") == 0)
                                errx(EX_DATAERR, "can't rename `root' account");
                        pwd->pw_name = pw_checkname((u_char *)arg->val, 0);
+                       edited = 1;
                }
+
                if ((arg = getarg(args, 'u')) != NULL && isdigit(*arg->val)) {
                        pwd->pw_uid = (uid_t) atol(arg->val);
+                       edited = 1;
                        if (pwd->pw_uid != 0 && strcmp(pwd->pw_name, "root") == 0)
                                errx(EX_DATAERR, "can't change uid of `root' account");
                        if (pwd->pw_uid == 0 && strcmp(pwd->pw_name, "root") != 0)
                                warnx("WARNING: account `%s' will have a uid of 0 (superuser access!)", pwd->pw_name);
                }
-               if ((arg = getarg(args, 'g')) != NULL && pwd->pw_uid != 0)      /* Already checked this */
-                       pwd->pw_gid = (gid_t) getgrnam(cnf->default_group)->gr_gid;
+
+               if ((arg = getarg(args, 'g')) != NULL && pwd->pw_uid != 0) {    /* Already checked this */
+                       gid_t newgid = (gid_t) GETGRNAM(cnf->default_group)->gr_gid;
+                       if (newgid != pwd->pw_gid) {
+                               edited = 1;
+                               pwd->pw_gid = pwd->pw_gid;
+                       }
+               }
 
                if ((arg = getarg(args, 'p')) != NULL) {
-                       if (*arg->val == '\0' || strcmp(arg->val, "0") == 0)
-                               pwd->pw_change = 0;
+                       if (*arg->val == '\0' || strcmp(arg->val, "0") == 0) {
+                               if (pwd->pw_change != 0) {
+                                       pwd->pw_change = 0;
+                                       edited = 1;
+                               }
+                       }
                        else {
                                time_t          now = time(NULL);
                                time_t          expire = parse_date(now, arg->val);
 
                                if (now == expire)
                                        errx(EX_DATAERR, "invalid password change date `%s'", arg->val);
-                               pwd->pw_change = expire;
+                               if (pwd->pw_change != expire) {
+                                       pwd->pw_change = expire;
+                                       edited = 1;
+                               }
                        }
                }
+
                if ((arg = getarg(args, 'e')) != NULL) {
-                       if (*arg->val == '\0' || strcmp(arg->val, "0") == 0)
-                               pwd->pw_expire = 0;
+                       if (*arg->val == '\0' || strcmp(arg->val, "0") == 0) {
+                               if (pwd->pw_expire != 0) {
+                                       pwd->pw_expire = 0;
+                                       edited = 1;
+                               }
+                       }
                        else {
                                time_t          now = time(NULL);
                                time_t          expire = parse_date(now, arg->val);
 
                                if (now == expire)
                                        errx(EX_DATAERR, "invalid account expiry date `%s'", arg->val);
-                               pwd->pw_expire = expire;
+                               if (pwd->pw_expire != expire) {
+                                       pwd->pw_expire = expire;
+                                       edited = 1;
+                               }
                        }
                }
-               if ((arg = getarg(args, 's')) != NULL)
-                       pwd->pw_shell = shell_path(cnf->shelldir, cnf->shells, arg->val);
 
-               if (getarg(args, 'L'))
-                       pwd->pw_class = cnf->default_class;
+               if ((arg = getarg(args, 's')) != NULL) {
+                       char *shell = shell_path(cnf->shelldir, cnf->shells, arg->val);
+                       if (shell == NULL)
+                               shell = "";
+                       if (strcmp(shell, pwd->pw_shell) != 0) {
+                               pwd->pw_shell = shell;
+                               edited = 1;
+                       }
+               }
+
+               if (getarg(args, 'L')) {
+                       if (cnf->default_class == NULL)
+                               cnf->default_class = "";
+                       if (strcmp(pwd->pw_class, cnf->default_class) != 0) {
+                               pwd->pw_class = cnf->default_class;
+                               edited = 1;
+                       }
+               }
 
                if ((arg  = getarg(args, 'd')) != NULL) {
                        if (stat(pwd->pw_dir = arg->val, &st) == -1) {
@@ -441,13 +537,20 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                                warnx("WARNING: home `%s' is not a directory", pwd->pw_dir);
                }
 
-               if ((arg = getarg(args, 'w')) != NULL && getarg(args, 'h') == NULL)
+               if ((arg = getarg(args, 'w')) != NULL && getarg(args, 'h') == NULL) {
                        pwd->pw_passwd = pw_password(cnf, args, pwd->pw_name);
+                       edited = 1;
+               }
 
        } else {
+
+               /*
+                * Add code
+                */
+
                if (a_name == NULL)     /* Required */
                        errx(EX_DATAERR, "login name required");
-               else if ((pwd = getpwnam(a_name->val)) != NULL) /* Exists */
+               else if ((pwd = GETPWNAM(a_name->val)) != NULL) /* Exists */
                        errx(EX_DATAERR, "login name `%s' already exists", a_name->val);
 
                /*
@@ -463,6 +566,7 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                pwd->pw_expire = pw_exppolicy(cnf, args);
                pwd->pw_dir = pw_homepolicy(cnf, args, pwd->pw_name);
                pwd->pw_shell = pw_shellpolicy(cnf, args, NULL);
+               edited = 1;
 
                if (pwd->pw_uid == 0 && strcmp(pwd->pw_name, "root") != 0)
                        warnx("WARNING: new account `%s' has a uid of 0 (superuser access!)", pwd->pw_name);
@@ -471,8 +575,13 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
        /*
         * Shared add/edit code
         */
-       if ((arg = getarg(args, 'c')) != NULL)
-               pwd->pw_gecos = pw_checkname((u_char *)arg->val, 1);
+       if ((arg = getarg(args, 'c')) != NULL) {
+               char    *gecos = pw_checkname((u_char *)arg->val, 1);
+               if (strcmp(pwd->pw_gecos, gecos) != 0) {
+                       pwd->pw_gecos = gecos;
+                       edited = 1;
+               }
+       }
 
        if ((arg = getarg(args, 'h')) != NULL) {
                if (strcmp(arg->val, "-") == 0)
@@ -512,6 +621,7 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        if (!*line)
                                errx(EX_DATAERR, "empty password read on file descriptor %d", fd);
                        pwd->pw_passwd = pw_pwcrypt(line);
+                       edited = 1;
                }
        }
 
@@ -519,25 +629,47 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
         * Special case: -N only displays & exits
         */
        if (getarg(args, 'N') != NULL)
-               return print_user(pwd, getarg(args, 'P') != NULL);
+               return print_user(pwd,
+                                 getarg(args, 'P') != NULL,
+                                 getarg(args, '7') != NULL);
 
-       r = r1 = 1;
        if (mode == M_ADD) {
-               r = addpwent(pwd);
-               if (r && cnf->nispasswd && *cnf->nispasswd=='/')
-                       r1 = addnispwent(cnf->nispasswd, pwd);
-       } else if (mode == M_UPDATE) {
-               r = chgpwent(a_name->val, pwd);
-               if (r && cnf->nispasswd && *cnf->nispasswd=='/')
-                       r1 = chgnispwent(cnf->nispasswd, a_name->val, pwd);
-       }
-
-       if (!r) {
-               warn("password update");
-               return EX_IOERR;
-       } else if (!r1) {
-               warn("WARNING: NIS password update");
-               /* Keep on trucking */
+               edited = 1;     /* Always */
+               rc = addpwent(pwd);
+               if (rc == -1) {
+                       warnx("user '%s' already exists", pwd->pw_name);
+                       return EX_IOERR;
+               } else if (rc != 0) {
+                       warnc(rc, "passwd file update");
+                       return EX_IOERR;
+               }
+               if (cnf->nispasswd && *cnf->nispasswd=='/') {
+                       rc = addnispwent(cnf->nispasswd, pwd);
+                       if (rc == -1)
+                               warnx("User '%s' already exists in NIS passwd", pwd->pw_name);
+                       else
+                               warnc(rc, "NIS passwd update");
+                       /* NOTE: we treat NIS-only update errors as non-fatal */
+               }
+       } else if (mode == M_UPDATE || mode == M_LOCK || mode == M_UNLOCK) {
+               if (edited) {   /* Only updated this if required */
+                       rc = chgpwent(a_name->val, pwd);
+                       if (rc == -1) {
+                               warnx("user '%s' does not exist (NIS?)", pwd->pw_name);
+                               return EX_IOERR;
+                       } else if (rc != 0) {
+                               warnc(rc, "passwd file update");
+                               return EX_IOERR;
+                       }
+                       if ( cnf->nispasswd && *cnf->nispasswd=='/') {
+                               rc = chgnispwent(cnf->nispasswd, a_name->val, pwd);
+                               if (rc == -1)
+                                       warn("User '%s' not found in NIS passwd", pwd->pw_name);
+                               else
+                                       warnc(rc, "NIS passwd update");
+                               /* NOTE: NIS-only update errors are not fatal */
+                       }
+               }
        }
 
        /*
@@ -548,10 +680,10 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                editgroups(pwd->pw_name, cnf->groups);
 
        /* pwd may have been invalidated */
-       if ((pwd = getpwnam(a_name->val)) == NULL)
+       if ((pwd = GETPWNAM(a_name->val)) == NULL)
                errx(EX_NOUSER, "user '%s' disappeared during update", a_name->val);
 
-       grp = getgrgid(pwd->pw_gid);
+       grp = GETGRGID(pwd->pw_gid);
        pw_log(cnf, mode, W_USER, "%s(%ld):%s(%d):%s:%s:%s",
               pwd->pw_name, (long) pwd->pw_uid,
            grp ? grp->gr_name : "unknown", (long) (grp ? grp->gr_gid : -1),
@@ -565,42 +697,46 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
        if (mode == M_ADD) {
                FILE           *fp;
 
-               sprintf(line, "%s/%s", _PATH_MAILDIR, pwd->pw_name);
-               close(open(line, O_RDWR | O_CREAT, 0600));      /* Preserve contents &
-                                                                * mtime */
-               chown(line, pwd->pw_uid, pwd->pw_gid);
+               if (!PWALTDIR()) {
+                       sprintf(line, "%s/%s", _PATH_MAILDIR, pwd->pw_name);
+                       close(open(line, O_RDWR | O_CREAT, 0600));      /* Preserve contents &
+                                                                        * mtime */
+                       chown(line, pwd->pw_uid, pwd->pw_gid);
 
-               /*
-                * Send mail to the new user as well, if we are asked to
-                */
-               if (cnf->newmail && *cnf->newmail && (fp = fopen(cnf->newmail, "r")) != NULL) {
-                       FILE           *pfp = popen(_PATH_SENDMAIL " -t", "w");
+                       /*
+                        * Send mail to the new user as well, if we are asked to
+                        */
+                       if (cnf->newmail && *cnf->newmail && (fp = fopen(cnf->newmail, "r")) != NULL) {
+                               FILE           *pfp = popen(_PATH_SENDMAIL " -t", "w");
 
-                       if (pfp == NULL)
-                               warn("sendmail");
-                       else {
-                               fprintf(pfp, "From: root\n" "To: %s\n" "Subject: Welcome!\n\n", pwd->pw_name);
-                               while (fgets(line, sizeof(line), fp) != NULL) {
-                                       /* Do substitutions? */
-                                       fputs(line, pfp);
+                               if (pfp == NULL)
+                                       warn("sendmail");
+                               else {
+                                       fprintf(pfp, "From: root\n" "To: %s\n" "Subject: Welcome!\n\n", pwd->pw_name);
+                                       while (fgets(line, sizeof(line), fp) != NULL) {
+                                               /* Do substitutions? */
+                                               fputs(line, pfp);
+                                       }
+                                       pclose(pfp);
+                                       pw_log(cnf, mode, W_USER, "%s(%ld) new user mail sent",
+                                              pwd->pw_name, (long) pwd->pw_uid);
                                }
-                               pclose(pfp);
-                               pw_log(cnf, mode, W_USER, "%s(%ld) new user mail sent",
-                                      pwd->pw_name, (long) pwd->pw_uid);
+                               fclose(fp);
                        }
-                       fclose(fp);
                }
        }
+
        /*
         * Finally, let's create and populate the user's home directory. Note
         * that this also `works' for editing users if -m is used, but
         * existing files will *not* be overwritten.
         */
-       if (getarg(args, 'm') != NULL && pwd->pw_dir && *pwd->pw_dir == '/' && pwd->pw_dir[1]) {
+       if (!PWALTDIR() && getarg(args, 'm') != NULL && pwd->pw_dir && *pwd->pw_dir == '/' && pwd->pw_dir[1]) {
                copymkdir(pwd->pw_dir, cnf->dotdir, 0755, pwd->pw_uid, pwd->pw_gid);
                pw_log(cnf, mode, W_USER, "%s(%ld) home %s made",
                       pwd->pw_name, (long) pwd->pw_uid, pwd->pw_dir);
        }
+
        return EXIT_SUCCESS;
 }
 
@@ -618,7 +754,7 @@ pw_uidpolicy(struct userconf * cnf, struct cargs * args)
        if (a_uid != NULL) {
                uid = (uid_t) atol(a_uid->val);
 
-               if ((pwd = getpwuid(uid)) != NULL && getarg(args, 'o') == NULL)
+               if ((pwd = GETPWUID(uid)) != NULL && getarg(args, 'o') == NULL)
                        errx(EX_DATAERR, "uid `%ld' has already been allocated", (long) pwd->pw_uid);
        } else {
                struct bitmap   bm;
@@ -638,11 +774,11 @@ pw_uidpolicy(struct userconf * cnf, struct cargs * args)
                /*
                 * Now, let's fill the bitmap from the password file
                 */
-               setpwent();
-               while ((pwd = getpwent()) != NULL)
-                       if (pwd->pw_uid >= (int) cnf->min_uid && pwd->pw_uid <= (int) cnf->max_uid)
+               SETPWENT();
+               while ((pwd = GETPWENT()) != NULL)
+                       if (pwd->pw_uid >= (uid_t) cnf->min_uid && pwd->pw_uid <= (uid_t) cnf->max_uid)
                                bm_setbit(&bm, pwd->pw_uid - cnf->min_uid);
-               endpwent();
+               ENDPWENT();
 
                /*
                 * Then apply the policy, with fallback to reuse if necessary
@@ -677,15 +813,15 @@ pw_gidpolicy(struct userconf * cnf, struct cargs * args, char *nam, gid_t prefer
        /*
         * Check the given gid, if any
         */
-       setgrent();
+       SETGRENT();
        if (a_gid != NULL) {
-               if ((grp = getgrnam(a_gid->val)) == NULL) {
+               if ((grp = GETGRNAM(a_gid->val)) == NULL) {
                        gid = (gid_t) atol(a_gid->val);
-                       if ((gid == 0 && !isdigit(*a_gid->val)) || (grp = getgrgid(gid)) == NULL)
+                       if ((gid == 0 && !isdigit(*a_gid->val)) || (grp = GETGRGID(gid)) == NULL)
                                errx(EX_NOUSER, "group `%s' is not defined", a_gid->val);
                }
                gid = grp->gr_gid;
-       } else if ((grp = getgrnam(nam)) != NULL && grp->gr_mem[0] == NULL) {
+       } else if ((grp = GETGRNAM(nam)) != NULL && grp->gr_mem[0] == NULL) {
                gid = grp->gr_gid;  /* Already created? Use it anyway... */
        } else {
                struct cargs    grpargs;
@@ -703,7 +839,7 @@ pw_gidpolicy(struct userconf * cnf, struct cargs * args, char *nam, gid_t prefer
                 * user's name dups an existing group, then the group add
                 * function will happily handle that case for us and exit.
                 */
-               if (getgrgid(prefer) == NULL) {
+               if (GETGRGID(prefer) == NULL) {
                        sprintf(tmp, "%lu", (unsigned long) prefer);
                        addarg(&grpargs, 'g', tmp);
                }
@@ -716,7 +852,7 @@ pw_gidpolicy(struct userconf * cnf, struct cargs * args, char *nam, gid_t prefer
                else
                {
                        pw_group(cnf, M_ADD, &grpargs);
-                       if ((grp = getgrnam(nam)) != NULL)
+                       if ((grp = GETGRNAM(nam)) != NULL)
                                gid = grp->gr_gid;
                }
                a_gid = grpargs.lh_first;
@@ -726,7 +862,7 @@ pw_gidpolicy(struct userconf * cnf, struct cargs * args, char *nam, gid_t prefer
                        a_gid = t;
                }
        }
-       endgrent();
+       ENDGRENT();
        return gid;
 }
 
@@ -956,17 +1092,17 @@ pw_password(struct userconf * cnf, struct cargs * args, char const * user)
 
 
 static int
-print_user(struct passwd * pwd, int pretty)
+print_user(struct passwd * pwd, int pretty, int v7)
 {
        if (!pretty) {
                char            buf[_UC_MAXLINE];
 
-               fmtpwent(buf, pwd);
+               fmtpwentry(buf, pwd, v7 ? PWF_PASSWD : PWF_STANDARD);
                fputs(buf, stdout);
        } else {
                int             j;
                char           *p;
-               struct group   *grp = getgrgid(pwd->pw_gid);
+               struct group   *grp = GETGRGID(pwd->pw_gid);
                char            uname[60] = "User &", office[60] = "[None]",
                                wphone[60] = "[None]", hphone[60] = "[None]";
                char            acexpire[32] = "[None]", pwexpire[32] = "[None]";
@@ -1014,9 +1150,9 @@ print_user(struct passwd * pwd, int pretty)
                       uname, pwd->pw_dir, pwd->pw_class,
                       pwd->pw_shell, office, wphone, hphone,
                       acexpire, pwexpire);
-               setgrent();
+               SETGRENT();
                j = 0;
-               while ((grp=getgrent()) != NULL)
+               while ((grp=GETGRENT()) != NULL)
                {
                        int     i = 0;
                        while (grp->gr_mem[i] != NULL)
@@ -1029,7 +1165,7 @@ print_user(struct passwd * pwd, int pretty)
                                ++i;
                        }
                }
-               endgrent();
+               ENDGRENT();
                printf("%s\n", j ? "\n" : "");
        }
        return EXIT_SUCCESS;