MFH: r282615-r283655

[pw-darwin.git] / adduser / adduser.sh

diff --git a/adduser/adduser.sh b/adduser/adduser.sh
index 6d1e469a8c4f7bdba21e3b7c92e0a04a6128a44f..4b0a6f61b2723ead35da9f6158d647c616743f38 100644 (file)
--- a/adduser/adduser.sh
+++ b/adduser/adduser.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
 #!/bin/sh
 #

-# Copyright (c) 2002, 2003 Michael Telahun Makonnen. All rights reserved.
+# Copyright (c) 2002-2004 Michael Telahun Makonnen. All rights reserved.

 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions


@@ -22,26 +22,26 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #

-#       Email: Mike Makonnen <mtm@identd.net>
+#       Email: Mike Makonnen <mtm@FreeBSD.Org>

 #
 # $FreeBSD$
 #
 
 # err msg
 #
 # $FreeBSD$
 #
 
 # err msg

-#       Display $msg on stderr, unless we're being quiet.
-# 
+#      Display $msg on stderr, unless we're being quiet.
+#

 err() {
        if [ -z "$quietflag" ]; then
 err() {
        if [ -z "$quietflag" ]; then

-               echo 1>&2 ${THISCMD}: ERROR: $*
+               echo 1>&2 ${THISCMD}: ERROR: $*

        fi
 }
 
 # info msg
        fi
 }
 
 # info msg

-#       Display $msg on stdout, unless we're being quiet.
-# 
+#      Display $msg on stdout, unless we're being quiet.
+#

 info() {
        if [ -z "$quietflag" ]; then
 info() {
        if [ -z "$quietflag" ]; then

-               echo ${THISCMD}: INFO: $*
+               echo ${THISCMD}: INFO: $*

        fi
 }
 
        fi
 }
 


@@ -50,7 +50,7 @@ info() {
 #      is not, output the value of the next higher uid that is available.
 #      If a uid is not specified, output the first available uid, as indicated
 #      by pw(8).
 #      is not, output the value of the next higher uid that is available.
 #      If a uid is not specified, output the first available uid, as indicated
 #      by pw(8).

-# 
+#

 get_nextuid () {
        _uid=$1
        _nextuid=
 get_nextuid () {
        _uid=$1
        _nextuid=


@@ -77,10 +77,13 @@ show_usage() {
        echo "usage: ${THISCMD} [options]"
        echo "  options may include:"
        echo "  -C              save to the configuration file only"
        echo "usage: ${THISCMD} [options]"
        echo "  options may include:"
        echo "  -C              save to the configuration file only"

+       echo "  -D              do not attempt to create the home directory"

        echo "  -E              disable this account after creation"
        echo "  -G              additional groups to add accounts to"
        echo "  -L              login class of the user"
        echo "  -E              disable this account after creation"
        echo "  -G              additional groups to add accounts to"
        echo "  -L              login class of the user"

+       echo "  -M              file permission for home directory"

        echo "  -N              do not read configuration file"
        echo "  -N              do not read configuration file"

+       echo "  -S              a nonexistent shell is not an error"

        echo "  -d              home directory"
        echo "  -f              file from which input will be received"
        echo "  -g              default login group"
        echo "  -d              home directory"
        echo "  -f              file from which input will be received"
        echo "  -g              default login group"


@@ -110,32 +113,73 @@ valid_shells() {
                        ;;
                esac
        done
                        ;;
                esac
        done

+
+       # /usr/sbin/nologin is a special case
+       [ -x "${NOLOGIN_PATH}" ] && echo -n " ${NOLOGIN}"

 }
 
 # fullpath_from_shell shell
 }
 
 # fullpath_from_shell shell

-#      Given $shell, the basename component of a valid shell, get the
+#      Given $shell, which is either the full path to a shell or
+#      the basename component of a valid shell, get the

 #      full path to the shell from the /etc/shells file.
 #
 fullpath_from_shell() {
        _shell=$1
        [ -z "$_shell" ] && return 1
 
 #      full path to the shell from the /etc/shells file.
 #
 fullpath_from_shell() {
        _shell=$1
        [ -z "$_shell" ] && return 1
 

+       # /usr/sbin/nologin is a special case; it needs to be handled
+       # before the cat | while loop, since a 'return' from within
+       # a subshell will not terminate the function's execution, and
+       # the path to the nologin shell might be printed out twice.
+       #
+       if [ "$_shell" = "${NOLOGIN}" -o \
+           "$_shell" = "${NOLOGIN_PATH}" ]; then
+               echo ${NOLOGIN_PATH}
+               return 0;
+       fi
+

        cat ${ETCSHELLS} |
        while read _path _junk ; do
                case "$_path" in
                \#*|'')
                        ;;
                *)
        cat ${ETCSHELLS} |
        while read _path _junk ; do
                case "$_path" in
                \#*|'')
                        ;;
                *)

-                       if [ "`basename $_path`" = "$_shell" ]; then
+                       if [ "$_path" = "$_shell" -o \
+                           "`basename $_path`" = "$_shell" ]; then

                                echo $_path
                                return 0
                        fi
                        ;;
                esac
        done
                                echo $_path
                                return 0
                        fi
                        ;;
                esac
        done

+

        return 1
 }
 
        return 1
 }
 

+# shell_exists shell
+#      If the given shell is listed in ${ETCSHELLS} or it is
+#      the nologin shell this function will return 0.
+#      Otherwise, it will return 1. If shell is valid but
+#      the path is invalid or it is not executable it
+#      will emit an informational message saying so.
+#
+shell_exists() {
+       _sh="$1"
+       _shellchk="${GREPCMD} '^$_sh$' ${ETCSHELLS} > /dev/null 2>&1"
+
+       if ! eval $_shellchk; then
+               # The nologin shell is not listed in /etc/shells.
+               if [ "$_sh" != "${NOLOGIN_PATH}" ]; then
+                       err "Invalid shell ($_sh) for user $username."
+                       return 1
+               fi
+       fi
+       ! [ -x "$_sh" ] &&
+           info "The shell ($_sh) does not exist or is not executable."
+
+       return 0
+}
+

 # save_config
 #      Save some variables to a configuration file.
 #      Note: not all script variables are saved, only those that
 # save_config
 #      Save some variables to a configuration file.
 #      Note: not all script variables are saved, only those that


@@ -146,6 +190,7 @@ save_config() {
        echo "# NOTE: only *some* variables are saved." >> ${ADDUSERCONF}
        echo "# Last Modified on `${DATECMD}`."         >> ${ADDUSERCONF}
        echo ''                         >> ${ADDUSERCONF}
        echo "# NOTE: only *some* variables are saved." >> ${ADDUSERCONF}
        echo "# Last Modified on `${DATECMD}`."         >> ${ADDUSERCONF}
        echo ''                         >> ${ADDUSERCONF}

+       echo "defaultHomePerm=$uhomeperm" >> ${ADDUSERCONF}

        echo "defaultLgroup=$ulogingroup" >> ${ADDUSERCONF}
        echo "defaultclass=$uclass"     >> ${ADDUSERCONF}
        echo "defaultgroups=$ugroups"   >> ${ADDUSERCONF}
        echo "defaultLgroup=$ulogingroup" >> ${ADDUSERCONF}
        echo "defaultclass=$uclass"     >> ${ADDUSERCONF}
        echo "defaultgroups=$ugroups"   >> ${ADDUSERCONF}


@@ -155,6 +200,7 @@ save_config() {
        echo "udotdir=$udotdir"         >> ${ADDUSERCONF}
        echo "msgfile=$msgfile"         >> ${ADDUSERCONF}
        echo "disableflag=$disableflag" >> ${ADDUSERCONF}
        echo "udotdir=$udotdir"         >> ${ADDUSERCONF}
        echo "msgfile=$msgfile"         >> ${ADDUSERCONF}
        echo "disableflag=$disableflag" >> ${ADDUSERCONF}

+       echo "uidstart=$uidstart"       >> ${ADDUSERCONF}

 }
 
 # add_user
 }
 
 # add_user


@@ -191,12 +237,27 @@ add_user() {
        [ -n "$ulogingroup" ] && _group='-g "$ulogingroup"'
        [ -n "$ugroups" ] && _grouplist='-G "$ugroups"'
        [ -n "$ushell" ] && _shell='-s "$ushell"'
        [ -n "$ulogingroup" ] && _group='-g "$ulogingroup"'
        [ -n "$ugroups" ] && _grouplist='-G "$ugroups"'
        [ -n "$ushell" ] && _shell='-s "$ushell"'

-       [ -n "$uhome" ] && _home='-m -d "$uhome"'

        [ -n "$uclass" ] && _class='-L "$uclass"'
        [ -n "$ugecos" ] && _comment='-c "$ugecos"'
        [ -n "$udotdir" ] && _dotdir='-k "$udotdir"'
        [ -n "$uexpire" ] && _expire='-e "$uexpire"'
        [ -n "$upwexpire" ] && _pwexpire='-p "$upwexpire"'
        [ -n "$uclass" ] && _class='-L "$uclass"'
        [ -n "$ugecos" ] && _comment='-c "$ugecos"'
        [ -n "$udotdir" ] && _dotdir='-k "$udotdir"'
        [ -n "$uexpire" ] && _expire='-e "$uexpire"'
        [ -n "$upwexpire" ] && _pwexpire='-p "$upwexpire"'

+       if [ -z "$Dflag" -a -n "$uhome" ]; then
+               # The /nonexistent home directory is special. It
+               # means the user has no home directory.
+               if [ "$uhome" = "$NOHOME" ]; then
+                       _home='-d "$uhome"'
+               else
+                       # Use home directory permissions if specified
+                       if [ -n "$uhomeperm" ]; then
+                               _home='-m -d "$uhome" -M "$uhomeperm"'
+                       else
+                               _home='-m -d "$uhome"'
+                       fi
+               fi
+       elif [ -n "$Dflag" -a -n "$uhome" ]; then
+               _home='-d "$uhome"'
+       fi

        case $passwdtype in
        no)
                _passwdmethod="-w no"
        case $passwdtype in
        no)
                _passwdmethod="-w no"


@@ -292,13 +353,19 @@ get_user() {
                        _input="`echo "$fileline" | cut -f1 -d:`"
                fi
 
                        _input="`echo "$fileline" | cut -f1 -d:`"
                fi
 

-               # There *must* be a username. If this is an interactive
-               # session give the user an opportunity to retry.
+               # There *must* be a username, and it must not exist. If
+               # this is an interactive session give the user an
+               # opportunity to retry.

                #
                if [ -z "$_input" ]; then
                        err "You must enter a username!"
                        [ -z "$fflag" ] && continue
                fi
                #
                if [ -z "$_input" ]; then
                        err "You must enter a username!"
                        [ -z "$fflag" ] && continue
                fi

+               ${PWCMD} usershow $_input > /dev/null 2>&1
+               if [ "$?" -eq 0 ]; then
+                       err "User exists!"
+                       [ -z "$fflag" ] && continue
+               fi

                break
        done
        username="$_input"
                break
        done
        username="$_input"


@@ -325,7 +392,7 @@ get_gecos() {
 
 # get_shell
 #      Get the account's shell. Works in interactive and batch mode. It
 
 # get_shell
 #      Get the account's shell. Works in interactive and batch mode. It

-#      accepts only the base name of the shell, NOT the full path.
+#      accepts either the base name of the shell or the full path.

 #      If an invalid shell is entered it will simply use the default shell.
 #
 get_shell() {
 #      If an invalid shell is entered it will simply use the default shell.
 #
 get_shell() {


@@ -334,11 +401,12 @@ get_shell() {
        ushell="$defaultshell"
 
        # Make sure the current value of the shell is a valid one
        ushell="$defaultshell"
 
        # Make sure the current value of the shell is a valid one

-       _shellchk="${GREPCMD} '^$ushell$' ${ETCSHELLS} > /dev/null 2>&1"
-       eval $_shellchk || {
-               err "Invalid shell ($ushell). Using default shell ${defaultshell}."
-               ushell="$defaultshell"
-       }
+       if [ -z "$Sflag" ]; then
+               if ! shell_exists $ushell ; then
+                       info "Using default shell ${defaultshell}."
+                       ushell="$defaultshell"
+               fi
+       fi

 
        if [ -z "$fflag" ]; then
                echo -n "Shell ($shells) [`basename $ushell`]: "
 
        if [ -z "$fflag" ]; then
                echo -n "Shell ($shells) [`basename $ushell`]: "


@@ -347,12 +415,17 @@ get_shell() {
                _input="`echo "$fileline" | cut -f9 -d:`"
        fi
        if [ -n "$_input" ]; then
                _input="`echo "$fileline" | cut -f9 -d:`"
        fi
        if [ -n "$_input" ]; then

-               _fullpath=`fullpath_from_shell $_input`
-               if [ -n "$_fullpath" ]; then
-                       ushell="$_fullpath"
+               if [ -n "$Sflag" ]; then
+                       ushell="$_input"

                else
                else

-                       err "Invalid shell selection. Using default shell ${defaultshell}."
-                       ushell="$defaultshell"
+                       _fullpath=`fullpath_from_shell $_input`
+                       if [ -n "$_fullpath" ]; then
+                               ushell="$_fullpath"
+                       else
+                               err "Invalid shell ($_input) for user $username."
+                               info "Using default shell ${defaultshell}."
+                               ushell="$defaultshell"
+                       fi

                fi
        fi
 }
                fi
        fi
 }


@@ -382,6 +455,29 @@ get_homedir() {
        fi
 }
 
        fi
 }
 

+# get_homeperm
+#      Reads the account's home directory permissions.
+#
+get_homeperm() {
+       uhomeperm=$defaultHomePerm
+       _input=
+       _prompt=
+
+       if [ -n "$uhomeperm" ]; then
+               _prompt="Home directory permissions [${uhomeperm}]: "
+       else
+               _prompt="Home directory permissions (Leave empty for default): "
+       fi
+       if [ -z "$fflag" ]; then
+               echo -n "$_prompt"
+               read _input
+       fi
+
+       if [ -n "$_input" ]; then
+               uhomeperm="$_input"
+       fi
+}
+

 # get_uid
 #      Reads a numeric userid in an interactive or batch session. Automatically
 #      allocates one if it is not specified.
 # get_uid
 #      Reads a numeric userid in an interactive or batch session. Automatically
 #      allocates one if it is not specified.


@@ -391,10 +487,8 @@ get_uid() {
        _input=
        _prompt=
 
        _input=
        _prompt=
 

-       # No need to take down uids for a configuration saving run.
-       [ -n "$configflag" ] && return
-

        if [ -n "$uuid" ]; then
        if [ -n "$uuid" ]; then

+               uuid=`get_nextuid $uuid`

                _prompt="Uid [$uuid]: "
        else
                _prompt="Uid (Leave empty for default): "
                _prompt="Uid [$uuid]: "
        else
                _prompt="Uid (Leave empty for default): "


@@ -528,21 +622,23 @@ input_from_file() {
        while read -r fileline ; do
                case "$fileline" in
                \#*|'')
        while read -r fileline ; do
                case "$fileline" in
                \#*|'')

-                       return 0

                        ;;
                        ;;

-               esac
-
-               get_user || continue
-               get_gecos
-               get_uid
-               get_logingroup
-               get_class
-               get_shell
-               get_homedir
-               get_password
-               get_expire_dates
+               *)
+                       get_user || continue
+                       get_gecos
+                       get_uid
+                       get_logingroup
+                       get_class
+                       get_shell
+                       get_homedir
+                       get_homeperm
+                       get_password
+                       get_expire_dates
+                       ugroups="$defaultgroups"

 
 

-               add_user
+                       add_user
+                       ;;
+               esac

        done
 }
 
        done
 }
 


@@ -551,7 +647,6 @@ input_from_file() {
 #      the user database.
 #
 input_interactive() {
 #      the user database.
 #
 input_interactive() {

-

        _disable=
        _pass=
        _passconfirm=
        _disable=
        _pass=
        _passconfirm=


@@ -605,6 +700,7 @@ input_interactive() {
        get_class
        get_shell
        get_homedir
        get_class
        get_shell
        get_homedir

+       get_homeperm

 
        while : ; do
                echo -n "Use password-based authentication? [$_usepass]: "
 
        while : ; do
                echo -n "Use password-based authentication? [$_usepass]: "


@@ -638,7 +734,7 @@ input_interactive() {
                                        read -r upass
                                        echo''
                                        echo -n "Enter password again: "
                                        read -r upass
                                        echo''
                                        echo -n "Enter password again: "

-                                       read _passconfirm
+                                       read -r _passconfirm

                                        echo ''
                                        stty echo
                                        # if user entered a blank password
                                        echo ''
                                        stty echo
                                        # if user entered a blank password


@@ -715,6 +811,7 @@ input_interactive() {
        printf "%-10s : %s\n" "Class" "$uclass"
        printf "%-10s : %s %s\n" "Groups" "${ulogingroup:-$username}" "$ugroups"
        printf "%-10s : %s\n" "Home" "$uhome"
        printf "%-10s : %s\n" "Class" "$uclass"
        printf "%-10s : %s %s\n" "Groups" "${ulogingroup:-$username}" "$ugroups"
        printf "%-10s : %s\n" "Home" "$uhome"

+       printf "%-10s : %s\n" "Home Mode" "$uhomeperm"

        printf "%-10s : %s\n" "Shell" "$ushell"
        printf "%-10s : %s\n" "Locked" "$_disable"
        while : ; do
        printf "%-10s : %s\n" "Shell" "$ushell"
        printf "%-10s : %s\n" "Locked" "$_disable"
        while : ; do


@@ -736,7 +833,7 @@ input_interactive() {
        return 0
 }
 
        return 0
 }
 

-#### END SUBROUTINE DEFENITION ####
+#### END SUBROUTINE DEFINITION ####

 
 THISCMD=`/usr/bin/basename $0`
 DEFAULTSHELL=/bin/sh
 
 THISCMD=`/usr/bin/basename $0`
 DEFAULTSHELL=/bin/sh


@@ -744,6 +841,9 @@ ADDUSERCONF="${ADDUSERCONF:-/etc/adduser.conf}"
 PWCMD="${PWCMD:-/usr/sbin/pw}"
 MAILCMD="${MAILCMD:-mail}"
 ETCSHELLS="${ETCSHELLS:-/etc/shells}"
 PWCMD="${PWCMD:-/usr/sbin/pw}"
 MAILCMD="${MAILCMD:-mail}"
 ETCSHELLS="${ETCSHELLS:-/etc/shells}"

+NOHOME="/nonexistent"
+NOLOGIN="nologin"
+NOLOGIN_PATH="/usr/sbin/nologin"

 GREPCMD="/usr/bin/grep"
 DATECMD="/bin/date"
 
 GREPCMD="/usr/bin/grep"
 DATECMD="/bin/date"
 


@@ -756,6 +856,7 @@ ugecos=
 ulogingroup=
 uclass=
 uhome=
 ulogingroup=
 uclass=
 uhome=

+uhomeperm=

 upass=
 ushell=
 udotdir=/usr/share/skel
 upass=
 ushell=
 udotdir=/usr/share/skel


@@ -771,6 +872,8 @@ configflag=
 fflag=
 infile=
 disableflag=
 fflag=
 infile=
 disableflag=

+Dflag=
+Sflag=

 readconfig="yes"
 homeprefix="/home"
 randompass=
 readconfig="yes"
 homeprefix="/home"
 randompass=


@@ -778,11 +881,12 @@ fileline=
 savedpwtype=
 defaultclass=
 defaultLgroup=
 savedpwtype=
 defaultclass=
 defaultLgroup=

-defaultgoups=
+defaultgroups=

 defaultshell="${DEFAULTSHELL}"
 defaultshell="${DEFAULTSHELL}"

+defaultHomePerm=

 
 # Make sure the user running this program is root. This isn't a security
 
 # Make sure the user running this program is root. This isn't a security

-# measure as much as it is a usefull method of reminding the user to
+# measure as much as it is a useful method of reminding the user to

 # 'su -' before he/she wastes time entering data that won't be saved.
 #
 procowner=${procowner:-`/usr/bin/id -u`}
 # 'su -' before he/she wastes time entering data that won't be saved.
 #
 procowner=${procowner:-`/usr/bin/id -u`}


@@ -791,7 +895,7 @@ if [ "$procowner" != "0" ]; then
        exit 1
 fi
 
        exit 1
 fi
 

-# Overide from our conf file
+# Override from our conf file

 # Quickly go through the commandline line to see if we should read
 # from our configuration file. The actual parsing of the commandline
 # arguments happens after we read in our configuration file (commandline
 # Quickly go through the commandline line to see if we should read
 # from our configuration file. The actual parsing of the commandline
 # arguments happens after we read in our configuration file (commandline


@@ -811,7 +915,7 @@ if [ -n "$readconfig" ]; then
        fi
 fi 
 
        fi
 fi 
 

-# Proccess command-line options
+# Process command-line options

 #
 for _switch ; do
        case $_switch in
 #
 for _switch ; do
        case $_switch in


@@ -823,6 +927,10 @@ for _switch ; do
                configflag=yes
                shift
                ;;
                configflag=yes
                shift
                ;;

+       -D)
+               Dflag=yes
+               shift
+               ;;

        -E)
                disableflag=yes
                shift
        -E)
                disableflag=yes
                shift


@@ -864,6 +972,10 @@ for _switch ; do
                esac
                shift; shift
                ;;
                esac
                shift; shift
                ;;

+       -M)
+               defaultHomePerm=$2
+               shift; shift
+               ;;

        -N)
                readconfig=
                shift
        -N)
                readconfig=
                shift


@@ -888,6 +1000,10 @@ for _switch ; do
                defaultshell="`fullpath_from_shell $2`"
                shift; shift
                ;;
                defaultshell="`fullpath_from_shell $2`"
                shift; shift
                ;;

+       -S)
+               Sflag=yes
+               shift
+               ;;

        -u)
                uidstart=$2
                shift; shift
        -u)
                uidstart=$2
                shift; shift