#include <sys/types.h>
#include <assert.h>
+#include <crypt.h>
#include <ctype.h>
#include <dirent.h>
#include <err.h>
"User &",
"/nonexistent",
"/bin/sh",
- 0,
0
};
return shell_path(cnf->shelldir, cnf->shells, cnf->shell_default);
}
-#define SALTSIZE 32
static char const chars[] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./";
char *
pw_pwcrypt(char *password)
{
- int i;
- char salt[SALTSIZE + 1];
char *cryptpw;
static char buf[256];
size_t pwlen;
- /*
- * Calculate a salt value
- */
- for (i = 0; i < SALTSIZE; i++)
- salt[i] = chars[arc4random_uniform(sizeof(chars) - 1)];
- salt[SALTSIZE] = '\0';
-
- cryptpw = crypt(password, salt);
+ cryptpw = crypt(password, crypt_gensalt("$6$", 0, chars, strlen(chars)));
if (cryptpw == NULL)
errx(EX_CONFIG, "crypt(3) failure");
pwlen = strlcpy(buf, cryptpw, sizeof(buf));
}
if (pwd->pw_expire > (time_t)0 && (tptr = localtime(&pwd->pw_expire)) != NULL)
strftime(acexpire, sizeof acexpire, "%c", tptr);
- if (pwd->pw_change > (time_t)0 && (tptr = localtime(&pwd->pw_change)) != NULL)
+ if (pwd->pw_change > (time_t)0 && (tptr = localtime(&pwd->pw_change)) != NULL)
strftime(pwexpire, sizeof pwexpire, "%c", tptr);
printf("Login Name: %-15s #%-12ju Group: %-15s #%ju\n"
" Full Name: %s\n"
reject = 0;
if (gecos) {
/* See if the name is valid as a gecos (comment) field. */
- badchars = ":!@";
+ badchars = ":";
showtype = "gecos field";
} else {
/* See if the name is valid as a userid or group. */
{
char tmp[1014];
FILE *fp;
- int fd;
size_t len;
- off_t atofs = 0;
-
+ long atofs;
+ int fd;
+
if ((fd = openat(conf.rootfd, "etc/opiekeys", O_RDWR)) == -1)
return;
fp = fdopen(fd, "r+");
len = strlen(name);
- while (fgets(tmp, sizeof(tmp), fp) != NULL) {
+ for (atofs = 0; fgets(tmp, sizeof(tmp), fp) != NULL && atofs >= 0;
+ atofs = ftell(fp)) {
if (strncmp(name, tmp, len) == 0 && tmp[len]==' ') {
/* Comment username out */
if (fseek(fp, atofs, SEEK_SET) == 0)
fwrite("#", 1, 1, fp);
break;
}
- atofs = ftell(fp);
}
/*
* If we got an error of any sort, don't update!
errx(EX_NOUSER, "no such user `%s'", name);
}
- if (PWF._altdir == PWF_REGULAR &&
- ((pwd->pw_fields & _PWF_SOURCE) != _PWF_FILES)) {
- if ((pwd->pw_fields & _PWF_SOURCE) == _PWF_NIS) {
- if (!nis && nispasswd && *nispasswd != '/')
- errx(EX_NOUSER, "Cannot remove NIS user `%s'",
- name);
- } else {
- errx(EX_NOUSER, "Cannot remove non local user `%s'",
- name);
- }
- }
-
id = pwd->pw_uid;
if (name == NULL)
name = pwd->pw_name;
- if (strcmp(pwd->pw_name, "root") == 0)
- errx(EX_DATAERR, "cannot remove user 'root'");
+ char *system_users[30] = {"nobody", "root", "mobile", "daemon", "_ftp", "_networkd", "_wireless", "_installd", "_neagent", "_ifccd", "_securityd", "_mdnsresponder", "_sshd", "_unknown", "_distnote", "_astris", "_ondemand", "_findmydevice", "_datadetectors", "_captiveagent", "_analyticsd", "_timed", "_gpsd", "_reportmemoryexception", "_diskimagesiod", "_logd", "_iconservices", "_fud", "_knowledgegraphd", "_coreml"};
+ for (int i = 0; i < 30; i++) {
+ if (strcmp(pwd->pw_name, system_users[i]) == 0)
+ errx(EX_DATAERR, "cannot remove user '%s'", system_users[i]);
+ }
/* Remove opie record from /etc/opiekeys */
if (PWALTDIR() != PWF_ALT)
/* Remove home directory and contents */
if (PWALTDIR() != PWF_ALT && deletehome && *home == '/' &&
- GETPWUID(id) == NULL &&
fstatat(conf.rootfd, home + 1, &st, 0) != -1) {
rm_r(conf.rootfd, home, id);
pw_log(cnf, M_DELETE, W_USER, "%s(%ju) home '%s' %s"
pwd->pw_uid = pw_uidpolicy(cmdcnf, id);
pwd->pw_gid = pw_gidpolicy(cnf, grname, pwd->pw_name,
(gid_t) pwd->pw_uid, dryrun);
-
+
+ split_groups(&cmdcnf->groups, grname);
+
+ /* cmdcnf->password_days and cmdcnf->expire_days hold unixtime here */
if (cmdcnf->password_days > 0)
- pwd->pw_change = now + cmdcnf->password_days * 86400L;
+ pwd->pw_change = cmdcnf->password_days;
if (cmdcnf->expire_days > 0)
- pwd->pw_expire = now + cmdcnf->expire_days * 86400L;
+ pwd->pw_expire = cmdcnf->expire_days;
pwd->pw_dir = pw_homepolicy(cmdcnf, homedir, pwd->pw_name);
pwd->pw_shell = pw_shellpolicy(cmdcnf);
bool quiet, createhome, pretty, dryrun, nis, edited;
bool precrypted;
mode_t homemode = 0;
- time_t expire_days, password_days, now;
+ time_t expire_time, password_time, now;
- expire_days = password_days = -1;
+ expire_time = password_time = -1;
gecos = homedir = grname = name = newname = skel = shell =NULL;
passwd = NULL;
class = nispasswd = NULL;
homedir = optarg;
break;
case 'e':
- expire_days = parse_date(now, optarg);
+ expire_time = parse_date(now, optarg);
break;
case 'p':
- password_days = parse_date(now, optarg);
+ password_time = parse_date(now, optarg);
break;
case 'g':
group_from_name_or_id(optarg);
if (nis && nispasswd == NULL)
nispasswd = cnf->nispasswd;
- if (PWF._altdir == PWF_REGULAR &&
- ((pwd->pw_fields & _PWF_SOURCE) != _PWF_FILES)) {
- if ((pwd->pw_fields & _PWF_SOURCE) == _PWF_NIS) {
- if (!nis && nispasswd && *nispasswd != '/')
- errx(EX_NOUSER, "Cannot modify NIS user `%s'",
- name);
- } else {
- errx(EX_NOUSER, "Cannot modify non local user `%s'",
- name);
- }
- }
-
if (newname) {
if (strcmp(pwd->pw_name, "root") == 0)
errx(EX_DATAERR, "can't rename `root' account");
}
- if (password_days >= 0) {
- pwd->pw_change = now + password_days * 86400L;
+ if (password_time >= 0 && pwd->pw_change != password_time) {
+ pwd->pw_change = password_time;
edited = true;
}
- if (expire_days >= 0) {
- pwd->pw_expire = now + expire_days * 86400L;
+ if (expire_time >= 0 && pwd->pw_expire != expire_time) {
+ pwd->pw_expire = expire_time;
edited = true;
}
git.ckatri.com / pw-darwin.git / blobdiff