X-Git-Url: https://git.cameronkatri.com/pw-darwin.git/blobdiff_plain/39d77815028ba1a72509c07e0a8583493f6ec0a8..b5b471acbfe024ca832aa18f73f49b3fbc3f14b9:/pw/pw_group.c

diff --git a/pw/pw_group.c b/pw/pw_group.c
index b57eab3..dd65062 100644
--- a/pw/pw_group.c
+++ b/pw/pw_group.c
@@ -1,4 +1,6 @@
 /*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
  * Copyright (C) 1996
  *	David L. Nugent.  All rights reserved.
  *
@@ -31,263 +33,99 @@ static const char rcsid[] =
 
 #include <ctype.h>
 #include <err.h>
-#include <termios.h>
-#include <stdbool.h>
-#include <unistd.h>
 #include <grp.h>
 #include <libutil.h>
+#include <paths.h>
+#include <string.h>
+#include <sysexits.h>
+#include <termios.h>
+#include <unistd.h>
 
 #include "pw.h"
 #include "bitmap.h"
 
-
 static struct passwd *lookup_pwent(const char *user);
-static void	delete_members(char ***members, int *grmembers, int *i,
-    struct carg *arg, struct group *grp);
-static int      print_group(struct group * grp, int pretty);
-static gid_t    gr_gidpolicy(struct userconf * cnf, struct cargs * args);
+static void	delete_members(struct group *grp, char *list);
+static int	print_group(struct group * grp, bool pretty);
+static gid_t	gr_gidpolicy(struct userconf * cnf, intmax_t id);
 
-int
-pw_group(int mode, struct cargs * args)
+static void
+grp_set_passwd(struct group *grp, bool update, int fd, bool precrypted)
 {
-	int		rc;
-	struct carg    *a_newname = getarg(args, 'l');
-	struct carg    *a_name = getarg(args, 'n');
-	struct carg    *a_gid = getarg(args, 'g');
-	struct carg    *arg;
-	struct group   *grp = NULL;
-	int	        grmembers = 0;
-	char           **members = NULL;
-	struct userconf	*cnf = conf.userconf;
-
-	static struct group fakegroup =
-	{
-		"nogroup",
-		"*",
-		-1,
-		NULL
-	};
+	int		 b;
+	int		 istty;
+	struct termios	 t, n;
+	char		*p, line[256];
 
-	if (a_gid != NULL) {
-		if (strspn(a_gid->val, "0123456789") != strlen(a_gid->val))
-			errx(EX_USAGE, "-g expects a number");
-	}
-
-	if (mode == M_LOCK || mode == M_UNLOCK)
-		errx(EX_USAGE, "'lock' command is not available for groups");
-
-	/*
-	 * With M_NEXT, we only need to return the
-	 * next gid to stdout
-	 */
-	if (mode == M_NEXT) {
-		gid_t next = gr_gidpolicy(cnf, args);
-		if (getarg(args, 'q'))
-			return next;
-		printf("%u\n", next);
-		return EXIT_SUCCESS;
-	}
-
-	if (mode == M_PRINT && getarg(args, 'a')) {
-		int             pretty = getarg(args, 'P') != NULL;
-
-		SETGRENT();
-		while ((grp = GETGRENT()) != NULL)
-			print_group(grp, pretty);
-		ENDGRENT();
-		return EXIT_SUCCESS;
-	}
-	if (a_gid == NULL) {
-		if (a_name == NULL)
-			errx(EX_DATAERR, "group name or id required");
+	if (fd == -1)
+		return;
 
-		if (mode != M_ADD && grp == NULL && isdigit((unsigned char)*a_name->val)) {
-			(a_gid = a_name)->ch = 'g';
-			a_name = NULL;
-		}
+	if (fd == '-') {
+		grp->gr_passwd = "*";	/* No access */
+		return;
 	}
-	grp = (a_name != NULL) ? GETGRNAM(a_name->val) : GETGRGID((gid_t) atoi(a_gid->val));
-
-	if (mode == M_UPDATE || mode == M_DELETE || mode == M_PRINT) {
-		if (a_name == NULL && grp == NULL)	/* Try harder */
-			grp = GETGRGID(atoi(a_gid->val));
-
-		if (grp == NULL) {
-			if (mode == M_PRINT && getarg(args, 'F')) {
-				char	*fmems[1];
-				fmems[0] = NULL;
-				fakegroup.gr_name = a_name ? a_name->val : "nogroup";
-				fakegroup.gr_gid = a_gid ? (gid_t) atol(a_gid->val) : (gid_t)-1;
-				fakegroup.gr_mem = fmems;
-				return print_group(&fakegroup, getarg(args, 'P') != NULL);
-			}
-			errx(EX_DATAERR, "unknown group `%s'", a_name ? a_name->val : a_gid->val);
-		}
-		if (a_name == NULL)	/* Needed later */
-			a_name = addarg(args, 'n', grp->gr_name);
-
-		/*
-		 * Handle deletions now
-		 */
-		if (mode == M_DELETE) {
-			gid_t           gid = grp->gr_gid;
-
-			rc = delgrent(grp);
-			if (rc == -1)
-				err(EX_IOERR, "group '%s' not available (NIS?)", grp->gr_name);
-			else if (rc != 0) {
-				err(EX_IOERR, "group update");
-			}
-			pw_log(cnf, mode, W_GROUP, "%s(%u) removed", a_name->val, gid);
-			return EXIT_SUCCESS;
-		} else if (mode == M_PRINT)
-			return print_group(grp, getarg(args, 'P') != NULL);
-
-		if (a_gid)
-			grp->gr_gid = (gid_t) atoi(a_gid->val);
-
-		if (a_newname != NULL)
-			grp->gr_name = pw_checkname(a_newname->val, 0);
-	} else {
-		if (a_name == NULL)	/* Required */
-			errx(EX_DATAERR, "group name required");
-		else if (grp != NULL)	/* Exists */
-			errx(EX_DATAERR, "group name `%s' already exists", a_name->val);
-
-		extendarray(&members, &grmembers, 200);
-		members[0] = NULL;
-		grp = &fakegroup;
-		grp->gr_name = pw_checkname(a_name->val, 0);
-		grp->gr_passwd = "*";
-		grp->gr_gid = gr_gidpolicy(cnf, args);
-		grp->gr_mem = members;
+	
+	if ((istty = isatty(fd))) {
+		n = t;
+		/* Disable echo */
+		n.c_lflag &= ~(ECHO);
+		tcsetattr(fd, TCSANOW, &n);
+		printf("%sassword for group %s:", update ? "New p" : "P",
+		    grp->gr_name);
+		fflush(stdout);
 	}
-
-	/*
-	 * This allows us to set a group password Group passwords is an
-	 * antique idea, rarely used and insecure (no secure database) Should
-	 * be discouraged, but it is apparently still supported by some
-	 * software.
-	 */
-
-	if ((arg = getarg(args, 'h')) != NULL ||
-	    (arg = getarg(args, 'H')) != NULL) {
-		if (strcmp(arg->val, "-") == 0)
-			grp->gr_passwd = "*";	/* No access */
-		else {
-			int             fd = atoi(arg->val);
-			int		precrypt = (arg->ch == 'H');
-			int             b;
-			int             istty = isatty(fd);
-			struct termios  t;
-			char           *p, line[256];
-
-			if (istty) {
-				if (tcgetattr(fd, &t) == -1)
-					istty = 0;
-				else {
-					struct termios  n = t;
-
-					/* Disable echo */
-					n.c_lflag &= ~(ECHO);
-					tcsetattr(fd, TCSANOW, &n);
-					printf("%sassword for group %s:", (mode == M_UPDATE) ? "New p" : "P", grp->gr_name);
-					fflush(stdout);
-				}
-			}
-			b = read(fd, line, sizeof(line) - 1);
-			if (istty) {	/* Restore state */
-				tcsetattr(fd, TCSANOW, &t);
-				fputc('\n', stdout);
-				fflush(stdout);
-			}
-			if (b < 0)
-				err(EX_OSERR, "-h file descriptor");
-			line[b] = '\0';
-			if ((p = strpbrk(line, " \t\r\n")) != NULL)
-				*p = '\0';
-			if (!*line)
-				errx(EX_DATAERR, "empty password read on file descriptor %d", fd);
-			if (precrypt) {
-				if (strchr(line, ':') != NULL)
-					return EX_DATAERR;
-				grp->gr_passwd = line;
-			} else
-				grp->gr_passwd = pw_pwcrypt(line);
-		}
+	b = read(fd, line, sizeof(line) - 1);
+	if (istty) {	/* Restore state */
+		tcsetattr(fd, TCSANOW, &t);
+		fputc('\n', stdout);
+		fflush(stdout);
 	}
+	if (b < 0)
+		err(EX_OSERR, "-h file descriptor");
+	line[b] = '\0';
+	if ((p = strpbrk(line, " \t\r\n")) != NULL)
+		*p = '\0';
+	if (!*line)
+		errx(EX_DATAERR, "empty password read on file descriptor %d",
+		    conf.fd);
+	if (precrypted) {
+		if (strchr(line, ':') != 0)
+			errx(EX_DATAERR, "wrong encrypted passwrd");
+		grp->gr_passwd = line;
+	} else
+		grp->gr_passwd = pw_pwcrypt(line);
+}
 
-	if (((arg = getarg(args, 'M')) != NULL ||
-	    (arg = getarg(args, 'd')) != NULL ||
-	    (arg = getarg(args, 'm')) != NULL) && arg->val) {
-		int	i = 0;
-		char   *p;
-		struct passwd	*pwd;
-
-		/* Make sure this is not stay NULL with -M "" */
-		extendarray(&members, &grmembers, 200);
-		if (arg->ch == 'd')
-			delete_members(&members, &grmembers, &i, arg, grp);
-		else if (arg->ch == 'm') {
-			int	k = 0;
-
-			if (grp->gr_mem != NULL) {
-				while (grp->gr_mem[k] != NULL) {
-					if (extendarray(&members, &grmembers, i + 2) != -1)
-						members[i++] = grp->gr_mem[k];
-					k++;
-				}
-			}
-		}
+int
+pw_groupnext(struct userconf *cnf, bool quiet)
+{
+	gid_t next = gr_gidpolicy(cnf, -1);
 
-		if (arg->ch != 'd')
-			for (p = strtok(arg->val, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
-				int	j;
-
-				/*
-				 * Check for duplicates
-				 */
-				pwd = lookup_pwent(p);
-				for (j = 0; j < i && strcmp(members[j], pwd->pw_name) != 0; j++)
-					;
-				if (j == i && extendarray(&members, &grmembers, i + 2) != -1)
-					members[i++] = newstr(pwd->pw_name);
-			}
-		while (i < grmembers)
-			members[i++] = NULL;
-		grp->gr_mem = members;
-	}
+	if (quiet)
+		return (next);
+	printf("%ju\n", (uintmax_t)next);
 
-	if (getarg(args, 'N') != NULL)
-		return print_group(grp, getarg(args, 'P') != NULL);
+	return (EXIT_SUCCESS);
+}
 
-	if (mode == M_ADD && (rc = addgrent(grp)) != 0) {
-		if (rc == -1)
-			errx(EX_IOERR, "group '%s' already exists",
-			    grp->gr_name);
-		else
-			err(EX_IOERR, "group update");
-	} else if (mode == M_UPDATE && (rc = chggrent(a_name->val, grp)) != 0) {
-		if (rc == -1)
-			errx(EX_IOERR, "group '%s' not available (NIS?)",
-			    grp->gr_name);
-		else
-			err(EX_IOERR, "group update");
+static struct group *
+getgroup(char *name, intmax_t id, bool fatal)
+{
+	struct group *grp;
+
+	if (id < 0 && name == NULL)
+		errx(EX_DATAERR, "groupname or id required");
+	grp = (name != NULL) ? GETGRNAM(name) : GETGRGID(id);
+	if (grp == NULL) {
+		if (!fatal)
+			return (NULL);
+		if (name == NULL)
+			errx(EX_DATAERR, "unknown gid `%ju'", id);
+		errx(EX_DATAERR, "unknown group `%s'", name);
 	}
-
-	arg = a_newname != NULL ? a_newname : a_name;
-	/* grp may have been invalidated */
-	if ((grp = GETGRNAM(arg->val)) == NULL)
-		errx(EX_SOFTWARE, "group disappeared during update");
-
-	pw_log(cnf, mode, W_GROUP, "%s(%u)", grp->gr_name, grp->gr_gid);
-
-	free(members);
-
-	return EXIT_SUCCESS;
+	return (grp);
 }
 
-
 /*
  * Lookup a passwd entry using a name or UID.
  */
@@ -309,120 +147,97 @@ lookup_pwent(const char *user)
  * Delete requested members from a group.
  */
 static void
-delete_members(char ***members, int *grmembers, int *i, struct carg *arg,
-    struct group *grp)
+delete_members(struct group *grp, char *list)
 {
-	bool matchFound;
-	char *user;
-	char *valueCopy;
-	char *valuePtr;
+	char *p;
 	int k;
-	struct passwd *pwd;
 
 	if (grp->gr_mem == NULL)
 		return;
 
-	k = 0;
-	while (grp->gr_mem[k] != NULL) {
-		matchFound = false;
-		if ((valueCopy = strdup(arg->val)) == NULL)
-			errx(EX_UNAVAILABLE, "out of memory");
-		valuePtr = valueCopy;
-		while ((user = strsep(&valuePtr, ", \t")) != NULL) {
-			pwd = lookup_pwent(user);
-			if (strcmp(grp->gr_mem[k], pwd->pw_name) == 0) {
-				matchFound = true;
+	for (p = strtok(list, ", \t"); p != NULL; p = strtok(NULL, ", \t")) {
+		for (k = 0; grp->gr_mem[k] != NULL; k++) {
+			if (strcmp(grp->gr_mem[k], p) == 0)
 				break;
-			}
 		}
-		free(valueCopy);
+		if (grp->gr_mem[k] == NULL) /* No match */
+			continue;
 
-		if (!matchFound &&
-		    extendarray(members, grmembers, *i + 2) != -1)
-			(*members)[(*i)++] = grp->gr_mem[k];
-
-		k++;
+		for (; grp->gr_mem[k] != NULL; k++)
+			grp->gr_mem[k] = grp->gr_mem[k+1];
 	}
-
-	return;
 }
 
-
-static          gid_t
-gr_gidpolicy(struct userconf * cnf, struct cargs * args)
+static gid_t
+gr_gidpolicy(struct userconf * cnf, intmax_t id)
 {
 	struct group   *grp;
+	struct bitmap   bm;
 	gid_t           gid = (gid_t) - 1;
-	struct carg    *a_gid = getarg(args, 'g');
 
 	/*
 	 * Check the given gid, if any
 	 */
-	if (a_gid != NULL) {
-		gid = (gid_t) atol(a_gid->val);
-
-		if ((grp = GETGRGID(gid)) != NULL && getarg(args, 'o') == NULL)
-			errx(EX_DATAERR, "gid `%u' has already been allocated", grp->gr_gid);
-	} else {
-		struct bitmap   bm;
-
-		/*
-		 * We need to allocate the next available gid under one of
-		 * two policies a) Grab the first unused gid b) Grab the
-		 * highest possible unused gid
-		 */
-		if (cnf->min_gid >= cnf->max_gid) {	/* Sanity claus^H^H^H^Hheck */
-			cnf->min_gid = 1000;
-			cnf->max_gid = 32000;
-		}
-		bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1);
+	if (id > 0) {
+		gid = (gid_t) id;
 
-		/*
-		 * Now, let's fill the bitmap from the password file
-		 */
-		SETGRENT();
-		while ((grp = GETGRENT()) != NULL)
-			if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid &&
-                            (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid)
-				bm_setbit(&bm, grp->gr_gid - cnf->min_gid);
-		ENDGRENT();
+		if ((grp = GETGRGID(gid)) != NULL && conf.checkduplicate)
+			errx(EX_DATAERR, "gid `%ju' has already been allocated",
+			    (uintmax_t)grp->gr_gid);
+		return (gid);
+	}
 
-		/*
-		 * Then apply the policy, with fallback to reuse if necessary
-		 */
-		if (cnf->reuse_gids)
-			gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
-		else {
-			gid = (gid_t) (bm_lastset(&bm) + 1);
-			if (!bm_isset(&bm, gid))
-				gid += cnf->min_gid;
-			else
-				gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
-		}
+	/*
+	 * We need to allocate the next available gid under one of
+	 * two policies a) Grab the first unused gid b) Grab the
+	 * highest possible unused gid
+	 */
+	if (cnf->min_gid >= cnf->max_gid) {	/* Sanity claus^H^H^H^Hheck */
+		cnf->min_gid = 1000;
+		cnf->max_gid = 32000;
+	}
+	bm = bm_alloc(cnf->max_gid - cnf->min_gid + 1);
+
+	/*
+	 * Now, let's fill the bitmap from the password file
+	 */
+	SETGRENT();
+	while ((grp = GETGRENT()) != NULL)
+		if ((gid_t)grp->gr_gid >= (gid_t)cnf->min_gid &&
+		    (gid_t)grp->gr_gid <= (gid_t)cnf->max_gid)
+			bm_setbit(&bm, grp->gr_gid - cnf->min_gid);
+	ENDGRENT();
 
-		/*
-		 * Another sanity check
-		 */
-		if (gid < cnf->min_gid || gid > cnf->max_gid)
-			errx(EX_SOFTWARE, "unable to allocate a new gid - range fully used");
-		bm_dealloc(&bm);
+	/*
+	 * Then apply the policy, with fallback to reuse if necessary
+	 */
+	if (cnf->reuse_gids)
+		gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
+	else {
+		gid = (gid_t) (bm_lastset(&bm) + 1);
+		if (!bm_isset(&bm, gid))
+			gid += cnf->min_gid;
+		else
+			gid = (gid_t) (bm_firstunset(&bm) + cnf->min_gid);
 	}
-	return gid;
-}
 
+	/*
+	 * Another sanity check
+	 */
+	if (gid < cnf->min_gid || gid > cnf->max_gid)
+		errx(EX_SOFTWARE, "unable to allocate a new gid - range fully "
+		    "used");
+	bm_dealloc(&bm);
+	return (gid);
+}
 
 static int
-print_group(struct group * grp, int pretty)
+print_group(struct group * grp, bool pretty)
 {
-	if (!pretty) {
-		char           *buf = NULL;
-
-		buf = gr_make(grp);
-		printf("%s\n", buf);
-		free(buf);
-	} else {
-		int             i;
+	char *buf = NULL;
+	int i;
 
+	if (pretty) {
 		printf("Group Name: %-15s   #%lu\n"
 		       "   Members: ",
 		       grp->gr_name, (long) grp->gr_gid);
@@ -431,6 +246,451 @@ print_group(struct group * grp, int pretty)
 				printf("%s%s", i ? "," : "", grp->gr_mem[i]);
 		}
 		fputs("\n\n", stdout);
+		return (EXIT_SUCCESS);
+	}
+
+	buf = gr_make(grp);
+	printf("%s\n", buf);
+	free(buf);
+	return (EXIT_SUCCESS);
+}
+
+int
+pw_group_next(int argc, char **argv, char *arg1 __unused)
+{
+	struct userconf *cnf;
+	const char *cfg = NULL;
+	int ch;
+	bool quiet = false;
+
+	while ((ch = getopt(argc, argv, "C:q")) != -1) {
+		switch (ch) {
+		case 'C':
+			cfg = optarg;
+			break;
+		case 'q':
+			quiet = true;
+			break;
+		}
 	}
-	return EXIT_SUCCESS;
+
+	if (quiet)
+		freopen(_PATH_DEVNULL, "w", stderr);
+	cnf = get_userconfig(cfg);
+	return (pw_groupnext(cnf, quiet));
+}
+
+int
+pw_group_show(int argc, char **argv, char *arg1)
+{
+	struct group *grp = NULL;
+	char *name = NULL;
+	intmax_t id = -1;
+	int ch;
+	bool all, force, quiet, pretty;
+
+	all = force = quiet = pretty = false;
+
+	struct group fakegroup = {
+		"nogroup",
+		"*",
+		-1,
+		NULL
+	};
+
+	if (arg1 != NULL) {
+		if (arg1[strspn(arg1, "0123456789")] == '\0')
+			id = pw_checkid(arg1, GID_MAX);
+		else
+			name = arg1;
+	}
+
+	while ((ch = getopt(argc, argv, "C:qn:g:FPa")) != -1) {
+		switch (ch) {
+		case 'C':
+			/* ignore compatibility */
+			break;
+		case 'q':
+			quiet = true;
+			break;
+		case 'n':
+			name = optarg;
+			break;
+		case 'g':
+			id = pw_checkid(optarg, GID_MAX);
+			break;
+		case 'F':
+			force = true;
+			break;
+		case 'P':
+			pretty = true;
+			break;
+		case 'a':
+			all = true;
+			break;
+		}
+	}
+
+	if (quiet)
+		freopen(_PATH_DEVNULL, "w", stderr);
+
+	if (all) {
+		SETGRENT();
+		while ((grp = GETGRENT()) != NULL)
+			print_group(grp, pretty);
+		ENDGRENT();
+		return (EXIT_SUCCESS);
+	}
+
+	grp = getgroup(name, id, !force);
+	if (grp == NULL)
+		grp = &fakegroup;
+
+	return (print_group(grp, pretty));
+}
+
+int
+pw_group_del(int argc, char **argv, char *arg1)
+{
+	struct userconf *cnf = NULL;
+	struct group *grp = NULL;
+	char *name;
+	const char *cfg = NULL;
+	intmax_t id = -1;
+	int ch, rc;
+	bool quiet = false;
+	bool nis = false;
+
+	if (arg1 != NULL) {
+		if (arg1[strspn(arg1, "0123456789")] == '\0')
+			id = pw_checkid(arg1, GID_MAX);
+		else
+			name = arg1;
+	}
+
+	while ((ch = getopt(argc, argv, "C:qn:g:Y")) != -1) {
+		switch (ch) {
+		case 'C':
+			cfg = optarg;
+			break;
+		case 'q':
+			quiet = true;
+			break;
+		case 'n':
+			name = optarg;
+			break;
+		case 'g':
+			id = pw_checkid(optarg, GID_MAX);
+			break;
+		case 'Y':
+			nis = true;
+			break;
+		}
+	}
+
+	if (quiet)
+		freopen(_PATH_DEVNULL, "w", stderr);
+	grp = getgroup(name, id, true);
+	cnf = get_userconfig(cfg);
+	rc = delgrent(grp);
+	if (rc == -1)
+		err(EX_IOERR, "group '%s' not available (NIS?)", name);
+	else if (rc != 0)
+		err(EX_IOERR, "group update");
+	pw_log(cnf, M_DELETE, W_GROUP, "%s(%ju) removed", name,
+	    (uintmax_t)id);
+
+	if (nis && nis_update() == 0)
+		pw_log(cnf, M_DELETE, W_GROUP, "NIS maps updated");
+
+	return (EXIT_SUCCESS);
+}
+
+static bool
+grp_has_member(struct group *grp, const char *name)
+{
+	int j;
+
+	for (j = 0; grp->gr_mem != NULL && grp->gr_mem[j] != NULL; j++)
+		if (strcmp(grp->gr_mem[j], name) == 0)
+			return (true);
+	return (false);
+}
+
+static void
+grp_add_members(struct group **grp, char *members)
+{
+	struct passwd *pwd;
+	char *p;
+	char tok[] = ", \t";
+
+	if (members == NULL)
+		return;
+	for (p = strtok(members, tok); p != NULL; p = strtok(NULL, tok)) {
+		pwd = lookup_pwent(p);
+		if (grp_has_member(*grp, pwd->pw_name))
+			continue;
+		*grp = gr_add(*grp, pwd->pw_name);
+	}
+}
+
+int
+groupadd(struct userconf *cnf, char *name, gid_t id, char *members, int fd,
+    bool dryrun, bool pretty, bool precrypted)
+{
+	struct group *grp;
+	int rc;
+
+	struct group fakegroup = {
+		"nogroup",
+		"*",
+		-1,
+		NULL
+	};
+
+	grp = &fakegroup;
+	grp->gr_name = pw_checkname(name, 0);
+	grp->gr_passwd = "*";
+	grp->gr_gid = gr_gidpolicy(cnf, id);
+	grp->gr_mem = NULL;
+
+	/*
+	 * This allows us to set a group password Group passwords is an
+	 * antique idea, rarely used and insecure (no secure database) Should
+	 * be discouraged, but it is apparently still supported by some
+	 * software.
+	 */
+	grp_set_passwd(grp, false, fd, precrypted);
+	grp_add_members(&grp, members);
+	if (dryrun)
+		return (print_group(grp, pretty));
+
+	if ((rc = addgrent(grp)) != 0) {
+		if (rc == -1)
+			errx(EX_IOERR, "group '%s' already exists",
+			    grp->gr_name);
+		else
+			err(EX_IOERR, "group update");
+	}
+
+	pw_log(cnf, M_ADD, W_GROUP, "%s(%ju)", grp->gr_name,
+	    (uintmax_t)grp->gr_gid);
+
+	return (EXIT_SUCCESS);
+}
+
+int
+pw_group_add(int argc, char **argv, char *arg1)
+{
+	struct userconf *cnf = NULL;
+	char *name = NULL;
+	char *members = NULL;
+	const char *cfg = NULL;
+	intmax_t id = -1;
+	int ch, rc, fd = -1;
+	bool quiet, precrypted, dryrun, pretty, nis;
+
+	quiet = precrypted = dryrun = pretty = nis = false;
+
+	if (arg1 != NULL) {
+		if (arg1[strspn(arg1, "0123456789")] == '\0')
+			id = pw_checkid(arg1, GID_MAX);
+		else
+			name = arg1;
+	}
+
+	while ((ch = getopt(argc, argv, "C:qn:g:h:H:M:oNPY")) != -1) {
+		switch (ch) {
+		case 'C':
+			cfg = optarg;
+			break;
+		case 'q':
+			quiet = true;
+			break;
+		case 'n':
+			name = optarg;
+			break;
+		case 'g':
+			id = pw_checkid(optarg, GID_MAX);
+			break;
+		case 'H':
+			if (fd != -1)
+				errx(EX_USAGE, "'-h' and '-H' are mutually "
+				    "exclusive options");
+			fd = pw_checkfd(optarg);
+			precrypted = true;
+			if (fd == '-')
+				errx(EX_USAGE, "-H expects a file descriptor");
+			break;
+		case 'h':
+			if (fd != -1)
+				errx(EX_USAGE, "'-h' and '-H' are mutually "
+				    "exclusive options");
+			fd = pw_checkfd(optarg);
+			break;
+		case 'M':
+			members = optarg;
+			break;
+		case 'o':
+			conf.checkduplicate = false;
+			break;
+		case 'N':
+			dryrun = true;
+			break;
+		case 'P':
+			pretty = true;
+			break;
+		case 'Y':
+			nis = true;
+			break;
+		}
+	}
+
+	if (quiet)
+		freopen(_PATH_DEVNULL, "w", stderr);
+	if (name == NULL)
+		errx(EX_DATAERR, "group name required");
+	if (GETGRNAM(name) != NULL)
+		errx(EX_DATAERR, "group name `%s' already exists", name);
+	cnf = get_userconfig(cfg);
+	rc = groupadd(cnf, name, gr_gidpolicy(cnf, id), members, fd, dryrun,
+	    pretty, precrypted);
+	if (nis && rc == EXIT_SUCCESS && nis_update() == 0)
+		pw_log(cnf, M_ADD, W_GROUP, "NIS maps updated");
+
+	return (rc);
+}
+
+int
+pw_group_mod(int argc, char **argv, char *arg1)
+{
+	struct userconf *cnf;
+	struct group *grp = NULL;
+	const char *cfg = NULL;
+	char *oldmembers = NULL;
+	char *members = NULL;
+	char *newmembers = NULL;
+	char *newname = NULL;
+	char *name = NULL;
+	intmax_t id = -1;
+	int ch, rc, fd = -1;
+	bool quiet, pretty, dryrun, nis, precrypted;
+
+	quiet = pretty = dryrun = nis = precrypted = false;
+
+	if (arg1 != NULL) {
+		if (arg1[strspn(arg1, "0123456789")] == '\0')
+			id = pw_checkid(arg1, GID_MAX);
+		else
+			name = arg1;
+	}
+
+	while ((ch = getopt(argc, argv, "C:qn:d:g:l:h:H:M:m:NPY")) != -1) {
+		switch (ch) {
+		case 'C':
+			cfg = optarg;
+			break;
+		case 'q':
+			quiet = true;
+			break;
+		case 'n':
+			name = optarg;
+			break;
+		case 'g':
+			id = pw_checkid(optarg, GID_MAX);
+			break;
+		case 'd':
+			oldmembers = optarg;
+			break;
+		case 'l':
+			newname = optarg;
+			break;
+		case 'H':
+			if (fd != -1)
+				errx(EX_USAGE, "'-h' and '-H' are mutually "
+				    "exclusive options");
+			fd = pw_checkfd(optarg);
+			precrypted = true;
+			if (fd == '-')
+				errx(EX_USAGE, "-H expects a file descriptor");
+			break;
+		case 'h':
+			if (fd != -1)
+				errx(EX_USAGE, "'-h' and '-H' are mutually "
+				    "exclusive options");
+			fd = pw_checkfd(optarg);
+			break;
+		case 'M':
+			members = optarg;
+			break;
+		case 'm':
+			newmembers = optarg;
+			break;
+		case 'N':
+			dryrun = true;
+			break;
+		case 'P':
+			pretty = true;
+			break;
+		case 'Y':
+			nis = true;
+			break;
+		}
+	}
+	if (quiet)
+		freopen(_PATH_DEVNULL, "w", stderr);
+	cnf = get_userconfig(cfg);
+	grp = getgroup(name, id, true);
+	if (name == NULL)
+		name = grp->gr_name;
+	if (id > 0)
+		grp->gr_gid = id;
+
+	if (newname != NULL)
+		grp->gr_name = pw_checkname(newname, 0);
+
+	grp_set_passwd(grp, true, fd, precrypted);
+	/*
+	 * Keep the same logic as old code for now:
+	 * if -M is passed, -d and -m are ignored
+	 * then id -d, -m is ignored
+	 * last is -m
+	 */
+
+	if (members) {
+		grp->gr_mem = NULL;
+		grp_add_members(&grp, members);
+	} else if (oldmembers) {
+		delete_members(grp, oldmembers);
+	} else if (newmembers) {
+		grp_add_members(&grp, newmembers);
+	}
+
+	if (dryrun) {
+		print_group(grp, pretty);
+		return (EXIT_SUCCESS);
+	}
+
+	if ((rc = chggrent(name, grp)) != 0) {
+		if (rc == -1)
+			errx(EX_IOERR, "group '%s' not available (NIS?)",
+			    grp->gr_name);
+		else
+			err(EX_IOERR, "group update");
+	}
+
+	if (newname)
+		name = newname;
+
+	/* grp may have been invalidated */
+	if ((grp = GETGRNAM(name)) == NULL)
+		errx(EX_SOFTWARE, "group disappeared during update");
+
+	pw_log(cnf, M_UPDATE, W_GROUP, "%s(%ju)", grp->gr_name,
+	    (uintmax_t)grp->gr_gid);
+
+	if (nis && nis_update() == 0)
+		pw_log(cnf, M_UPDATE, W_GROUP, "NIS maps updated");
+
+	return (EXIT_SUCCESS);
 }