diff options
| author |   Baptiste Daroussin <bapt@FreeBSD.org> | 2014-10-28 14:54:04 +0000 |
|---|---|---|
| committer | Baptiste Daroussin <bapt@FreeBSD.org> | 2014-10-28 14:54:04 +0000 |
| commit | 85717372d65dd2fe05ea2b086c24f03cbe7d1206 (patch) | |
| tree | 83c0bdb85e1364b4f9ac99d390b9abeec4775489 /pw | |
| parent | c61c6f66352171814a5d114527357d837df5cad9 (diff) | |
| download | pw-darwin-85717372d65dd2fe05ea2b086c24f03cbe7d1206.tar.gz pw-darwin-85717372d65dd2fe05ea2b086c24f03cbe7d1206.tar.zst pw-darwin-85717372d65dd2fe05ea2b086c24f03cbe7d1206.zip | |
Do not delete the group wheel when bad argument is passed to pw groupdel -g
Check that the -g argument is actually a number, if not report an error.
This argument is converted without checking with atoi(3) later so without this
check it converts any alpha entries into 0 meaning it deletes the group wheel
Add a regression test about it
PR: 90114
Reported by: bkoenig@cs.tu-berlin.de
MFC after: 1 week
Diffstat (limited to 'pw')
| -rw-r--r-- | pw/pw_group.c | 5 | ||||
| -rwxr-xr-x | pw/tests/pw_delete.sh | 12 |
2 files changed, 17 insertions, 0 deletions
diff --git a/pw/pw_group.c b/pw/pw_group.c index 4ed6ea9..b20ce88 100644 --- a/pw/pw_group.c +++ b/pw/pw_group.c @@ -67,6 +67,11 @@ pw_group(struct userconf * cnf, int mode, struct cargs * args) NULL }; + if (a_gid != NULL) { + if (strspn(a_gid->val, "0123456789") != strlen(a_gid->val)) + errx(EX_USAGE, "-g expects a number"); + } + if (mode == M_LOCK || mode == M_UNLOCK) errx(EX_USAGE, "'lock' command is not available for groups"); diff --git a/pw/tests/pw_delete.sh b/pw/tests/pw_delete.sh index 0636629..6ebbf24 100755 --- a/pw/tests/pw_delete.sh +++ b/pw/tests/pw_delete.sh @@ -18,7 +18,19 @@ rmuser_seperate_group_body() { pw -V ${HOME} userdel test || atf_fail "delete the user" } +atf_test_case group_do_not_delete_wheel_if_group_unkown +group_do_not_delete_wheel_if_group_unkown_head() { + atf_set "descr" "Make sure we do not consider as gid 0 an unknown group" +} + +group_do_not_delete_wheel_if_group_unkown_body() { + populate_etc_skel + atf_check -s exit:0 -o inline:"wheel:*:0:root\n" -x pw -V ${HOME} groupshow wheel + atf_check -e inline:"pw: -g expects a number\n" -s exit:64 -x pw -V ${HOME} groupdel -g I_do_not_exist + atf_check -s exit:0 -o "wheel:*:0:root\n" -x pw -V ${HOME} groupshow wheel +} atf_init_test_cases() { atf_add_test_case rmuser_seperate_group + atf_add_test_case group_do_not_delete_wheel_if_group_unkown } |