|
Server IP : 161.35.85.9 / Your IP : 216.73.217.134 Web Server : nginx/1.30.1 System : Linux cheapdeb-ams3 7.0.9+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.0.9-1 (2026-05-22) x86_64 User : root ( 0) PHP Version : 8.2.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON Directory (0755) : /usr/share/java/../../sbin/ |
| [ Home ] | [ C0mmand ] | [ Upload File ] |
|---|
#! /usr/bin/perl -T
# Copyright (C) 1994 Debian Association, Inc.
# 1995 Ted Hajek <tedhajek@boombox.micro.umn.edu>
# 1995 Ian A. Murdock <imurdock@debian.org>
# 1997-1999 Guy Maor <maor@debian.org>
# 2000-2004 Roland Bauerschmidt <rb@debian.org>
# 2004-2025 Marc Haber <mh+debian-packages@zugschlus.de>
# 2005-2009 Joerg Hoh <joerg@joerghoh.de>
# 2006-2011 Stephen Gran <sgran@debian.org>
# 2016 Dr. Helge Kreutzmann <debian@helgefjell.de>
# 2016-2017 Afif Elghraoui <afif@debian.org>
# 2021-2022 Jason Franklin <jason@oneway.dev>
# 2022 Matt Barry <matt@hazelmollusk.org>
# 2022 Benjamin Drung <benjamin.drung@canonical.com>
# 2023 Guillem Jover <guillem@debian.org>
#
# Original adduser:
# Copyright (C) 1997-1999 Guy Maor <maor@debian.org>
#
# Copyright (C) 1995 Ted Hajek <tedhajek@boombox.micro.umn.edu>
# Ian A. Murdock <imurdock@gnu.ai.mit.edu>
#
# The general scheme of this program was adapted from the original
# Debian "adduser" program by Ian A. Murdock <imurdock@gnu.ai.mit.edu>.
#
# License: GPL-2+
use 5.36.0;
use utf8;
use Getopt::Long;
use Debian::AdduserCommon 3.139;
use Debian::AdduserLogging 3.139;
use Debian::AdduserRetvalues 3.139;
use Debian::AdduserStatefile 3.139;
use Debian::AdduserCreateHomedir 3.139;
BEGIN {
if ( Debian::AdduserCommon->VERSION != version->declare('3.139') ||
Debian::AdduserLogging->VERSION != version->declare('3.139') ||
Debian::AdduserRetvalues->VERSION != version->declare('3.139') ) {
die "wrong module version in adduser, check your packaging or path";
}
}
my $version = "3.155";
my $encode_loaded;
my $codeset;
# explicitly set PATH, because super (1) cleans up the path and makes adduser unusable;
# this is also a good idea for sudo (which doesn't clean up)
$ENV{"PATH"}="/bin:/usr/bin:/sbin:/usr/sbin";
$ENV{"IFS"}=" \t\n";
$ENV{"ENV"}=undef;
$ENV{"BASH_ENV"}=undef;
$ENV{"CDPATH"}=undef;
BEGIN {
local $ENV{PERL_DL_NONLAZY}=1;
eval {
require POSIX;
POSIX->import(qw(setlocale));
};
if ($@) {
*setlocale = sub { return 1 };
} else {
setlocale( &POSIX::LC_MESSAGES, "" );
}
eval {
require Encode;
Encode->import(qw(encode decode));
};
$encode_loaded = 1;
if ($@) {
$encode_loaded = 0;
*encode = sub { return $_[1]; };
*decode = sub { return $_[1]; };
}
$codeset = "US-ASCII";
eval {
require I18N::Langinfo;
I18N::Langinfo->import(qw(langinfo CODESET YESEXPR NOEXPR));
$codeset = I18N::Langinfo->CODESET;
};
if ($@) {
*langinfo = sub { return shift; };
*YESEXPR = sub { "^[yY]" };
*NOEXPR = sub { "^[nN]" };
}
}
my $yesexpr = langinfo(YESEXPR());
my $charset = langinfo($codeset);
if ($encode_loaded) {
binmode(STDOUT, ":encoding($charset)");
binmode(STDERR, ":encoding($charset)");
}
my %config = ();
my $nogroup_id = egetgrnam("nogroup") || 65534;
$0 =~ s+.*/++;
our $action;
our $verbose; # should we be verbose?
my $name_check_level = 0; # should we allow bad names?
our $stdoutmsglevel = undef;
our $stderrmsglevel = undef;
our $logmsglevel = undef;
my $allow_badname = 0; # should we allow bad names?
my $ask_passwd = 1; # ask for a passwd?
my $disabled_login = 0; # leave the new account disabled?
our @configfiles;
our $found_group_opt = undef;
our $found_sys_opt = undef;
our $found_unlock_opt = undef;
our $ingroup_name = undef;
our $new_firstgid = undef;
our $new_firstuid = undef;
our $comment_tainted = undef;
our $gid_option = undef;
our $primary_gid = undef;
our $new_lastgid = undef;
our $new_lastuid = undef;
our $new_uid = undef;
our $no_create_home = undef;
our $no_copy_skel = undef;
our $special_home = undef;
our $special_shell = undef;
our $add_extra_groups;
our $add_extra_groups_old;
# Global variables we need later
my $existing_user = undef;
my $existing_group = undef;
my $new_name = undef;
my $make_group_also = 0;
my $home_dir = undef;
my $undohome = undef;
my $undouser = undef;
my $undogroup = undef;
my $shell = undef;
my $first_uid = undef;
my $last_uid = undef;
my $first_gid = undef;
my $last_gid = undef;
my $dir_mode = undef;
my $perm = undef;
my %uid_pool;
my %gid_pool;
my %reserved_uid_pool;
my %reserved_gid_pool;
my $returnvalue = RET_OK;
our @names;
log_trace("ARGV %s", join(@ARGV,"-"));
GetOptions(
'add-extra-groups' => \$add_extra_groups,
'add_extra_groups' => \$add_extra_groups_old,
'allow-all-names' => sub { $name_check_level = 2 },
'allow-badname' => sub { $name_check_level = 1 unless $name_check_level },
'allow-bad-names' => sub { $name_check_level = 1 unless $name_check_level },
'comment:s' => \$comment_tainted,
'conf|c=s' => \@configfiles,
'debug' => sub { $verbose = 2; },
'stdoutmsglevel=s' => \$stdoutmsglevel,
'stderrmsglevel=s' => \$stderrmsglevel,
'logmsglevel=s' => \$logmsglevel,
'disabled-login' => sub { $disabled_login = 1; $ask_passwd = 0 },
'disabled-password' => sub { $ask_passwd = 0 },
'firstgid=i' => \$new_firstgid,
'firstuid=i' => \$new_firstuid,
'force-badname' => sub { $name_check_level = 1 unless $name_check_level },
'gecos:s' => \$comment_tainted,
'gid=i' => \$gid_option,
'group' => \$found_group_opt,
'help|h' => sub { &usage; exit 0; },
'home=s' => \$special_home,
'ingroup=s' => \$ingroup_name,
'lastgid=i' => \$new_lastgid,
'lastuid=i' => \$new_lastuid,
'no-create-home' => \$no_create_home,
'no-copy-skel' => \$no_copy_skel,
'quiet|q' => sub { $verbose = 0; },
'shell=s' => \$special_shell,
'system' => \$found_sys_opt,
'uid=i' => \$new_uid,
'unlock' => \$found_unlock_opt,
'verbose' => sub { $verbose = 1; },
'version|v' => sub { &version; exit },
) or &usage_error;
log_trace("ARGV %s", join(@ARGV,"-"));
# make sure that message levels apply for reading configuration
# this will be overridden again after reading configuration
set_msglevel(
sanitize_string($stderrmsglevel or STDERRDEFLEVEL),
sanitize_string($stdoutmsglevel or STDOUTDEFLEVEL),
sanitize_string($logmsglevel or LOGMSGDEFLEVEL),
);
log_trace("ARGV %s", join(@ARGV,"-"));
log_trace("special_home %s", $special_home);
log_trace("special_home %s", encode($charset, $special_home));
log_trace("special_home %s", decode($charset, $special_home));
##########################################################
# (1) read the config
# (2) read the default /etc/adduser.conf configuration.
# (3) read the default /etc/deluser.conf configuration.
# (4) process commmand line settings
# last match wins
##########################################################
unless (@configfiles) {
@configfiles = ("/etc/adduser.conf");
}
@configfiles = decode($charset, $_) for @configfiles;
%config = read_config(@configfiles);
# everyone can issue "--help" and "--version", but only root can go on
if( $> != 0) {
log_fatal( mtx("Only root may add a user or group to the system.") );
exit( RET_ROOT_NEEDED );
}
# ARGV > adduser.conf > (default)
$stdoutmsglevel //= $config{'stdoutmsglevel'};
$stdoutmsglevel //= STDOUTDEFLEVEL;
$stderrmsglevel //= $config{'stderrmsglevel'};
$stderrmsglevel //= STDERRDEFLEVEL;
$logmsglevel //= $config{'logmsglevel'};
$logmsglevel //= LOGMSGDEFLEVEL;
$stdoutmsglevel = sanitize_string($stdoutmsglevel);
$stderrmsglevel = sanitize_string($stderrmsglevel);
$logmsglevel = sanitize_string($logmsglevel);
set_msglevel( $stderrmsglevel, $stdoutmsglevel, $logmsglevel );
if( defined $verbose ) {
if( $verbose == 0 ) {
set_msglevel( $stderrmsglevel, "error", $logmsglevel );
} elsif( $verbose == 1 ) {
set_msglevel( $stderrmsglevel, "info", $logmsglevel );
} elsif( $verbose == 2 ) {
set_msglevel( $stdoutmsglevel, "debug", $logmsglevel );
set_msglevel( $stderrmsglevel, "debug", $logmsglevel );
}
}
# detect the operation mode
$action = $0 eq "addgroup" ? "addgroup" : "adduser";
if (defined($found_sys_opt)) {
$action = "addsysuser" if ($action eq "adduser");
$action = "addsysgroup" if ($action eq "addgroup");
}
log_trace("action $action");
############################
# checks related to @names #
############################
log_trace("ARGV %s", join(@ARGV,"-"));
while (defined(my $arg = shift(@ARGV))) {
$arg = decode($charset, $arg);
log_trace("process argument %s", $arg);
if (defined($names[0]) && $arg =~ /^--/) {
log_fatal( mtx("No options allowed after names.") );
exit( RET_INVALID_CALL );
} else { # it's a username
log_trace("add argument %s to \@names", $arg);
push (@names, $arg);
}
}
if ( (! defined $names[0]) || length($names[0]) == 0 || @names > 2) {
log_fatal( mtx("Only one or two names allowed.") );
exit( RET_INVALID_CALL );
}
if (@names == 2) { # must be addusertogroup
if ($action eq "addsysuser" || $found_group_opt) {
log_fatal( mtx("Specify only one name in this mode.") );
exit( RET_INVALID_CALL );
}
if ($action eq "addgroup" or $action eq "addsysgroup") {
log_fatal( mtx("addgroup with two arguments is an unspecified operation.") );
exit( RET_INVALID_CALL );
}
$action = "addusertogroup";
$existing_user = sanitize_string( shift (@names), anynamere );
$existing_group = sanitize_string( shift (@names), anynamere );
}
else { # 1 parameter, must be adduser
$new_name = sanitize_name( shift (@names) );
log_trace("sanitized new_name %s", $new_name);
}
undef(@names);
# TODO: map this to log levels
$ENV{"VERBOSE"} = $verbose;
$ENV{"DEBUG"} = $verbose;
###################################
# check for consistent parameters #
###################################
if (!defined $add_extra_groups) {
if( defined $add_extra_groups_old ) {
$add_extra_groups = $add_extra_groups_old;
} else {
$add_extra_groups = 0;
}
}
if ($action ne "addgroup" &&
defined($found_group_opt) +defined($ingroup_name) +defined($gid_option) > 1 ) {
log_fatal( mtx("The --group, --ingroup, and --gid options are mutually exclusive.") );
exit( RET_EXCLUSIVE_PARAMETERS );
}
if ($found_group_opt) {
if ($action eq "addsysuser") {
$make_group_also = 1;
}
elsif ($found_sys_opt) {
$action = "addsysgroup";
}
else {
$action = "addgroup";
}
}
if ($found_unlock_opt) {
$action = "unlockuser";
}
# $new_firstuid = $new_firstuid || $config{"first_uid"} || 1000;
# $new_lastuid = $new_lastuid || $config{"last_uid"} || 59999;
# $new_firstgid = $new_firstgid || $config{"first_gid"} || 1000;
# $new_lastgid = $new_lastgid || $config{"last_gid"} || 59999;
# $new_firstuid = $new_firstuid || $config{"first_uid"} || 1000;
# $new_lastuid = $new_lastuid || $config{"last_uid"} || 59999;
# $new_firstgid = $new_firstgid || $config{"first_gid"} || 1000;
# $new_lastgid = $new_lastgid || $config{"last_gid"} || 59999;
# read the uid and gid pool
if ($config{"uid_pool"}) {
read_pool ($config{"uid_pool"}, "uid", \%uid_pool);
if ($config{"reserve_uid_pool"} ne "no") {
%reserved_uid_pool = map {$uid_pool{$_}{id} => $_} keys %uid_pool;
}
}
if ($config{"gid_pool"}) {
read_pool ($config{"gid_pool"}, "gid", \%gid_pool);
if ($config{"reserve_gid_pool"} ne "no") {
%reserved_gid_pool = map {$gid_pool{$_}{id} => $_} keys %gid_pool;
}
}
if( defined $ingroup_name ) {
log_trace("sanitize ingroup_name");
$ingroup_name = sanitize_name( decode($charset, $ingroup_name));
}
if( defined $special_home ) {
log_trace("sanitize special_home %s", $special_home);
$special_home = sanitize_string( decode($charset, $special_home), simplepathre);
}
if ( defined $comment_tainted ) {
log_trace("check comment %s for unwanted chars", $special_home);
# do not sanitize, can't be done without libperl
if ( $comment_tainted !~ qr/^([^\x00-\x1F\x7F:]*)$/ ) {
log_fatal( mtx("unwanted chars in comment") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
}
if( defined $special_shell ) {
log_trace("sanitize special_shell");
$special_shell = sanitize_string( decode($charset, $special_shell), simplepathre);
}
if( defined $new_firstgid ) {
log_trace("sanitize new_firstgid");
$new_firstgid = sanitize_string($new_firstgid, numberre);
}
if( defined $new_lastgid ) {
log_trace("sanitize new_lastgid");
$new_lastgid = sanitize_string($new_lastgid, numberre);
}
if( defined $new_firstuid ) {
log_trace("sanitize new_firstuid");
$new_firstuid = sanitize_string($new_firstuid, numberre);
}
if( defined $new_lastuid ) {
log_trace("sanitize new_lastuid");
$new_lastuid = sanitize_string($new_lastuid, numberre);
}
if( defined $new_uid ) {
log_trace("sanitize new_uid");
$new_uid = sanitize_string($new_uid, numberre);
}
if( defined $gid_option ) {
log_trace("sanitize gid_option");
$gid_option = sanitize_string($gid_option, numberre);
}
if ((defined($special_home)) && ($special_home !~ m+^/+ )) {
log_fatal( mtx("The home dir must be an absolute path.") );
exit( RET_INVALID_HOME_DIRECTORY );
}
$SIG{'INT'} = $SIG{'QUIT'} = $SIG{'HUP'} = 'handler';
#####
# OK, we've processed the arguments. $action equals one of the following,
# and the appropriate variables have been set:
#
# $action = "adduser"
# $new_name - the name of the new user.
# $ingroup_name | $gid_option - the group to add the user to
# $special_home, $new_uid, $comment_tainted - optional overrides
# $action = "addgroup"
# $new_name - the name of the new group
# $gid_option - optional override
# $action = "addsysgroup"
# $new_name - the name of the new group
# $gid_option - optional override
# $action = "addsysuser"
# $new_name - the name of the new user
# $make_group_also | $ingroup_name | $gid_option | 0 - which group
# $special_home, $new_uid, $comment_tainted - optional overrides
# $action = "addusertogroup"
# $existing_user - the user to be added
# $existing_group - the group to add her to
# $action = "unlockuser"
# $new_name - the user to be unlocked
#####
#################
## addsysgroup ##
#################
if ($action eq "addsysgroup") {
acquire_lock();
log_trace( "addsysuser %s, uid %s", $new_name, $new_uid );
# Check if requested group already exists and we can exit safely
my $asgret = existing_group_status(\%config, $new_name, $gid_option);
log_trace( "existing_group_status( %s, %s ) returns %s", $new_name, $gid_option, $asgret );
if ($asgret & EXISTING_FOUND) {
# a group with this name already exists; it's a problem when it's not a system group
if ( ( $asgret & EXISTING_SYSTEM ) == 0 ) {
log_fatal( mtx("The group `%s' already exists, but is not a system group. Exiting."), $new_name );
exit( RET_WRONG_OBJECT_PROPERTIES );
}
}
if ($asgret & EXISTING_ID_MISMATCH) {
log_err( mtx("The group `%s' already exists, but has a different GID. Exiting."), $new_name );
exit( RET_WRONG_OBJECT_PROPERTIES );
}
if ($asgret & EXISTING_FOUND) {
log_info( mtx("The system group `%s' already exists. Exiting.\n"), $new_name );
exit( RET_OK );
}
if (defined($gid_option) && defined(getgrgid($gid_option))) {
log_fatal( mtx("The GID `%s' is already in use."), $gid_option );
exit( RET_ID_IN_USE );
}
if (!defined($gid_option)) {
$first_gid = $new_firstgid || $config{"first_system_gid"};
$last_gid = $new_lastgid || $config{"last_system_gid"};
$gid_option = &first_avail_gid($first_gid,
$last_gid,
$gid_pool{$new_name}{'id'});
if ($gid_option == -1) {
log_warn( mtx("No GID is available in the range %d-%d (FIRST_SYS_GID - LAST_SYS_GID)."),
$first_gid, $last_gid );
log_err( mtx("The group `%s' was not created."), $new_name );
exit( RET_NO_ID_IN_RANGE );
}
}
log_info( mtx("Adding group `%s' (GID %d) ..."), $new_name, $gid_option);
my $groupadd = which('groupadd');
my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
release_lock(0);
exit( $returnvalue );
}
##############
## addgroup ##
##############
if ($action eq "addgroup") {
acquire_lock();
if (defined egetgrnam(encode($charset, $new_name))) {
log_fatal( mtx("The group `%s' already exists."), $new_name);
exit( RET_OBJECT_EXISTS );
}
if (defined($gid_option) && defined(getgrgid($gid_option))) {
log_fatal( mtx("The GID `%s' is already in use."), $gid_option );
exit( RET_ID_IN_USE );
}
if (!defined($gid_option)) {
$first_gid = $new_firstgid || $config{"first_gid"};
$last_gid = $new_lastgid || $config{"last_gid"};
log_debug( "Searching for gid with first_gid=%s, last_gid=%s, new_name=%s, gid_pool=%s",
$first_gid,
$last_gid,
$new_name,
$gid_pool{$new_name}{'id'}
);
$gid_option = &first_avail_gid($first_gid,
$last_gid,
$gid_pool{$new_name}{'id'});
if ($gid_option == -1) {
log_warn( mtx("No GID is available in the range %d-%d (FIRST_GID - LAST_GID)."),
$first_gid, $last_gid );
log_fatal( mtx("The group `%s' was not created."), $new_name );
exit( RET_NO_ID_IN_RANGE );
}
}
log_info( mtx("Adding group `%s' (GID %d) ..."), $new_name, $gid_option);
my $groupadd = which('groupadd');
my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
release_lock(0);
exit( $returnvalue );
}
####################
## addusertogroup ##
####################
if ($action eq 'addusertogroup') {
if (!defined egetpwnam($existing_user)) {
log_fatal( mtx("The user `%s' does not exist."), $existing_user );
exit( RET_OBJECT_DOES_NOT_EXIST );
}
if (!defined egetgrnam($existing_group)) {
log_fatal( mtx("The group `%s' does not exist."), $existing_group );
exit( RET_OBJECT_DOES_NOT_EXIST );
}
if (&user_is_member($existing_user, $existing_group)) {
log_warn( mtx("The user `%s' is already a member of `%s'."), $existing_user, $existing_group );
exit( RET_OK );
}
log_info( mtx("Adding user `%s' to group `%s' ..."), $existing_user, $existing_group );
acquire_lock();
systemcall('/usr/sbin/usermod', '-a', '-G', $existing_group, $existing_user);
release_lock();
exit( $returnvalue );
}
################
## addsysuser ##
################
if ($action eq "addsysuser") {
acquire_lock();
log_trace( "addsysuser %s, uid %s", $new_name, $new_uid );
my $ret = existing_user_status(\%config, $new_name, $new_uid);
if ($ret & (EXISTING_FOUND)) {
# a user with this name already exists; it's a problem when it's not a system user
if ( ($ret & EXISTING_SYSTEM) == 0 ) {
log_fatal( mtx("The user `%s' already exists, but is not a system user. Exiting."), $new_name );
exit( RET_WRONG_OBJECT_PROPERTIES );
}
}
if ($ret & EXISTING_ID_MISMATCH) {
log_fatal( mtx("The user `%s' already exists with a different UID. Exiting."), $new_name );
exit( RET_WRONG_OBJECT_PROPERTIES );
}
if ($ret & EXISTING_HAS_PASSWORD) {
log_fatal( mtx("The user `%s' already exists and has a password. Exiting."), $new_name );
exit( RET_WRONG_OBJECT_PROPERTIES );
}
if ($ret & EXISTING_FOUND) {
if ($ret & EXISTING_LOCKED) {
unlock_user($new_name, 1);
}
log_info( mtx("The system user `%s' already exists. Exiting.\n"), $new_name );
exit( RET_OK );
}
if (!$ingroup_name && !defined($gid_option) && !$make_group_also) {
$gid_option = $nogroup_id;
}
check_user_group(1);
if (!defined($new_uid) && $make_group_also) {
$new_uid = &first_avail_uid($new_firstuid || $config{"first_system_uid"},
$new_lastuid || $config{"last_system_uid"},
$uid_pool{$new_name}{'id'});
if ($new_uid == -1) {
log_warn( mtx("No UID/GID pair is available in the range %d-%d (FIRST_SYS_UID - LAST_SYS_UID)."),
$config{"first_system_uid"},
$config{"last_system_uid"} );
log_fatal( mtx("The user `%s' was not created."), $new_name );
exit( RET_NO_ID_IN_RANGE );
}
$gid_option = &first_avail_gid($new_firstgid || $config{"first_system_gid"},
$new_lastgid || $config{"last_system_gid"},
$gid_pool{$new_name}{'id'});
$ingroup_name = $new_name;
}
elsif (!defined($new_uid) && !$make_group_also) {
$new_uid = &first_avail_uid($new_firstuid || $config{"first_system_uid"},
$new_lastuid || $config{"last_system_uid"},
$uid_pool{$new_name}{'id'});
if ($new_uid == -1) {
log_warn( mtx("No UID is available in the range %d-%d (FIRST_SYS_UID - LAST_SYS_UID)."),
$config{"first_system_uid"},
$config{"last_system_uid"} );
log_fatal( mtx("The user `%s' was not created."), $new_name);
exit( RET_NO_ID_IN_RANGE );
}
if (defined($gid_option)) {
$ingroup_name = getgrgid($gid_option);
} elsif ($ingroup_name) {
$gid_option = egetgrnam($ingroup_name);
} else {
log_fatal( mtx("Neither ingroup option nor gid given.") );
exit( RET_NO_PRIMARY_GROUP );
}
}
else {
if (defined($gid_option)) {
$ingroup_name = getgrgid($gid_option);
} elsif ($ingroup_name) {
$gid_option = egetgrnam($ingroup_name);
} elsif ($make_group_also) {
$gid_option=$new_uid; $ingroup_name=$new_name;
} else {
log_fatal( mtx("Neither ingroup option nor gid given and make_group_also unset.") );
exit( RET_NO_PRIMARY_GROUP );
}
}
log_info( mtx("Adding system user `%s' (UID %d) ..."), $new_name, $new_uid );
# if we reach this point, and the group does already exist, we can use it.
if ($make_group_also && !egetgrnam($new_name)) {
log_info( mtx("Adding new group `%s' (GID %d) ..."), $new_name, $gid_option );
$undogroup = $new_name;
my $groupadd = which('groupadd');
my $ga_ret = systemcall_useradd($name_check_level, $groupadd, '-g', $gid_option, $new_name);
if( $ga_ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
}
if (defined($special_home) && $special_home ne "/nonexistent" ) {
if (!defined($no_create_home) && -d $special_home) {
log_info( mtx("The home dir %s you specified already exists.\n"), $special_home );
}
if (defined($no_create_home) && ! -d $special_home) {
log_info( mtx("The home dir %s you specified can't be accessed: %s\n"), $special_home, $! );
}
}
log_info( mtx("Adding new user `%s' (UID %d) with group `%s' ..."),
$new_name, $new_uid, $ingroup_name );
$home_dir = $special_home || $uid_pool{$new_name}{'home'} || '/nonexistent';
$no_create_home = $home_dir =~ /^\/+nonexistent(\/|$)/ ? 1 : $no_create_home;
$shell = $special_shell || $uid_pool{$new_name}{'shell'} || '/usr/sbin/nologin';
$undouser = $new_name;
my $useradd = which('useradd');
my $ua_ret = systemcall_useradd($name_check_level,
$useradd,
'-r',
'-K', sprintf('SYS_UID_MIN=%d', $new_firstuid || $config{'first_system_uid'}),
'-K', sprintf('SYS_UID_MAX=%d', $new_lastuid || $config{'last_system_uid'}),
'-d', $home_dir,
'-g', $ingroup_name,
'-s', $shell,
'-u', $new_uid,
$new_name);
if( $ua_ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
release_lock(0);
if (defined($comment_tainted)) {
ch_comment($new_name, $comment_tainted);
} elsif ($uid_pool{$new_name}{'comment'}) {
ch_comment($new_name, $uid_pool{$new_name}{'comment'});
}
$primary_gid = $gid_option;
create_homedir(
home_dir => $home_dir,
uid => $new_uid,
gid => $gid_option,
copy_skeleton => 0,
system_user => 1,
no_create_home => $no_create_home,
dir_mode => $dir_mode,
config => \%config,
) or cleanup();
exit( $returnvalue );
}
#############
## adduser ##
#############
if ($action eq "adduser") {
acquire_lock();
$primary_gid=-1;
my @supplemental_groups=();
log_trace( "new_uid %s", $new_uid );
log_trace( "ingroup_name %s, gid_option %s", $ingroup_name, $gid_option );
log_trace( "usergroups %s", $config{"usergroups"} );
log_trace( "users_gid %s, users_group %s", $config{"users_gid"}, $config{"users_group"} );
log_trace( "primary_gid %s, supplemental groups %s", $primary_gid, join(", ",@supplemental_groups) );
if( defined($config{"users_gid"}) && defined($config{"users_group"}) ) {
log_warn ( mtx("USERS_GID and USERS_GROUP both given in configuration. This is an error.") );
log_fatal (mtx("The user `%s' was not created."),$new_name);
exit( RET_CONFIG_ERROR );
}
if ($config{"usergroups"} =~ /yes/i) {
log_trace( "config usergroups == yes code path" );
$make_group_also = 1;
if( $gid_option ) {
$make_group_also = 0;
$primary_gid = $gid_option;
log_trace( "gid_option defined %s, make_group_also 0, primary_gid=gid_option", $gid_option );
}
if( $ingroup_name ) {
$make_group_also = 0;
$primary_gid = egetgrnam($ingroup_name);
log_trace( "ingroup_name defined %s, make_group_also 0, primary_gid %s", $gid_option, $primary_gid );
}
log_trace( "make_group_also %s, primary_gid %s", $make_group_also, $primary_gid );
if( defined( $primary_gid) && $primary_gid == -1 && $make_group_also == 0 ) {
if (defined($config{"users_gid"}) && $config{"users_gid"} != -1) {
my @grgid=getgrgid($config{"users_gid"});
my $grname=$grgid[0];
log_debug( "set primary_gid to users_gid %s %s", $config{"users_gid"}, $grname);
$primary_gid = $config{"users_gid"};
} elsif (defined($config{"users_gid"}) && $config{"users_gid"} == -1) {
# nothing
} else {
my $primary_group="users";
if (defined($config{"users_group"})) {
$primary_group=$config{"users_group"};
}
$primary_gid=egetgrnam($primary_group);
log_debug( "set primary_gid to users_group %s %s", $primary_gid, $primary_group);
}
} else {
if (defined($config{"users_gid"}) && $config{"users_gid"} != -1) {
my @grgid=getgrgid($config{"users_gid"});
my $grname=$grgid[0];
log_trace( "push users_gid %s %s to supplemental_groups", $config{"users_gid"}, $grname);
push(@supplemental_groups, $grname);
} elsif (defined($config{"users_gid"}) && $config{"users_gid"} == -1) {
# nothing
} else {
my $supp_group="users";
if (defined($config{"users_group"})) {
$supp_group=$config{"users_group"};
}
log_trace( "push %s to supplemental_groups", $supp_group );
push(@supplemental_groups, $supp_group);
}
}
} else {
log_debug( "config usergroups != yes code path" );
if( defined($ingroup_name) ) {
$primary_gid=egetgrnam($ingroup_name);
} elsif (defined($config{"users_gid"})) {
log_trace( "primary_gid = users_gid = %d", $primary_gid );
$primary_gid = $config{"users_gid"};
} else {
if (defined($config{"users_group"})) {
my @grgid=egetgrnam($config{"users_group"});
my $grgid=$grgid[2];
log_trace( "primary_gid = users_group %s %s", $config{"users_group"}, $grgid);
$primary_gid = $grgid;
} else {
log_trace( "primary_gid = literal 100");
$primary_gid = 100;
}
}
if( $primary_gid == -1 ) {
log_fatal( "no primary GID for user set. User not created." );
exit( RET_NO_PRIMARY_GID );
}
}
log_debug( "primary_gid %s, supplemental groups %s", $primary_gid, join(", ",@supplemental_groups) );
if ( defined $ingroup_name || defined $gid_option ) {
$make_group_also = 0;
log_trace( "set make_group_also 0, neither ingroup_name or gid_option defined" );
}
check_user_group(0);
$first_uid = $new_firstuid || $config{"first_uid"};
$last_uid = $new_lastuid || $config{"last_uid"};
if ($config{"usergroups"} =~ /yes/i) {
$first_gid = $first_uid;
$last_gid = $last_uid;
} else {
$first_gid = $new_firstgid || $config{"first_gid"};
$last_gid = $new_lastgid || $config{"last_gid"};
}
log_trace( "first_uid %s, last_uid %s, first_gid %s, last_gid %s", $first_uid, $last_uid, $first_gid, $last_gid );
log_info (gtx("Adding user `%s' ..."),$new_name);
if (!defined($new_uid)) {
if ( defined $ingroup_name ) {
$new_uid = &first_avail_uid( $first_uid,
$last_uid,
$uid_pool{$new_name}{'id'});
} else {
my $first_uidgid = ($first_uid, $first_gid)[$first_uid > $first_gid];
my $last_uidgid = ($last_uid, $last_gid)[$last_uid < $last_gid];
# TODO: Check what happens when those ranges do not overlap
$new_uid = &first_avail_uid_gid( $first_uidgid,
$last_uidgid,
$uid_pool{$new_name}{'id'});
log_trace( "uidgid=%s, from first_uidgid %s, last_uidgid %s", $new_uid, $first_uidgid, $last_uidgid);
}
# TODO: user can specify different UID and GID here.
# idea: split handling in uid/gid, which are equally the return value of
# first_avail_uid_gid. If either pool_id is defined, set uid and gid from
# distinct first_avail_uid and first_avail_gid calls.
log_debug( "new_uid %s selected", $new_uid);
if ($new_uid == -1) {
log_warn( mtx("No UID/GID pair is available in the range %d-%d (FIRST_UID - LAST_UID)."), $first_uid, $last_uid);
log_fatal( mtx("The user `%s' was not created."), $new_name );
exit( RET_NO_ID_IN_RANGE );
}
log_trace( "gid_option %s, ingroup_name %s", $gid_option, $ingroup_name );
if ( defined $gid_option && $gid_option == -1 && defined $ingroup_name && $ingroup_name == "") {
log_warn( mtx("USERGROUPS=no, USER_GID=-1 and USERS_GROUP empty. A user needs a primary group!") );
log_fatal( mtx("The user `%s' was not created."), $new_name );
exit( RET_NO_PRIMARY_GROUP );
} elsif (defined($gid_option) && $gid_option != -1) {
$ingroup_name = getgrgid($gid_option);
$primary_gid = $gid_option;
log_debug( "gid_option defined and not -1, ingroup_name %s, primary_gid %d", $ingroup_name, $primary_gid );
} elsif ($ingroup_name) {
$primary_gid = egetgrnam($ingroup_name);
log_debug( "ingroup_name defined %s, primary_gid %d", $ingroup_name, $primary_gid );
} elsif ( defined( $primary_gid ) ) {
$ingroup_name = getgrgid($primary_gid);
log_debug( "primary_gid defined %d, ingroup_name %s", $primary_gid, $primary_gid );
} else {
$ingroup_name = 'users';
$primary_gid = 100;
log_debug( "ingroup_name hard users, primary_gid hard 100" );
}
if ($make_group_also) {
$primary_gid = $new_uid;
$ingroup_name = $new_name;
log_trace( "make_group_also %s, primary_gid %s, ingroup_name %s", $make_group_also, $primary_gid, $ingroup_name );
}
} else {
log_debug( "new_uid %s, primary_gid %s, ingroup_name %s, make_group_also %s", $new_uid, $primary_gid, $ingroup_name, $make_group_also );
if (defined($gid_option)) {
$ingroup_name = getgrgid($gid_option);
$primary_gid = $gid_option;
log_debug( "gid_option defined %s, ingroup_name %s", $gid_option, $ingroup_name );
} elsif (defined($primary_gid) && $primary_gid != -1) {
$ingroup_name = getgrgid($primary_gid);
log_debug( "primary_gid defined %s, ingroup_name %s", $primary_gid, $ingroup_name );
} elsif ($ingroup_name) {
$primary_gid = egetgrnam($ingroup_name);
log_debug( "ingroup_name defined %s, primary_gid %s", $ingroup_name, $primary_gid );
} elsif ($make_group_also) {
$primary_gid=$new_uid; $ingroup_name=$new_name;
log_debug( "make_group_also %s, primary_gid defined %s, ingroup_name %s", $make_group_also, $primary_gid, $ingroup_name );
} else {
log_debug( "no gid_option, no primary_gid, no ingroup_name, no make_group_also" );
log_fatal( mtx("Internal error interpreting parameter combination") );
exit( RET_INTERNAL );
}
}
log_debug ("make_group_also %s", $make_group_also );
if ($make_group_also) {
$undogroup = $new_name;
my $groupadd = which('groupadd');
my $ret;
if( defined( $primary_gid ) ) {
log_info( mtx("Adding new group `%s' (%d) ..."), $new_name, $primary_gid);
$ret = systemcall_useradd($name_check_level, $groupadd, '-g', $primary_gid, $new_name);
} else {
log_info( mtx("Adding new group `%s' (new group ID) ..."), $new_name);
$ret = systemcall_useradd($name_check_level, $groupadd, $new_name);
$primary_gid = egetgrnam($new_name);
log_info( mtx("new group '%s' created with GID %d"), $new_name, $primary_gid );
}
if( $ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
}
if (defined($special_home) && $special_home ne "/nonexistent" ) {
if (!defined($no_create_home) && -d $special_home) {
log_warn( mtx("The home dir %s you specified already exists.\n"), $special_home );
}
if (defined($no_create_home) && ! -d $special_home) {
log_warn( mtx("The home dir %s you specified can't be accessed: %s\n"), $special_home, $! );
}
}
{
my @grgid=getgrgid($primary_gid);
my $grname=$grgid[0];
log_info( mtx("Adding new user `%s' (%d) with group `%s (%d)' ..."), $new_name, $new_uid, $grname, $primary_gid );
}
$home_dir = $special_home || $uid_pool{$new_name}{'home'} || &homedir($new_name, $ingroup_name);
if( !$disabled_login ) {
$shell = $special_shell || $uid_pool{$new_name}{'shell'} || $config{"dshell"};
} else {
$shell = $special_shell || $uid_pool{$new_name}{'shell'} || "/usr/sbin/nologin";
}
log_debug( "creating new user %s with home_dir %s and shell %s", $new_name, $home_dir, $shell );
$undouser = $new_name;
my $useradd = which('useradd');
my $ret = systemcall_useradd($name_check_level,
$useradd,
'-d', $home_dir,
'-g', $primary_gid,
'-s', $shell,
'-u', $new_uid,
$new_name);
if( $ret == RET_INVALID_NAME_FROM_USERADD ) {
$returnvalue = RET_INVALID_NAME_FROM_USERADD;
}
create_homedir(
home_dir => $home_dir,
uid => $new_uid,
gid => $primary_gid,
copy_skeleton => $no_copy_skel ? 0 : 1,
system_user => 0,
no_create_home => $no_create_home,
dir_mode => $dir_mode,
config => \%config,
) or cleanup();
# useradd without -p has left the account disabled (password string is '!')
if ($ask_passwd) {
my %passwd_errors = (
1 => "Permission denied",
2 => "Invalid combination of options",
3 => "Unexpected failure, nothing done",
4 => "Passwd file missing",
5 => "Passwd file busy, try again",
6 => "Invalid argument to option",
10 => "Wrong password given or retyped incorrectly",
);
interactive_command_with_confirmation(
'passwd', $new_name, \%passwd_errors
);
}
if (defined($comment_tainted)) {
ch_comment($new_name, $comment_tainted);
} elsif ($uid_pool{$new_name}{'comment'}) {
ch_comment($new_name, $uid_pool{$new_name}{'comment'});
} else {
my %chfn_errors = (
1 => "Permission denied",
2 => "Invalid combination of options",
);
interactive_command_with_confirmation(
'chfn', $new_name, \%chfn_errors, 1
);
}
if ( ( $add_extra_groups || $config{"add_extra_groups"} ) && defined($config{"extra_groups"}) ) {
log_debug( "add extra_groups from config (%s) to supplemental_groups", $config{"extra_groups"} );
push (@supplemental_groups, split(/\s+/,$config{"extra_groups"}));
}
if ( @supplemental_groups ) {
log_info( mtx("Adding new user `%s' to supplemental / extra groups `%s' ..."), $new_name, join(", ", @supplemental_groups) );
foreach my $newgrp ( @supplemental_groups ) {
log_trace( "newgrp %s", $newgrp );
if (!defined egetgrnam($newgrp)) {
log_warn( mtx("The group `%s' does not exist."), $newgrp);
next;
}
if (&user_is_member($new_name, $newgrp)) {
log_warn( mtx("The user `%s' is already a member of `%s'."),
$new_name,$newgrp );
next;
}
log_info( mtx("Adding user `%s' to group `%s' ..."), $new_name, $newgrp );
my $gpasswd = &which('gpasswd');
systemcall($gpasswd, '-M',
join(',', get_group_members($newgrp), $new_name),
$newgrp);
}
}
systemcall('/usr/local/sbin/adduser.local', $new_name, $new_uid,
$primary_gid, $home_dir) if (-x "/usr/local/sbin/adduser.local");
release_lock(0);
exit( $returnvalue );
}
if ($action eq "unlockuser") {
log_trace( "unlockuser %s", $new_name );
acquire_lock();
unlock_user($new_name, 0);
release_lock(0);
exit( $returnvalue );
}
#
# we never go here
#
# calculate home directory
sub homedir {
my $dir = $config{"dhome"};
$dir .= '/' . $_[0];
return $dir;
}
# check_user_group: Do checks regarding user, group, gid and group
# requirement that are basically the same for normal users and
# system users. Factored out to avoid code duplication.
# parameters:
# system: 0 if the user will be a system user, 1 otherwise
# return values:
# if the function returns, all requirements are met. otherwise
# it exits() from the program with an appropriate exit code
# todo: not sure whether global variables apply fine here.
# global variables used:
# $make_group_also
# $new_name
# $new_uid
# $ingroup_name
# $gid_option
sub check_user_group {
my ($system) = @_;
log_debug( "check_user_group %s called, make_group_also %s", $system, $make_group_also );
my $ustat = existing_user_status(\%config, $new_name, $new_uid);
if ($ustat & EXISTING_FOUND) {
if ($ustat & EXISTING_LOCKED) {
# this must be a non-system user, addsysuser handles the locked case before we get called
log_err( mtx("User `%s' already exists and is locked. use adduser --unlock explicitly to unlock. Exiting.\n"), $new_name );
exit( RET_OBJECT_EXISTS );
}
}
if ($system) {
if (($ustat & EXISTING_FOUND) && !($ustat & EXISTING_SYSTEM)) {
log_fatal( mtx("The user `%s' already exists, and is not a system user."), $new_name);
exit( RET_WRONG_OBJECT_PROPERTIES );
}
# if ($new_uid && !($ustat & EXISTING_SYSTEM)) {
# log_fatal( mtx("The uid `%s' is invalid for system users."), $new_name);
# exit( RET_OBJECT_EXISTS );
# }
} else {
if ($ustat & EXISTING_FOUND) {
log_fatal( mtx("The user `%s' already exists."), $new_name);
exit( RET_OBJECT_EXISTS );
}
}
if ($make_group_also) {
log_trace( "make_group_also 1, new_name %s, new_uid %s", $new_name, $new_uid );
if( !$system || !existing_group_status(\%config, $new_name, $new_uid) ) {
if (defined egetgrnam($new_name)) {
log_fatal( mtx("The group `%s' already exists."),$new_name );
exit( RET_OBJECT_EXISTS );
}
if (defined($new_uid) && defined(getgrgid($new_uid))) {
log_fatal( mtx("The GID %d is already in use."),$new_uid );
exit( RET_ID_IN_USE );
}
}
} else {
if ($ingroup_name && !defined(egetgrnam($ingroup_name))) {
log_fatal( mtx("The group `%s' does not exist."), $ingroup_name);
exit( RET_OBJECT_DOES_NOT_EXIST );
}
if (defined($gid_option) && !defined(getgrgid($gid_option))) {
log_fatal( mtx("No group with GID %d found."), $gid_option);
exit( RET_OBJECT_DOES_NOT_EXIST );
}
}
log_debug( "return from check_user_group" );
}
# sanitize_name: perform some sanity checks
# parameters:
# name: the name to check
# return values:
# the sanitized and untainted name, available to use
sub sanitize_name {
my ($name) = @_;
my $name_regex_var = $found_sys_opt ? 'SYS_NAME_REGEX' : 'NAME_REGEX';
my $name_regex = $config{lc $name_regex_var};
log_trace("sanitize name %s called. name_regex_var %s, name_regex %s, Now testing all numeric. ", $name, $name_regex_var, $name_regex);
if ($name =~ qr/^-?[\d]+$/) {
# this check cannot be turned off
log_err( mtx("To avoid ambiguity with numerical UIDs, usernames which" .
"resemble numbers or negative numbers are not allowed.") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
log_trace("sanitize_name testing single or double period");
if ( $name =~ qr/^\.\.?$/ ) {
# this check cannot be turned off
log_err( mtx("Usernames must not be a single or a double period.") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
log_trace("sanitize_name testing > 32 chars");
if (length( encode($charset, $name) ) > 32) {
# this check cannot be turned off
log_err( mtx("Usernames must be no more than 32 bytes in length.") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
log_trace("sanitize_name testing %s against insane chars %s", $name, def_min_regex);
if ($name !~ def_min_regex) {
# this check cannot be turned off
log_err( mtx("To avoid problems, the username must not start with a" .
"dash, plus sign, or tilde, and it must not contain any of the" .
"following: colon, comma, slash, or any whitespace characters" .
"including spaces, tabs, and newlines.") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
log_trace("sanitize_name checking %s against %s (%s)", $name, $name_regex, $name_regex_var);
if ($name =~ qr/($name_regex)/) {
log_trace("sanitize_name passed. returning %s", $1);
return $1;
};
log_trace("sanitize_name checking %s ieee_regex %s", $name, def_ieee_name_regex);
if ($name !~ def_ieee_name_regex && $name_check_level < 2) {
log_err( mtx("To avoid problems, the username should consist only of" .
"letters, digits, underscores, periods, at signs and dashes, and" .
"not start with a dash (as defined by IEEE Std 1003.1-2001). For" .
"compatibility with Samba machine accounts, \$ is also supported" .
"at the end of the username. (Use the `--allow-all-names' option" .
"to bypass this restriction.)") );
exit( RET_INVALID_CHARS_IN_INPUT );
}
if ($name_check_level) {
log_info( mtx("Allowing use of questionable username.") );
} else {
log_err( mtx("Please enter a username matching the regular expression" .
"configured via the %s configuration variable. Use the" .
"`--allow-bad-names' option to relax this check or reconfigure" .
"%s in configuration."), $name_regex_var, $name_regex_var );
exit( RET_INVALID_CHARS_IN_INPUT );
}
log_trace("sanitize_name checking %s against %s", $name, anynamere);
if ($name =~ anynamere) {
log_trace("sanitize_name passed. returning %s", $1);
return $1;
};
log_fatal("sanitize_name failed. invalid user name %s", $name);
return "";
}
# first_avail_uid: return the first available uid in given range
# parameters:
# min, max: the range
# pool_id: user id suggested from pool
# return values:
# -1 if no free uid is available
# otherwise the choosen uid
sub first_avail_uid {
my ($min, $max, $pool_id) = @_;
if (defined ($pool_id)) {
return $pool_id if (!defined(getpwuid($pool_id)));
return -1;
}
log_info( mtx("Selecting UID from range %d to %d ...\n"),$min,$max);
my $t = $min;
while ($t <= $max) {
return $t if (!exists($reserved_uid_pool{$t}) and !defined(getpwuid($t)));
$t++;
}
return -1; # nothing available
}
# first_avail_gid: return the first available gid in given range
# parameters:
# min, max: the range
# pool_id: group id suggested from pool
# return values:
# -1 if no free gid is available
# otherwise the choosen gid
sub first_avail_gid {
my ($min, $max, $pool_id) = @_;
if (defined ($pool_id)) {
return $pool_id if (!defined(getgrgid($pool_id)));
return -1;
}
log_info( mtx("Selecting GID from range %d to %d ..."),$min,$max);
my $t = $min;
while ($t <= $max) {
return $t if (!exists($reserved_gid_pool{$t}) and !defined(getgrgid($t)));
$t++;
}
return -1; # nothing available
}
# first_avail_uid_gid: return the first available id in given range
# that is both available as uid and gid
# parameters:
# min, max: the range
# pool_id: user id suggested from pool
# return values:
# -1 if no free id is available
# otherwise the choosen id
sub first_avail_uid_gid {
my ($min, $max, $pool_id) = @_;
if (defined ($pool_id)) {
return $pool_id if (!defined(getgrgid($pool_id)));
return -1;
}
log_info( mtx("Selecting UID/GID from range %d to %d ..."), $min, $max );
my $t = $min;
while ($t <= $max) {
return $t if (!exists($reserved_uid_pool{$t}) && !exists($reserved_gid_pool{$t}) &&
!defined(getgrgid($t)) && !defined(getpwuid($t)));
$t++;
}
return -1; # nothing available
}
sub ch_comment {
my ($name, $comment) = @_;
my $usermod = &which('usermod');
# untaint unconditionally. our call to system() is safe, so
# we leave the check to usermod
if ($comment =~ qr/^([^\x00-\x1F\x7F:]*)$/ ) {
systemcall($usermod, '-c', $1, $name);
} else {
log_fatal("unconditional sanitize of comment failed. This should not happen.");
}
}
# user is member of group?
sub user_is_member {
my($user, $group) = @_;
for (split(/ /, (egetgrnam($group))[3])) {
return 1 if ($user eq $_);
}
return 0;
}
# unlock user
sub unlock_user {
my ($user_name, $system) = @_;
log_debug( "unlock_user %s called, system %s", $user_name, $system );
my $ret = existing_user_status(\%config, $user_name, undef);
if ($ret & EXISTING_FOUND) {
if ($ret & EXISTING_LOCKED) {
my $default_shell = $system ? "/usr/sbin/nologin" : "/bin/bash";
# Get current shell state if available
my $shell = get_state_value($user_name, "shell") // $default_shell;
# Build usermod argument list
my @usermod_args = (
'-e', '-1', # set account expiry to never
'-s', $shell, # set shell
$user_name # username
);
# Add -U only if account has a password
if ($ret & EXISTING_HAS_PASSWORD) {
push @usermod_args, '-U';
} else {
log_info( mtx(
"Unlocking password `%s' would result in a passwordless account. Leaving password locked\n",
$user_name
));
}
log_info( mtx("Unlocking user `%s' ...", $user_name) );
log_trace( "usermod `%s' ...", join(" ", @usermod_args) );
my $unlock_ret = systemcall_useradd($name_check_level, 'usermod', @usermod_args);
if( $unlock_ret == 0 ) {
log_info( mtx("user `%s' successfully unlocked.\n", $user_name) );
set_state_value($user_name, "shell", undef);
set_state_value($user_name, "locked", undef);
} else {
log_fatal( mtx("error %s while unlocking user `%s'. Exiting.\n", $unlock_ret, $user_name) );
exit( RET_SYSTEMCALL_ERROR );
}
}
log_info( mtx("User `%s' is already unlocked.\n"), $user_name );
} else {
log_fatal( mtx("User `%s' does not exist\n"), $user_name );
exit( RET_OBJECT_DOES_NOT_EXIST );
}
}
sub interactive_command_with_confirmation {
my ($cmd, $user_name, $error_map, $always_confirm) = @_;
$always_confirm //= 0; # default to false if not provided
return unless -t STDIN; # skip non-interactive
my $yesexpr = langinfo(YESEXPR);
my $noexpr = langinfo(NOEXPR);
my $retry = 1;
while ($retry) {
$retry = 0;
my $full_cmd = which($cmd);
my $ok = systemcall_or_warn($full_cmd, $user_name);
$ok = $ok >> 8; # extract exit code
log_debug("systemcall_or_warn %s %s return value %s", $full_cmd, $user_name, $ok);
if ($ok != 0 && $error_map) {
if (exists $error_map->{$ok}) {
log_warn($error_map->{$ok});
} else {
log_warn("Unexpected return code %s from %s", $ok, $cmd);
}
}
# Prompt for confirmation if requested
if ($always_confirm) {
my $answer;
do {
print gtx("Is the information correct? [Y/n] ");
$answer = <STDIN>;
unless (defined $answer) {
warn "No input available, assuming 'yes'\n";
last;
}
chomp($answer);
$answer =~ s/^\s+|\s+$//g;
if ($answer =~ m/$yesexpr/o || $answer eq '') {
$retry = 0; # accepted
last;
} elsif ($answer =~ m/$noexpr/o) {
$retry = 1; # retry command
} else {
print "Please answer yes or no.\n";
$answer = undef; # repeat prompt
}
} while (!defined $answer);
}
}
}
sub cleanup {
if ($undohome) {
log_info( mtx("Removing directory `%s' ..."), $undohome);
systemcall('rm', '-rf', $undohome);
}
if ($undouser) {
log_info( mtx("Removing user `%s' ..."), $undouser);
systemcall('userdel', $undouser);
}
if ($undogroup) {
log_info( mtx("Removing group `%s' ..."), $undogroup);
systemcall('groupdel', $undogroup);
}
exit( RET_ADDUSER_ABORTED );
}
sub handler {
my($sig) = @_;
# Translators: the variable %s is INT, QUIT, or HUP.
# Please do not insert a space character between SIG and %s.
log_err( mtx( "Caught a SIG%s." ), $sig );
&cleanup();
}
sub version {
printf( gtx("adduser version %s\n\n"), $version );
print( gtx("Adds a user or group to the system.
For detailed copyright information, please refer to
/usr/share/doc/adduser/copyright.
\n") );
print( gtx(
"This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License, /usr/share/common-licenses/GPL, for more details.
") );
}
sub usage {
printf( gtx(
"adduser [--uid id] [--firstuid id] [--lastuid id]
[--gid id] [--firstgid id] [--lastgid id] [--ingroup group]
[--add-extra-groups] [--shell shell]
[--comment comment] [--home dir] [--no-create-home]
[--allow-all-names] [--allow-bad-names]
[--disabled-password] [--disabled-login]
[--conf file] [--quiet] [--verbose] [--debug]
user
Add a regular user
adduser --unlock
[--system]
user
Unlock an existing locked user account
adduser --system
[--uid id] [--group] [--ingroup group] [--gid id]
[--shell shell] [--comment comment] [--home dir] [--no-create-home]
[--conf file] [--quiet] [--verbose] [--debug]
user
Add a system user
adduser --group
[--gid ID] [--firstgid id] [--lastgid id]
[--conf file] [--quiet] [--verbose] [--debug]
group
addgroup
[--gid ID] [--firstgid id] [--lastgid id]
[--conf file] [--quiet] [--verbose] [--debug]
group
Add a user group
addgroup --system
[--gid id]
[--conf file] [--quiet] [--verbose] [--debug]
group
Add a system group
adduser USER GROUP
Add an existing user to an existing group\n") );
}
sub usage_error {
&usage;
exit( RET_INVALID_CALL );
}
# get_dir_mode: return the appropriate permissions mode for a home directory
# parameters:
# none
# return value:
# a valid octal mode
sub get_dir_mode
{
my $mode = $found_sys_opt
? $config{"sys_dir_mode"}
: $config{"dir_mode"};
if(!defined($mode) || ! ($mode =~ /[0-7]{3}/ || $mode =~ /[0-7]{4}/)) {
$mode = ($found_sys_opt) ? "755" : "0700";
}
return oct($mode);
}
# Local Variables:
# mode:cperl
# cperl-indent-level:4
# End:
# vim: tabstop=4 shiftwidth=4 expandtab