Commit Graph

108 Commits

Author SHA1 Message Date
Dag-Erling Smørgrav
508aee9681 pwd_mkdb: Sort options and update usage message.
Sponsored by:	Klara, Inc.
Reviewed by:	allanjude
Differential Revision:	https://reviews.freebsd.org/D39266
2023-03-25 14:15:40 +00:00
Andre Albsmeier
0deb25bd9d pwd_mkdb(8): Don't copy comments from /etc/master.passwd to /etc/passwd.
The intention of /etc/passwd was to support legacy applications that are
not yet converted to use modern API like getpwent(3). Comments are not
defined in the legacy format, so copying them could break these
applications. Plus, it could leak sensitive information (e.g. encrypted
form of password of an user that was commented out instead of deleted
or disabled).

PR:		bin/144652
MFC after:	1 month
2023-01-04 22:18:09 -08:00
Alex Richardson
b05fc77a36 Fix bootstrapping of pwd_mkdb after r364049
I moved the bootstrap pwd.h to a subdirectory in r364049 but forgot to
adjust the #include path.
2020-08-11 16:46:38 +00:00
Alex Richardson
dfb98e350c Fix i386 build of chpass after r363992
My change to allow bootstrapping pwd_mkdb (r363992) resulted in i386 build
failures because the bootstrap header was being included in non-bootstrap chpass.
Dropping the no longer required pwd_mkdb include path from chpass fixes
the build, but to be certain that the failure doesn't get re-introduced,
I've also moved the bootstrap pwd.h into a subdirectory so that adding
-I${SRCTOP}/usr.sbin/pwd_mkdb doesn't pull it in.

Reported by:	mjg
2020-08-08 10:05:27 +00:00
Alex Richardson
a583962d61 Allow bootstrapping pwd_mkdb on Linux/macOS
We need to provide a struct passwd that is compatible with the target
system and this is not the case when cross-building from macOS/Linux.
It should also be a problem when bootstrapping for an i386 target from a
FreeBSD amd64 host since time_t does not match across those systems.
However, pwd_mkdb always truncates integer values to 32-bit so this
difference does not result in different databases.

Reviewed By:	brooks
Differential Revision: https://reviews.freebsd.org/D25931
2020-08-06 20:46:13 +00:00
Emmanuel Vadot
a7b5a3d486 pkgbase: Put a lot of binaries and lib in FreeBSD-runtime
All of them are needed to be able to boot to single user and be able
to repair a existing FreeBSD installation so put them directly into
FreeBSD-runtime.

Reviewed by:    bapt, gjb
Differential Revision:  https://reviews.freebsd.org/D21503
2019-09-05 14:13:08 +00:00
Ed Maste
8e1887fa1a pwd_mkdb: retire -B and -L endianness options
Legacy v3 db support was retired in r333133, and it was v3 support that
required the -B and -L options.  The options were retained temporarily,
but now that stable/12 has branched they can be removed.

Sponsored by:	The FreeBSD Foundation
2018-10-21 00:48:38 +00:00
Ed Maste
c20dbeb676 pwd_mkdb: retire legacy v3 db support (-l option)
pwd_mkdb has emitted v4 password database records since 2003 (r113596)
in addition to v3, and as of r283981 by default it emitted only v4.
As described in r283981, retire the -l legacy option.

The -B and -L options were originally added to set the endianness of v3
records emitted by pwd_mkdb, but they also set the db hash endiannes and
so have been retained temporarily.

Announced on the FreeBSD-Current and FreeBSD-Stable lists.  In stable/11
the man page contains a deprecation notice, and pwd_mkdb will emit a
deprecation notice if the -l option is specified.

Reviewed by:	delphij, lidl, rgrimes
Relnotes:	Yes
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D15144
2018-05-01 00:53:46 +00:00
Ed Maste
e936bb9f69 pwd_mkdb: default to network (big) endian hash order
For cross-architecture reproducibility.  The db(3) functions work with
hashes of either endianness, and the current (v4) version password db
entries already store integers in network order.  Do so with the hash as
well so that identical password databases can be created on big- and
little-endian hosts.

The -B and -L flags exist to set the endianness for legacy (v3) entries
when the -l flag is used, and they will still control hash endianness
(at least until the backwards compatibility infrastructure is removed).

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
2018-04-24 01:22:57 +00:00
Ed Maste
60dd682329 pwd_mkdb: add deprecation notice in manpage too
Followon to r332789; as reported on the -current and -stable lists and
in review D15144 the -l option will be removed before FreeBSD 12.0.
2018-04-22 23:10:37 +00:00
Ed Maste
97303f37f8 pwd_mkdb: warn that legacy support is deprecated (if specified)
r283981 switched pwd_mkdb to emit only v4 database entries by default,
and introduced a -l (legacy) option emit v3 entries in addition.  The
commit message claims that legacy support will be removed in 12.0, so
emit a warning now if it is used.
2018-04-19 20:25:19 +00:00
Pedro F. Giffuni
8a16b7a18f General further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.
2017-11-20 19:49:47 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Enji Cooper
64a0982bee usr.sbin: normalize paths using SRCTOP-relative paths or :H when possible
This simplifies make logic/output

MFC after:	1 month
Sponsored by:	Dell EMC Isilon
2017-03-04 11:38:03 +00:00
Warner Losh
fbbd9655e5 Renumber copyright clause 4
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96
2017-02-28 23:42:47 +00:00
David Malone
95bcaf513b Following revision r295924, the changes to a db file should be fsynced
before the file is closed. Consequently, it shouldn't be necessary to
open the file with O_SYNC any more.

This improves the performance of building large .db files for large
password files a lot and should resolve this problem:

	https://forums.freebsd.org/threads/10-2-pre-pwd_mkdb-slow-on-larger-master-passwd.52700/

Differential Revision:	https://reviews.freebsd.org/D5186
Reviewed by:	garga, vangyzen, bapt, se
MFC after:	1 week
2016-02-23 15:28:13 +00:00
Marcelo Araujo
daa3baeb1d The sdp opens the database with PERM_SECURE mode and it is different than
dp that opens the database with PERM_INSECURE, so we need to check sdp->put
against sdp instead of use dp->put.

PR:		bin/191720
Submitted by:	Miles Ohlrich <turingsboy@yahoo.com>
Approved by:	rodrigc (mentor)
Differential Revision:	https://reviews.freebsd.org/D4255
2015-12-28 05:48:22 +00:00
Christian Brueffer
99d43aee11 Fix a few mandoc warnings.
MFC after:	1 week
2015-08-12 10:34:05 +00:00
Renato Botelho
d32a66b2a2 When passwd or group information is changed (by pw, vipw, chpass, ...)
temporary file is created and then a rename() call move it to official file.
This operation didn't have any check to make sure data was written to disk
and if a power cycle happens system could end up with a 0 length passwd
or group database.

There is a pfSense bug with more infor about it:

https://redmine.pfsense.org/issues/4523

The following changes were made to protect passwd and group operations:

* lib/libutil/gr_util.c:
 - Replace mkstemp() by mkostemp() with O_SYNC flag to create temp file
 - After rename(), fsync() call on directory for faster result

* lib/libutil/pw_util.c
 - Replace mkstemp() by mkostemp() with O_SYNC flag to create temp file

* usr.sbin/pwd_mkdb/pwd_mkdb.c
 - Added O_SYNC flag on dbopen() calls
 - After rename(), fsync() call on directory for faster result

* lib/libutil/pw_util.3
 - pw_lock() returns a file descriptor to master password file on success

Differential Revision:	https://reviews.freebsd.org/D2978
Approved by:	bapt
Sponsored by:	Netgate
2015-07-02 17:30:59 +00:00
Simon J. Gerraty
ccfb965433 Add META_MODE support.
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision:       D2796
Reviewed by: brooks imp
2015-06-13 19:20:56 +00:00
Simon J. Gerraty
44d314f704 dirdeps.mk now sets DEP_RELDIR 2015-06-08 23:35:17 +00:00
Xin LI
ac57983523 Whitespace changes for r283981. No actual code changes. 2015-06-04 07:25:40 +00:00
Xin LI
3e08b16eca In r113596, version 4 of entries have been added but pwd_mkdb have
been generating both new (machine independent) and legacy version
entries (endianness sensitive).

The base system have been using the new format for quite some time,
so disable the generation by default.

An interim option, -l, have been added to re-enable old behavior.
The -l, -B and -L options are considered deprecated and will be
removed in FreeBSD 12.0 release.
2015-06-04 07:24:56 +00:00
Simon J. Gerraty
fae50821ae Updated dependencies 2014-05-16 14:09:51 +00:00
Simon J. Gerraty
76b28ad6ab Updated dependencies 2014-05-10 05:16:28 +00:00
Simon J. Gerraty
3b8f084595 Merge head 2014-04-28 07:50:45 +00:00
Dag-Erling Smørgrav
b7e6051a78 Add -p to the example (why isn't this the default?)
MFC after:	1 week
2014-02-06 09:57:27 +00:00
Dag-Erling Smørgrav
b81e945b9b Add an example of the most common use case.
MFC after:	1 week
2014-02-05 09:28:02 +00:00
Simon J. Gerraty
7cf3a1c6b2 Updated dependencies 2013-03-11 17:21:52 +00:00
Simon J. Gerraty
f5f7c05209 Updated dependencies 2013-02-16 01:23:54 +00:00
Marcel Moolenaar
7750ad47a9 Sync FreeBSD's bmake branch with Juniper's internal bmake branch.
Requested by: Simon Gerraty <sjg@juniper.net>
2012-08-22 19:25:57 +00:00
Ed Schouten
4da4d0013d Mark global functions and/or variables in pwd_mkdb(8) static where possible.
This allows compilers and static analyzers to do more thorough analysis.
2011-11-06 19:02:25 +00:00
Gordon Tetlow
c909243f40 Only increment the ypcnt once per data record. The old implementation
was incrementing it twice making it impossible to iterate the table
since the records were 1, 3, 5, 7 (or 2, 4, 6, 8 for the v3 records).

MFC after:	10 days
2011-07-06 06:34:08 +00:00
Ed Schouten
71ccf09269 The last big commit: let usr.sbin/ use WARNS=6 by default. 2010-01-02 11:07:44 +00:00
Brian Somers
15344a5690 Verify that the username length is smaller than MAXLOGNAME when
asked to verify a passwd file (pwd_mkdb -C).

Entries with oversized usernames are still permitted when building
the passwd database.

When entries are >= MAXLOGNAME in length, they are correctly stored
in passwd, pwd.db and spwd.db but are only correctly retrieved by
getpwent*() and getpwuid*().  getpwnam*() truncates to MAXLOGNAME - 1
when reading from a file (breaking at least sh, tcsh and bash)
and utilities such as su(1) check, complain and fail if the
passed name is >= MAXLOGNAME in length.

MFC after:	3 weeks
2009-05-20 08:32:25 +00:00
Dima Dorfman
ff900deda6 Correctly handle an input file without a newline on the last line (and
avoid the confusing error message about the line being too long). This
change uses fgetln to detect the right conditions, but the fixed-width
line buffer is kept because too many other places in the program make
assumptions about its maximum width.

Approved by:	re (scottl)
2005-06-15 10:13:04 +00:00
Philippe Charnier
ce2657c007 Even if variable is never used uninitialized by the semantic, reduce compiler
warning by giving an initial value in all cases.
2005-05-29 16:01:12 +00:00
Ruslan Ermilov
e2db8d3732 Add endianness support.
While version 4 entries are architecture-independent, we
also store old (version 3) entries in native byte order.
Also, the hash itself is created in a native byte order.

With this change, pwd_mkdb(8) can be used to cross-build
*pwd.db files for another architecture.

Tested on:	i386, amd64, alpha, sparc64
2005-02-28 21:05:30 +00:00
Stefan Farfeleder
bf94610c6b Turn K&R functions into prototypes. 2005-02-10 09:00:55 +00:00
Ruslan Ermilov
59a3c79da6 Sort sections. 2005-01-18 20:02:45 +00:00
Warner Losh
486c8cc4c6 Per letter dated July 22, 1999 remove 3rd clause of Berkeley derived software
(with permission of addtional copyright holders where appropriate)
2004-08-07 04:28:56 +00:00
Warner Losh
db7bacc61c Add 'i' to the getopt string.
Noticed by: jhein
2004-08-05 15:44:26 +00:00
Warner Losh
9906740e39 Add support for ignoring locking failures. This is only enabled when
you've specified a directory.  It is intended to be used in building
custom releases over NFS where locking may be unreliable at best and
there is no contention that the locking is designed to arbitrate.
Other uses of this flag are discouraged.  Document same in usage and
man page (including the warning about unwise).

Sponsored by: Timing Solutions
2004-07-21 17:38:04 +00:00
Warner Losh
24412bd1af Two style related changes:
(1) use strlcpy instead of strncpy since the use here of the latter
    was incorrect.
(2) Move 'N' case into proper sorted order (sorted the same way that
    ls sorts its args).
2004-07-21 17:02:36 +00:00
Ruslan Ermilov
07bfccd71e Mechanically kill hard sentence breaks. 2004-07-02 23:13:00 +00:00
David E. O'Brien
b728350ee6 Use __FBSDID over rcsid[]. Protect copyright[] where needed. 2003-05-03 21:06:42 +00:00
Jacques Vidrine
257ca75f51 When updating a single entry (i.e. when the `-u' option is given),
do not add the "\xFF" "VERSION" key --- it should only be added once
ALL entries have been updated.

While I'm here, correct the logic that detects whether or not the
user-ID has changed so that it works even if all entries have not
yet been updated to the new format.

Users missing-in-action were
Reported by:	tjr, Vallo Kallaste <vallo@estcard.ee>,
		    leafy <leafy@leafy.idv.tw>

Sponsored by:	DARPA, Network Associates Laboratories
2003-04-28 11:41:56 +00:00
Jacques Vidrine
b4603f3dd4 Revert the definitions of _PW_KEY* to their previous values. There is
at least one consumer outside of libc and pwd_mkdb.
Adjust the versioning in libc and pwd_mkdb accordingly.

named was the application affected, and that fact was first
Reported by:	Zherdev Anatoly <tolyar@mx.ru>

Sponsored by:	DARPA, Network Associates Laboratories
2003-04-18 14:11:17 +00:00
Jacques Vidrine
05f98035ee = Implement thread-safe versions of the getpwent(3) and getgrent(3)
family of functions using the new nsdispatch(3) core.  Remove
  arbitrary size limits when using the thread-safe versions.

= Re-implement the traditional getpwent(3)/getgrent(3) functions on
  top of the thread-safe versions.

= Update the on-disk format of the hashed version of the passwd(5)
  databases to allow for versioned entries.  The legacy version is
  `3'.  (Don't ask.)

= Add support for version `4' entries in the passwd(5) database.
  Entries in this format are identical to version 3 entries except
  that all integers are stored as 32-bit integers in network byte
  order (big endian).

= pwd_mkdb is updated to generate both version 3 and version 4
  entries.

Sponsored by:	DARPA, Network Associates Laboratories
2003-04-17 14:15:26 +00:00
David E. O'Brien
052238b16c style.Makefile(5) 2003-04-04 17:49:21 +00:00