1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
27 /* All Rights Reserved */
28
29
30 #include <sys/types.h>
31 #include <sys/stat.h>
32 #include <sys/param.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <ctype.h>
36 #include <limits.h>
37 #include <string.h>
38 #include <userdefs.h>
39 #include <errno.h>
40 #include <project.h>
41 #include <unistd.h>
42 #include <user_attr.h>
43 #include "users.h"
44 #include "messages.h"
45 #include "userdisp.h"
46 #include "funcs.h"
47
48 /*
49 * useradd [-u uid [-o] | -g group | -G group [[, group]...] | -d dir [-m]
50 * | -s shell | -c comment | -k skel_dir | -b base_dir] ]
51 * [ -A authorization [, authorization ...]]
52 * [ -P profile [, profile ...]]
53 * [ -K key=value ]
54 * [ -R role [, role ...]] [-p project [, project ...]] login
55 * useradd -D [ -g group ] [ -b base_dir | -f inactive | -e expire |
56 * -s shell | -k skel_dir ]
57 * [ -A authorization [, authorization ...]]
58 * [ -P profile [, profile ...]] [ -K key=value ]
59 * [ -R role [, role ...]] [-p project [, project ...]] login
60 *
61 * This command adds new user logins to the system. Arguments are:
62 *
63 * uid - an integer
64 * group - an existing group's integer ID or char string name
65 * dir - home directory
66 * shell - a program to be used as a shell
67 * comment - any text string
68 * skel_dir - a skeleton directory
69 * base_dir - a directory
70 * login - a string of printable chars except colon(:)
71 * authorization - One or more comma separated authorizations defined
72 * in auth_attr(4).
73 * profile - One or more comma separated execution profiles defined
74 * in prof_attr(4)
75 * role - One or more comma-separated role names defined in user_attr(4)
76 * project - One or more comma-separated project names or numbers
77 *
78 */
79
80 extern struct userdefs *getusrdef();
81 extern void dispusrdef();
82
83 static void cleanup();
84
85 extern uid_t findnextuid(void);
86 extern int check_perm(), valid_expire();
87 extern int putusrdef(), valid_uid();
88 extern int call_passmgmt(), edit_group(), create_home();
89 extern int edit_project();
90 extern int **valid_lgroup();
91 extern projid_t **valid_lproject();
92 extern void update_def(struct userdefs *);
93 extern void import_def(struct userdefs *);
94
95 static uid_t uid; /* new uid */
96 static char *logname; /* login name to add */
97 static struct userdefs *usrdefs; /* defaults for useradd */
98
99 char *cmdname;
100
101 static char homedir[ PATH_MAX + 1 ]; /* home directory */
102 static char gidstring[32]; /* group id string representation */
103 static gid_t gid; /* gid of new login */
104 static char uidstring[32]; /* user id string representation */
105 static char *uidstr = NULL; /* uid from command line */
106 static char *base_dir = NULL; /* base_dir from command line */
107 static char *group = NULL; /* group from command line */
108 static char *grps = NULL; /* multi groups from command line */
109 static char *dir = NULL; /* home dir from command line */
110 static char *shell = NULL; /* shell from command line */
111 static char *comment = NULL; /* comment from command line */
112 static char *skel_dir = NULL; /* skel dir from command line */
113 static long inact; /* inactive days */
114 static char *inactstr = NULL; /* inactive from command line */
115 static char inactstring[10]; /* inactivity string representation */
116 static char *expirestr = NULL; /* expiration date from command line */
117 static char *projects = NULL; /* project id's from command line */
118
119 static char *usertype = NULL; /* type of user, either role or normal */
120
121 typedef enum {
122 BASEDIR = 0,
123 SKELDIR,
124 SHELL
125 } path_opt_t;
126
127
128 static void valid_input(path_opt_t, const char *);
129
130 int
131 main(argc, argv)
132 int argc;
133 char *argv[];
134 {
135 int ch, ret, mflag = 0, oflag = 0, Dflag = 0, **gidlist;
136 projid_t **projlist;
137 char *ptr; /* loc in a str, may be set by strtol */
138 struct group *g_ptr;
139 struct project p_ptr;
140 char mybuf[PROJECT_BUFSZ];
141 struct stat statbuf; /* status buffer for stat */
142 int warning;
143 int busy = 0;
144 char **nargv; /* arguments for execvp of passmgmt */
145 int argindex; /* argument index into nargv */
146
147 cmdname = argv[0];
148
149 if (geteuid() != 0) {
150 errmsg(M_PERM_DENIED);
151 exit(EX_NO_PERM);
152 }
153
154 opterr = 0; /* no print errors from getopt */
155 usertype = getusertype(argv[0]);
156
157 change_key(USERATTR_TYPE_KW, usertype);
158
159 while ((ch = getopt(argc, argv,
160 "b:c:Dd:e:f:G:g:k:mop:s:u:A:P:R:K:")) != EOF)
161 switch (ch) {
162 case 'b':
163 base_dir = optarg;
164 break;
165
166 case 'c':
167 comment = optarg;
168 break;
169
170 case 'D':
171 Dflag++;
172 break;
173
174 case 'd':
175 dir = optarg;
176 break;
177
178 case 'e':
179 expirestr = optarg;
180 break;
181
182 case 'f':
183 inactstr = optarg;
184 break;
185
186 case 'G':
187 grps = optarg;
188 break;
189
190 case 'g':
191 group = optarg;
192 break;
193
194 case 'k':
195 skel_dir = optarg;
196 break;
197
198 case 'm':
199 mflag++;
200 break;
201
202 case 'o':
203 oflag++;
204 break;
205
206 case 'p':
207 projects = optarg;
208 break;
209
210 case 's':
211 shell = optarg;
212 break;
213
214 case 'u':
215 uidstr = optarg;
216 break;
217
218 case 'A':
219 change_key(USERATTR_AUTHS_KW, optarg);
220 break;
221
222 case 'P':
223 change_key(USERATTR_PROFILES_KW, optarg);
224 break;
225
226 case 'R':
227 if (is_role(usertype)) {
228 errmsg(M_ARUSAGE);
229 exit(EX_SYNTAX);
230 }
231 change_key(USERATTR_ROLES_KW, optarg);
232 break;
233
234 case 'K':
235 change_key(NULL, optarg);
236 break;
237
238 default:
239 case '?':
240 if (is_role(usertype))
241 errmsg(M_ARUSAGE);
242 else
243 errmsg(M_AUSAGE);
244 exit(EX_SYNTAX);
245 }
246
247 /* get defaults for adding new users */
248 usrdefs = getusrdef(usertype);
249
250 if (Dflag) {
251 /* DISPLAY mode */
252
253 /* check syntax */
254 if (optind != argc) {
255 if (is_role(usertype))
256 errmsg(M_ARUSAGE);
257 else
258 errmsg(M_AUSAGE);
259 exit(EX_SYNTAX);
260 }
261
262 if (uidstr != NULL || oflag || grps != NULL ||
263 dir != NULL || mflag || comment != NULL) {
264 if (is_role(usertype))
265 errmsg(M_ARUSAGE);
266 else
267 errmsg(M_AUSAGE);
268 exit(EX_SYNTAX);
269 }
270
271 /* Group must be an existing group */
272 if (group != NULL) {
273 switch (valid_group(group, &g_ptr, &warning)) {
274 case INVALID:
275 errmsg(M_INVALID, group, "group id");
276 exit(EX_BADARG);
277 /*NOTREACHED*/
278 case TOOBIG:
279 errmsg(M_TOOBIG, "gid", group);
280 exit(EX_BADARG);
281 /*NOTREACHED*/
282 case RESERVED:
283 case UNIQUE:
284 errmsg(M_GRP_NOTUSED, group);
285 exit(EX_NAME_NOT_EXIST);
286 }
287 if (warning)
288 warningmsg(warning, group);
289
290 usrdefs->defgroup = g_ptr->gr_gid;
291 usrdefs->defgname = g_ptr->gr_name;
292
293 }
294
295 /* project must be an existing project */
296 if (projects != NULL) {
297 switch (valid_project(projects, &p_ptr, mybuf,
298 sizeof (mybuf), &warning)) {
299 case INVALID:
300 errmsg(M_INVALID, projects, "project id");
301 exit(EX_BADARG);
302 /*NOTREACHED*/
303 case TOOBIG:
304 errmsg(M_TOOBIG, "projid", projects);
305 exit(EX_BADARG);
306 /*NOTREACHED*/
307 case UNIQUE:
308 errmsg(M_PROJ_NOTUSED, projects);
309 exit(EX_NAME_NOT_EXIST);
310 }
311 if (warning)
312 warningmsg(warning, projects);
313
314 usrdefs->defproj = p_ptr.pj_projid;
315 usrdefs->defprojname = p_ptr.pj_name;
316 }
317
318 /* base_dir must be an existing directory */
319 if (base_dir != NULL) {
320 valid_input(BASEDIR, base_dir);
321 usrdefs->defparent = base_dir;
322 }
323
324 /* inactivity period is an integer */
325 if (inactstr != NULL) {
326 /* convert inactstr to integer */
327 inact = strtol(inactstr, &ptr, 10);
328 if (*ptr || inact < 0) {
329 errmsg(M_INVALID, inactstr,
330 "inactivity period");
331 exit(EX_BADARG);
332 }
333
334 usrdefs->definact = inact;
335 }
336
337 /* expiration string is a date, newer than today */
338 if (expirestr != NULL) {
339 if (*expirestr) {
340 if (valid_expire(expirestr, (time_t *)0)
341 == INVALID) {
342 errmsg(M_INVALID, expirestr,
343 "expiration date");
344 exit(EX_BADARG);
345 }
346 usrdefs->defexpire = expirestr;
347 } else
348 /* Unset the expiration date */
349 usrdefs->defexpire = "";
350 }
351
352 if (shell != NULL) {
353 valid_input(SHELL, shell);
354 usrdefs->defshell = shell;
355 }
356 if (skel_dir != NULL) {
357 valid_input(SKELDIR, skel_dir);
358 usrdefs->defskel = skel_dir;
359 }
360 update_def(usrdefs);
361
362 /* change defaults for useradd */
363 if (putusrdef(usrdefs, usertype) < 0) {
364 errmsg(M_UPDATE, "created");
365 exit(EX_UPDATE);
366 }
367
368 /* Now, display */
369 dispusrdef(stdout, (D_ALL & ~D_RID), usertype);
370 exit(EX_SUCCESS);
371
372 }
373
374 /* ADD mode */
375
376 /* check syntax */
377 if (optind != argc - 1 || (skel_dir != NULL && !mflag)) {
378 if (is_role(usertype))
379 errmsg(M_ARUSAGE);
380 else
381 errmsg(M_AUSAGE);
382 exit(EX_SYNTAX);
383 }
384
385 logname = argv[optind];
386 switch (valid_login(logname, (struct passwd **)NULL, &warning)) {
387 case INVALID:
388 errmsg(M_INVALID, logname, "login name");
389 exit(EX_BADARG);
390 /*NOTREACHED*/
391
392 case NOTUNIQUE:
393 errmsg(M_USED, logname);
394 exit(EX_NAME_EXISTS);
395 /*NOTREACHED*/
396 }
397
398 if (warning)
399 warningmsg(warning, logname);
400 if (uidstr != NULL) {
401 /* convert uidstr to integer */
402 errno = 0;
403 uid = (uid_t)strtol(uidstr, &ptr, (int)10);
404 if (*ptr || errno == ERANGE) {
405 errmsg(M_INVALID, uidstr, "user id");
406 exit(EX_BADARG);
407 }
408
409 switch (valid_uid(uid, NULL)) {
410 case NOTUNIQUE:
411 if (!oflag) {
412 /* override not specified */
413 errmsg(M_UID_USED, uid);
414 exit(EX_ID_EXISTS);
415 }
416 break;
417 case RESERVED:
418 errmsg(M_RESERVED, uid);
419 break;
420 case TOOBIG:
421 errmsg(M_TOOBIG, "uid", uid);
422 exit(EX_BADARG);
423 break;
424 }
425
426 } else {
427
428 if ((uid = findnextuid()) < 0) {
429 errmsg(M_INVALID, "default id", "user id");
430 exit(EX_ID_EXISTS);
431 }
432 }
433
434 if (group != NULL) {
435 switch (valid_group(group, &g_ptr, &warning)) {
436 case INVALID:
437 errmsg(M_INVALID, group, "group id");
438 exit(EX_BADARG);
439 /*NOTREACHED*/
440 case TOOBIG:
441 errmsg(M_TOOBIG, "gid", group);
442 exit(EX_BADARG);
443 /*NOTREACHED*/
444 case RESERVED:
445 case UNIQUE:
446 errmsg(M_GRP_NOTUSED, group);
447 exit(EX_NAME_NOT_EXIST);
448 /*NOTREACHED*/
449 }
450
451 if (warning)
452 warningmsg(warning, group);
453 gid = g_ptr->gr_gid;
454
455 } else gid = usrdefs->defgroup;
456
457 if (grps != NULL) {
458 if (!*grps)
459 /* ignore -G "" */
460 grps = (char *)0;
461 else if (!(gidlist = valid_lgroup(grps, gid)))
462 exit(EX_BADARG);
463 }
464
465 if (projects != NULL) {
466 if (! *projects)
467 projects = (char *)0;
468 else if (! (projlist = valid_lproject(projects)))
469 exit(EX_BADARG);
470 }
471
472 /* if base_dir is provided, check its validity; otherwise default */
473 if (base_dir != NULL)
474 valid_input(BASEDIR, base_dir);
475 else
476 base_dir = usrdefs->defparent;
477
478 if (dir == NULL) {
479 /* set homedir to home directory made from base_dir */
480 (void) sprintf(homedir, "%s/%s", base_dir, logname);
481
482 } else if (REL_PATH(dir)) {
483 errmsg(M_RELPATH, dir);
484 exit(EX_BADARG);
485
486 } else
487 (void) strcpy(homedir, dir);
488
489 if (mflag) {
490 /* Does home dir. already exist? */
491 if (stat(homedir, &statbuf) == 0) {
492 /* directory exists - don't try to create */
493 mflag = 0;
494
495 if (check_perm(statbuf, uid, gid, S_IXOTH) != 0)
496 errmsg(M_NO_PERM, logname, homedir);
497 }
498 }
499 /*
500 * if shell, skel_dir are provided, check their validity.
501 * Otherwise default.
502 */
503 if (shell != NULL)
504 valid_input(SHELL, shell);
505 else
506 shell = usrdefs->defshell;
507
508 if (skel_dir != NULL)
509 valid_input(SKELDIR, skel_dir);
510 else
511 skel_dir = usrdefs->defskel;
512
513 if (inactstr != NULL) {
514 /* convert inactstr to integer */
515 inact = strtol(inactstr, &ptr, 10);
516 if (*ptr || inact < 0) {
517 errmsg(M_INVALID, inactstr, "inactivity period");
518 exit(EX_BADARG);
519 }
520 } else inact = usrdefs->definact;
521
522 /* expiration string is a date, newer than today */
523 if (expirestr != NULL) {
524 if (*expirestr) {
525 if (valid_expire(expirestr, (time_t *)0) == INVALID) {
526 errmsg(M_INVALID, expirestr, "expiration date");
527 exit(EX_BADARG);
528 }
529 usrdefs->defexpire = expirestr;
530 } else
531 /* Unset the expiration date */
532 expirestr = (char *)0;
533
534 } else expirestr = usrdefs->defexpire;
535
536 import_def(usrdefs);
537
538 /* must now call passmgmt */
539
540 /* set up arguments to passmgmt in nargv array */
541 nargv = malloc((30 + nkeys * 2) * sizeof (char *));
542 argindex = 0;
543 nargv[argindex++] = PASSMGMT;
544 nargv[argindex++] = "-a"; /* add */
545
546 if (comment != NULL) {
547 /* comment */
548 nargv[argindex++] = "-c";
549 nargv[argindex++] = comment;
550 }
551
552 /* flags for home directory */
553 nargv[argindex++] = "-h";
554 nargv[argindex++] = homedir;
555
556 /* set gid flag */
557 nargv[argindex++] = "-g";
558 (void) sprintf(gidstring, "%u", gid);
559 nargv[argindex++] = gidstring;
560
561 /* shell */
562 nargv[argindex++] = "-s";
563 nargv[argindex++] = shell;
564
565 /* set inactive */
566 nargv[argindex++] = "-f";
567 (void) sprintf(inactstring, "%ld", inact);
568 nargv[argindex++] = inactstring;
569
570 /* set expiration date */
571 if (expirestr != NULL) {
572 nargv[argindex++] = "-e";
573 nargv[argindex++] = expirestr;
574 }
575
576 /* set uid flag */
577 nargv[argindex++] = "-u";
578 (void) sprintf(uidstring, "%u", uid);
579 nargv[argindex++] = uidstring;
580
581 if (oflag) nargv[argindex++] = "-o";
582
583 if (nkeys > 1)
584 addkey_args(nargv, &argindex);
585
586 /* finally - login name */
587 nargv[argindex++] = logname;
588
589 /* set the last to null */
590 nargv[argindex++] = NULL;
591
592 /* now call passmgmt */
593 ret = PEX_FAILED;
594 /*
595 * If call_passmgmt fails for any reason other than PEX_BADUID, exit
596 * is invoked with an appropriate error message. If PEX_BADUID is
597 * returned, then if the user specified the ID, exit is invoked
598 * with an appropriate error message. Otherwise we try to pick a
599 * different ID and try again. If we run out of IDs, i.e. no more
600 * users can be created, then -1 is returned and we terminate via exit.
601 * If PEX_BUSY is returned we increment a count, since we will stop
602 * trying if PEX_BUSY reaches 3. For PEX_SUCCESS we immediately
603 * terminate the loop.
604 */
605 while (busy < 3 && ret != PEX_SUCCESS) {
606 switch (ret = call_passmgmt(nargv)) {
607 case PEX_SUCCESS:
608 break;
609 case PEX_BUSY:
610 busy++;
611 break;
612 case PEX_HOSED_FILES:
613 errmsg(M_HOSED_FILES);
614 exit(EX_INCONSISTENT);
615 break;
616
617 case PEX_SYNTAX:
618 case PEX_BADARG:
619 /* should NEVER occur that passmgmt usage is wrong */
620 if (is_role(usertype))
621 errmsg(M_ARUSAGE);
622 else
623 errmsg(M_AUSAGE);
624 exit(EX_SYNTAX);
625 break;
626
627 case PEX_BADUID:
628 /*
629 * The uid has been taken. If it was specified by a
630 * user, then we must fail. Otherwise, keep trying
631 * to get a good uid until we run out of IDs.
632 */
633 if (uidstr != NULL) {
634 errmsg(M_UID_USED, uid);
635 exit(EX_ID_EXISTS);
636 } else {
637 if ((uid = findnextuid()) < 0) {
638 errmsg(M_INVALID, "default id",
639 "user id");
640 exit(EX_ID_EXISTS);
641 }
642 (void) sprintf(uidstring, "%u", uid);
643 }
644 break;
645
646 case PEX_BADNAME:
647 /* invalid loname */
648 errmsg(M_USED, logname);
649 exit(EX_NAME_EXISTS);
650 break;
651
652 default:
653 errmsg(M_UPDATE, "created");
654 exit(ret);
655 break;
656 }
657 }
658 if (busy == 3) {
659 errmsg(M_UPDATE, "created");
660 exit(ret);
661 }
662
663 /* add group entry */
664 if ((grps != NULL) && edit_group(logname, (char *)0, gidlist, 0)) {
665 errmsg(M_UPDATE, "created");
666 cleanup(logname);
667 exit(EX_UPDATE);
668 }
669
670 /* update project database */
671 if ((projects != NULL) &&
672 edit_project(logname, (char *)NULL, projlist, 0)) {
673 errmsg(M_UPDATE, "created");
674 cleanup(logname);
675 exit(EX_UPDATE);
676 }
677
678 /* create home directory */
679 if (mflag &&
680 (create_home(homedir, skel_dir, uid, gid) != EX_SUCCESS)) {
681 (void) edit_group(logname, (char *)0, (int **)0, 1);
682 cleanup(logname);
683 exit(EX_HOMEDIR);
684 }
685
686 return (ret);
687 }
688
689 static void
690 cleanup(logname)
691 char *logname;
692 {
693 char *nargv[4];
694
695 nargv[0] = PASSMGMT;
696 nargv[1] = "-d";
697 nargv[2] = logname;
698 nargv[3] = NULL;
699
700 switch (call_passmgmt(nargv)) {
701 case PEX_SUCCESS:
702 break;
703
704 case PEX_SYNTAX:
705 /* should NEVER occur that passmgmt usage is wrong */
706 if (is_role(usertype))
707 errmsg(M_ARUSAGE);
708 else
709 errmsg(M_AUSAGE);
710 break;
711
712 case PEX_BADUID:
713 /* uid is used - shouldn't happen but print message anyway */
714 errmsg(M_UID_USED, uid);
715 break;
716
717 case PEX_BADNAME:
718 /* invalid loname */
719 errmsg(M_USED, logname);
720 break;
721
722 default:
723 errmsg(M_UPDATE, "created");
724 break;
725 }
726 }
727
728 /* Check the validity for shell, base_dir and skel_dir */
729
730 void
731 valid_input(path_opt_t opt, const char *input)
732 {
733 struct stat statbuf;
734
735 if (REL_PATH(input)) {
736 errmsg(M_RELPATH, input);
737 exit(EX_BADARG);
738 }
739 if (stat(input, &statbuf) == -1) {
740 errmsg(M_INVALID, input, "path");
741 exit(EX_BADARG);
742 }
743 if (opt == SHELL) {
744 if (!S_ISREG(statbuf.st_mode) ||
745 (statbuf.st_mode & 0555) != 0555) {
746 errmsg(M_INVALID, input, "shell");
747 exit(EX_BADARG);
748 }
749 } else {
750 if (!S_ISDIR(statbuf.st_mode)) {
751 errmsg(M_INVALID, input, "directory");
752 exit(EX_BADARG);
753 }
754 }
755 }