mkusers 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443
  1. #!/usr/bin/env bash
  2. set -e
  3. myname="${0##*/}"
  4. #----------------------------------------------------------------------------
  5. # Configurable items
  6. MIN_UID=1000
  7. MAX_UID=1999
  8. MIN_GID=1000
  9. MAX_GID=1999
  10. # No more is configurable below this point
  11. #----------------------------------------------------------------------------
  12. #----------------------------------------------------------------------------
  13. error() {
  14. local fmt="${1}"
  15. shift
  16. printf "%s: " "${myname}" >&2
  17. printf "${fmt}" "${@}" >&2
  18. }
  19. fail() {
  20. error "$@"
  21. exit 1
  22. }
  23. #----------------------------------------------------------------------------
  24. if [ ${#} -ne 2 ]; then
  25. fail "usage: %s USERS_TABLE TARGET_DIR\n"
  26. fi
  27. USERS_TABLE="${1}"
  28. TARGET_DIR="${2}"
  29. shift 2
  30. PASSWD="${TARGET_DIR}/etc/passwd"
  31. SHADOW="${TARGET_DIR}/etc/shadow"
  32. GROUP="${TARGET_DIR}/etc/group"
  33. # /etc/gshadow is not part of the standard skeleton, so not everybody
  34. # will have it, but some may have it, and its content must be in sync
  35. # with /etc/group, so any use of gshadow must be conditional.
  36. GSHADOW="${TARGET_DIR}/etc/gshadow"
  37. # We can't simply source ${BR2_CONFIG} as it may contains constructs
  38. # such as:
  39. # BR2_DEFCONFIG="$(CONFIG_DIR)/defconfig"
  40. # which when sourced from a shell script will eventually try to execute
  41. # a command named 'CONFIG_DIR', which is plain wrong for virtually every
  42. # systems out there.
  43. # So, we have to scan that file instead. Sigh... :-(
  44. PASSWD_METHOD="$( sed -r -e '/^BR2_TARGET_GENERIC_PASSWD_METHOD="(.*)"$/!d;' \
  45. -e 's//\1/;' \
  46. "${BR2_CONFIG}" \
  47. )"
  48. #----------------------------------------------------------------------------
  49. get_uid() {
  50. local username="${1}"
  51. awk -F: -v username="${username}" \
  52. '$1 == username { printf( "%d\n", $3 ); }' "${PASSWD}"
  53. }
  54. #----------------------------------------------------------------------------
  55. get_ugid() {
  56. local username="${1}"
  57. awk -F: -v username="${username}" \
  58. '$1 == username { printf( "%d\n", $4 ); }' "${PASSWD}"
  59. }
  60. #----------------------------------------------------------------------------
  61. get_gid() {
  62. local group="${1}"
  63. awk -F: -v group="${group}" \
  64. '$1 == group { printf( "%d\n", $3 ); }' "${GROUP}"
  65. }
  66. #----------------------------------------------------------------------------
  67. get_members() {
  68. local group="${1}"
  69. awk -F: -v group="${group}" \
  70. '$1 == group { printf( "%s\n", $4 ); }' "${GROUP}"
  71. }
  72. #----------------------------------------------------------------------------
  73. get_username() {
  74. local uid="${1}"
  75. awk -F: -v uid="${uid}" \
  76. '$3 == uid { printf( "%s\n", $1 ); }' "${PASSWD}"
  77. }
  78. #----------------------------------------------------------------------------
  79. get_group() {
  80. local gid="${1}"
  81. awk -F: -v gid="${gid}" \
  82. '$3 == gid { printf( "%s\n", $1 ); }' "${GROUP}"
  83. }
  84. #----------------------------------------------------------------------------
  85. get_ugroup() {
  86. local username="${1}"
  87. local ugid
  88. ugid="$( get_ugid "${username}" )"
  89. if [ -n "${ugid}" ]; then
  90. get_group "${ugid}"
  91. fi
  92. }
  93. #----------------------------------------------------------------------------
  94. # Sanity-check the new user/group:
  95. # - check the gid is not already used for another group
  96. # - check the group does not already exist with another gid
  97. # - check the user does not already exist with another gid
  98. # - check the uid is not already used for another user
  99. # - check the user does not already exist with another uid
  100. # - check the user does not already exist in another group
  101. check_user_validity() {
  102. local username="${1}"
  103. local uid="${2}"
  104. local group="${3}"
  105. local gid="${4}"
  106. local _uid _ugid _gid _username _group _ugroup
  107. _group="$( get_group "${gid}" )"
  108. _gid="$( get_gid "${group}" )"
  109. _ugid="$( get_ugid "${username}" )"
  110. _username="$( get_username "${uid}" )"
  111. _uid="$( get_uid "${username}" )"
  112. _ugroup="$( get_ugroup "${username}" )"
  113. if [ "${username}" = "root" ]; then
  114. fail "invalid username '%s\n'" "${username}"
  115. fi
  116. if [ ${gid} -lt -1 -o ${gid} -eq 0 ]; then
  117. fail "invalid gid '%d' for '%s'\n" ${gid} "${username}"
  118. elif [ ${gid} -ne -1 ]; then
  119. # check the gid is not already used for another group
  120. if [ -n "${_group}" -a "${_group}" != "${group}" ]; then
  121. fail "gid '%d' for '%s' is already used by group '%s'\n" \
  122. ${gid} "${username}" "${_group}"
  123. fi
  124. # check the group does not already exists with another gid
  125. # Need to split the check in two, otherwise '[' complains it
  126. # is missing arguments when _gid is empty
  127. if [ -n "${_gid}" ] && [ ${_gid} -ne ${gid} ]; then
  128. fail "group '%s' for '%s' already exists with gid '%d' (wants '%d')\n" \
  129. "${group}" "${username}" ${_gid} ${gid}
  130. fi
  131. # check the user does not already exists with another gid
  132. # Need to split the check in two, otherwise '[' complains it
  133. # is missing arguments when _ugid is empty
  134. if [ -n "${_ugid}" ] && [ ${_ugid} -ne ${gid} ]; then
  135. fail "user '%s' already exists with gid '%d' (wants '%d')\n" \
  136. "${username}" ${_ugid} ${gid}
  137. fi
  138. fi
  139. if [ ${uid} -lt -1 -o ${uid} -eq 0 ]; then
  140. fail "invalid uid '%d' for '%s'\n" ${uid} "${username}"
  141. elif [ ${uid} -ne -1 ]; then
  142. # check the uid is not already used for another user
  143. if [ -n "${_username}" -a "${_username}" != "${username}" ]; then
  144. fail "uid '%d' for '%s' already used by user '%s'\n" \
  145. ${uid} "${username}" "${_username}"
  146. fi
  147. # check the user does not already exists with another uid
  148. # Need to split the check in two, otherwise '[' complains it
  149. # is missing arguments when _uid is empty
  150. if [ -n "${_uid}" ] && [ ${_uid} -ne ${uid} ]; then
  151. fail "user '%s' already exists with uid '%d' (wants '%d')\n" \
  152. "${username}" ${_uid} ${uid}
  153. fi
  154. fi
  155. # check the user does not already exist in another group
  156. if [ -n "${_ugroup}" -a "${_ugroup}" != "${group}" ]; then
  157. fail "user '%s' already exists with group '%s' (wants '%s')\n" \
  158. "${username}" "${_ugroup}" "${group}"
  159. fi
  160. return 0
  161. }
  162. #----------------------------------------------------------------------------
  163. # Generate a unique GID for given group. If the group already exists,
  164. # then simply report its current GID. Otherwise, generate the lowest GID
  165. # that is:
  166. # - not 0
  167. # - comprised in [MIN_GID..MAX_GID]
  168. # - not already used by a group
  169. generate_gid() {
  170. local group="${1}"
  171. local gid
  172. gid="$( get_gid "${group}" )"
  173. if [ -z "${gid}" ]; then
  174. for(( gid=MIN_GID; gid<=MAX_GID; gid++ )); do
  175. if [ -z "$( get_group "${gid}" )" ]; then
  176. break
  177. fi
  178. done
  179. if [ ${gid} -gt ${MAX_GID} ]; then
  180. fail "can not allocate a GID for group '%s'\n" "${group}"
  181. fi
  182. fi
  183. printf "%d\n" "${gid}"
  184. }
  185. #----------------------------------------------------------------------------
  186. # Add a group; if it does already exist, remove it first
  187. add_one_group() {
  188. local group="${1}"
  189. local gid="${2}"
  190. local members
  191. # Generate a new GID if needed
  192. if [ ${gid} -eq -1 ]; then
  193. gid="$( generate_gid "${group}" )"
  194. fi
  195. members=$(get_members "$group")
  196. # Remove any previous instance of this group, and re-add the new one
  197. sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GROUP}"
  198. printf "%s:x:%d:%s\n" "${group}" "${gid}" "${members}" >>"${GROUP}"
  199. # Ditto for /etc/gshadow if it exists
  200. if [ -f "${GSHADOW}" ]; then
  201. sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GSHADOW}"
  202. printf "%s:*::\n" "${group}" >>"${GSHADOW}"
  203. fi
  204. }
  205. #----------------------------------------------------------------------------
  206. # Generate a unique UID for given username. If the username already exists,
  207. # then simply report its current UID. Otherwise, generate the lowest UID
  208. # that is:
  209. # - not 0
  210. # - comprised in [MIN_UID..MAX_UID]
  211. # - not already used by a user
  212. generate_uid() {
  213. local username="${1}"
  214. local uid
  215. uid="$( get_uid "${username}" )"
  216. if [ -z "${uid}" ]; then
  217. for(( uid=MIN_UID; uid<=MAX_UID; uid++ )); do
  218. if [ -z "$( get_username "${uid}" )" ]; then
  219. break
  220. fi
  221. done
  222. if [ ${uid} -gt ${MAX_UID} ]; then
  223. fail "can not allocate a UID for user '%s'\n" "${username}"
  224. fi
  225. fi
  226. printf "%d\n" "${uid}"
  227. }
  228. #----------------------------------------------------------------------------
  229. # Add given user to given group, if not already the case
  230. add_user_to_group() {
  231. local username="${1}"
  232. local group="${2}"
  233. local _f
  234. for _f in "${GROUP}" "${GSHADOW}"; do
  235. [ -f "${_f}" ] || continue
  236. sed -r -i --follow-symlinks \
  237. -e 's/^('"${group}"':.*:)(([^:]+,)?)'"${username}"'(,[^:]+*)?$/\1\2\4/;' \
  238. -e 's/^('"${group}"':.*)$/\1,'"${username}"'/;' \
  239. -e 's/,+/,/' \
  240. -e 's/:,/:/' \
  241. "${_f}"
  242. done
  243. }
  244. #----------------------------------------------------------------------------
  245. # Encode a password
  246. encode_password() {
  247. local passwd="${1}"
  248. mkpasswd -m "${PASSWD_METHOD}" "${passwd}"
  249. }
  250. #----------------------------------------------------------------------------
  251. # Add a user; if it does already exist, remove it first
  252. add_one_user() {
  253. local username="${1}"
  254. local uid="${2}"
  255. local group="${3}"
  256. local gid="${4}"
  257. local passwd="${5}"
  258. local home="${6}"
  259. local shell="${7}"
  260. local groups="${8}"
  261. local comment="${9}"
  262. local _f _group _home _shell _gid _passwd
  263. # First, sanity-check the user
  264. check_user_validity "${username}" "${uid}" "${group}" "${gid}"
  265. # Generate a new UID if needed
  266. if [ ${uid} -eq -1 ]; then
  267. uid="$( generate_uid "${username}" )"
  268. fi
  269. # Remove any previous instance of this user
  270. for _f in "${PASSWD}" "${SHADOW}"; do
  271. sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"
  272. done
  273. _gid="$( get_gid "${group}" )"
  274. _shell="${shell}"
  275. if [ "${shell}" = "-" ]; then
  276. _shell="/bin/false"
  277. fi
  278. case "${home}" in
  279. -) _home="/";;
  280. /) fail "home can not explicitly be '/'\n";;
  281. /*) _home="${home}";;
  282. *) fail "home must be an absolute path\n";;
  283. esac
  284. case "${passwd}" in
  285. -)
  286. _passwd=""
  287. ;;
  288. !=*)
  289. _passwd='!'"$( encode_password "${passwd#!=}" )"
  290. ;;
  291. =*)
  292. _passwd="$( encode_password "${passwd#=}" )"
  293. ;;
  294. *)
  295. _passwd="${passwd}"
  296. ;;
  297. esac
  298. printf "%s:x:%d:%d:%s:%s:%s\n" \
  299. "${username}" "${uid}" "${_gid}" \
  300. "${comment}" "${_home}" "${_shell}" \
  301. >>"${PASSWD}"
  302. printf "%s:%s:::::::\n" \
  303. "${username}" "${_passwd}" \
  304. >>"${SHADOW}"
  305. # Add the user to its additional groups
  306. if [ "${groups}" != "-" ]; then
  307. for _group in ${groups//,/ }; do
  308. add_user_to_group "${username}" "${_group}"
  309. done
  310. fi
  311. # If the user has a home, chown it
  312. # (Note: stdout goes to the fakeroot-script)
  313. if [ "${home}" != "-" ]; then
  314. mkdir -p "${TARGET_DIR}/${home}"
  315. printf "chown -h -R %d:%d '%s'\n" "${uid}" "${_gid}" "${TARGET_DIR}/${home}"
  316. fi
  317. }
  318. #----------------------------------------------------------------------------
  319. main() {
  320. local username uid group gid passwd home shell groups comment
  321. local line
  322. local -a ENTRIES
  323. # Some sanity checks
  324. if [ ${MIN_UID} -le 0 ]; then
  325. fail "MIN_UID must be >0 (currently %d)\n" ${MIN_UID}
  326. fi
  327. if [ ${MIN_GID} -le 0 ]; then
  328. fail "MIN_GID must be >0 (currently %d)\n" ${MIN_GID}
  329. fi
  330. # Read in all the file in memory, exclude empty lines and comments
  331. while read line; do
  332. ENTRIES+=( "${line}" )
  333. done < <( sed -r -e 's/#.*//; /^[[:space:]]*$/d;' "${USERS_TABLE}" )
  334. # We first create groups whose gid is not -1, and then we create groups
  335. # whose gid is -1 (automatic), so that, if a group is defined both with
  336. # a specified gid and an automatic gid, we ensure the specified gid is
  337. # used, rather than a different automatic gid is computed.
  338. # First, create all the main groups which gid is *not* automatic
  339. for line in "${ENTRIES[@]}"; do
  340. read username uid group gid passwd home shell groups comment <<<"${line}"
  341. [ ${gid} -ge 0 ] || continue # Automatic gid
  342. add_one_group "${group}" "${gid}"
  343. done
  344. # Then, create all the main groups which gid *is* automatic
  345. for line in "${ENTRIES[@]}"; do
  346. read username uid group gid passwd home shell groups comment <<<"${line}"
  347. [ ${gid} -eq -1 ] || continue # Non-automatic gid
  348. add_one_group "${group}" "${gid}"
  349. done
  350. # Then, create all the additional groups
  351. # If any additional group is already a main group, we should use
  352. # the gid of that main group; otherwise, we can use any gid
  353. for line in "${ENTRIES[@]}"; do
  354. read username uid group gid passwd home shell groups comment <<<"${line}"
  355. if [ "${groups}" != "-" ]; then
  356. for g in ${groups//,/ }; do
  357. add_one_group "${g}" -1
  358. done
  359. fi
  360. done
  361. # When adding users, we do as for groups, in case two packages create
  362. # the same user, one with an automatic uid, the other with a specified
  363. # uid, to ensure the specified uid is used, rather than an incompatible
  364. # uid be generated.
  365. # Now, add users whose uid is *not* automatic
  366. for line in "${ENTRIES[@]}"; do
  367. read username uid group gid passwd home shell groups comment <<<"${line}"
  368. [ "${username}" != "-" ] || continue # Magic string to skip user creation
  369. [ ${uid} -ge 0 ] || continue # Automatic uid
  370. add_one_user "${username}" "${uid}" "${group}" "${gid}" "${passwd}" \
  371. "${home}" "${shell}" "${groups}" "${comment}"
  372. done
  373. # Finally, add users whose uid *is* automatic
  374. for line in "${ENTRIES[@]}"; do
  375. read username uid group gid passwd home shell groups comment <<<"${line}"
  376. [ "${username}" != "-" ] || continue # Magic string to skip user creation
  377. [ ${uid} -eq -1 ] || continue # Non-automatic uid
  378. add_one_user "${username}" "${uid}" "${group}" "${gid}" "${passwd}" \
  379. "${home}" "${shell}" "${groups}" "${comment}"
  380. done
  381. }
  382. #----------------------------------------------------------------------------
  383. main "${@}"