svn commit: trunk/busybox: include libbb loginutils
vda at busybox.net
vda at busybox.net
Wed Mar 19 23:15:28 UTC 2008
Author: vda
Date: 2008-03-19 16:15:26 -0700 (Wed, 19 Mar 2008)
New Revision: 21404
Log:
adduser/addgroup: check username for invalid chars
(by Tito <farmatito AT tiscali.it>). +129 bytes when enabled.
Modified:
trunk/busybox/include/libbb.h
trunk/busybox/libbb/Kbuild
trunk/busybox/loginutils/Config.in
trunk/busybox/loginutils/addgroup.c
trunk/busybox/loginutils/adduser.c
Changeset:
Modified: trunk/busybox/include/libbb.h
===================================================================
--- trunk/busybox/include/libbb.h 2008-03-19 19:38:46 UTC (rev 21403)
+++ trunk/busybox/include/libbb.h 2008-03-19 23:15:26 UTC (rev 21404)
@@ -637,8 +637,12 @@
void clear_username_cache(void);
/* internally usernames are saved in fixed-sized char[] buffers */
enum { USERNAME_MAX_SIZE = 16 - sizeof(int) };
+#if ENABLE_FEATURE_CHECK_NAMES
+void die_if_bad_username(const char* name);
+#else
+#define die_if_bad_username(name) ((void)(name))
+#endif
-
int execable_file(const char *name);
char *find_execable(const char *filename);
int exists_execable(const char *filename);
Modified: trunk/busybox/libbb/Kbuild
===================================================================
--- trunk/busybox/libbb/Kbuild 2008-03-19 19:38:46 UTC (rev 21403)
+++ trunk/busybox/libbb/Kbuild 2008-03-19 23:15:26 UTC (rev 21404)
@@ -122,6 +122,7 @@
lib-$(CONFIG_SELINUX) += selinux_common.o
lib-$(CONFIG_HWCLOCK) += rtc.o
lib-$(CONFIG_RTCWAKE) += rtc.o
+lib-$(CONFIG_FEATURE_CHECK_NAMES) += die_if_bad_username.o
# We shouldn't build xregcomp.c if we don't need it - this ensures we don't
# require regex.h to be in the include dir even if we don't need it thereby
Modified: trunk/busybox/loginutils/Config.in
===================================================================
--- trunk/busybox/loginutils/Config.in 2008-03-19 19:38:46 UTC (rev 21403)
+++ trunk/busybox/loginutils/Config.in 2008-03-19 23:15:26 UTC (rev 21404)
@@ -82,6 +82,18 @@
If called with two non-option arguments, deluser
or delgroup will remove an user from a specified group.
+config FEATURE_CHECK_NAMES
+ bool "Enable sanity check on user/group names in adduser and addgroup"
+ default n
+ depends on ADDUSER || ADDGROUP
+ help
+ Enable sanity check on user and group names in adduser and addgroup.
+ To avoid problems, the user or group name should consist only of
+ letters, digits, underscores, periods, at signs and dashes,
+ and not start with a dash (as defined by IEEE Std 1003.1-2001).
+ For compatibility with Samba machine accounts "$" is also supported
+ at the end of the user or group name.
+
config ADDUSER
bool "adduser"
default n
Modified: trunk/busybox/loginutils/addgroup.c
===================================================================
--- trunk/busybox/loginutils/addgroup.c 2008-03-19 19:38:46 UTC (rev 21403)
+++ trunk/busybox/loginutils/addgroup.c 2008-03-19 23:15:26 UTC (rev 21404)
@@ -173,8 +173,11 @@
#endif
} else
#endif /* ENABLE_FEATURE_ADDUSER_TO_GROUP */
+ {
+ die_if_bad_username(argv[0]);
new_group(argv[0], gid);
+ }
/* Reached only on success */
return EXIT_SUCCESS;
}
Modified: trunk/busybox/loginutils/adduser.c
===================================================================
--- trunk/busybox/loginutils/adduser.c 2008-03-19 19:38:46 UTC (rev 21403)
+++ trunk/busybox/loginutils/adduser.c 2008-03-19 23:15:26 UTC (rev 21404)
@@ -111,6 +111,7 @@
/* fill in the passwd struct */
pw.pw_name = argv[0];
+ die_if_bad_username(pw.pw_name);
if (!pw.pw_dir) {
/* create string for $HOME if not specified already */
pw.pw_dir = xasprintf("/home/%s", argv[0]);
More information about the busybox-cvs
mailing list