* NEWS, src/gpasswd.c: Read the group and shadow groups using

  gr_locate and sgr_locate. gpasswd write in the file database. Thus
  it should read information from the file database, not using
  getgrnam. The change to sgr_locate is just for consistency. This
  requires opening the group databases (read only) using
  gr_open/sgr_open.
* NEWS: Indicate that manpages should be re-generated if configure
  option are changed, due to conditions.

diff --git a/ChangeLog b/ChangeLog
index 1907f1f25969dd1f0777d6a7edcf02fdb1b58abd..dc9674f529afd3cb02afdb74b4b574f1ae51bfd8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2007-11-22  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEWS, src/gpasswd.c: Read the group and shadow groups using
+       gr_locate and sgr_locate. gpasswd write in the file database. Thus
+       it should read information from the file database, not using
+       getgrnam. The change to sgr_locate is just for consistency. This
+       requires opening the group databases (read only) using
+       gr_open/sgr_open.
+
 2007-11-22  Nicolas François  <nicolas.francois@centraliens.net>
 
        * configure.in: SHADOWGRP added to AM_CONDITIONAL for the
@@ -8,6 +17,8 @@
        gshadow/no_gshadow condition.
        * man/gpasswd.1.xml: Use the gshadow/no_gshadow condition to
        change the manpage depending on the shadow group support.
+       * NEWS: Indicate that manpages should be re-generated if configure
+       option are changed, due to conditions.
 
 2007-11-22  Nicolas François  <nicolas.francois@centraliens.net>
 

diff --git a/NEWS b/NEWS
index ec519be6c8ea75e5b0b7be1fefd1b0eb92d28128..5f2fbfc7d13ef79923811ea894a63fbab3a31bc9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -43,9 +43,15 @@ shadow-4.0.18.1 -> shadow-4.0.18.2                                   UNRELEASED
   passwordless account.
 - Full review of the usage of getpwnam(), getpwuid(), getgrnam(),
   getgrgid(), and getspnam(). There should be no functional changes.
+- gpasswd: Only read information from the local file group database. It
+  writes the changes in /etc/group and/or /etc/gshadow, but used to read
+  information from getgrnam (hence possibly from another group database).
 
 *** documentation:
 - Generate the translated manpages from PO at build time.
+- The generated manpages will change depending on the configure options.
+  If you use different options than the one used for the distributed
+  archive, you should re-generate the manpages.
 
 shadow-4.0.18.1 -> shadow-4.0.18.2                                     28-10-2007
 

diff --git a/src/gpasswd.c b/src/gpasswd.c
index 861dca0821150e518d6b8a8bd5dca08e5a51d4bb..26b41b7362442b69658a601390901d8035164ef4 100644 (file)
--- a/src/gpasswd.c
+++ b/src/gpasswd.c
@@ -171,12 +171,12 @@ int main (int argc, char **argv)
        char *cp;
        int amroot;
        int retries;
-       struct group *gr = NULL;
+       struct group const*gr = NULL;
        struct group grent;
        static char pass[BUFSIZ];
 
 #ifdef SHADOWGRP
-       struct sgrp *sg = NULL;
+       struct sgrp const*sg = NULL;
        struct sgrp sgent;
        char *admins = NULL;
 #endif
@@ -314,14 +314,20 @@ int main (int argc, char **argv)
         * will be completely replicated so it may be modified later on.
         */
 
-       /*
-        * XXX - should get the entry using gr_locate() and modify that,
-        * getgrnam() could give us a NIS group.  --marekm
-        */
        if (!(group = argv[optind]))
                usage ();
 
-       if (!(gr = getgrnam (group))) { /* dup, no need for xgetgrnam */
+       if (!gr_open (O_RDONLY)) {
+               fprintf (stderr, _("%s: can't open file\n"), Prog);
+               SYSLOG ((LOG_WARN, "cannot open /etc/group"));
+#ifdef WITH_AUDIT
+               audit_logger (AUDIT_USER_CHAUTHTOK, Prog, "opening /etc/group",
+                             group, -1, 0);
+#endif
+               exit (1);
+       }
+
+       if (!(gr = gr_locate (group))) {
                fprintf (stderr, _("unknown group: %s\n"), group);
 #ifdef WITH_AUDIT
                audit_logger (AUDIT_USER_CHAUTHTOK, Prog, "group lookup", group,
@@ -334,8 +340,26 @@ int main (int argc, char **argv)
        grent.gr_passwd = xstrdup (gr->gr_passwd);
 
        grent.gr_mem = dup_list (gr->gr_mem);
+       if (!gr_close ()) {
+               fprintf (stderr, _("%s: can't close file\n"), Prog);
+               SYSLOG ((LOG_WARN, "cannot close /etc/group"));
+#ifdef WITH_AUDIT
+               audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+                             "closing /etc/group", group, -1, 0);
+#endif
+               exit (1);
+       }
 #ifdef SHADOWGRP
-       if ((sg = getsgnam (group))) {
+       if (!sgr_open (O_RDONLY)) {
+               fprintf (stderr, _("%s: can't open shadow file\n"), Prog);
+               SYSLOG ((LOG_WARN, "cannot open /etc/gshadow"));
+#ifdef WITH_AUDIT
+               audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+                             "opening /etc/gshadow", group, -1, 0);
+#endif
+               exit (1);
+       }
+       if ((sg = sgr_locate (group))) {
                sgent = *sg;
                sgent.sg_name = xstrdup (sg->sg_name);
                sgent.sg_passwd = xstrdup (sg->sg_passwd);
@@ -360,6 +384,15 @@ int main (int argc, char **argv)
 
                sg = &sgent;
        }
+       if (!sgr_close ()) {
+               fprintf (stderr, _("%s: can't close shadow file\n"), Prog);
+               SYSLOG ((LOG_WARN, "cannot close /etc/gshadow"));
+#ifdef WITH_AUDIT
+               audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+                             "closing /etc/gshadow", group, -1, 0);
+#endif
+               exit (1);
+       }
 
        /*
         * The policy here for changing a group is that 1) you must be root