VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

src/: Remove dead code

Browse Source 
FIRST_MEMBER_IS_ADMIN was never enabled.  And BTW, that code had been
broken for a long time, so probably nobody should manually enable it.

Link: <https://github.com/shadow-maint/shadow/pull/991#discussion_r1660308748>
Reported-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
2024-06-30 23:50:31 +02:00
committed by Serge Hallyn
parent ba3a51e90f
commit 53e1eb4045
2 changed files with 7 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gpasswd.c
+3 -33
View File
@@ -682,30 +682,8 @@ static void check_perms (const struct group *gr)
}
} else
#endif /* SHADOWGRP */
if (!amroot) {
/*
* The policy here for changing a group is that
* 1) you must be root or
* 2) you must be the first listed member of the group.
* The first listed member of a group can do anything to
* that group that the root user can. The rationale for
* this hack is that the FIRST user is probably the most
* important user in this entire group.
*
* This feature enabled by default could be a security
* problem when installed on existing systems where the
* first group member might be just a normal user.
* --marekm
*/
#if !defined(FIRST_MEMBER_IS_ADMIN)
if (!amroot)
failure();
#endif
if (gr->gr_mem[0] == NULL)
failure();
if (strcmp(gr->gr_mem[0], myname) != 0)
failure();
}
}
/*
@@ -805,16 +783,8 @@ static void get_group (struct group *gr)
sg->sg_mem = dup_list (gr->gr_mem);
sg->sg_adm = XMALLOC(2, char *);
#ifdef FIRST_MEMBER_IS_ADMIN
if (sg->sg_mem[0]) {
sg->sg_adm[0] = xstrdup (sg->sg_mem[0]);
sg->sg_adm[1] = NULL;
} else
#endif
{
sg->sg_adm[0] = NULL;
}
sg->sg_adm = XMALLOC(1, char *);
sg->sg_adm[0] = NULL;
}
if (sgr_close () == 0) {
src/groupmems.c
+4 -20
View File
@@ -129,16 +129,8 @@ static void add_user (const char *user,
static struct sgrp sgrent;
sgrent.sg_name = xstrdup (newgrp->gr_name);
sgrent.sg_mem = dup_list (newgrp->gr_mem);
sgrent.sg_adm = XMALLOC(2, char *);
#ifdef FIRST_MEMBER_IS_ADMIN
if (sgrent.sg_mem[0]) {
sgrent.sg_adm[0] = xstrdup (sgrent.sg_mem[0]);
sgrent.sg_adm[1] = NULL;
} else
#endif
{
sgrent.sg_adm[0] = NULL;
}
sgrent.sg_adm = XMALLOC(1, char *);
sgrent.sg_adm[0] = NULL;
/* Move any password to gshadow */
sgrent.sg_passwd = newgrp->gr_passwd;
@@ -212,16 +204,8 @@ static void remove_user (const char *user,
static struct sgrp sgrent;
sgrent.sg_name = xstrdup (newgrp->gr_name);
sgrent.sg_mem = dup_list (newgrp->gr_mem);
sgrent.sg_adm = XMALLOC(2, char *);
#ifdef FIRST_MEMBER_IS_ADMIN
if (sgrent.sg_mem[0]) {
sgrent.sg_adm[0] = xstrdup (sgrent.sg_mem[0]);
sgrent.sg_adm[1] = NULL;
} else
#endif
{
sgrent.sg_adm[0] = NULL;
}
sgrent.sg_adm = XMALLOC(1, char *);
sgrent.sg_adm[0] = NULL;
/* Move any password to gshadow */
sgrent.sg_passwd = newgrp->gr_passwd;