VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Forbid purely numeric user/group names, and "." and ".."

Browse Source
This commit is contained in:
Chris Hofstaedtler
2024-12-06 19:55:29 +01:00
parent 931b0f68b7
commit d14cb1acb3
2 changed files with 32 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
debian/patches/debian/Define-LOGIN_NAME_MAX-on-HURD.patch
Vendored
+1 -1
View File
@@ -7,7 +7,7 @@ Subject: Define LOGIN_NAME_MAX on HURD
1 file changed, 6 insertions(+)
diff --git a/lib/chkname.c b/lib/chkname.c
index f71f9fe..412dcce 100644
index 95fbe10..c36bcc9 100644
--- a/lib/chkname.c
+++ b/lib/chkname.c
@@ -31,6 +31,12 @@
debian/patches/debian/Relax-usernames-groupnames-checking.patch
Vendored
+31 -40
View File
@@ -16,16 +16,16 @@ anymore. closes: #79682, #166798, #171179
Status wrt upstream: Debian specific. Not to be used upstream
---
lib/chkname.c | 50 ++++++++++++++------------------------------------
man/groupadd.8.xml | 6 ++++++
man/useradd.8.xml | 8 ++++++++
3 files changed, 28 insertions(+), 36 deletions(-)
lib/chkname.c | 39 +++++++++++++++------------------------
man/groupadd.8.xml | 7 +++++++
man/useradd.8.xml | 9 +++++++++
3 files changed, 31 insertions(+), 24 deletions(-)
diff --git a/lib/chkname.c b/lib/chkname.c
index 8bde7a2..f71f9fe 100644
index 8bde7a2..95fbe10 100644
--- a/lib/chkname.c
+++ b/lib/chkname.c
@@ -60,51 +60,29 @@ is_valid_name(const char *name)
@@ -60,24 +60,22 @@ is_valid_name(const char *name)
}
/*
@@ -37,8 +37,16 @@ index 8bde7a2..f71f9fe 100644
- *
- * Also do not allow fully numeric names or just "." or "..".
- */
- int numeric;
-
+ * POSIX indicate that usernames are composed of characters from the
+ * portable filename character set [A-Za-z0-9._-], and that the hyphen
+ * should not be used as the first character of a portable user name.
+ *
+ * Allow more relaxed user/group names in Debian -- ^[^-~+:,\\\s][^:,\\\s]*$
+ *
+ * Also do not allow fully numeric names or just "." or "..".
+ */
int numeric;
- if ('\0' == *name ||
- ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
- '\0' == name[1])) ||
@@ -47,24 +55,19 @@ index 8bde7a2..f71f9fe 100644
- (*name >= '0' && *name <= '9') ||
- *name == '_' ||
- *name == '.'))
+ * POSIX indicate that usernames are composed of characters from the
+ * portable filename character set [A-Za-z0-9._-], and that the hyphen
+ * should not be used as the first character of a portable user name.
+ *
+ * Allow more relaxed user/group names in Debian -- ^[^-~+:,\\\s][^:,\\\s]*$
+ */
+ if ( ('\0' == *name)
+ || ('-' == *name)
+ || ('~' == *name)
+ || ('+' == *name))
+ if (('\0' == *name) ||
+ ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
+ '\0' == name[1])) ||
+ ('-' == *name) ||
+ ('~' == *name) ||
+ ('+' == *name))
{
errno = EINVAL;
return false;
}
@@ -86,14 +84,7 @@ is_valid_name(const char *name)
numeric = isdigit(*name);
- numeric = isdigit(*name);
-
- while ('\0' != *++name) {
while ('\0' != *++name) {
- if (!((*name >= 'a' && *name <= 'z') ||
- (*name >= 'A' && *name <= 'Z') ||
- (*name >= '0' && *name <= '9') ||
@@ -73,29 +76,15 @@ index 8bde7a2..f71f9fe 100644
- *name == '-' ||
- (*name == '$' && name[1] == '\0')
- ))
+ do {
+ if ((':' == *name) || (',' == *name) || ('\\' == *name) || isspace(*name))
{
errno = EINVAL;
return false;
}
- numeric &= isdigit(*name);
- }
-
- if (numeric) {
- errno = EINVAL;
- return false;
- }
+ name++;
+ } while ('\0' != *name);
return true;
}
diff --git a/man/groupadd.8.xml b/man/groupadd.8.xml
index 9abf159..06f8f7c 100644
index 9abf159..5aa7998 100644
--- a/man/groupadd.8.xml
+++ b/man/groupadd.8.xml
@@ -71,6 +71,12 @@
@@ -71,6 +71,13 @@
Fully numeric groupnames and groupnames . or .. are
also disallowed.
</para>
@@ -104,15 +93,16 @@ index 9abf159..06f8f7c 100644
+ with a dash ('-') nor plus ('+') nor tilde ('~') nor contain a
+ colon (':'), a comma (','), or a whitespace (space:' ',
+ end of line: '\n', tabulation: '\t', etc.).
+ They also cannot be purely numeric or the strings "." or "..".
+ </para>
<para>
Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
</para>
diff --git a/man/useradd.8.xml b/man/useradd.8.xml
index 17987a6..c98b214 100644
index 17987a6..e164940 100644
--- a/man/useradd.8.xml
+++ b/man/useradd.8.xml
@@ -735,6 +735,14 @@
@@ -735,6 +735,15 @@
<para>
Usernames may only be up to 256 characters long.
</para>
@@ -123,6 +113,7 @@ index 17987a6..c98b214 100644
+ end of line: '\n', tabulation: '\t', etc.). Note that using a slash
+ ('/') may break the default algorithm for the definition of the
+ user's home directory.
+ They also cannot be purely numeric or the strings "." or "..".
+ </para>
</refsect1>