support/scripts/mkusers: allow /etc/shadow to be symlinked

PATCH Superseded Jens Maus 3 participants 6 messages Jun 8, 2017 – Jun 24, 2017

Share & tools

Jens Maus

author

2017-06-08 15:26 UTC #0 lore raw

PATCH 1/1 support/scripts/mkusers: allow /etc/shadow to be symlinked

This commit fixes a problem where it was not possible to replace /etc/shadow with a symlink to a e.g. a user partition where the shadow file is placed. This is required, e.g. for systems where the rootfs is mounted read-only but users should still be able to be added. Thus, if within an filesystem overlay setup a user tries to replace /etc/shadow with a symlink to the real file on a user partition a buildroot build stops with an error message because sed is called on the symlink instead of following the symlink. This commit fixes this shortcoming.

Signed-off-by Jens Maus <[email protected]>

---
 support/scripts/mkusers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

support/scripts/mkusers +1 -1

index 2ac76f986..e83aff6e0 100755
@@ -303,7 +303,7 @@ add_one_user() {
 
     # Remove any previous instance of this user
     for _f in "${PASSWD}" "${SHADOW}"; do
-        sed -r -i -e '/^'"${username}"':.*/d;' "${_f}"
+        sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"
     done
 
     _gid="$( get_gid "${group}" )"

Signature · 1 line

2.11.0

Yann E. MORIN

2017-06-11 13:48 UTC #1 lore raw

PATCH 1/1 support/scripts/mkusers: allow /etc/shadow to be symlinked

Jens, All,

On 2017-06-08 17:26 +0200, Jens Maus spake thusly:

Quoted 11 lines

This commit fixes a problem where it was not possible to replace /etc/shadow with a symlink to a e.g. a user partition where the shadow file is placed. This is required, e.g. for systems where the rootfs is mounted read-only but users should still be able to be added. Thus, if within an filesystem overlay setup a user tries to replace /etc/shadow with a symlink to the real file on a user partition a buildroot build stops with an error message because sed is called on the symlink instead of following the symlink. This commit fixes this shortcoming.
Signed-off-by Jens Maus <[email protected]>

Reviewed-by "Yann E. MORIN" <[email protected]>

It is to be noted that --follow-symlinks was introduced in sed 4.2, released 2009-05-11, a bit more than 8 years ago, and this is old enough that we believe all sane distros have it.

Regards,
Yann E. MORIN.

Quoted 24 lines

---
 support/scripts/mkusers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

support/scripts/mkusers +1 -1

index 2ac76f986..e83aff6e0 100755
@@ -303,7 +303,7 @@ add_one_user() {
 
     # Remove any previous instance of this user
     for _f in "${PASSWD}" "${SHADOW}"; do
-        sed -r -i -e '/^'"${username}"':.*/d;' "${_f}"
+        sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"
     done
 
     _gid="$( get_gid "${group}" )"

Signature · 6 lines

2.11.0

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Yann E. MORIN

2017-06-11 13:52 UTC #2 lore raw

PATCH 1/1 support/scripts/mkusers: allow /etc/shadow to be symlinked

In reply to Jens Maus

Jens, All,

On 2017-06-08 17:26 +0200, Jens Maus spake thusly:

Quoted 20 lines

This commit fixes a problem where it was not possible to replace /etc/shadow with a symlink to a e.g. a user partition where the shadow file is placed. This is required, e.g. for systems where the rootfs is mounted read-only but users should still be able to be added. Thus, if within an filesystem overlay setup a user tries to replace /etc/shadow with a symlink to the real file on a user partition a buildroot build stops with an error message because sed is called on the symlink instead of following the symlink. This commit fixes this shortcoming.
Signed-off-by Jens Maus <[email protected]>
---
 support/scripts/mkusers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
support/scripts/mkusers +0 -0
index 2ac76f986..e83aff6e0 100755

support/scripts/mkusers add_one_user() { · line 306

Quoted 5 lines

support/scripts/mkusers +1 -1

@@ -303,7 +303,7 @@ add_one_user() {
 
     # Remove any previous instance of this user
     for _f in "${PASSWD}" "${SHADOW}"; do
-        sed -r -i -e '/^'"${username}"':.*/d;' "${_f}"
+        sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"

By the way, you missed a few occurences:
- line 222
- line 227
- line 266

Care to fix those as well and respin, please?

Regards,
Yann E. MORIN.

Quoted 10 lines

support/scripts/mkusers +0 -0

     done
 
     _gid="$( get_gid "${group}" )"

Signature · 6 lines

2.11.0

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Jens Maus

author

2017-06-12 13:35 UTC #3 lore raw

PATCH v2 1/1 support/scripts: allow /etc/shadow to be symlinked

In reply to Jens Maus

Signed-off-by Jens Maus <[email protected]>

---
Changes v1 -> v2:
- extended follow-symlinks use (requested by Yann)

Signed-off-by Jens Maus <[email protected]>

---
 support/scripts/mkusers | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

support/scripts/mkusers +5 -4

index 2ac76f986..5bbec3e10 100755
@@ -219,12 +219,12 @@ add_one_group() {
     fi
 
     # Remove any previous instance of this group, and re-add the new one
-    sed -i -e '/^'"${group}"':.*/d;' "${GROUP}"
+    sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GROUP}"
     printf "%s:x:%d:\n" "${group}" "${gid}" >>"${GROUP}"
 
     # Ditto for /etc/gshadow if it exists
     if [ -f "${GSHADOW}" ]; then
-        sed -i -e '/^'"${group}"':.*/d;' "${GSHADOW}"
+        sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GSHADOW}"
         printf "%s:*::\n" "${group}" >>"${GSHADOW}"
     fi
 }

@@ -263,7 +263,8 @@ add_user_to_group() {
 
     for _f in "${GROUP}" "${GSHADOW}"; do
         [ -f "${_f}" ] || continue
-        sed -r -i -e 's/^('"${group}"':.*:)(([^:]+,)?)'"${username}"'(,[^:]+*)?$/\1\2\4/;'  \
+        sed -r -i --follow-symlinks \
+                  -e 's/^('"${group}"':.*:)(([^:]+,)?)'"${username}"'(,[^:]+*)?$/\1\2\4/;'  \
                   -e 's/^('"${group}"':.*)$/\1,'"${username}"'/;'                           \
                   -e 's/,+/,/'                                                              \
                   -e 's/:,/:/'                                                              \

@@ -303,7 +304,7 @@ add_one_user() {
 
     # Remove any previous instance of this user
     for _f in "${PASSWD}" "${SHADOW}"; do
-        sed -r -i -e '/^'"${username}"':.*/d;' "${_f}"
+        sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"
     done
 
     _gid="$( get_gid "${group}" )"

Signature · 1 line

2.11.0

Yann E. MORIN

2017-06-17 19:27 UTC #4 lore raw

PATCH v2 1/1 support/scripts: allow /etc/shadow to be symlinked

Jens, All,

On 2017-06-12 15:35 +0200, Jens Maus spake thusly:

Quoted 11 lines

This commit fixes a problem where it was not possible to replace /etc/shadow with a symlink to a e.g. a user partition where the shadow file is placed. This is required, e.g. for systems where the rootfs is mounted read-only but users should still be able to be added. Thus, if within an filesystem overlay setup a user tries to replace /etc/shadow with a symlink to the real file on a user partition a buildroot build stops with an error message because sed is called on the symlink instead of following the symlink. This commit fixes this shortcoming.
Signed-off-by Jens Maus <[email protected]>

Reviewed-by "Yann E. MORIN" <[email protected]>

Regards,
Yann E. MORIN.

Quoted 54 lines

---
Changes v1 -> v2:
- extended follow-symlinks use (requested by Yann)

Signed-off-by Jens Maus <[email protected]>

---
 support/scripts/mkusers | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

support/scripts/mkusers +5 -4

index 2ac76f986..5bbec3e10 100755
@@ -219,12 +219,12 @@ add_one_group() {
     fi
 
     # Remove any previous instance of this group, and re-add the new one
-    sed -i -e '/^'"${group}"':.*/d;' "${GROUP}"
+    sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GROUP}"
     printf "%s:x:%d:\n" "${group}" "${gid}" >>"${GROUP}"
 
     # Ditto for /etc/gshadow if it exists
     if [ -f "${GSHADOW}" ]; then
-        sed -i -e '/^'"${group}"':.*/d;' "${GSHADOW}"
+        sed -i --follow-symlinks -e '/^'"${group}"':.*/d;' "${GSHADOW}"
         printf "%s:*::\n" "${group}" >>"${GSHADOW}"
     fi
 }

@@ -263,7 +263,8 @@ add_user_to_group() {
 
     for _f in "${GROUP}" "${GSHADOW}"; do
         [ -f "${_f}" ] || continue
-        sed -r -i -e 's/^('"${group}"':.*:)(([^:]+,)?)'"${username}"'(,[^:]+*)?$/\1\2\4/;'  \
+        sed -r -i --follow-symlinks \
+                  -e 's/^('"${group}"':.*:)(([^:]+,)?)'"${username}"'(,[^:]+*)?$/\1\2\4/;'  \
                   -e 's/^('"${group}"':.*)$/\1,'"${username}"'/;'                           \
                   -e 's/,+/,/'                                                              \
                   -e 's/:,/:/'                                                              \

@@ -303,7 +304,7 @@ add_one_user() {
 
     # Remove any previous instance of this user
     for _f in "${PASSWD}" "${SHADOW}"; do
-        sed -r -i -e '/^'"${username}"':.*/d;' "${_f}"
+        sed -r -i --follow-symlinks -e '/^'"${username}"':.*/d;' "${_f}"
     done
 
     _gid="$( get_gid "${group}" )"

Signature · 6 lines

2.11.0

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Thomas Petazzoni

Applied

2017-06-24 15:50 UTC #5 lore raw

PATCH v2 1/1 support/scripts: allow /etc/shadow to be symlinked

In reply to Jens Maus

Hello,

Quoted 10 lines · Jens Maus

This commit fixes a problem where it was not possible to replace /etc/shadow with a symlink to a e.g. a user partition where the shadow file is placed. This is required, e.g. for systems where the rootfs is mounted read-only but users should still be able to be added. Thus, if within an filesystem overlay setup a user tries to replace /etc/shadow with a symlink to the real file on a user partition a buildroot build stops with an error message because sed is called on the symlink instead of following the symlink. This commit fixes this shortcoming.

Quoted 5 lines

Signed-off-by Jens Maus <[email protected]>
---
Changes v1 -> v2:
- extended follow-symlinks use (requested by Yann)

Applied to master, thanks.

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com