support/scripts/mkusers: allow option for system uid/gid

for all packages, this is the fitting default,

but the fallout will be user provided tables.

Also update the docs with the chagned behaviour.

Signed-off-by Norbert Lange <[email protected]>

---
  docs/manual/makeusers-syntax.txt | 11 +++++++----
  support/scripts/mkusers          |  6 +++---
  2 files changed, 10 insertions(+), 7 deletions(-)

docs/manual/makeusers-syntax.txt +7 -4

index 467e596230..3d1013f447 100644
@@ -20,13 +20,16 @@ Where:
    It can not be +root+, and must be unique. If set to +-+, then just a
    group will be created.
  - +uid+ is the desired UID for the user. It must be unique, and not
-  +0+. If set to +-1+, then a unique UID will be computed by Buildroot
-  in the range [1000...1999]
+  +0+. If set to +-1+ or +-2+, then a unique UID will be computed by
+  Buildroot, with +-1+ denoting a system UID from [100...999] and +-2+
+  denoting a user UID from [1000...1999].
  - +group+ is the desired name for the user's main group. It can not
    be +root+. If the group does not exist, it will be created.
  - +gid+ is the desired GID for the user's main group. It must be unique,
-  and not +0+. If set to +-1+, and the group does not already exist, then
-  a unique GID will be computed by Buildroot in the range [1000..1999]
+  and not +0+. If set to +-1+ or +-2+, and the group does not already
+  exist, then a unique GID will be computed by Buildroot, with +-1+
+  denoting a system GID from [100...999] and +-2+ denoting a user GID
+  from [1000...1999].
  - +password+ is the crypt(3)-encoded password. If prefixed with +!+,
    then login is disabled. If prefixed with +=+, then it is interpreted
    as clear-text, and will be crypt-encoded (using MD5). If prefixed with

support/scripts/mkusers +2 -2

index 9d8295e8a3..f7a3180e30 100755
@@ -14,8 +14,8 @@ LAST_SYSTEM_UID=999
  FIRST_SYSTEM_GID=100
  LAST_SYSTEM_GID=999
  # argument to automatically crease system/user id
-AUTO_SYSTEM_ID=-2
-AUTO_USER_ID=-1
+AUTO_SYSTEM_ID=-1
+AUTO_USER_ID=-2
 
  # No more is configurable below this point
  #----------------------------------------------------------------------------

for all packages, this is the fitting default,
but the fallout will be user provided tables.

Also update the docs with the chagned behaviour.

Signed-off-by Norbert Lange <[email protected]>

---
  docs/manual/makeusers-syntax.txt | 11 +++++++----
  support/scripts/mkusers          |  6 +++---
  2 files changed, 10 insertions(+), 7 deletions(-)

docs/manual/makeusers-syntax.txt +7 -4

index 467e596230..3d1013f447 100644
@@ -20,13 +20,16 @@ Where:
    It can not be +root+, and must be unique. If set to +-+, then just a
    group will be created.
  - +uid+ is the desired UID for the user. It must be unique, and not
-  +0+. If set to +-1+, then a unique UID will be computed by Buildroot
-  in the range [1000...1999]
+  +0+. If set to +-1+ or +-2+, then a unique UID will be computed by
+  Buildroot, with +-1+ denoting a system UID from [100...999] and +-2+
+  denoting a user UID from [1000...1999].
  - +group+ is the desired name for the user's main group. It can not
    be +root+. If the group does not exist, it will be created.
  - +gid+ is the desired GID for the user's main group. It must be unique,
-  and not +0+. If set to +-1+, and the group does not already exist, then
-  a unique GID will be computed by Buildroot in the range [1000..1999]
+  and not +0+. If set to +-1+ or +-2+, and the group does not already
+  exist, then a unique GID will be computed by Buildroot, with +-1+
+  denoting a system GID from [100...999] and +-2+ denoting a user GID
+  from [1000...1999].
  - +password+ is the crypt(3)-encoded password. If prefixed with +!+,
    then login is disabled. If prefixed with +=+, then it is interpreted
    as clear-text, and will be crypt-encoded (using MD5). If prefixed with

support/scripts/mkusers +2 -2

index 9d8295e8a3..f7a3180e30 100755
@@ -14,8 +14,8 @@ LAST_SYSTEM_UID=999
  FIRST_SYSTEM_GID=100
  LAST_SYSTEM_GID=999
  # argument to automatically crease system/user id
-AUTO_SYSTEM_ID=-2
-AUTO_USER_ID=-1
+AUTO_SYSTEM_ID=-1
+AUTO_USER_ID=-2
 
  # No more is configurable below this point
  #----------------------------------------------------------------------------

Some software decides based on uid/gid whether a user is a system or normal/human user, with differnt behaviour for those flavors (example journald [2]).

So adding logic to create system-users is necessary, we take the now common ranges from [1].

This extends the mkusers script to allow -2 for uid/gid, this argument will take an identifier from the system range.

System/user ranges are added as variables, and the argument for user/system uid was added as variable aswell. Thus some magic constants could be removed, some further occurences of -1 were replaced with equivalent logic.

[1] - https://systemd.io/UIDS-GIDS/
[2] - https://www.freedesktop.org/software/systemd/man/journald.conf.html

Signed-off-by Norbert Lange <[email protected]>

---
  support/scripts/mkusers | 57 +++++++++++++++++++++++++++++------------
  1 file changed, 40 insertions(+), 17 deletions(-)

support/scripts/mkusers +0 -0

index d00ba33823..9d8295e8a3 100755

support/scripts/mkusers +2 -0

+AUTO_USER_ID=-1
+

support/scripts/mkusers +14 -8

+
      local uid
 
      uid="$( get_uid "${username}" )"
      if [ -z "${uid}" ]; then
-        for(( uid=MIN_UID; uid<=MAX_UID; uid++ )); do
+        for(( uid=minuid; uid<=maxuid; uid++ )); do
              if [ -z "$( get_username "${uid}" )" ]; then
                  break
              fi
          done
-        if [ ${uid} -gt ${MAX_UID} ]; then
+        if [ ${uid} -gt ${maxuid} ]; then
              fail "can not allocate a UID for user '%s'\n" "${username}"
          fi
      fi

@@ -307,8 +325,13 @@ add_one_user() {
      check_user_validity "${username}" "${uid}" "${group}" "${gid}"
 
      # Generate a new UID if needed
-    if [ ${uid} -eq -1 ]; then
-        uid="$( generate_uid "${username}" )"
+    if [ ${uid} -lt 0 ]; then
+        if [ ${uid} -eq ${AUTO_USER_ID} ]; then
+            uid="$( generate_uid "${username}" )"
+        else
+            uid="$( generate_uid "${username}" $FIRST_SYSTEM_UID $LAST_SYSTEM_UID )"
+
+        fi
      fi
 
      # Remove any previous instance of this user

@@ -384,8 +407,8 @@ main() {
          ENTRIES+=( "${line}" )
      done < <( sed -r -e 's/#.*//; /^[[:space:]]*$/d;' "${USERS_TABLE}" )
 
-    # We first create groups whose gid is not -1, and then we create groups
-    # whose gid is -1 (automatic), so that, if a group is defined both with
+    # We first create groups whose gid is positive, and then we create groups
+    # whose gid is automatic, so that, if a group is defined both with
      # a specified gid and an automatic gid, we ensure the specified gid is
      # used, rather than a different automatic gid is computed.
 

@@ -399,7 +422,7 @@ main() {
      # Then, create all the main groups which gid *is* automatic
      for line in "${ENTRIES[@]}"; do
          read username uid group gid passwd home shell groups comment <<<"${line}"
-        [ ${gid} -eq -1 ] || continue    # Non-automatic gid
+        [ ${gid} -lt 0 ] || continue    # Non-automatic gid
          add_one_group "${group}" "${gid}"
      done
 

@@ -410,7 +433,7 @@ main() {
          read username uid group gid passwd home shell groups comment <<<"${line}"
          if [ "${groups}" != "-" ]; then
              for g in ${groups//,/ }; do
-                add_one_group "${g}" -1
+                add_one_group "${g}" ${AUTO_USER_ID}
              done
          fi
      done

Quoted 3 lines

Some software decides based on uid/gid whether a user is a system or normal/human user, with differnt behaviour for those flavors (example journald [2]).

Thank you for the short yet sufficient summary!

Quoted 12 lines

So adding logic to create system-users is necessary, we take the now common ranges from [1].

This extends the mkusers script to allow -2 for uid/gid, this argument will take an identifier from the system range.

System/user ranges are added as variables, and the argument for user/system uid was added as variable aswell. Thus some magic constants could be removed, some further occurences of -1 were replaced with equivalent logic.

Quoted 4 lines

[1] - https://systemd.io/UIDS-GIDS/
[2] - https://www.freedesktop.org/software/systemd/man/journald.conf.html

Signed-off-by Norbert Lange <[email protected]>

You forgot to mention that this is v2. v1 is here [1].

I think the only change is in the commit message.

Quoted 10 lines

---
  support/scripts/mkusers | 57 +++++++++++++++++++++++++++++------------
  1 file changed, 40 insertions(+), 17 deletions(-)

support/scripts/mkusers +0 -0

index d00ba33823..9d8295e8a3 100755

support/scripts/mkusers MIN_UID=1000 · line 17

Quoted 10 lines

support/scripts/mkusers +7 -0

@@ -8,6 +8,15 @@ MIN_UID=1000
  MAX_UID=1999
  MIN_GID=1000
  MAX_GID=1999
+# use names from /etc/adduser.conf
+FIRST_SYSTEM_UID=100
+LAST_SYSTEM_UID=999
+FIRST_SYSTEM_GID=100
+LAST_SYSTEM_GID=999
+# argument to automatically crease system/user id
+AUTO_SYSTEM_ID=-2

Wouldn't it be better to use -1 for system users (= the usual case) and add -2
for normal users? System users are the usual, after all, and all current in-tree uses of -1 are definitely system users.

I though that someone had already made this remark, but I can't find any trace
of it.

Quoted 2 lines

support/scripts/mkusers +2 -0

+AUTO_USER_ID=-1
+

[snip]

support/scripts/mkusers add_one_group() { · line 238

Quoted 9 lines

support/scripts/mkusers +3 -2

@@ -222,8 +233,12 @@ add_one_group() {
      local members
 
      # Generate a new GID if needed
-    if [ ${gid} -eq -1 ]; then
-        gid="$( generate_gid "${group}" )"
+    if [ ${gid} -lt 0 ]; then
+        if [ ${gid} -eq ${AUTO_USER_ID} ]; then
+            gid="$( generate_gid "${group}" )"

(nitpick) For symmetry, I'd always pass the first and last as argument here.

support/scripts/mkusers add_one_group() { · line 242

Quoted 4 lines

support/scripts/mkusers +3 -0

+        else
+            gid="$( generate_gid "${group}" $FIRST_SYSTEM_GID $LAST_SYSTEM_GID )"
+        fi
      fi

(nitpick) I'd structure the entire block above as follows:

     if [ ${gid} -eq ${AUTO_USER_ID} ]; then
     elif [ ${gid} -eq ${AUTO_SYSTEM_ID} ]; then
     fi

That's one level less deep, and more explicit about the system-id branch.

Both remarks also apply to the uid case of course.

support/scripts/mkusers add_one_group() { · line 266

Quoted 8 lines

support/scripts/mkusers +2 -0

      members=$(get_members "$group")

@@ -247,16 +262,19 @@ add_one_group() {
  #   - not already used by a user
  generate_uid() {
      local username="${1}"
+    local minuid="${2:-$MIN_UID}"
+    local maxuid="${3:-$MAX_UID}"

So here I'd remove the defaults and instead always pass the arguments.

Regards,
Arnout

[1]
https://patchwork.ozlabs.org/project/buildroot/list/?series=152843&state=%2A&archive=both

Quoted 63 lines

support/scripts/mkusers +14 -8

+
      local uid
 
      uid="$( get_uid "${username}" )"
      if [ -z "${uid}" ]; then
-        for(( uid=MIN_UID; uid<=MAX_UID; uid++ )); do
+        for(( uid=minuid; uid<=maxuid; uid++ )); do
              if [ -z "$( get_username "${uid}" )" ]; then
                  break
              fi
          done
-        if [ ${uid} -gt ${MAX_UID} ]; then
+        if [ ${uid} -gt ${maxuid} ]; then
              fail "can not allocate a UID for user '%s'\n" "${username}"
          fi
      fi

@@ -307,8 +325,13 @@ add_one_user() {
      check_user_validity "${username}" "${uid}" "${group}" "${gid}"
 
      # Generate a new UID if needed
-    if [ ${uid} -eq -1 ]; then
-        uid="$( generate_uid "${username}" )"
+    if [ ${uid} -lt 0 ]; then
+        if [ ${uid} -eq ${AUTO_USER_ID} ]; then
+            uid="$( generate_uid "${username}" )"
+        else
+            uid="$( generate_uid "${username}" $FIRST_SYSTEM_UID $LAST_SYSTEM_UID )"
+
+        fi
      fi
 
      # Remove any previous instance of this user

@@ -384,8 +407,8 @@ main() {
          ENTRIES+=( "${line}" )
      done < <( sed -r -e 's/#.*//; /^[[:space:]]*$/d;' "${USERS_TABLE}" )
 
-    # We first create groups whose gid is not -1, and then we create groups
-    # whose gid is -1 (automatic), so that, if a group is defined both with
+    # We first create groups whose gid is positive, and then we create groups
+    # whose gid is automatic, so that, if a group is defined both with
      # a specified gid and an automatic gid, we ensure the specified gid is
      # used, rather than a different automatic gid is computed.
 

@@ -399,7 +422,7 @@ main() {
      # Then, create all the main groups which gid *is* automatic
      for line in "${ENTRIES[@]}"; do
          read username uid group gid passwd home shell groups comment <<<"${line}"
-        [ ${gid} -eq -1 ] || continue    # Non-automatic gid
+        [ ${gid} -lt 0 ] || continue    # Non-automatic gid
          add_one_group "${group}" "${gid}"
      done
 

@@ -410,7 +433,7 @@ main() {
          read username uid group gid passwd home shell groups comment <<<"${line}"
          if [ "${groups}" != "-" ]; then
              for g in ${groups//,/ }; do
-                add_one_group "${g}" -1
+                add_one_group "${g}" ${AUTO_USER_ID}
              done
          fi
      done

@@ -433,7 +456,7 @@ main() {
      for line in "${ENTRIES[@]}"; do

support/scripts/mkusers main() { · line 462

Quoted 8 lines

support/scripts/mkusers +1 -1

          read username uid group gid passwd home shell groups comment <<<"${line}"
          [ "${username}" != "-" ] || continue # Magic string to skip user creation
-        [ ${uid} -eq -1        ] || continue # Non-automatic uid
+        [ ${uid} -lt 0        ] || continue # Non-automatic uid
          add_one_user "${username}" "${uid}" "${group}" "${gid}" "${passwd}" \
                       "${home}" "${shell}" "${groups}" "${comment}"
      done

Some software decides based on uid/gid whether a user is a system or normal/human user, with differnt behaviour for those flavors (example journald [2]).

So adding logic to create system-users is necessary, we take the now common ranges from [1].

This extends the mkusers script to allow -2 for uid/gid, this argument will take an identifier from the system range.

System/user ranges are added as variables, and the argument for user/system uid was added as variable aswell. Thus some magic constants could be removed, some further occurences of -1 were replaced with equivalent logic.

[1] - https://systemd.io/UIDS-GIDS/
[2] - https://www.freedesktop.org/software/systemd/man/journald.conf.html

Signed-off-by Norbert Lange <[email protected]>

support/scripts/mkusers +39 -16

  MIN_GID=1000
  MAX_GID=1999
+# use names from /etc/adduser.conf
+FIRST_SYSTEM_UID=100
+LAST_SYSTEM_UID=999
+FIRST_SYSTEM_GID=100
+LAST_SYSTEM_GID=999
+# argument to automatically crease system/user id
+AUTO_SYSTEM_ID=-2
+AUTO_USER_ID=-1
+
  # No more is configurable below this point
  #----------------------------------------------------------------------------
 

@@ -136,9 +145,9 @@ check_user_validity() {
          fail "invalid username '%s\n'" "${username}"
      fi
 
-    if [ ${gid} -lt -1 -o ${gid} -eq 0 ]; then
+    if [ ${gid} -lt -2 -o ${gid} -eq 0 ]; then
          fail "invalid gid '%d' for '%s'\n" ${gid} "${username}"
-    elif [ ${gid} -ne -1 ]; then
+    elif [ ${gid} -ge 0 ]; then
          # check the gid is not already used for another group
          if [ -n "${_group}" -a "${_group}" != "${group}" ]; then
              fail "gid '%d' for '%s' is already used by group '%s'\n" \

@@ -162,9 +171,9 @@ check_user_validity() {
          fi
      fi
 
-    if [ ${uid} -lt -1 -o ${uid} -eq 0 ]; then
+    if [ ${uid} -lt -2 -o ${uid} -eq 0 ]; then
          fail "invalid uid '%d' for '%s'\n" ${uid} "${username}"
-    elif [ ${uid} -ne -1 ]; then
+    elif [ ${uid} -ge 0 ]; then
          # check the uid is not already used for another user
          if [ -n "${_username}" -a "${_username}" != "${username}" ]; then
              fail "uid '%d' for '%s' already used by user '%s'\n" \

@@ -198,16 +207,18 @@ check_user_validity() {
  #   - not already used by a group
  generate_gid() {
      local group="${1}"
+    local mingid="${2:-$MIN_UID}"
+    local maxgid="${3:-$MAX_UID}"
      local gid
 
      gid="$( get_gid "${group}" )"
      if [ -z "${gid}" ]; then
-        for(( gid=MIN_GID; gid<=MAX_GID; gid++ )); do
+        for(( gid=mingid; gid<=maxgid; gid++ )); do
              if [ -z "$( get_group "${gid}" )" ]; then
                  break
              fi
          done
-        if [ ${gid} -gt ${MAX_GID} ]; then
+        if [ ${gid} -gt ${maxgid} ]; then
              fail "can not allocate a GID for group '%s'\n" "${group}"
          fi
      fi

@@ -222,8 +233,12 @@ add_one_group() {
      local members
 
      # Generate a new GID if needed
-    if [ ${gid} -eq -1 ]; then
-        gid="$( generate_gid "${group}" )"
+    if [ ${gid} -lt 0 ]; then
+        if [ ${gid} -eq ${AUTO_USER_ID} ]; then
+            gid="$( generate_gid "${group}" )"
+        else
+            gid="$( generate_gid "${group}" $FIRST_SYSTEM_GID $LAST_SYSTEM_GID )"
+        fi
      fi
 
      members=$(get_members "$group")

@@ -247,16 +262,19 @@ add_one_group() {
  #   - not already used by a user
  generate_uid() {
      local username="${1}"
+    local minuid="${2:-$MIN_UID}"
+    local maxuid="${3:-$MAX_UID}"
+
      local uid
 
      uid="$( get_uid "${username}" )"
      if [ -z "${uid}" ]; then
-        for(( uid=MIN_UID; uid<=MAX_UID; uid++ )); do
+        for(( uid=minuid; uid<=maxuid; uid++ )); do
              if [ -z "$( get_username "${uid}" )" ]; then
                  break
              fi
          done
-        if [ ${uid} -gt ${MAX_UID} ]; then
+        if [ ${uid} -gt ${maxuid} ]; then
              fail "can not allocate a UID for user '%s'\n" "${username}"
          fi
      fi

@@ -307,8 +325,13 @@ add_one_user() {
      check_user_validity "${username}" "${uid}" "${group}" "${gid}"
 
      # Generate a new UID if needed
-    if [ ${uid} -eq -1 ]; then
-        uid="$( generate_uid "${username}" )"
+    if [ ${uid} -lt 0 ]; then
+        if [ ${uid} -eq ${AUTO_USER_ID} ]; then
+            uid="$( generate_uid "${username}" )"
+        else
+            uid="$( generate_uid "${username}" $FIRST_SYSTEM_UID $LAST_SYSTEM_UID )"
+
+        fi
      fi
 
      # Remove any previous instance of this user

@@ -384,8 +407,8 @@ main() {
          ENTRIES+=( "${line}" )
      done < <( sed -r -e 's/#.*//; /^[[:space:]]*$/d;' "${USERS_TABLE}" )
 
-    # We first create groups whose gid is not -1, and then we create groups
-    # whose gid is -1 (automatic), so that, if a group is defined both with
+    # We first create groups whose gid is positive, and then we create groups
+    # whose gid is automatic, so that, if a group is defined both with
      # a specified gid and an automatic gid, we ensure the specified gid is
      # used, rather than a different automatic gid is computed.
 

@@ -399,7 +422,7 @@ main() {
      # Then, create all the main groups which gid *is* automatic
      for line in "${ENTRIES[@]}"; do
          read username uid group gid passwd home shell groups comment <<<"${line}"
-        [ ${gid} -eq -1 ] || continue    # Non-automatic gid
+        [ ${gid} -lt 0 ] || continue    # Non-automatic gid
          add_one_group "${group}" "${gid}"
      done
 

@@ -410,7 +433,7 @@ main() {
          read username uid group gid passwd home shell groups comment <<<"${line}"
          if [ "${groups}" != "-" ]; then
              for g in ${groups//,/ }; do
-                add_one_group "${g}" -1
+                add_one_group "${g}" ${AUTO_USER_ID}
              done
          fi
      done