Accepting request 786819 from home:favogt:nobash

- Clean up sysusers2shadow and make it use only /bin/sh
- Don't let busybox adduser create the home directory, it breaks
  permissions of e.g. /sbin (home of daemon)
- Use only /bin/sh in sysusers-generate-pre and the generated code

OBS-URL: https://build.opensuse.org/request/show/786819
OBS-URL: https://build.opensuse.org/package/show/Base:System/sysuser-tools?expand=0&rev=23

sysuser-tools.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Fri Mar 20 10:08:43 UTC 2020 - Fabian Vogt <fvogt@suse.com>
+
+- Clean up sysusers2shadow and make it use only /bin/sh
+- Don't let busybox adduser create the home directory, it breaks
+  permissions of e.g. /sbin (home of daemon)
+- Use only /bin/sh in sysusers-generate-pre and the generated code
+
 -------------------------------------------------------------------
 Tue Mar 17 10:12:15 UTC 2020 - Fabian Vogt <fvogt@suse.com>
 

sysusers-generate-pre

@@ -1,8 +1,8 @@
-#!/bin/bash
+#!/bin/sh
-# pass systemd sysusers config files a as argument to this script.
+# pass systemd sysusers config paths as argument to this script.
 
-echo '#!/bin/bash'
+echo '#!/bin/sh'
 echo 'cat <<"EOF" |'
 grep -he '^[ugmr]' "$@"
 echo 'EOF'
-echo '/usr/sbin/sysusers2shadow || [[ -f /.buildenv ]]'
+echo '/usr/sbin/sysusers2shadow || [ -f /.buildenv ]'

sysusers2shadow.sh

@@ -1,96 +1,83 @@
-#!/bin/bash
+#!/bin/sh
+set -eu
 
-while read LINE
+# Print the command and run it
+run() {
+	echo "$@"
+	"$@"
+}
+
+# Absolute path to busybox, if found
+busybox=
+for i in /bin/busybox /usr/bin/busybox; do [ -x "$i" ] && busybox=$i; done
+
+while read arg0 arg1 arg2 arg3 arg4
 do
-    case "$LINE" in
+	case "$arg0" in
-	\#*|"")
+	g)
-	    ;;
+		ARGUMENTS="${arg1}"
-	g*)
+		if [ -n "${arg2}" -a "${arg2}" != "-" ]; then
-            eval arr=( $LINE )
+			ARGUMENTS="-g ${arg2} $ARGUMENTS"
-            ARGUMENTS="${arr[1]}"
+		fi
-            if [ ! -z "${arr[2]}" -a "${arr[2]}" != "-" ]; then
+
-                ARGUMENTS="-g ${arr[2]} $ARGUMENTS"
+		if ! /usr/bin/getent group "${arg1}" >> /dev/null; then
-	    fi
+			if [ -x "/usr/sbin/groupadd" ]; then
-	    if [ -x /usr/sbin/groupadd ]; then
+				run /usr/sbin/groupadd -r $ARGUMENTS
-		echo "groupadd -r $ARGUMENTS"
+			elif [ -x "$busybox" ]; then
-		/usr/bin/getent group "${arr[1]}" >> /dev/null || /usr/sbin/groupadd -r $ARGUMENTS || exit $?
+				run $busybox addgroup -S $ARGUMENTS
-	    elif [ -x /usr/bin/busybox ]; then
+			else
-		echo "addgroup -S $ARGUMENTS"
+				echo "ERROR: neither groupadd nor busybox found!"
-		/usr/bin/getent group "${arr[1]}" >> /dev/null || /usr/bin/busybox addgroup -S $ARGUMENTS || exit $?
+				exit 1
-	    elif [ -x /bin/busybox ]; then
+			fi
-		echo "addgroup -S $ARGUMENTS"
+		fi
-		/usr/bin/getent group "${arr[1]}" >> /dev/null || /bin/busybox addgroup -S $ARGUMENTS || exit $?
+		;;
-	    else
+	u)
-		echo "ERROR: neither groupadd nor busybox found!"
+		ARGUMENTS="${arg1}"
-		exit 1
+		if [ -n "${arg2}" ] && [ "${arg2}" != "-" ]; then
-	    fi
+			ARGUMENTS="-u ${arg2} $ARGUMENTS"
-	    ;;
+		fi
-	u*)
+		if [ -n "${arg4}" ] && [ "${arg4}" != "-" ]; then
-            eval arr=( $LINE )
+			ARGUMENTS="-d ${arg4} $ARGUMENTS"
-	    ARGUMENTS="${arr[1]}"
-	    if [ ! -z "${arr[2]}" -a "${arr[2]}" != "-" ]; then
-		ARGUMENTS="-u ${arr[2]} $ARGUMENTS"
-	    fi
-	    if [ ! -z "${arr[4]}" -a "${arr[4]}" != "-" ]; then
-		ARGUMENTS="-d ${arr[4]} $ARGUMENTS"
-	    else
-		ARGUMENTS="-d / $ARGUMENTS"
-	    fi
-	    if [ -x /usr/sbin/useradd ]; then
-		# this is useradd/shadow specific
-		/usr/bin/getent group ${arr[1]} >> /dev/null
-		if [ $? -eq 0 ]; then
-              	    ARGUMENTS="-g ${arr[1]} $ARGUMENTS"
 		else
-		    ARGUMENTS="-U $ARGUMENTS"
+			ARGUMENTS="-d / $ARGUMENTS"
 		fi
-		echo "useradd -r -s /sbin/nologin -c \"${arr[3]}\" $ARGUMENTS"
+
-		/usr/bin/getent passwd ${arr[1]} >> /dev/null || /usr/sbin/useradd -r -s /sbin/nologin -c "${arr[3]}" $ARGUMENTS || exit $?
+		if [ -x /usr/sbin/useradd ]; then
-	    elif [ -x /usr/bin/busybox ]; then
+			if ! /usr/bin/getent passwd "${arg1}" >> /dev/null; then
-		/usr/bin/getent group ${arr[1]} >> /dev/null
+				# this is useradd/shadow specific
-		if [ $? -ne 0 ]; then
+				ARGUMENTS="-g ${arg1} $ARGUMENTS"
-		    /usr/bin/busybox addgroup ${arr[1]}
+				/usr/bin/getent group "${arg1}" >> /dev/null || ARGUMENTS="-U $ARGUMENTS"
+			
+				run /usr/sbin/useradd -r -s /sbin/nologin -c "${arg3}" $ARGUMENTS
+			fi
+		elif [ -x "$busybox" ]; then
+			/usr/bin/getent group "${arg1}" >> /dev/null || $busybox addgroup "${arg1}"
+
+			if ! /usr/bin/getent passwd ${arg1} >> /dev/null; then
+				ARGUMENTS="$(echo -G ${arg1} $ARGUMENTS | sed -e 's|-d|-h|g' -e 's|-g|-G|g')"
+				run $busybox adduser -S -H -s /sbin/nologin -g "${arg3}" $ARGUMENTS
+			fi
+		else
+			echo "ERROR: neither useradd nor busybox found!"
+			exit 1
 		fi
-              	ARGUMENTS="-G ${arr[1]} $ARGUMENTS"
+	    ;;
-		ARGUMENTS=`echo $ARGUMENTS | sed -e 's|-d|-h|g' -e 's|-g|-G|g'`
+	m)
-		echo "adduser -S -s /sbin/nologin -g \"${arr[3]}\" $ARGUMENTS"
+		if [ -x /usr/sbin/usermod ] ; then
-		/usr/bin/getent passwd ${arr[1]} >> /dev/null || /usr/bin/busybox adduser -S -s /sbin/nologin -g "${arr[3]}" $ARGUMENTS || exit $?
+				run /usr/sbin/usermod -a -G ${arg2} ${arg1}
-	    elif [ -x /bin/busybox ]; then
+		elif [ -x "$busybox" ]; then
-		/usr/bin/getent group ${arr[1]} >> /dev/null
+				run $busybox addgroup ${arg1} ${arg2}
-		if [ $? -ne 0 ]; then
+		else
-		    /bin/busybox addgroup ${arr[1]}
+				echo "ERROR: neither usermod nor busybox found!"
+				exit 1
 		fi
-              	ARGUMENTS="-G ${arr[1]} $ARGUMENTS"
-		ARGUMENTS=`echo $ARGUMENTS | sed -e 's|-d|-h|g' -e 's|-g|-G|g'`
-		echo "adduser -S -s /sbin/nologin -g \"${arr[3]}\" $ARGUMENTS"
-		/usr/bin/getent passwd ${arr[1]} >> /dev/null || /bin/busybox adduser -S -s /sbin/nologin -g "${arr[3]}" $ARGUMENTS || exit $?
-	    else
-		echo "ERROR: neither useradd nor busybox found!"
-		exit 1
-	    fi
-	    ;;
-	m*)
-            eval arr=( $LINE )
-	    if [ -x /usr/sbin/usermod ] ; then
-		echo "usermod -a -G ${arr[2]} ${arr[1]}"
-		/usr/sbin/usermod -a -G ${arr[2]} ${arr[1]} || exit $?
-	    elif [ -x /usr/bin/busybox ]; then
-		echo "addgroup ${arr[1]} ${arr[2]}"
-		/usr/bin/busybox addgroup ${arr[1]} ${arr[2]} || exit $?
-	    elif [ -x /bin/busybox ]; then
-		echo "addgroup ${arr[1]} ${arr[2]}"
-		/bin/busybox addgroup ${arr[1]} ${arr[2]} || exit $?
-	    else
-		echo "ERROR: neither usermod nor busybox found!"
-		exit 1
-	    fi
-	    ;;
-	r*)
-	    echo "range option ignored: \"$LINE\""
 	    ;;
+	r)
+		echo "range option ignored: \"$arg0 $arg1 $arg2 $arg3\""
+		;;
 	*)
-	    echo "Syntax Error: \"$LINE\""
+	    echo "Syntax Error: \"$arg0\""
 	    exit 1
 	    ;;
-    esac
+	esac
 done