Skip to content

Commit

Permalink
Revert "update-users-groups.pl: Keep track of deallocated UIDs/GIDs"
Browse files Browse the repository at this point in the history 
This reverts commit 1447e55. Let's
not do scary changes to update-users-groups.pl one day before release
:-)
  • Loading branch information
@edolstra
edolstra committed Mar 30, 2017
1 parent 78ec18c commit 830cfc0
Showing 1 changed file with 17 additions and 53 deletions.
70 changes: 17 additions & 53 deletions nixos/modules/config/update-users-groups.pl
View file
Expand Up @@ -6,21 +6,6 @@
make_path("/var/lib/nixos", { mode => 0755 });


# Keep track of deleted uids and gids.
my $uidMapFile = "/var/lib/nixos/uid-map";
my $uidMap = -e $uidMapFile ? decode_json(read_file($uidMapFile)) : {};

my $gidMapFile = "/var/lib/nixos/gid-map";
my $gidMap = -e $gidMapFile ? decode_json(read_file($gidMapFile)) : {};


sub updateFile {
my ($path, $contents, $perms) = @_;
write_file("$path.tmp", { binmode => ':utf8', perms => $perms // 0644 }, $contents);
rename("$path.tmp", $path) or die;
}


sub hashPassword {
my ($password) = @_;
my $salt = "";
Expand All @@ -33,10 +18,10 @@ sub hashPassword {
# Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
# /etc/login.defs.
sub allocId {
my ($used, $prevUsed, $idMin, $idMax, $up, $getid) = @_;
my ($used, $idMin, $idMax, $up, $getid) = @_;
my $id = $up ? $idMin : $idMax;
while ($id >= $idMin && $id <= $idMax) {
if (!$used->{$id} && !$prevUsed->{$id} && !defined &$getid($id)) {
if (!$used->{$id} && !defined &$getid($id)) {
$used->{$id} = 1;
return $id;
}
Expand All @@ -46,36 +31,23 @@ sub allocId {
die "$0: out of free UIDs or GIDs\n";
}

my (%gidsUsed, %uidsUsed, %gidsPrevUsed, %uidsPrevUsed);
my (%gidsUsed, %uidsUsed);

sub allocGid {
my ($name) = @_;
my $prevGid = $gidMap->{$name};
if (defined $prevGid && !defined $gidsUsed{$prevGid}) {
print STDERR "reviving group '$name' with GID $prevGid\n";
$gidsUsed{$prevGid} = 1;
return $prevGid;
}
return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
return allocId(\%gidsUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
}

sub allocUid {
my ($name, $isSystemUser) = @_;
my ($isSystemUser) = @_;
my ($min, $max, $up) = $isSystemUser ? (400, 499, 0) : (1000, 29999, 1);
my $prevUid = $uidMap->{$name};
if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
print STDERR "reviving user '$name' with UID $prevUid\n";
$uidsUsed{$prevUid} = 1;
return $prevUid;
}
return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
return allocId(\%uidsUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
}


# Read the declared users/groups.
my $spec = decode_json(read_file($ARGV[0]));

# Don't allocate UIDs/GIDs that are manually assigned.
# Don't allocate UIDs/GIDs that are already in use.
foreach my $g (@{$spec->{groups}}) {
$gidsUsed{$g->{gid}} = 1 if defined $g->{gid};
}
Expand All @@ -84,11 +56,6 @@ sub allocUid {
$uidsUsed{$u->{uid}} = 1 if defined $u->{uid};
}

# Likewise for previously used but deleted UIDs/GIDs.
$uidsPrevUsed{$_} = 1 foreach values %{$uidMap};
$gidsPrevUsed{$_} = 1 foreach values %{$gidMap};


# Read the current /etc/group.
sub parseGroup {
chomp;
Expand Down Expand Up @@ -147,18 +114,16 @@ sub parseUser {
}
}
} else {
$g->{gid} = allocGid($name) if !defined $g->{gid};
$g->{gid} = allocGid if !defined $g->{gid};
$g->{password} = "x";
}

$g->{members} = join ",", sort(keys(%members));
$groupsOut{$name} = $g;

$gidMap->{$name} = $g->{gid};
}

# Update the persistent list of declarative groups.
updateFile($declGroupsFile, join(" ", sort(keys %groupsOut)));
write_file($declGroupsFile, { binmode => ':utf8' }, join(" ", sort(keys %groupsOut)));

# Merge in the existing /etc/group.
foreach my $name (keys %groupsCur) {
Expand All @@ -175,8 +140,8 @@ sub parseUser {
# Rewrite /etc/group. FIXME: acquire lock.
my @lines = map { join(":", $_->{name}, $_->{password}, $_->{gid}, $_->{members}) . "\n" }
(sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));
updateFile($gidMapFile, encode_json($gidMap));
updateFile("/etc/group", \@lines);
write_file("/etc/group.tmp", { binmode => ':utf8' }, @lines);
rename("/etc/group.tmp", "/etc/group") or die;
system("nscd --invalidate group");

# Generate a new /etc/passwd containing the declared users.
Expand All @@ -202,7 +167,7 @@ sub parseUser {
$u->{uid} = $existing->{uid};
}
} else {
$u->{uid} = allocUid($name, $u->{isSystemUser}) if !defined $u->{uid};
$u->{uid} = allocUid($u->{isSystemUser}) if !defined $u->{uid};

if (defined $u->{initialPassword}) {
$u->{hashedPassword} = hashPassword($u->{initialPassword});
Expand Down Expand Up @@ -230,12 +195,10 @@ sub parseUser {

$u->{fakePassword} = $existing->{fakePassword} // "x";
$usersOut{$name} = $u;

$uidMap->{$name} = $u->{uid};
}

# Update the persistent list of declarative users.
updateFile($declUsersFile, join(" ", sort(keys %usersOut)));
write_file($declUsersFile, { binmode => ':utf8' }, join(" ", sort(keys %usersOut)));

# Merge in the existing /etc/passwd.
foreach my $name (keys %usersCur) {
Expand All @@ -251,8 +214,8 @@ sub parseUser {
# Rewrite /etc/passwd. FIXME: acquire lock.
@lines = map { join(":", $_->{name}, $_->{fakePassword}, $_->{uid}, $_->{gid}, $_->{description}, $_->{home}, $_->{shell}) . "\n" }
(sort { $a->{uid} <=> $b->{uid} } (values %usersOut));
updateFile($uidMapFile, encode_json($uidMap));
updateFile("/etc/passwd", \@lines);
write_file("/etc/passwd.tmp", { binmode => ':utf8' }, @lines);
rename("/etc/passwd.tmp", "/etc/passwd") or die;
system("nscd --invalidate passwd");


Expand All @@ -279,4 +242,5 @@ sub parseUser {
push @shadowNew, join(":", $u->{name}, $hashedPassword, "1::::::") . "\n";
}

updateFile("/etc/shadow", \@shadowNew, 0600);
write_file("/etc/shadow.tmp", { binmode => ':utf8', perms => 0600 }, @shadowNew);
rename("/etc/shadow.tmp", "/etc/shadow") or die;

0 comments on commit 830cfc0

Please sign in to comment.