src/shared/user-record-show.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "format-util.h"
   4 #include "fs-util.h"
   5 #include "process-util.h"
   6 #include "rlimit-util.h"
   7 #include "strv.h"
   8 #include "terminal-util.h"
   9 #include "user-record-show.h"
  10 #include "user-util.h"
  11 #include "userdb.h"
  12
  13 const char *user_record_state_color(const char *state) {
  14         if (STR_IN_SET(state, "unfixated", "absent"))
  15                 return ansi_grey();
  16         else if (streq(state, "active"))
  17                 return ansi_highlight_green();
  18         else if (STR_IN_SET(state, "locked", "dirty"))
  19                  return ansi_highlight_yellow();
  20
  21         return NULL;
  22 }
  23
  24 void user_record_show(UserRecord *hr, bool show_full_group_info) {
  25         const char *hd, *ip, *shell;
  26         UserStorage storage;
  27         usec_t t;
  28         size_t k;
  29         int r, b;
  30
  31         printf("   User name: %s\n",
  32                user_record_user_name_and_realm(hr));
  33
  34         if (hr->state) {
  35                 const char *color;
  36
  37                 color = user_record_state_color(hr->state);
  38
  39                 printf("       State: %s%s%s\n",
  40                        strempty(color), hr->state, color ? ansi_normal() : "");
  41         }
  42
  43         printf(" Disposition: %s\n", user_disposition_to_string(user_record_disposition(hr)));
  44
  45         if (hr->last_change_usec != USEC_INFINITY) {
  46                 printf(" Last Change: %s\n", FORMAT_TIMESTAMP(hr->last_change_usec));
  47
  48                 if (hr->last_change_usec > now(CLOCK_REALTIME))
  49                         printf("              %sModification time lies in the future, system clock wrong?%s\n",
  50                                ansi_highlight_yellow(), ansi_normal());
  51         }
  52
  53         if (hr->last_password_change_usec != USEC_INFINITY &&
  54             hr->last_password_change_usec != hr->last_change_usec)
  55                 printf(" Last Passw.: %s\n", FORMAT_TIMESTAMP(hr->last_password_change_usec));
  56
  57         r = user_record_test_blocked(hr);
  58         switch (r) {
  59
  60         case -ENOLCK:
  61                 printf("    Login OK: %sno%s (record is locked)\n", ansi_highlight_red(), ansi_normal());
  62                 break;
  63
  64         case -EL2HLT:
  65                 printf("    Login OK: %sno%s (record not valid yet))\n", ansi_highlight_red(), ansi_normal());
  66                 break;
  67
  68         case -EL3HLT:
  69                 printf("    Login OK: %sno%s (record not valid anymore))\n", ansi_highlight_red(), ansi_normal());
  70                 break;
  71
  72         case -ESTALE:
  73         default: {
  74                 usec_t y;
  75
  76                 if (r < 0 && r != -ESTALE) {
  77                         errno = -r;
  78                         printf("    Login OK: %sno%s (%m)\n", ansi_highlight_red(), ansi_normal());
  79                         break;
  80                 }
  81
  82                 if (is_nologin_shell(user_record_shell(hr))) {
  83                         printf("    Login OK: %sno%s (nologin shell)\n", ansi_highlight_red(), ansi_normal());
  84                         break;
  85                 }
  86
  87                 y = user_record_ratelimit_next_try(hr);
  88                 if (y != USEC_INFINITY && y > now(CLOCK_REALTIME)) {
  89                         printf("    Login OK: %sno%s (ratelimit)\n", ansi_highlight_red(), ansi_normal());
  90                         break;
  91                 }
  92
  93                 printf("    Login OK: %syes%s\n", ansi_highlight_green(), ansi_normal());
  94                 break;
  95         }}
  96
  97         r = user_record_test_password_change_required(hr);
  98         switch (r) {
  99
 100         case -EKEYREVOKED:
 101                 printf(" Password OK: %schange now%s\n", ansi_highlight_yellow(), ansi_normal());
 102                 break;
 103
 104         case -EOWNERDEAD:
 105                 printf(" Password OK: %sexpired%s (change now!)\n", ansi_highlight_yellow(), ansi_normal());
 106                 break;
 107
 108         case -EKEYREJECTED:
 109                 printf(" Password OK: %sexpired%s (for good)\n", ansi_highlight_red(), ansi_normal());
 110                 break;
 111
 112         case -EKEYEXPIRED:
 113                 printf(" Password OK: %sexpires soon%s\n", ansi_highlight_yellow(), ansi_normal());
 114                 break;
 115
 116         case -ENETDOWN:
 117                 printf(" Password OK: %sno timestamp%s\n", ansi_highlight_red(), ansi_normal());
 118                 break;
 119
 120         case -EROFS:
 121                 printf(" Password OK: %schange not permitted%s\n", ansi_highlight_yellow(), ansi_normal());
 122                 break;
 123
 124         case -ESTALE:
 125                 printf(" Password OK: %slast password change in future%s\n", ansi_highlight_yellow(), ansi_normal());
 126                 break;
 127
 128         default:
 129                 if (r < 0) {
 130                         errno = -r;
 131                         printf(" Password OK: %sno%s (%m)\n", ansi_highlight_yellow(), ansi_normal());
 132                         break;
 133                 }
 134
 135                 if (strv_isempty(hr->hashed_password)) {
 136                         if (hr->incomplete) /* Record might be incomplete, due to privs */
 137                                 break;
 138                         printf(" Password OK: %sno%s (none set)\n", ansi_highlight(), ansi_normal());
 139                         break;
 140                 }
 141                 if (strv_contains(hr->hashed_password, "")) {
 142                         printf(" Password OK: %sno%s (empty set)\n", ansi_highlight_red(), ansi_normal());
 143                         break;
 144                 }
 145                 bool has_valid_passwords = false;
 146                 char **p;
 147                 STRV_FOREACH(p, hr->hashed_password)
 148                         if (!hashed_password_is_locked_or_invalid(*p)) {
 149                                 has_valid_passwords = true;
 150                                 break;
 151                         }
 152                 if (has_valid_passwords)
 153                         printf(" Password OK: %syes%s\n", ansi_highlight_green(), ansi_normal());
 154                 else
 155                         printf(" Password OK: %sno%s (locked)\n", ansi_highlight(), ansi_normal());
 156         }
 157         if (uid_is_valid(hr->uid))
 158                 printf("         UID: " UID_FMT "\n", hr->uid);
 159         if (gid_is_valid(hr->gid)) {
 160                 if (show_full_group_info) {
 161                         _cleanup_(group_record_unrefp) GroupRecord *gr = NULL;
 162
 163                         r = groupdb_by_gid(hr->gid, 0, &gr);
 164                         if (r < 0) {
 165                                 errno = -r;
 166                                 printf("         GID: " GID_FMT " (unresolvable: %m)\n", hr->gid);
 167                         } else
 168                                 printf("         GID: " GID_FMT " (%s)\n", hr->gid, gr->group_name);
 169                 } else
 170                         printf("         GID: " GID_FMT "\n", hr->gid);
 171         } else if (uid_is_valid(hr->uid)) /* Show UID as GID if not separately configured */
 172                 printf("         GID: " GID_FMT "\n", (gid_t) hr->uid);
 173
 174         if (show_full_group_info) {
 175                 _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 176
 177                 r = membershipdb_by_user(hr->user_name, 0, &iterator);
 178                 if (r < 0) {
 179                         errno = -r;
 180                         printf(" Aux. Groups: (can't acquire: %m)\n");
 181                 } else {
 182                         const char *prefix = " Aux. Groups:";
 183
 184                         for (;;) {
 185                                 _cleanup_free_ char *group = NULL;
 186
 187                                 r = membershipdb_iterator_get(iterator, NULL, &group);
 188                                 if (r == -ESRCH)
 189                                         break;
 190                                 if (r < 0) {
 191                                         errno = -r;
 192                                         printf("%s (can't iterate: %m)\n", prefix);
 193                                         break;
 194                                 }
 195
 196                                 printf("%s %s\n", prefix, group);
 197                                 prefix = "             ";
 198                         }
 199                 }
 200         }
 201
 202         if (hr->real_name && !streq(hr->real_name, hr->user_name))
 203                 printf("   Real Name: %s\n", hr->real_name);
 204
 205         hd = user_record_home_directory(hr);
 206         if (hd)
 207                 printf("   Directory: %s\n", hd);
 208
 209         storage = user_record_storage(hr);
 210         if (storage >= 0) /* Let's be political, and clarify which storage we like, and which we don't. About CIFS we don't complain. */
 211                 printf("     Storage: %s%s\n", user_storage_to_string(storage),
 212                        storage == USER_LUKS ? " (strong encryption)" :
 213                        storage == USER_FSCRYPT ? " (weak encryption)" :
 214                        IN_SET(storage, USER_DIRECTORY, USER_SUBVOLUME) ? " (no encryption)" : "");
 215
 216         ip = user_record_image_path(hr);
 217         if (ip && !streq_ptr(ip, hd))
 218                 printf("  Image Path: %s\n", ip);
 219
 220         b = user_record_removable(hr);
 221         if (b >= 0)
 222                 printf("   Removable: %s\n", yes_no(b));
 223
 224         shell = user_record_shell(hr);
 225         if (shell)
 226                 printf("       Shell: %s\n", shell);
 227
 228         if (hr->email_address)
 229                 printf("       Email: %s\n", hr->email_address);
 230         if (hr->location)
 231                 printf("    Location: %s\n", hr->location);
 232         if (hr->password_hint)
 233                 printf(" Passw. Hint: %s\n", hr->password_hint);
 234         if (hr->icon_name)
 235                 printf("   Icon Name: %s\n", hr->icon_name);
 236
 237         if (hr->time_zone)
 238                 printf("   Time Zone: %s\n", hr->time_zone);
 239
 240         if (hr->preferred_language)
 241                 printf("    Language: %s\n", hr->preferred_language);
 242
 243         if (!strv_isempty(hr->environment)) {
 244                 char **i;
 245
 246                 STRV_FOREACH(i, hr->environment) {
 247                         printf(i == hr->environment ?
 248                                " Environment: %s\n" :
 249                                "              %s\n", *i);
 250                 }
 251         }
 252
 253         if (hr->locked >= 0)
 254                 printf("      Locked: %s\n", yes_no(hr->locked));
 255
 256         if (hr->not_before_usec != UINT64_MAX)
 257                 printf("  Not Before: %s\n", FORMAT_TIMESTAMP(hr->not_before_usec));
 258
 259         if (hr->not_after_usec != UINT64_MAX)
 260                 printf("   Not After: %s\n", FORMAT_TIMESTAMP(hr->not_after_usec));
 261
 262         if (hr->umask != MODE_INVALID)
 263                 printf("       UMask: 0%03o\n", hr->umask);
 264
 265         if (nice_is_valid(hr->nice_level))
 266                 printf("        Nice: %i\n", hr->nice_level);
 267
 268         for (int j = 0; j < _RLIMIT_MAX; j++) {
 269                 if (hr->rlimits[j])
 270                         printf("       Limit: RLIMIT_%s=%" PRIu64 ":%" PRIu64 "\n",
 271                                rlimit_to_string(j), (uint64_t) hr->rlimits[j]->rlim_cur, (uint64_t) hr->rlimits[j]->rlim_max);
 272         }
 273
 274         if (hr->tasks_max != UINT64_MAX)
 275                 printf("   Tasks Max: %" PRIu64 "\n", hr->tasks_max);
 276
 277         if (hr->memory_high != UINT64_MAX)
 278                 printf(" Memory High: %s\n", FORMAT_BYTES(hr->memory_high));
 279
 280         if (hr->memory_max != UINT64_MAX)
 281                 printf("  Memory Max: %s\n", FORMAT_BYTES(hr->memory_max));
 282
 283         if (hr->cpu_weight != UINT64_MAX)
 284                 printf("  CPU Weight: %" PRIu64 "\n", hr->cpu_weight);
 285
 286         if (hr->io_weight != UINT64_MAX)
 287                 printf("   IO Weight: %" PRIu64 "\n", hr->io_weight);
 288
 289         if (hr->access_mode != MODE_INVALID)
 290                 printf(" Access Mode: 0%03o\n", user_record_access_mode(hr));
 291
 292         if (storage == USER_LUKS) {
 293                 printf("LUKS Discard: online=%s offline=%s\n", yes_no(user_record_luks_discard(hr)), yes_no(user_record_luks_offline_discard(hr)));
 294
 295                 if (!sd_id128_is_null(hr->luks_uuid))
 296                         printf("   LUKS UUID: " SD_ID128_UUID_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(hr->luks_uuid));
 297                 if (!sd_id128_is_null(hr->partition_uuid))
 298                         printf("   Part UUID: " SD_ID128_UUID_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(hr->partition_uuid));
 299                 if (!sd_id128_is_null(hr->file_system_uuid))
 300                         printf("     FS UUID: " SD_ID128_UUID_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(hr->file_system_uuid));
 301
 302                 if (hr->file_system_type)
 303                         printf(" File System: %s\n", user_record_file_system_type(hr));
 304
 305                 if (hr->luks_extra_mount_options)
 306                         printf("LUKS MntOpts: %s\n", hr->luks_extra_mount_options);
 307
 308                 if (hr->luks_cipher)
 309                         printf(" LUKS Cipher: %s\n", hr->luks_cipher);
 310                 if (hr->luks_cipher_mode)
 311                         printf(" Cipher Mode: %s\n", hr->luks_cipher_mode);
 312                 if (hr->luks_volume_key_size != UINT64_MAX)
 313                         printf("  Volume Key: %" PRIu64 "bit\n", hr->luks_volume_key_size * 8);
 314
 315                 if (hr->luks_pbkdf_type)
 316                         printf("  PBKDF Type: %s\n", hr->luks_pbkdf_type);
 317                 if (hr->luks_pbkdf_hash_algorithm)
 318                         printf("  PBKDF Hash: %s\n", hr->luks_pbkdf_hash_algorithm);
 319                 if (hr->luks_pbkdf_time_cost_usec != UINT64_MAX)
 320                         printf("  PBKDF Time: %s\n", FORMAT_TIMESPAN(hr->luks_pbkdf_time_cost_usec, 0));
 321                 if (hr->luks_pbkdf_memory_cost != UINT64_MAX)
 322                         printf(" PBKDF Bytes: %s\n", FORMAT_BYTES(hr->luks_pbkdf_memory_cost));
 323
 324                 if (hr->luks_pbkdf_parallel_threads != UINT64_MAX)
 325                         printf("PBKDF Thread: %" PRIu64 "\n", hr->luks_pbkdf_parallel_threads);
 326
 327         } else if (storage == USER_CIFS) {
 328
 329                 if (hr->cifs_service)
 330                         printf("CIFS Service: %s\n", hr->cifs_service);
 331
 332                 if (hr->cifs_extra_mount_options)
 333                         printf("CIFS MntOpts: %s\n", hr->cifs_extra_mount_options);
 334         }
 335
 336         if (hr->cifs_user_name)
 337                 printf("   CIFS User: %s\n", user_record_cifs_user_name(hr));
 338         if (hr->cifs_domain)
 339                 printf(" CIFS Domain: %s\n", hr->cifs_domain);
 340
 341         if (storage != USER_CLASSIC)
 342                 printf(" Mount Flags: %s %s %s\n",
 343                        hr->nosuid ? "nosuid" : "suid",
 344                        hr->nodev ? "nodev" : "dev",
 345                        hr->noexec ? "noexec" : "exec");
 346
 347         if (hr->skeleton_directory)
 348                 printf("  Skel. Dir.: %s\n", user_record_skeleton_directory(hr));
 349
 350         if (hr->disk_size != UINT64_MAX)
 351                 printf("   Disk Size: %s\n", FORMAT_BYTES(hr->disk_size));
 352
 353         if (hr->disk_usage != UINT64_MAX) {
 354                 if (hr->disk_size != UINT64_MAX) {
 355                         unsigned permille;
 356
 357                         permille = (unsigned) DIV_ROUND_UP(hr->disk_usage * 1000U, hr->disk_size); /* Round up! */
 358                         printf("  Disk Usage: %s (= %u.%01u%%)\n",
 359                                FORMAT_BYTES(hr->disk_usage),
 360                                permille / 10, permille % 10);
 361                 } else
 362                         printf("  Disk Usage: %s\n", FORMAT_BYTES(hr->disk_usage));
 363         }
 364
 365         if (hr->disk_free != UINT64_MAX) {
 366                 if (hr->disk_size != UINT64_MAX) {
 367                         const char *color_on, *color_off;
 368                         unsigned permille;
 369
 370                         permille = (unsigned) ((hr->disk_free * 1000U) / hr->disk_size); /* Round down! */
 371
 372                         /* Color the output red or yellow if we are below 10% resp. 25% free. Because 10% and
 373                          * 25% can be a lot of space still, let's additionally make some absolute
 374                          * restrictions: 1G and 2G */
 375                         if (permille <= 100U &&
 376                             hr->disk_free < 1024U*1024U*1024U /* 1G */) {
 377                                 color_on = ansi_highlight_red();
 378                                 color_off = ansi_normal();
 379                         } else if (permille <= 250U &&
 380                                    hr->disk_free < 2U*1024U*1024U*1024U /* 2G */) {
 381                                 color_on = ansi_highlight_yellow();
 382                                 color_off = ansi_normal();
 383                         } else
 384                                 color_on = color_off = "";
 385
 386                         printf("   Disk Free: %s%s (= %u.%01u%%)%s\n",
 387                                color_on,
 388                                FORMAT_BYTES(hr->disk_free),
 389                                permille / 10, permille % 10,
 390                                color_off);
 391                 } else
 392                         printf("   Disk Free: %s\n", FORMAT_BYTES(hr->disk_free));
 393         }
 394
 395         if (hr->disk_floor != UINT64_MAX)
 396                 printf("  Disk Floor: %s\n", FORMAT_BYTES(hr->disk_floor));
 397
 398         if (hr->disk_ceiling != UINT64_MAX)
 399                 printf("Disk Ceiling: %s\n", FORMAT_BYTES(hr->disk_ceiling));
 400
 401         if (hr->good_authentication_counter != UINT64_MAX)
 402                 printf("  Good Auth.: %" PRIu64 "\n", hr->good_authentication_counter);
 403
 404         if (hr->last_good_authentication_usec != UINT64_MAX)
 405                 printf("   Last Good: %s\n", FORMAT_TIMESTAMP(hr->last_good_authentication_usec));
 406
 407         if (hr->bad_authentication_counter != UINT64_MAX)
 408                 printf("   Bad Auth.: %" PRIu64 "\n", hr->bad_authentication_counter);
 409
 410         if (hr->last_bad_authentication_usec != UINT64_MAX)
 411                 printf("    Last Bad: %s\n", FORMAT_TIMESTAMP(hr->last_bad_authentication_usec));
 412
 413         t = user_record_ratelimit_next_try(hr);
 414         if (t != USEC_INFINITY) {
 415                 usec_t n = now(CLOCK_REALTIME);
 416
 417                 if (t <= n)
 418                         printf("    Next Try: anytime\n");
 419                 else
 420                         printf("    Next Try: %sin %s%s\n",
 421                                ansi_highlight_red(),
 422                                FORMAT_TIMESPAN(t - n, USEC_PER_SEC),
 423                                ansi_normal());
 424         }
 425
 426         if (storage != USER_CLASSIC)
 427                 printf(" Auth. Limit: %" PRIu64 " attempts per %s\n", user_record_ratelimit_burst(hr),
 428                        FORMAT_TIMESPAN(user_record_ratelimit_interval_usec(hr), 0));
 429
 430         if (hr->enforce_password_policy >= 0)
 431                 printf(" Passwd Pol.: %s\n", yes_no(hr->enforce_password_policy));
 432
 433         if (hr->password_change_min_usec != UINT64_MAX ||
 434             hr->password_change_max_usec != UINT64_MAX ||
 435             hr->password_change_warn_usec != UINT64_MAX ||
 436             hr->password_change_inactive_usec != UINT64_MAX) {
 437
 438                 printf(" Passwd Chg.:");
 439
 440                 if (hr->password_change_min_usec != UINT64_MAX) {
 441                         printf(" min %s", FORMAT_TIMESPAN(hr->password_change_min_usec, 0));
 442
 443                         if (hr->password_change_max_usec != UINT64_MAX)
 444                                 printf(" …");
 445                 }
 446
 447                 if (hr->password_change_max_usec != UINT64_MAX)
 448                         printf(" max %s", FORMAT_TIMESPAN(hr->password_change_max_usec, 0));
 449
 450                 if (hr->password_change_warn_usec != UINT64_MAX)
 451                         printf("/warn %s", FORMAT_TIMESPAN(hr->password_change_warn_usec, 0));
 452
 453                 if (hr->password_change_inactive_usec != UINT64_MAX)
 454                         printf("/inactive %s", FORMAT_TIMESPAN(hr->password_change_inactive_usec, 0));
 455
 456                 printf("\n");
 457         }
 458
 459         if (hr->password_change_now >= 0)
 460                 printf("Pas. Ch. Now: %s\n", yes_no(hr->password_change_now));
 461
 462         if (hr->drop_caches >= 0 || user_record_drop_caches(hr))
 463                 printf(" Drop Caches: %s\n", yes_no(user_record_drop_caches(hr)));
 464
 465         if (hr->auto_resize_mode >= 0)
 466                 printf(" Auto Resize: %s\n", auto_resize_mode_to_string(user_record_auto_resize_mode(hr)));
 467
 468         if (hr->rebalance_weight != REBALANCE_WEIGHT_UNSET) {
 469                 uint64_t rb;
 470
 471                 rb = user_record_rebalance_weight(hr);
 472                 if (rb == REBALANCE_WEIGHT_OFF)
 473                         printf("   Rebalance: off\n");
 474                 else
 475                         printf("   Rebalance: weight %" PRIu64 "\n", rb);
 476         }
 477
 478         if (!strv_isempty(hr->ssh_authorized_keys))
 479                 printf("SSH Pub. Key: %zu\n", strv_length(hr->ssh_authorized_keys));
 480
 481         if (!strv_isempty(hr->pkcs11_token_uri)) {
 482                 char **i;
 483
 484                 STRV_FOREACH(i, hr->pkcs11_token_uri)
 485                         printf(i == hr->pkcs11_token_uri ?
 486                                "PKCS11 Token: %s\n" :
 487                                "              %s\n", *i);
 488         }
 489
 490         if (hr->n_fido2_hmac_credential > 0)
 491                 printf(" FIDO2 Token: %zu\n", hr->n_fido2_hmac_credential);
 492
 493         if (!strv_isempty(hr->recovery_key_type))
 494                 printf("Recovery Key: %zu\n", strv_length(hr->recovery_key_type));
 495
 496         k = strv_length(hr->hashed_password);
 497         if (k == 0)
 498                 printf("   Passwords: %snone%s\n",
 499                        user_record_disposition(hr) == USER_REGULAR ? ansi_highlight_yellow() : ansi_normal(), ansi_normal());
 500         else
 501                 printf("   Passwords: %zu\n", k);
 502
 503         if (hr->signed_locally >= 0)
 504                 printf("  Local Sig.: %s\n", yes_no(hr->signed_locally));
 505
 506         if (hr->stop_delay_usec != UINT64_MAX)
 507                 printf("  Stop Delay: %s\n", FORMAT_TIMESPAN(hr->stop_delay_usec, 0));
 508
 509         if (hr->auto_login >= 0)
 510                 printf("Autom. Login: %s\n", yes_no(hr->auto_login));
 511
 512         if (hr->kill_processes >= 0)
 513                 printf("  Kill Proc.: %s\n", yes_no(hr->kill_processes));
 514
 515         if (hr->service)
 516                 printf("     Service: %s\n", hr->service);
 517 }
 518
 519 void group_record_show(GroupRecord *gr, bool show_full_user_info) {
 520         int r;
 521
 522         printf("  Group name: %s\n",
 523                group_record_group_name_and_realm(gr));
 524
 525         printf(" Disposition: %s\n", user_disposition_to_string(group_record_disposition(gr)));
 526
 527         if (gr->last_change_usec != USEC_INFINITY)
 528                 printf(" Last Change: %s\n", FORMAT_TIMESTAMP(gr->last_change_usec));
 529
 530         if (gid_is_valid(gr->gid))
 531                 printf("         GID: " GID_FMT "\n", gr->gid);
 532
 533         if (show_full_user_info) {
 534                 _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 535
 536                 r = membershipdb_by_group(gr->group_name, 0, &iterator);
 537                 if (r < 0) {
 538                         errno = -r;
 539                         printf("     Members: (can't acquire: %m)");
 540                 } else {
 541                         const char *prefix = "     Members:";
 542
 543                         for (;;) {
 544                                 _cleanup_free_ char *user = NULL;
 545
 546                                 r = membershipdb_iterator_get(iterator, &user, NULL);
 547                                 if (r == -ESRCH)
 548                                         break;
 549                                 if (r < 0) {
 550                                         errno = -r;
 551                                         printf("%s (can't iterate: %m\n", prefix);
 552                                         break;
 553                                 }
 554
 555                                 printf("%s %s\n", prefix, user);
 556                                 prefix = "             ";
 557                         }
 558                 }
 559         } else {
 560                 const char *prefix = "     Members:";
 561                 char **i;
 562
 563                 STRV_FOREACH(i, gr->members) {
 564                         printf("%s %s\n", prefix, *i);
 565                         prefix = "             ";
 566                 }
 567         }
 568
 569         if (!strv_isempty(gr->administrators)) {
 570                 const char *prefix = "      Admins:";
 571                 char **i;
 572
 573                 STRV_FOREACH(i, gr->administrators) {
 574                         printf("%s %s\n", prefix, *i);
 575                         prefix = "             ";
 576                 }
 577         }
 578
 579         if (gr->description && !streq(gr->description, gr->group_name))
 580                 printf(" Description: %s\n", gr->description);
 581
 582         if (!strv_isempty(gr->hashed_password))
 583                 printf("   Passwords: %zu\n", strv_length(gr->hashed_password));
 584
 585         if (gr->service)
 586                 printf("     Service: %s\n", gr->service);
 587 }