src/sysusers/sysusers.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <getopt.h>
   4 #include <utmp.h>
   5
   6 #include "alloc-util.h"
   7 #include "conf-files.h"
   8 #include "copy.h"
   9 #include "def.h"
  10 #include "fd-util.h"
  11 #include "fileio.h"
  12 #include "format-util.h"
  13 #include "fs-util.h"
  14 #include "hashmap.h"
  15 #include "pager.h"
  16 #include "path-util.h"
  17 #include "pretty-print.h"
  18 #include "selinux-util.h"
  19 #include "smack-util.h"
  20 #include "specifier.h"
  21 #include "string-util.h"
  22 #include "strv.h"
  23 #include "tmpfile-util-label.h"
  24 #include "uid-range.h"
  25 #include "user-util.h"
  26 #include "utf8.h"
  27 #include "util.h"
  28
  29 typedef enum ItemType {
  30         ADD_USER = 'u',
  31         ADD_GROUP = 'g',
  32         ADD_MEMBER = 'm',
  33         ADD_RANGE = 'r',
  34 } ItemType;
  35
  36 typedef struct Item {
  37         ItemType type;
  38
  39         char *name;
  40         char *uid_path;
  41         char *gid_path;
  42         char *description;
  43         char *home;
  44         char *shell;
  45
  46         gid_t gid;
  47         uid_t uid;
  48
  49         bool gid_set:1;
  50
  51         /* When set the group with the specified gid must exist
  52          * and the check if a uid clashes with the gid is skipped.
  53          */
  54         bool id_set_strict:1;
  55
  56         bool uid_set:1;
  57
  58         bool todo_user:1;
  59         bool todo_group:1;
  60 } Item;
  61
  62 static char *arg_root = NULL;
  63 static bool arg_cat_config = false;
  64 static const char *arg_replace = NULL;
  65 static bool arg_inline = false;
  66 static PagerFlags arg_pager_flags = 0;
  67
  68 static OrderedHashmap *users = NULL, *groups = NULL;
  69 static OrderedHashmap *todo_uids = NULL, *todo_gids = NULL;
  70 static OrderedHashmap *members = NULL;
  71
  72 static Hashmap *database_uid = NULL, *database_user = NULL;
  73 static Hashmap *database_gid = NULL, *database_group = NULL;
  74
  75 static uid_t search_uid = UID_INVALID;
  76 static UidRange *uid_range = NULL;
  77 static unsigned n_uid_range = 0;
  78
  79 static int load_user_database(void) {
  80         _cleanup_fclose_ FILE *f = NULL;
  81         const char *passwd_path;
  82         struct passwd *pw;
  83         int r;
  84
  85         passwd_path = prefix_roota(arg_root, "/etc/passwd");
  86         f = fopen(passwd_path, "re");
  87         if (!f)
  88                 return errno == ENOENT ? 0 : -errno;
  89
  90         r = hashmap_ensure_allocated(&database_user, &string_hash_ops);
  91         if (r < 0)
  92                 return r;
  93
  94         r = hashmap_ensure_allocated(&database_uid, NULL);
  95         if (r < 0)
  96                 return r;
  97
  98         while ((r = fgetpwent_sane(f, &pw)) > 0) {
  99                 char *n;
 100                 int k, q;
 101
 102                 n = strdup(pw->pw_name);
 103                 if (!n)
 104                         return -ENOMEM;
 105
 106                 k = hashmap_put(database_user, n, UID_TO_PTR(pw->pw_uid));
 107                 if (k < 0 && k != -EEXIST) {
 108                         free(n);
 109                         return k;
 110                 }
 111
 112                 q = hashmap_put(database_uid, UID_TO_PTR(pw->pw_uid), n);
 113                 if (q < 0 && q != -EEXIST) {
 114                         if (k <= 0)
 115                                 free(n);
 116                         return q;
 117                 }
 118
 119                 if (k <= 0 && q <= 0)
 120                         free(n);
 121         }
 122         return r;
 123 }
 124
 125 static int load_group_database(void) {
 126         _cleanup_fclose_ FILE *f = NULL;
 127         const char *group_path;
 128         struct group *gr;
 129         int r;
 130
 131         group_path = prefix_roota(arg_root, "/etc/group");
 132         f = fopen(group_path, "re");
 133         if (!f)
 134                 return errno == ENOENT ? 0 : -errno;
 135
 136         r = hashmap_ensure_allocated(&database_group, &string_hash_ops);
 137         if (r < 0)
 138                 return r;
 139
 140         r = hashmap_ensure_allocated(&database_gid, NULL);
 141         if (r < 0)
 142                 return r;
 143
 144         errno = 0;
 145         while ((gr = fgetgrent(f))) {
 146                 char *n;
 147                 int k, q;
 148
 149                 n = strdup(gr->gr_name);
 150                 if (!n)
 151                         return -ENOMEM;
 152
 153                 k = hashmap_put(database_group, n, GID_TO_PTR(gr->gr_gid));
 154                 if (k < 0 && k != -EEXIST) {
 155                         free(n);
 156                         return k;
 157                 }
 158
 159                 q = hashmap_put(database_gid, GID_TO_PTR(gr->gr_gid), n);
 160                 if (q < 0 && q != -EEXIST) {
 161                         if (k <= 0)
 162                                 free(n);
 163                         return q;
 164                 }
 165
 166                 if (k <= 0 && q <= 0)
 167                         free(n);
 168
 169                 errno = 0;
 170         }
 171         if (!IN_SET(errno, 0, ENOENT))
 172                 return -errno;
 173
 174         return 0;
 175 }
 176
 177 static int make_backup(const char *target, const char *x) {
 178         _cleanup_close_ int src = -1;
 179         _cleanup_fclose_ FILE *dst = NULL;
 180         _cleanup_free_ char *temp = NULL;
 181         char *backup;
 182         struct timespec ts[2];
 183         struct stat st;
 184         int r;
 185
 186         src = open(x, O_RDONLY|O_CLOEXEC|O_NOCTTY);
 187         if (src < 0) {
 188                 if (errno == ENOENT) /* No backup necessary... */
 189                         return 0;
 190
 191                 return -errno;
 192         }
 193
 194         if (fstat(src, &st) < 0)
 195                 return -errno;
 196
 197         r = fopen_temporary_label(target, x, &dst, &temp);
 198         if (r < 0)
 199                 return r;
 200
 201         r = copy_bytes(src, fileno(dst), (uint64_t) -1, COPY_REFLINK);
 202         if (r < 0)
 203                 goto fail;
 204
 205         /* Don't fail on chmod() or chown(). If it stays owned by us
 206          * and/or unreadable by others, then it isn't too bad... */
 207
 208         backup = strjoina(x, "-");
 209
 210         /* Copy over the access mask */
 211         r = fchmod_and_chown(fileno(dst), st.st_mode & 07777, st.st_uid, st.st_gid);
 212         if (r < 0)
 213                 log_warning_errno(r, "Failed to change access mode or ownership of %s: %m", backup);
 214
 215         ts[0] = st.st_atim;
 216         ts[1] = st.st_mtim;
 217         if (futimens(fileno(dst), ts) < 0)
 218                 log_warning_errno(errno, "Failed to fix access and modification time of %s: %m", backup);
 219
 220         r = fflush_sync_and_check(dst);
 221         if (r < 0)
 222                 goto fail;
 223
 224         if (rename(temp, backup) < 0) {
 225                 r = -errno;
 226                 goto fail;
 227         }
 228
 229         return 0;
 230
 231 fail:
 232         unlink(temp);
 233         return r;
 234 }
 235
 236 static int putgrent_with_members(const struct group *gr, FILE *group) {
 237         char **a;
 238
 239         assert(gr);
 240         assert(group);
 241
 242         a = ordered_hashmap_get(members, gr->gr_name);
 243         if (a) {
 244                 _cleanup_strv_free_ char **l = NULL;
 245                 bool added = false;
 246                 char **i;
 247
 248                 l = strv_copy(gr->gr_mem);
 249                 if (!l)
 250                         return -ENOMEM;
 251
 252                 STRV_FOREACH(i, a) {
 253                         if (strv_find(l, *i))
 254                                 continue;
 255
 256                         if (strv_extend(&l, *i) < 0)
 257                                 return -ENOMEM;
 258
 259                         added = true;
 260                 }
 261
 262                 if (added) {
 263                         struct group t;
 264                         int r;
 265
 266                         strv_uniq(l);
 267                         strv_sort(l);
 268
 269                         t = *gr;
 270                         t.gr_mem = l;
 271
 272                         r = putgrent_sane(&t, group);
 273                         return r < 0 ? r : 1;
 274                 }
 275         }
 276
 277         return putgrent_sane(gr, group);
 278 }
 279
 280 #if ENABLE_GSHADOW
 281 static int putsgent_with_members(const struct sgrp *sg, FILE *gshadow) {
 282         char **a;
 283
 284         assert(sg);
 285         assert(gshadow);
 286
 287         a = ordered_hashmap_get(members, sg->sg_namp);
 288         if (a) {
 289                 _cleanup_strv_free_ char **l = NULL;
 290                 bool added = false;
 291                 char **i;
 292
 293                 l = strv_copy(sg->sg_mem);
 294                 if (!l)
 295                         return -ENOMEM;
 296
 297                 STRV_FOREACH(i, a) {
 298                         if (strv_find(l, *i))
 299                                 continue;
 300
 301                         if (strv_extend(&l, *i) < 0)
 302                                 return -ENOMEM;
 303
 304                         added = true;
 305                 }
 306
 307                 if (added) {
 308                         struct sgrp t;
 309                         int r;
 310
 311                         strv_uniq(l);
 312                         strv_sort(l);
 313
 314                         t = *sg;
 315                         t.sg_mem = l;
 316
 317                         r = putsgent_sane(&t, gshadow);
 318                         return r < 0 ? r : 1;
 319                 }
 320         }
 321
 322         return putsgent_sane(sg, gshadow);
 323 }
 324 #endif
 325
 326 static int sync_rights(FILE *from, FILE *to) {
 327         struct stat st;
 328
 329         if (fstat(fileno(from), &st) < 0)
 330                 return -errno;
 331
 332         return fchmod_and_chown(fileno(to), st.st_mode & 07777, st.st_uid, st.st_gid);
 333 }
 334
 335 static int rename_and_apply_smack(const char *temp_path, const char *dest_path) {
 336         int r = 0;
 337         if (rename(temp_path, dest_path) < 0)
 338                 return -errno;
 339
 340 #ifdef SMACK_RUN_LABEL
 341         r = mac_smack_apply(dest_path, SMACK_ATTR_ACCESS, SMACK_FLOOR_LABEL);
 342         if (r < 0)
 343                 return r;
 344 #endif
 345         return r;
 346 }
 347
 348 static const char* default_shell(uid_t uid) {
 349         return uid == 0 ? "/bin/sh" : "/sbin/nologin";
 350 }
 351
 352 static int write_temporary_passwd(const char *passwd_path, FILE **tmpfile, char **tmpfile_path) {
 353         _cleanup_fclose_ FILE *original = NULL, *passwd = NULL;
 354         _cleanup_(unlink_and_freep) char *passwd_tmp = NULL;
 355         struct passwd *pw = NULL;
 356         Iterator iterator;
 357         Item *i;
 358         int r;
 359
 360         if (ordered_hashmap_size(todo_uids) == 0)
 361                 return 0;
 362
 363         r = fopen_temporary_label("/etc/passwd", passwd_path, &passwd, &passwd_tmp);
 364         if (r < 0)
 365                 return r;
 366
 367         original = fopen(passwd_path, "re");
 368         if (original) {
 369
 370                 r = sync_rights(original, passwd);
 371                 if (r < 0)
 372                         return r;
 373
 374                 while ((r = fgetpwent_sane(original, &pw)) > 0) {
 375
 376                         i = ordered_hashmap_get(users, pw->pw_name);
 377                         if (i && i->todo_user) {
 378                                 log_error("%s: User \"%s\" already exists.", passwd_path, pw->pw_name);
 379                                 return -EEXIST;
 380                         }
 381
 382                         if (ordered_hashmap_contains(todo_uids, UID_TO_PTR(pw->pw_uid))) {
 383                                 log_error("%s: Detected collision for UID " UID_FMT ".", passwd_path, pw->pw_uid);
 384                                 return -EEXIST;
 385                         }
 386
 387                         /* Make sure we keep the NIS entries (if any) at the end. */
 388                         if (IN_SET(pw->pw_name[0], '+', '-'))
 389                                 break;
 390
 391                         r = putpwent_sane(pw, passwd);
 392                         if (r < 0)
 393                                 return r;
 394                 }
 395                 if (r < 0)
 396                         return r;
 397
 398         } else {
 399                 if (errno != ENOENT)
 400                         return -errno;
 401                 if (fchmod(fileno(passwd), 0644) < 0)
 402                         return -errno;
 403         }
 404
 405         ORDERED_HASHMAP_FOREACH(i, todo_uids, iterator) {
 406                 struct passwd n = {
 407                         .pw_name = i->name,
 408                         .pw_uid = i->uid,
 409                         .pw_gid = i->gid,
 410                         .pw_gecos = i->description,
 411
 412                         /* "x" means the password is stored in the shadow file */
 413                         .pw_passwd = (char*) "x",
 414
 415                         /* We default to the root directory as home */
 416                         .pw_dir = i->home ? i->home : (char*) "/",
 417
 418                         /* Initialize the shell to nologin, with one exception:
 419                          * for root we patch in something special */
 420                         .pw_shell = i->shell ?: (char*) default_shell(i->uid),
 421                 };
 422
 423                 r = putpwent_sane(&n, passwd);
 424                 if (r < 0)
 425                         return r;
 426         }
 427
 428         /* Append the remaining NIS entries if any */
 429         while (pw) {
 430                 r = putpwent_sane(pw, passwd);
 431                 if (r < 0)
 432                         return r;
 433
 434                 r = fgetpwent_sane(original, &pw);
 435                 if (r < 0)
 436                         return r;
 437                 if (r == 0)
 438                         break;
 439         }
 440
 441         r = fflush_and_check(passwd);
 442         if (r < 0)
 443                 return r;
 444
 445         *tmpfile = TAKE_PTR(passwd);
 446         *tmpfile_path = TAKE_PTR(passwd_tmp);
 447
 448         return 0;
 449 }
 450
 451 static int write_temporary_shadow(const char *shadow_path, FILE **tmpfile, char **tmpfile_path) {
 452         _cleanup_fclose_ FILE *original = NULL, *shadow = NULL;
 453         _cleanup_(unlink_and_freep) char *shadow_tmp = NULL;
 454         struct spwd *sp = NULL;
 455         Iterator iterator;
 456         long lstchg;
 457         Item *i;
 458         int r;
 459
 460         if (ordered_hashmap_size(todo_uids) == 0)
 461                 return 0;
 462
 463         r = fopen_temporary_label("/etc/shadow", shadow_path, &shadow, &shadow_tmp);
 464         if (r < 0)
 465                 return r;
 466
 467         lstchg = (long) (now(CLOCK_REALTIME) / USEC_PER_DAY);
 468
 469         original = fopen(shadow_path, "re");
 470         if (original) {
 471
 472                 r = sync_rights(original, shadow);
 473                 if (r < 0)
 474                         return r;
 475
 476                 while ((r = fgetspent_sane(original, &sp)) > 0) {
 477
 478                         i = ordered_hashmap_get(users, sp->sp_namp);
 479                         if (i && i->todo_user) {
 480                                 /* we will update the existing entry */
 481                                 sp->sp_lstchg = lstchg;
 482
 483                                 /* only the /etc/shadow stage is left, so we can
 484                                  * safely remove the item from the todo set */
 485                                 i->todo_user = false;
 486                                 ordered_hashmap_remove(todo_uids, UID_TO_PTR(i->uid));
 487                         }
 488
 489                         /* Make sure we keep the NIS entries (if any) at the end. */
 490                         if (IN_SET(sp->sp_namp[0], '+', '-'))
 491                                 break;
 492
 493                         r = putspent_sane(sp, shadow);
 494                         if (r < 0)
 495                                 return r;
 496                 }
 497                 if (r < 0)
 498                         return r;
 499
 500         } else {
 501                 if (errno != ENOENT)
 502                         return -errno;
 503                 if (fchmod(fileno(shadow), 0000) < 0)
 504                         return -errno;
 505         }
 506
 507         ORDERED_HASHMAP_FOREACH(i, todo_uids, iterator) {
 508                 struct spwd n = {
 509                         .sp_namp = i->name,
 510                         .sp_pwdp = (char*) "!!",
 511                         .sp_lstchg = lstchg,
 512                         .sp_min = -1,
 513                         .sp_max = -1,
 514                         .sp_warn = -1,
 515                         .sp_inact = -1,
 516                         .sp_expire = -1,
 517                         .sp_flag = (unsigned long) -1, /* this appears to be what everybody does ... */
 518                 };
 519
 520                 r = putspent_sane(&n, shadow);
 521                 if (r < 0)
 522                         return r;
 523         }
 524
 525         /* Append the remaining NIS entries if any */
 526         while (sp) {
 527                 r = putspent_sane(sp, shadow);
 528                 if (r < 0)
 529                         return r;
 530
 531                 r = fgetspent_sane(original, &sp);
 532                 if (r < 0)
 533                         return r;
 534                 if (r == 0)
 535                         break;
 536         }
 537         if (!IN_SET(errno, 0, ENOENT))
 538                 return -errno;
 539
 540         r = fflush_sync_and_check(shadow);
 541         if (r < 0)
 542                 return r;
 543
 544         *tmpfile = TAKE_PTR(shadow);
 545         *tmpfile_path = TAKE_PTR(shadow_tmp);
 546
 547         return 0;
 548 }
 549
 550 static int write_temporary_group(const char *group_path, FILE **tmpfile, char **tmpfile_path) {
 551         _cleanup_fclose_ FILE *original = NULL, *group = NULL;
 552         _cleanup_(unlink_and_freep) char *group_tmp = NULL;
 553         bool group_changed = false;
 554         struct group *gr = NULL;
 555         Iterator iterator;
 556         Item *i;
 557         int r;
 558
 559         if (ordered_hashmap_size(todo_gids) == 0 && ordered_hashmap_size(members) == 0)
 560                 return 0;
 561
 562         r = fopen_temporary_label("/etc/group", group_path, &group, &group_tmp);
 563         if (r < 0)
 564                 return r;
 565
 566         original = fopen(group_path, "re");
 567         if (original) {
 568
 569                 r = sync_rights(original, group);
 570                 if (r < 0)
 571                         return r;
 572
 573                 while ((r = fgetgrent_sane(original, &gr)) > 0) {
 574                         /* Safety checks against name and GID collisions. Normally,
 575                          * this should be unnecessary, but given that we look at the
 576                          * entries anyway here, let's make an extra verification
 577                          * step that we don't generate duplicate entries. */
 578
 579                         i = ordered_hashmap_get(groups, gr->gr_name);
 580                         if (i && i->todo_group) {
 581                                 log_error("%s: Group \"%s\" already exists.", group_path, gr->gr_name);
 582                                 return -EEXIST;
 583                         }
 584
 585                         if (ordered_hashmap_contains(todo_gids, GID_TO_PTR(gr->gr_gid))) {
 586                                 log_error("%s: Detected collision for GID " GID_FMT ".", group_path, gr->gr_gid);
 587                                 return  -EEXIST;
 588                         }
 589
 590                         /* Make sure we keep the NIS entries (if any) at the end. */
 591                         if (IN_SET(gr->gr_name[0], '+', '-'))
 592                                 break;
 593
 594                         r = putgrent_with_members(gr, group);
 595                         if (r < 0)
 596                                 return r;
 597                         if (r > 0)
 598                                 group_changed = true;
 599                 }
 600                 if (r < 0)
 601                         return r;
 602
 603         } else {
 604                 if (errno != ENOENT)
 605                         return -errno;
 606                 if (fchmod(fileno(group), 0644) < 0)
 607                         return -errno;
 608         }
 609
 610         ORDERED_HASHMAP_FOREACH(i, todo_gids, iterator) {
 611                 struct group n = {
 612                         .gr_name = i->name,
 613                         .gr_gid = i->gid,
 614                         .gr_passwd = (char*) "x",
 615                 };
 616
 617                 r = putgrent_with_members(&n, group);
 618                 if (r < 0)
 619                         return r;
 620
 621                 group_changed = true;
 622         }
 623
 624         /* Append the remaining NIS entries if any */
 625         while (gr) {
 626                 r = putgrent_sane(gr, group);
 627                 if (r < 0)
 628                         return r;
 629
 630                 r = fgetgrent_sane(original, &gr);
 631                 if (r < 0)
 632                         return r;
 633                 if (r == 0)
 634                         break;
 635         }
 636
 637         r = fflush_sync_and_check(group);
 638         if (r < 0)
 639                 return r;
 640
 641         if (group_changed) {
 642                 *tmpfile = TAKE_PTR(group);
 643                 *tmpfile_path = TAKE_PTR(group_tmp);
 644         }
 645         return 0;
 646 }
 647
 648 static int write_temporary_gshadow(const char * gshadow_path, FILE **tmpfile, char **tmpfile_path) {
 649 #if ENABLE_GSHADOW
 650         _cleanup_fclose_ FILE *original = NULL, *gshadow = NULL;
 651         _cleanup_(unlink_and_freep) char *gshadow_tmp = NULL;
 652         bool group_changed = false;
 653         Iterator iterator;
 654         Item *i;
 655         int r;
 656
 657         if (ordered_hashmap_size(todo_gids) == 0 && ordered_hashmap_size(members) == 0)
 658                 return 0;
 659
 660         r = fopen_temporary_label("/etc/gshadow", gshadow_path, &gshadow, &gshadow_tmp);
 661         if (r < 0)
 662                 return r;
 663
 664         original = fopen(gshadow_path, "re");
 665         if (original) {
 666                 struct sgrp *sg;
 667
 668                 r = sync_rights(original, gshadow);
 669                 if (r < 0)
 670                         return r;
 671
 672                 while ((r = fgetsgent_sane(original, &sg)) > 0) {
 673
 674                         i = ordered_hashmap_get(groups, sg->sg_namp);
 675                         if (i && i->todo_group) {
 676                                 log_error("%s: Group \"%s\" already exists.", gshadow_path, sg->sg_namp);
 677                                 return -EEXIST;
 678                         }
 679
 680                         r = putsgent_with_members(sg, gshadow);
 681                         if (r < 0)
 682                                 return r;
 683                         if (r > 0)
 684                                 group_changed = true;
 685                 }
 686                 if (r < 0)
 687                         return r;
 688
 689         } else {
 690                 if (errno != ENOENT)
 691                         return -errno;
 692                 if (fchmod(fileno(gshadow), 0000) < 0)
 693                         return -errno;
 694         }
 695
 696         ORDERED_HASHMAP_FOREACH(i, todo_gids, iterator) {
 697                 struct sgrp n = {
 698                         .sg_namp = i->name,
 699                         .sg_passwd = (char*) "!!",
 700                 };
 701
 702                 r = putsgent_with_members(&n, gshadow);
 703                 if (r < 0)
 704                         return r;
 705
 706                 group_changed = true;
 707         }
 708
 709         r = fflush_sync_and_check(gshadow);
 710         if (r < 0)
 711                 return r;
 712
 713         if (group_changed) {
 714                 *tmpfile = TAKE_PTR(gshadow);
 715                 *tmpfile_path = TAKE_PTR(gshadow_tmp);
 716         }
 717         return 0;
 718 #else
 719         return 0;
 720 #endif
 721 }
 722
 723 static int write_files(void) {
 724         _cleanup_fclose_ FILE *passwd = NULL, *group = NULL, *shadow = NULL, *gshadow = NULL;
 725         _cleanup_(unlink_and_freep) char *passwd_tmp = NULL, *group_tmp = NULL, *shadow_tmp = NULL, *gshadow_tmp = NULL;
 726         const char *passwd_path = NULL, *group_path = NULL, *shadow_path = NULL, *gshadow_path = NULL;
 727         int r;
 728
 729         passwd_path = prefix_roota(arg_root, "/etc/passwd");
 730         shadow_path = prefix_roota(arg_root, "/etc/shadow");
 731         group_path = prefix_roota(arg_root, "/etc/group");
 732         gshadow_path = prefix_roota(arg_root, "/etc/gshadow");
 733
 734         r = write_temporary_group(group_path, &group, &group_tmp);
 735         if (r < 0)
 736                 return r;
 737
 738         r = write_temporary_gshadow(gshadow_path, &gshadow, &gshadow_tmp);
 739         if (r < 0)
 740                 return r;
 741
 742         r = write_temporary_passwd(passwd_path, &passwd, &passwd_tmp);
 743         if (r < 0)
 744                 return r;
 745
 746         r = write_temporary_shadow(shadow_path, &shadow, &shadow_tmp);
 747         if (r < 0)
 748                 return r;
 749
 750         /* Make a backup of the old files */
 751         if (group) {
 752                 r = make_backup("/etc/group", group_path);
 753                 if (r < 0)
 754                         return r;
 755         }
 756         if (gshadow) {
 757                 r = make_backup("/etc/gshadow", gshadow_path);
 758                 if (r < 0)
 759                         return r;
 760         }
 761
 762         if (passwd) {
 763                 r = make_backup("/etc/passwd", passwd_path);
 764                 if (r < 0)
 765                         return r;
 766         }
 767         if (shadow) {
 768                 r = make_backup("/etc/shadow", shadow_path);
 769                 if (r < 0)
 770                         return r;
 771         }
 772
 773         /* And make the new files count */
 774         if (group) {
 775                 r = rename_and_apply_smack(group_tmp, group_path);
 776                 if (r < 0)
 777                         return r;
 778
 779                 group_tmp = mfree(group_tmp);
 780         }
 781         if (gshadow) {
 782                 r = rename_and_apply_smack(gshadow_tmp, gshadow_path);
 783                 if (r < 0)
 784                         return r;
 785
 786                 gshadow_tmp = mfree(gshadow_tmp);
 787         }
 788
 789         if (passwd) {
 790                 r = rename_and_apply_smack(passwd_tmp, passwd_path);
 791                 if (r < 0)
 792                         return r;
 793
 794                 passwd_tmp = mfree(passwd_tmp);
 795         }
 796         if (shadow) {
 797                 r = rename_and_apply_smack(shadow_tmp, shadow_path);
 798                 if (r < 0)
 799                         return r;
 800
 801                 shadow_tmp = mfree(shadow_tmp);
 802         }
 803
 804         return 0;
 805 }
 806
 807 static int uid_is_ok(uid_t uid, const char *name, bool check_with_gid) {
 808         struct passwd *p;
 809         struct group *g;
 810         const char *n;
 811         Item *i;
 812
 813         /* Let's see if we already have assigned the UID a second time */
 814         if (ordered_hashmap_get(todo_uids, UID_TO_PTR(uid)))
 815                 return 0;
 816
 817         /* Try to avoid using uids that are already used by a group
 818          * that doesn't have the same name as our new user. */
 819         if (check_with_gid) {
 820                 i = ordered_hashmap_get(todo_gids, GID_TO_PTR(uid));
 821                 if (i && !streq(i->name, name))
 822                         return 0;
 823         }
 824
 825         /* Let's check the files directly */
 826         if (hashmap_contains(database_uid, UID_TO_PTR(uid)))
 827                 return 0;
 828
 829         if (check_with_gid) {
 830                 n = hashmap_get(database_gid, GID_TO_PTR(uid));
 831                 if (n && !streq(n, name))
 832                         return 0;
 833         }
 834
 835         /* Let's also check via NSS, to avoid UID clashes over LDAP and such, just in case */
 836         if (!arg_root) {
 837                 errno = 0;
 838                 p = getpwuid(uid);
 839                 if (p)
 840                         return 0;
 841                 if (!IN_SET(errno, 0, ENOENT))
 842                         return -errno;
 843
 844                 if (check_with_gid) {
 845                         errno = 0;
 846                         g = getgrgid((gid_t) uid);
 847                         if (g) {
 848                                 if (!streq(g->gr_name, name))
 849                                         return 0;
 850                         } else if (!IN_SET(errno, 0, ENOENT))
 851                                 return -errno;
 852                 }
 853         }
 854
 855         return 1;
 856 }
 857
 858 static int root_stat(const char *p, struct stat *st) {
 859         const char *fix;
 860
 861         fix = prefix_roota(arg_root, p);
 862         if (stat(fix, st) < 0)
 863                 return -errno;
 864
 865         return 0;
 866 }
 867
 868 static int read_id_from_file(Item *i, uid_t *_uid, gid_t *_gid) {
 869         struct stat st;
 870         bool found_uid = false, found_gid = false;
 871         uid_t uid = 0;
 872         gid_t gid = 0;
 873
 874         assert(i);
 875
 876         /* First, try to get the gid directly */
 877         if (_gid && i->gid_path && root_stat(i->gid_path, &st) >= 0) {
 878                 gid = st.st_gid;
 879                 found_gid = true;
 880         }
 881
 882         /* Then, try to get the uid directly */
 883         if ((_uid || (_gid && !found_gid))
 884             && i->uid_path
 885             && root_stat(i->uid_path, &st) >= 0) {
 886
 887                 uid = st.st_uid;
 888                 found_uid = true;
 889
 890                 /* If we need the gid, but had no success yet, also derive it from the uid path */
 891                 if (_gid && !found_gid) {
 892                         gid = st.st_gid;
 893                         found_gid = true;
 894                 }
 895         }
 896
 897         /* If that didn't work yet, then let's reuse the gid as uid */
 898         if (_uid && !found_uid && i->gid_path) {
 899
 900                 if (found_gid) {
 901                         uid = (uid_t) gid;
 902                         found_uid = true;
 903                 } else if (root_stat(i->gid_path, &st) >= 0) {
 904                         uid = (uid_t) st.st_gid;
 905                         found_uid = true;
 906                 }
 907         }
 908
 909         if (_uid) {
 910                 if (!found_uid)
 911                         return 0;
 912
 913                 *_uid = uid;
 914         }
 915
 916         if (_gid) {
 917                 if (!found_gid)
 918                         return 0;
 919
 920                 *_gid = gid;
 921         }
 922
 923         return 1;
 924 }
 925
 926 static int add_user(Item *i) {
 927         void *z;
 928         int r;
 929
 930         assert(i);
 931
 932         /* Check the database directly */
 933         z = hashmap_get(database_user, i->name);
 934         if (z) {
 935                 log_debug("User %s already exists.", i->name);
 936                 i->uid = PTR_TO_UID(z);
 937                 i->uid_set = true;
 938                 return 0;
 939         }
 940
 941         if (!arg_root) {
 942                 struct passwd *p;
 943
 944                 /* Also check NSS */
 945                 errno = 0;
 946                 p = getpwnam(i->name);
 947                 if (p) {
 948                         log_debug("User %s already exists.", i->name);
 949                         i->uid = p->pw_uid;
 950                         i->uid_set = true;
 951
 952                         r = free_and_strdup(&i->description, p->pw_gecos);
 953                         if (r < 0)
 954                                 return log_oom();
 955
 956                         return 0;
 957                 }
 958                 if (!IN_SET(errno, 0, ENOENT))
 959                         return log_error_errno(errno, "Failed to check if user %s already exists: %m", i->name);
 960         }
 961
 962         /* Try to use the suggested numeric uid */
 963         if (i->uid_set) {
 964                 r = uid_is_ok(i->uid, i->name, !i->id_set_strict);
 965                 if (r < 0)
 966                         return log_error_errno(r, "Failed to verify uid " UID_FMT ": %m", i->uid);
 967                 if (r == 0) {
 968                         log_debug("Suggested user ID " UID_FMT " for %s already used.", i->uid, i->name);
 969                         i->uid_set = false;
 970                 }
 971         }
 972
 973         /* If that didn't work, try to read it from the specified path */
 974         if (!i->uid_set) {
 975                 uid_t c;
 976
 977                 if (read_id_from_file(i, &c, NULL) > 0) {
 978
 979                         if (c <= 0 || !uid_range_contains(uid_range, n_uid_range, c))
 980                                 log_debug("User ID " UID_FMT " of file not suitable for %s.", c, i->name);
 981                         else {
 982                                 r = uid_is_ok(c, i->name, true);
 983                                 if (r < 0)
 984                                         return log_error_errno(r, "Failed to verify uid " UID_FMT ": %m", i->uid);
 985                                 else if (r > 0) {
 986                                         i->uid = c;
 987                                         i->uid_set = true;
 988                                 } else
 989                                         log_debug("User ID " UID_FMT " of file for %s is already used.", c, i->name);
 990                         }
 991                 }
 992         }
 993
 994         /* Otherwise, try to reuse the group ID */
 995         if (!i->uid_set && i->gid_set) {
 996                 r = uid_is_ok((uid_t) i->gid, i->name, true);
 997                 if (r < 0)
 998                         return log_error_errno(r, "Failed to verify uid " UID_FMT ": %m", i->uid);
 999                 if (r > 0) {
1000                         i->uid = (uid_t) i->gid;
1001                         i->uid_set = true;
1002                 }
1003         }
1004
1005         /* And if that didn't work either, let's try to find a free one */
1006         if (!i->uid_set) {
1007                 for (;;) {
1008                         r = uid_range_next_lower(uid_range, n_uid_range, &search_uid);
1009                         if (r < 0) {
1010                                 log_error("No free user ID available for %s.", i->name);
1011                                 return r;
1012                         }
1013
1014                         r = uid_is_ok(search_uid, i->name, true);
1015                         if (r < 0)
1016                                 return log_error_errno(r, "Failed to verify uid " UID_FMT ": %m", i->uid);
1017                         else if (r > 0)
1018                                 break;
1019                 }
1020
1021                 i->uid_set = true;
1022                 i->uid = search_uid;
1023         }
1024
1025         r = ordered_hashmap_ensure_allocated(&todo_uids, NULL);
1026         if (r < 0)
1027                 return log_oom();
1028
1029         r = ordered_hashmap_put(todo_uids, UID_TO_PTR(i->uid), i);
1030         if (r < 0)
1031                 return log_oom();
1032
1033         i->todo_user = true;
1034         log_info("Creating user %s (%s) with uid " UID_FMT " and gid " GID_FMT ".", i->name, strna(i->description), i->uid, i->gid);
1035
1036         return 0;
1037 }
1038
1039 static int gid_is_ok(gid_t gid) {
1040         struct group *g;
1041         struct passwd *p;
1042
1043         if (ordered_hashmap_get(todo_gids, GID_TO_PTR(gid)))
1044                 return 0;
1045
1046         /* Avoid reusing gids that are already used by a different user */
1047         if (ordered_hashmap_get(todo_uids, UID_TO_PTR(gid)))
1048                 return 0;
1049
1050         if (hashmap_contains(database_gid, GID_TO_PTR(gid)))
1051                 return 0;
1052
1053         if (hashmap_contains(database_uid, UID_TO_PTR(gid)))
1054                 return 0;
1055
1056         if (!arg_root) {
1057                 errno = 0;
1058                 g = getgrgid(gid);
1059                 if (g)
1060                         return 0;
1061                 if (!IN_SET(errno, 0, ENOENT))
1062                         return -errno;
1063
1064                 errno = 0;
1065                 p = getpwuid((uid_t) gid);
1066                 if (p)
1067                         return 0;
1068                 if (!IN_SET(errno, 0, ENOENT))
1069                         return -errno;
1070         }
1071
1072         return 1;
1073 }
1074
1075 static int add_group(Item *i) {
1076         void *z;
1077         int r;
1078
1079         assert(i);
1080
1081         /* Check the database directly */
1082         z = hashmap_get(database_group, i->name);
1083         if (z) {
1084                 log_debug("Group %s already exists.", i->name);
1085                 i->gid = PTR_TO_GID(z);
1086                 i->gid_set = true;
1087                 return 0;
1088         }
1089
1090         /* Also check NSS */
1091         if (!arg_root) {
1092                 struct group *g;
1093
1094                 errno = 0;
1095                 g = getgrnam(i->name);
1096                 if (g) {
1097                         log_debug("Group %s already exists.", i->name);
1098                         i->gid = g->gr_gid;
1099                         i->gid_set = true;
1100                         return 0;
1101                 }
1102                 if (!IN_SET(errno, 0, ENOENT))
1103                         return log_error_errno(errno, "Failed to check if group %s already exists: %m", i->name);
1104         }
1105
1106         /* Try to use the suggested numeric gid */
1107         if (i->gid_set) {
1108                 r = gid_is_ok(i->gid);
1109                 if (r < 0)
1110                         return log_error_errno(r, "Failed to verify gid " GID_FMT ": %m", i->gid);
1111                 if (i->id_set_strict) {
1112                         /* If we require the gid to already exist we can return here:
1113                          * r > 0: means the gid does not exist -> fail
1114                          * r == 0: means the gid exists -> nothing more to do.
1115                          */
1116                         if (r > 0)
1117                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1118                                                        "Failed to create %s: please create GID %d",
1119                                                        i->name, i->gid);
1120                         if (r == 0)
1121                                 return 0;
1122                 }
1123                 if (r == 0) {
1124                         log_debug("Suggested group ID " GID_FMT " for %s already used.", i->gid, i->name);
1125                         i->gid_set = false;
1126                 }
1127         }
1128
1129         /* Try to reuse the numeric uid, if there's one */
1130         if (!i->gid_set && i->uid_set) {
1131                 r = gid_is_ok((gid_t) i->uid);
1132                 if (r < 0)
1133                         return log_error_errno(r, "Failed to verify gid " GID_FMT ": %m", i->gid);
1134                 if (r > 0) {
1135                         i->gid = (gid_t) i->uid;
1136                         i->gid_set = true;
1137                 }
1138         }
1139
1140         /* If that didn't work, try to read it from the specified path */
1141         if (!i->gid_set) {
1142                 gid_t c;
1143
1144                 if (read_id_from_file(i, NULL, &c) > 0) {
1145
1146                         if (c <= 0 || !uid_range_contains(uid_range, n_uid_range, c))
1147                                 log_debug("Group ID " GID_FMT " of file not suitable for %s.", c, i->name);
1148                         else {
1149                                 r = gid_is_ok(c);
1150                                 if (r < 0)
1151                                         return log_error_errno(r, "Failed to verify gid " GID_FMT ": %m", i->gid);
1152                                 else if (r > 0) {
1153                                         i->gid = c;
1154                                         i->gid_set = true;
1155                                 } else
1156                                         log_debug("Group ID " GID_FMT " of file for %s already used.", c, i->name);
1157                         }
1158                 }
1159         }
1160
1161         /* And if that didn't work either, let's try to find a free one */
1162         if (!i->gid_set) {
1163                 for (;;) {
1164                         /* We look for new GIDs in the UID pool! */
1165                         r = uid_range_next_lower(uid_range, n_uid_range, &search_uid);
1166                         if (r < 0) {
1167                                 log_error("No free group ID available for %s.", i->name);
1168                                 return r;
1169                         }
1170
1171                         r = gid_is_ok(search_uid);
1172                         if (r < 0)
1173                                 return log_error_errno(r, "Failed to verify gid " GID_FMT ": %m", i->gid);
1174                         else if (r > 0)
1175                                 break;
1176                 }
1177
1178                 i->gid_set = true;
1179                 i->gid = search_uid;
1180         }
1181
1182         r = ordered_hashmap_ensure_allocated(&todo_gids, NULL);
1183         if (r < 0)
1184                 return log_oom();
1185
1186         r = ordered_hashmap_put(todo_gids, GID_TO_PTR(i->gid), i);
1187         if (r < 0)
1188                 return log_oom();
1189
1190         i->todo_group = true;
1191         log_info("Creating group %s with gid " GID_FMT ".", i->name, i->gid);
1192
1193         return 0;
1194 }
1195
1196 static int process_item(Item *i) {
1197         int r;
1198
1199         assert(i);
1200
1201         switch (i->type) {
1202
1203         case ADD_USER: {
1204                 Item *j;
1205
1206                 j = ordered_hashmap_get(groups, i->name);
1207                 if (j && j->todo_group) {
1208                         /* When the group with the same name is already in queue,
1209                          * use the information about the group and do not create
1210                          * duplicated group entry. */
1211                         i->gid_set = j->gid_set;
1212                         i->gid = j->gid;
1213                         i->id_set_strict = true;
1214                 } else {
1215                         r = add_group(i);
1216                         if (r < 0)
1217                                 return r;
1218                 }
1219
1220                 return add_user(i);
1221         }
1222
1223         case ADD_GROUP:
1224                 return add_group(i);
1225
1226         default:
1227                 assert_not_reached("Unknown item type");
1228         }
1229 }
1230
1231 static void item_free(Item *i) {
1232
1233         if (!i)
1234                 return;
1235
1236         free(i->name);
1237         free(i->uid_path);
1238         free(i->gid_path);
1239         free(i->description);
1240         free(i->home);
1241         free(i->shell);
1242         free(i);
1243 }
1244
1245 DEFINE_TRIVIAL_CLEANUP_FUNC(Item*, item_free);
1246
1247 static int add_implicit(void) {
1248         char *g, **l;
1249         Iterator iterator;
1250         int r;
1251
1252         /* Implicitly create additional users and groups, if they were listed in "m" lines */
1253         ORDERED_HASHMAP_FOREACH_KEY(l, g, members, iterator) {
1254                 char **m;
1255
1256                 STRV_FOREACH(m, l)
1257                         if (!ordered_hashmap_get(users, *m)) {
1258                                 _cleanup_(item_freep) Item *j = NULL;
1259
1260                                 r = ordered_hashmap_ensure_allocated(&users, &string_hash_ops);
1261                                 if (r < 0)
1262                                         return log_oom();
1263
1264                                 j = new0(Item, 1);
1265                                 if (!j)
1266                                         return log_oom();
1267
1268                                 j->type = ADD_USER;
1269                                 j->name = strdup(*m);
1270                                 if (!j->name)
1271                                         return log_oom();
1272
1273                                 r = ordered_hashmap_put(users, j->name, j);
1274                                 if (r < 0)
1275                                         return log_oom();
1276
1277                                 log_debug("Adding implicit user '%s' due to m line", j->name);
1278                                 j = NULL;
1279                         }
1280
1281                 if (!(ordered_hashmap_get(users, g) ||
1282                       ordered_hashmap_get(groups, g))) {
1283                         _cleanup_(item_freep) Item *j = NULL;
1284
1285                         r = ordered_hashmap_ensure_allocated(&groups, &string_hash_ops);
1286                         if (r < 0)
1287                                 return log_oom();
1288
1289                         j = new0(Item, 1);
1290                         if (!j)
1291                                 return log_oom();
1292
1293                         j->type = ADD_GROUP;
1294                         j->name = strdup(g);
1295                         if (!j->name)
1296                                 return log_oom();
1297
1298                         r = ordered_hashmap_put(groups, j->name, j);
1299                         if (r < 0)
1300                                 return log_oom();
1301
1302                         log_debug("Adding implicit group '%s' due to m line", j->name);
1303                         j = NULL;
1304                 }
1305         }
1306
1307         return 0;
1308 }
1309
1310 static bool item_equal(Item *a, Item *b) {
1311         assert(a);
1312         assert(b);
1313
1314         if (a->type != b->type)
1315                 return false;
1316
1317         if (!streq_ptr(a->name, b->name))
1318                 return false;
1319
1320         if (!streq_ptr(a->uid_path, b->uid_path))
1321                 return false;
1322
1323         if (!streq_ptr(a->gid_path, b->gid_path))
1324                 return false;
1325
1326         if (!streq_ptr(a->description, b->description))
1327                 return false;
1328
1329         if (a->uid_set != b->uid_set)
1330                 return false;
1331
1332         if (a->uid_set && a->uid != b->uid)
1333                 return false;
1334
1335         if (a->gid_set != b->gid_set)
1336                 return false;
1337
1338         if (a->gid_set && a->gid != b->gid)
1339                 return false;
1340
1341         if (!streq_ptr(a->home, b->home))
1342                 return false;
1343
1344         if (!streq_ptr(a->shell, b->shell))
1345                 return false;
1346
1347         return true;
1348 }
1349
1350 static int parse_line(const char *fname, unsigned line, const char *buffer) {
1351
1352         static const Specifier specifier_table[] = {
1353                 { 'm', specifier_machine_id,     NULL },
1354                 { 'b', specifier_boot_id,        NULL },
1355                 { 'H', specifier_host_name,      NULL },
1356                 { 'v', specifier_kernel_release, NULL },
1357                 { 'T', specifier_tmp_dir,        NULL },
1358                 { 'V', specifier_var_tmp_dir,    NULL },
1359                 {}
1360         };
1361
1362         _cleanup_free_ char *action = NULL,
1363                 *name = NULL, *resolved_name = NULL,
1364                 *id = NULL, *resolved_id = NULL,
1365                 *description = NULL, *resolved_description = NULL,
1366                 *home = NULL, *resolved_home = NULL,
1367                 *shell, *resolved_shell = NULL;
1368         _cleanup_(item_freep) Item *i = NULL;
1369         Item *existing;
1370         OrderedHashmap *h;
1371         int r;
1372         const char *p;
1373
1374         assert(fname);
1375         assert(line >= 1);
1376         assert(buffer);
1377
1378         /* Parse columns */
1379         p = buffer;
1380         r = extract_many_words(&p, NULL, EXTRACT_QUOTES,
1381                                &action, &name, &id, &description, &home, &shell, NULL);
1382         if (r < 0) {
1383                 log_error("[%s:%u] Syntax error.", fname, line);
1384                 return r;
1385         }
1386         if (r < 2) {
1387                 log_error("[%s:%u] Missing action and name columns.", fname, line);
1388                 return -EINVAL;
1389         }
1390         if (!isempty(p)) {
1391                 log_error("[%s:%u] Trailing garbage.", fname, line);
1392                 return -EINVAL;
1393         }
1394
1395         /* Verify action */
1396         if (strlen(action) != 1) {
1397                 log_error("[%s:%u] Unknown modifier '%s'", fname, line, action);
1398                 return -EINVAL;
1399         }
1400
1401         if (!IN_SET(action[0], ADD_USER, ADD_GROUP, ADD_MEMBER, ADD_RANGE)) {
1402                 log_error("[%s:%u] Unknown command type '%c'.", fname, line, action[0]);
1403                 return -EBADMSG;
1404         }
1405
1406         /* Verify name */
1407         if (isempty(name) || streq(name, "-"))
1408                 name = mfree(name);
1409
1410         if (name) {
1411                 r = specifier_printf(name, specifier_table, NULL, &resolved_name);
1412                 if (r < 0) {
1413                         log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, name);
1414                         return r;
1415                 }
1416
1417                 if (!valid_user_group_name(resolved_name)) {
1418                         log_error("[%s:%u] '%s' is not a valid user or group name.", fname, line, resolved_name);
1419                         return -EINVAL;
1420                 }
1421         }
1422
1423         /* Verify id */
1424         if (isempty(id) || streq(id, "-"))
1425                 id = mfree(id);
1426
1427         if (id) {
1428                 r = specifier_printf(id, specifier_table, NULL, &resolved_id);
1429                 if (r < 0) {
1430                         log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, name);
1431                         return r;
1432                 }
1433         }
1434
1435         /* Verify description */
1436         if (isempty(description) || streq(description, "-"))
1437                 description = mfree(description);
1438
1439         if (description) {
1440                 r = specifier_printf(description, specifier_table, NULL, &resolved_description);
1441                 if (r < 0) {
1442                         log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, description);
1443                         return r;
1444                 }
1445
1446                 if (!valid_gecos(resolved_description)) {
1447                         log_error("[%s:%u] '%s' is not a valid GECOS field.", fname, line, resolved_description);
1448                         return -EINVAL;
1449                 }
1450         }
1451
1452         /* Verify home */
1453         if (isempty(home) || streq(home, "-"))
1454                 home = mfree(home);
1455
1456         if (home) {
1457                 r = specifier_printf(home, specifier_table, NULL, &resolved_home);
1458                 if (r < 0) {
1459                         log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, home);
1460                         return r;
1461                 }
1462
1463                 if (!valid_home(resolved_home)) {
1464                         log_error("[%s:%u] '%s' is not a valid home directory field.", fname, line, resolved_home);
1465                         return -EINVAL;
1466                 }
1467         }
1468
1469         /* Verify shell */
1470         if (isempty(shell) || streq(shell, "-"))
1471                 shell = mfree(shell);
1472
1473         if (shell) {
1474                 r = specifier_printf(shell, specifier_table, NULL, &resolved_shell);
1475                 if (r < 0) {
1476                         log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, shell);
1477                         return r;
1478                 }
1479
1480                 if (!valid_shell(resolved_shell)) {
1481                         log_error("[%s:%u] '%s' is not a valid login shell field.", fname, line, resolved_shell);
1482                         return -EINVAL;
1483                 }
1484         }
1485
1486         switch (action[0]) {
1487
1488         case ADD_RANGE:
1489                 if (resolved_name) {
1490                         log_error("[%s:%u] Lines of type 'r' don't take a name field.", fname, line);
1491                         return -EINVAL;
1492                 }
1493
1494                 if (!resolved_id) {
1495                         log_error("[%s:%u] Lines of type 'r' require a ID range in the third field.", fname, line);
1496                         return -EINVAL;
1497                 }
1498
1499                 if (description || home || shell) {
1500                         log_error("[%s:%u] Lines of type '%c' don't take a %s field.",
1501                                   fname, line, action[0],
1502                                   description ? "GECOS" : home ? "home directory" : "login shell");
1503                         return -EINVAL;
1504                 }
1505
1506                 r = uid_range_add_str(&uid_range, &n_uid_range, resolved_id);
1507                 if (r < 0) {
1508                         log_error("[%s:%u] Invalid UID range %s.", fname, line, resolved_id);
1509                         return -EINVAL;
1510                 }
1511
1512                 return 0;
1513
1514         case ADD_MEMBER: {
1515                 char **l;
1516
1517                 /* Try to extend an existing member or group item */
1518                 if (!name) {
1519                         log_error("[%s:%u] Lines of type 'm' require a user name in the second field.", fname, line);
1520                         return -EINVAL;
1521                 }
1522
1523                 if (!resolved_id) {
1524                         log_error("[%s:%u] Lines of type 'm' require a group name in the third field.", fname, line);
1525                         return -EINVAL;
1526                 }
1527
1528                 if (!valid_user_group_name(resolved_id)) {
1529                         log_error("[%s:%u] '%s' is not a valid user or group name.", fname, line, resolved_id);
1530                         return -EINVAL;
1531                 }
1532
1533                 if (description || home || shell) {
1534                         log_error("[%s:%u] Lines of type '%c' don't take a %s field.",
1535                                   fname, line, action[0],
1536                                   description ? "GECOS" : home ? "home directory" : "login shell");
1537                         return -EINVAL;
1538                 }
1539
1540                 r = ordered_hashmap_ensure_allocated(&members, &string_hash_ops);
1541                 if (r < 0)
1542                         return log_oom();
1543
1544                 l = ordered_hashmap_get(members, resolved_id);
1545                 if (l) {
1546                         /* A list for this group name already exists, let's append to it */
1547                         r = strv_push(&l, resolved_name);
1548                         if (r < 0)
1549                                 return log_oom();
1550
1551                         resolved_name = NULL;
1552
1553                         assert_se(ordered_hashmap_update(members, resolved_id, l) >= 0);
1554                 } else {
1555                         /* No list for this group name exists yet, create one */
1556
1557                         l = new0(char *, 2);
1558                         if (!l)
1559                                 return -ENOMEM;
1560
1561                         l[0] = resolved_name;
1562                         l[1] = NULL;
1563
1564                         r = ordered_hashmap_put(members, resolved_id, l);
1565                         if (r < 0) {
1566                                 free(l);
1567                                 return log_oom();
1568                         }
1569
1570                         resolved_id = resolved_name = NULL;
1571                 }
1572
1573                 return 0;
1574         }
1575
1576         case ADD_USER:
1577                 if (!name) {
1578                         log_error("[%s:%u] Lines of type 'u' require a user name in the second field.", fname, line);
1579                         return -EINVAL;
1580                 }
1581
1582                 r = ordered_hashmap_ensure_allocated(&users, &string_hash_ops);
1583                 if (r < 0)
1584                         return log_oom();
1585
1586                 i = new0(Item, 1);
1587                 if (!i)
1588                         return log_oom();
1589
1590                 if (resolved_id) {
1591                         if (path_is_absolute(resolved_id)) {
1592                                 i->uid_path = TAKE_PTR(resolved_id);
1593                                 path_simplify(i->uid_path, false);
1594                         } else {
1595                                 _cleanup_free_ char *uid = NULL, *gid = NULL;
1596                                 if (split_pair(resolved_id, ":", &uid, &gid) == 0) {
1597                                         r = parse_gid(gid, &i->gid);
1598                                         if (r < 0)
1599                                                 return log_error_errno(r, "Failed to parse GID: '%s': %m", id);
1600                                         i->gid_set = true;
1601                                         i->id_set_strict = true;
1602                                         free_and_replace(resolved_id, uid);
1603                                 }
1604                                 if (!streq(resolved_id, "-")) {
1605                                         r = parse_uid(resolved_id, &i->uid);
1606                                         if (r < 0)
1607                                                 return log_error_errno(r, "Failed to parse UID: '%s': %m", id);
1608                                         i->uid_set = true;
1609                                 }
1610                         }
1611                 }
1612
1613                 i->description = TAKE_PTR(resolved_description);
1614                 i->home = TAKE_PTR(resolved_home);
1615                 i->shell = TAKE_PTR(resolved_shell);
1616
1617                 h = users;
1618                 break;
1619
1620         case ADD_GROUP:
1621                 if (!name) {
1622                         log_error("[%s:%u] Lines of type 'g' require a user name in the second field.", fname, line);
1623                         return -EINVAL;
1624                 }
1625
1626                 if (description || home || shell) {
1627                         log_error("[%s:%u] Lines of type '%c' don't take a %s field.",
1628                                   fname, line, action[0],
1629                                   description ? "GECOS" : home ? "home directory" : "login shell");
1630                         return -EINVAL;
1631                 }
1632
1633                 r = ordered_hashmap_ensure_allocated(&groups, &string_hash_ops);
1634                 if (r < 0)
1635                         return log_oom();
1636
1637                 i = new0(Item, 1);
1638                 if (!i)
1639                         return log_oom();
1640
1641                 if (resolved_id) {
1642                         if (path_is_absolute(resolved_id)) {
1643                                 i->gid_path = TAKE_PTR(resolved_id);
1644                                 path_simplify(i->gid_path, false);
1645                         } else {
1646                                 r = parse_gid(resolved_id, &i->gid);
1647                                 if (r < 0)
1648                                         return log_error_errno(r, "Failed to parse GID: '%s': %m", id);
1649
1650                                 i->gid_set = true;
1651                         }
1652                 }
1653
1654                 h = groups;
1655                 break;
1656
1657         default:
1658                 return -EBADMSG;
1659         }
1660
1661         i->type = action[0];
1662         i->name = TAKE_PTR(resolved_name);
1663
1664         existing = ordered_hashmap_get(h, i->name);
1665         if (existing) {
1666
1667                 /* Two identical items are fine */
1668                 if (!item_equal(existing, i))
1669                         log_warning("Two or more conflicting lines for %s configured, ignoring.", i->name);
1670
1671                 return 0;
1672         }
1673
1674         r = ordered_hashmap_put(h, i->name, i);
1675         if (r < 0)
1676                 return log_oom();
1677
1678         i = NULL;
1679         return 0;
1680 }
1681
1682 static int read_config_file(const char *fn, bool ignore_enoent) {
1683         _cleanup_fclose_ FILE *rf = NULL;
1684         FILE *f = NULL;
1685         unsigned v = 0;
1686         int r = 0;
1687
1688         assert(fn);
1689
1690         if (streq(fn, "-"))
1691                 f = stdin;
1692         else {
1693                 r = search_and_fopen(fn, "re", arg_root, (const char**) CONF_PATHS_STRV("sysusers.d"), &rf);
1694                 if (r < 0) {
1695                         if (ignore_enoent && r == -ENOENT)
1696                                 return 0;
1697
1698                         return log_error_errno(r, "Failed to open '%s', ignoring: %m", fn);
1699                 }
1700
1701                 f = rf;
1702         }
1703
1704         for (;;) {
1705                 _cleanup_free_ char *line = NULL;
1706                 char *l;
1707                 int k;
1708
1709                 k = read_line(f, LONG_LINE_MAX, &line);
1710                 if (k < 0)
1711                         return log_error_errno(k, "Failed to read '%s': %m", fn);
1712                 if (k == 0)
1713                         break;
1714
1715                 v++;
1716
1717                 l = strstrip(line);
1718                 if (IN_SET(*l, 0, '#'))
1719                         continue;
1720
1721                 k = parse_line(fn, v, l);
1722                 if (k < 0 && r == 0)
1723                         r = k;
1724         }
1725
1726         if (ferror(f)) {
1727                 log_error_errno(errno, "Failed to read from file %s: %m", fn);
1728                 if (r == 0)
1729                         r = -EIO;
1730         }
1731
1732         return r;
1733 }
1734
1735 static void free_database(Hashmap *by_name, Hashmap *by_id) {
1736         char *name;
1737
1738         for (;;) {
1739                 name = hashmap_first(by_id);
1740                 if (!name)
1741                         break;
1742
1743                 hashmap_remove(by_name, name);
1744
1745                 hashmap_steal_first_key(by_id);
1746                 free(name);
1747         }
1748
1749         while ((name = hashmap_steal_first_key(by_name)))
1750                 free(name);
1751
1752         hashmap_free(by_name);
1753         hashmap_free(by_id);
1754 }
1755
1756 static int cat_config(void) {
1757         _cleanup_strv_free_ char **files = NULL;
1758         int r;
1759
1760         r = conf_files_list_with_replacement(arg_root, CONF_PATHS_STRV("sysusers.d"), arg_replace, &files, NULL);
1761         if (r < 0)
1762                 return r;
1763
1764         (void) pager_open(arg_pager_flags);
1765
1766         return cat_files(NULL, files, 0);
1767 }
1768
1769 static int help(void) {
1770         _cleanup_free_ char *link = NULL;
1771         int r;
1772
1773         r = terminal_urlify_man("systemd-sysusers.service", "8", &link);
1774         if (r < 0)
1775                 return log_oom();
1776
1777         printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
1778                "Creates system user accounts.\n\n"
1779                "  -h --help                 Show this help\n"
1780                "     --version              Show package version\n"
1781                "     --cat-config           Show configuration files\n"
1782                "     --root=PATH            Operate on an alternate filesystem root\n"
1783                "     --replace=PATH         Treat arguments as replacement for PATH\n"
1784                "     --inline               Treat arguments as configuration lines\n"
1785                "     --no-pager             Do not pipe output into a pager\n"
1786                "\nSee the %s for details.\n"
1787                , program_invocation_short_name
1788                , link
1789         );
1790
1791         return 0;
1792 }
1793
1794 static int parse_argv(int argc, char *argv[]) {
1795
1796         enum {
1797                 ARG_VERSION = 0x100,
1798                 ARG_CAT_CONFIG,
1799                 ARG_ROOT,
1800                 ARG_REPLACE,
1801                 ARG_INLINE,
1802                 ARG_NO_PAGER,
1803         };
1804
1805         static const struct option options[] = {
1806                 { "help",       no_argument,       NULL, 'h'            },
1807                 { "version",    no_argument,       NULL, ARG_VERSION    },
1808                 { "cat-config", no_argument,       NULL, ARG_CAT_CONFIG },
1809                 { "root",       required_argument, NULL, ARG_ROOT       },
1810                 { "replace",    required_argument, NULL, ARG_REPLACE    },
1811                 { "inline",     no_argument,       NULL, ARG_INLINE     },
1812                 { "no-pager",   no_argument,       NULL, ARG_NO_PAGER   },
1813                 {}
1814         };
1815
1816         int c, r;
1817
1818         assert(argc >= 0);
1819         assert(argv);
1820
1821         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
1822
1823                 switch (c) {
1824
1825                 case 'h':
1826                         return help();
1827
1828                 case ARG_VERSION:
1829                         return version();
1830
1831                 case ARG_CAT_CONFIG:
1832                         arg_cat_config = true;
1833                         break;
1834
1835                 case ARG_ROOT:
1836                         r = parse_path_argument_and_warn(optarg, true, &arg_root);
1837                         if (r < 0)
1838                                 return r;
1839                         break;
1840
1841                 case ARG_REPLACE:
1842                         if (!path_is_absolute(optarg) ||
1843                             !endswith(optarg, ".conf"))
1844                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1845                                                        "The argument to --replace= must an absolute path to a config file");
1846
1847                         arg_replace = optarg;
1848                         break;
1849
1850                 case ARG_INLINE:
1851                         arg_inline = true;
1852                         break;
1853
1854                 case ARG_NO_PAGER:
1855                         arg_pager_flags |= PAGER_DISABLE;
1856                         break;
1857
1858                 case '?':
1859                         return -EINVAL;
1860
1861                 default:
1862                         assert_not_reached("Unhandled option");
1863                 }
1864
1865         if (arg_replace && arg_cat_config)
1866                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1867                                        "Option --replace= is not supported with --cat-config");
1868
1869         if (arg_replace && optind >= argc)
1870                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1871                                        "When --replace= is given, some configuration items must be specified");
1872
1873         return 1;
1874 }
1875
1876 static int parse_arguments(char **args) {
1877         char **arg;
1878         unsigned pos = 1;
1879         int r;
1880
1881         STRV_FOREACH(arg, args) {
1882                 if (arg_inline)
1883                         /* Use (argument):n, where n==1 for the first positional arg */
1884                         r = parse_line("(argument)", pos, *arg);
1885                 else
1886                         r = read_config_file(*arg, false);
1887                 if (r < 0)
1888                         return r;
1889
1890                 pos++;
1891         }
1892
1893         return 0;
1894 }
1895
1896 static int read_config_files(char **args) {
1897         _cleanup_strv_free_ char **files = NULL;
1898         _cleanup_free_ char *p = NULL;
1899         char **f;
1900         int r;
1901
1902         r = conf_files_list_with_replacement(arg_root, CONF_PATHS_STRV("sysusers.d"), arg_replace, &files, &p);
1903         if (r < 0)
1904                 return r;
1905
1906         STRV_FOREACH(f, files)
1907                 if (p && path_equal(*f, p)) {
1908                         log_debug("Parsing arguments at position \"%s\"…", *f);
1909
1910                         r = parse_arguments(args);
1911                         if (r < 0)
1912                                 return r;
1913                 } else {
1914                         log_debug("Reading config file \"%s\"…", *f);
1915
1916                         /* Just warn, ignore result otherwise */
1917                         (void) read_config_file(*f, true);
1918                 }
1919
1920         return 0;
1921 }
1922
1923 int main(int argc, char *argv[]) {
1924         _cleanup_close_ int lock = -1;
1925         Iterator iterator;
1926         char *n, **v;
1927         Item *i;
1928         int r;
1929
1930         r = parse_argv(argc, argv);
1931         if (r <= 0)
1932                 goto finish;
1933
1934         log_setup_service();
1935
1936         if (arg_cat_config) {
1937                 r = cat_config();
1938                 goto finish;
1939         }
1940
1941         umask(0022);
1942
1943         r = mac_selinux_init();
1944         if (r < 0) {
1945                 log_error_errno(r, "SELinux setup failed: %m");
1946                 goto finish;
1947         }
1948
1949         /* If command line arguments are specified along with --replace, read all
1950          * configuration files and insert the positional arguments at the specified
1951          * place. Otherwise, if command line arguments are specified, execute just
1952          * them, and finally, without --replace= or any positional arguments, just
1953          * read configuration and execute it.
1954          */
1955         if (arg_replace || optind >= argc)
1956                 r = read_config_files(argv + optind);
1957         else
1958                 r = parse_arguments(argv + optind);
1959         if (r < 0)
1960                 goto finish;
1961
1962         /* Let's tell nss-systemd not to synthesize the "root" and "nobody" entries for it, so that our detection
1963          * whether the names or UID/GID area already used otherwise doesn't get confused. After all, even though
1964          * nss-systemd synthesizes these users/groups, they should still appear in /etc/passwd and /etc/group, as the
1965          * synthesizing logic is merely supposed to be fallback for cases where we run with a completely unpopulated
1966          * /etc. */
1967         if (setenv("SYSTEMD_NSS_BYPASS_SYNTHETIC", "1", 1) < 0) {
1968                 r = log_error_errno(errno, "Failed to set SYSTEMD_NSS_BYPASS_SYNTHETIC environment variable: %m");
1969                 goto finish;
1970         }
1971
1972         if (!uid_range) {
1973                 /* Default to default range of 1..SYSTEM_UID_MAX */
1974                 r = uid_range_add(&uid_range, &n_uid_range, 1, SYSTEM_UID_MAX);
1975                 if (r < 0) {
1976                         log_oom();
1977                         goto finish;
1978                 }
1979         }
1980
1981         r = add_implicit();
1982         if (r < 0)
1983                 goto finish;
1984
1985         lock = take_etc_passwd_lock(arg_root);
1986         if (lock < 0) {
1987                 log_error_errno(lock, "Failed to take /etc/passwd lock: %m");
1988                 goto finish;
1989         }
1990
1991         r = load_user_database();
1992         if (r < 0) {
1993                 log_error_errno(r, "Failed to load user database: %m");
1994                 goto finish;
1995         }
1996
1997         r = load_group_database();
1998         if (r < 0) {
1999                 log_error_errno(r, "Failed to read group database: %m");
2000                 goto finish;
2001         }
2002
2003         ORDERED_HASHMAP_FOREACH(i, groups, iterator)
2004                 (void) process_item(i);
2005
2006         ORDERED_HASHMAP_FOREACH(i, users, iterator)
2007                 (void) process_item(i);
2008
2009         r = write_files();
2010         if (r < 0)
2011                 log_error_errno(r, "Failed to write files: %m");
2012
2013 finish:
2014         pager_close();
2015
2016         ordered_hashmap_free_with_destructor(groups, item_free);
2017         ordered_hashmap_free_with_destructor(users, item_free);
2018
2019         while ((v = ordered_hashmap_steal_first_key_and_value(members, (void **) &n))) {
2020                 strv_free(v);
2021                 free(n);
2022         }
2023         ordered_hashmap_free(members);
2024
2025         ordered_hashmap_free(todo_uids);
2026         ordered_hashmap_free(todo_gids);
2027
2028         free_database(database_user, database_uid);
2029         free_database(database_group, database_gid);
2030
2031         free(uid_range);
2032
2033         free(arg_root);
2034
2035         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
2036 }