run_parts for groupadd and groupdel

run_parts currently exists in useradd and userdel, this commit mirrors
the functionality with groupadd and groupdel

Hook for group{add,del} to include killing processes that have group
membership that would no longer exist to avoid membership ID reuse.

diff --git a/etc/shadow-maint/groupdel-pre.d/01-kill_group_procs.sh b/etc/shadow-maint/groupdel-pre.d/01-kill_group_procs.sh
new file mode 100644 (file)
index 0000000..10db527
--- /dev/null
+++ b/etc/shadow-maint/groupdel-pre.d/01-kill_group_procs.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+GROUPID=`awk -F: '$1 == "'"${SUBJECT}"'" { print $3 }' /etc/group`
+
+if [ "${GROUPID}" = "" ]; then
+    exit 0
+fi
+
+for status in /proc/*/status; do
+    # either this isn't a process or its already dead since expanding the list
+    [ -f "$status" ] || continue
+
+    tbuf=${status%/status}
+    pid=${tbuf#/proc/}
+    case "$pid" in
+        "$$") continue;;
+        [0-9]*) :;;
+        *) continue
+    esac
+    
+    grep -q '^Groups:.*\b'"${GROUPID}"'\b.*' "/proc/$pid/status" || continue
+
+    kill -9 "$pid" || echo "cannot kill $pid" 1>&2
+done
+

diff --git a/src/groupadd.c b/src/groupadd.c
index 31142101460ba69df6175b61833b12a6b7ef9434..2eda1c68045d90b3fe6f8aaec88997afbcfec9d5 100644 (file)
--- a/src/groupadd.c
+++ b/src/groupadd.c
@@ -34,6 +34,7 @@
 #include "sgroupio.h"
 #endif
 #include "shadowlog.h"
+#include "run_part.h"
 
 /*
  * exit status values
@@ -603,6 +604,11 @@ int main (int argc, char **argv)
 
        check_perms ();
 
+       if (run_parts ("/etc/shadow-maint/groupadd-pre.d", group_name,
+                       "groupadd")) {
+               exit(1);
+       }
+
 #ifdef SHADOWGRP
        is_shadow_grp = sgr_file_present ();
 #endif
@@ -621,6 +627,11 @@ int main (int argc, char **argv)
 
        grp_update ();
        close_files ();
+       if (run_parts ("/etc/shadow-maint/groupadd-post.d", group_name,
+                       "groupadd")) {
+               exit(1);
+       }
+
 
        nscd_flush_cache ("group");
        sssd_flush_cache (SSSD_DB_GROUP);

diff --git a/src/groupdel.c b/src/groupdel.c
index fdccf5e15a55316c5a84e62f305afd62aeaccc36..bae4367ba4c579fc83e4eb3ceb55ce8ae56d2fef 100644 (file)
--- a/src/groupdel.c
+++ b/src/groupdel.c
@@ -32,6 +32,7 @@
 #include "sgroupio.h"
 #endif
 #include "shadowlog.h"
+#include "run_part.h"
 /*
  * Global variables
  */
@@ -461,6 +462,11 @@ int main (int argc, char **argv)
                group_busy (group_id);
        }
 
+       if (run_parts ("/etc/shadow-maint/groupdel-pre.d", group_name,
+                       "groupdel")) {
+               exit(1);
+       }
+
        /*
         * Do the hard stuff - open the files, delete the group entries,
         * then close and update the files.
@@ -471,6 +477,11 @@ int main (int argc, char **argv)
 
        close_files ();
 
+       if (run_parts ("/etc/shadow-maint/groupdel-post.d", group_name,
+                       "groupdel")) {
+               exit(1);
+       }
+
        nscd_flush_cache ("group");
        sssd_flush_cache (SSSD_DB_GROUP);