mirror of
https://github.com/uutils/shadow.git
synced 2026-10-16 02:48:14 -07:00
Pierre Warnier
8575f629a8
vipw and vigr are the nineteenth and twentieth tools, and the fourth and
fifth of the nine that both Debian and Fedora ship and we did not. They
hand /etc/passwd, /etc/shadow, /etc/group or /etc/gshadow to the
administrator's editor under the same lock every other tool takes, and
install the result atomically. vigr is vipw with the group file as its
default -- the GNU suite ships it as a symlink -- so it is a crate that calls
uu_vipw::run with a different default and nothing else.
The reason the tool exists is the lock, so that is what the e2e suite proves:
with the editor open on /etc/passwd, a concurrent useradd waits rather than
failing or racing, and both changes land.
Two deliberate departures from GNU, both established by running its binary:
- The edited file is parsed before it is installed. GNU installs whatever
the editor saved: a line with no colons went in, and so did
`evil::0:0:::/bin/sh`, a UID 0 account with an empty password field.
Here a file the rest of the suite could not read back is refused. The
check is structural -- pwck and grpck still judge the contents -- and
when it refuses, the edit is kept beside the file rather than discarded.
An administrator whose ten minutes of work vanished would use a raw
editor next time, which is the outcome this tool exists to prevent.
- Changes are detected by content, not by timestamp. GNU compares
modification times in whole seconds, so an edit saved within the same
second as the copy was made is silently thrown away. The first probe of
the GNU tool hit exactly that: every scripted edit came back
"unchanged" until the script was slowed down.
The working copy sits beside the target as passwd.edit, created under a
zeroed umask with the original's mode and ownership, so a copy of
/etc/shadow is never more readable than /etc/shadow. A stale copy from a
crashed run is replaced, and the editor is handed the live contents.
vipw blocks SIGINT and friends for the whole edit so a Ctrl-C aimed at the
editor cannot kill it holding the lock. That mask would be inherited by the
editor, which then could not be interrupted at all, so
shadow_core::process::spawn_with_signals_unblocked starts the child with a
clean mask -- one pre_exec in the module where unsafe is allowed.
Verified: 852 tests on debian, alpine and fedora; make check clean including
the unprivileged run; 319 e2e assertions against a real install; 47 GNU
comparisons; 24 arm64 assertions under emulation.
424 B
424 B
vigr(8) - edit the group or gshadow file
NAME
vigr - edit the group or gshadow file
SYNOPSIS
vigr [options]
DESCRIPTION
vigr is vipw(8) with /etc/group as its default file; vigr -s edits /etc/gshadow. Everything else — the lock, the working copy, the editor, the check before installing, the options — is described in vipw(8).
SEE ALSO
vipw(8), group(5), gshadow(5), grpck(8)