1 |
On Fri, 2021-01-08 at 21:19 +0100, Thomas Deutschmann wrote: |
2 |
> In some setups where users are changed/managed not only via ebuilds, |
3 |
> for example through configuration management systems, it could be |
4 |
> problematic if acct-user.eclass will restore user/group settings |
5 |
> to values set in ebuild. |
6 |
> |
7 |
> Setting ACCT_USER_NO_MODIFY to a non-zero value will allow system |
8 |
> administrator to disable modification of any existing user. |
9 |
> |
10 |
> Note: Lock/unlock when acct-* package will be installed/removed |
11 |
> will still happen. |
12 |
> |
13 |
> Signed-off-by: Thomas Deutschmann <whissi@g.o> |
14 |
> --- |
15 |
> |
16 |
> v2: Keep current behavior; Add opt-out |
17 |
> |
18 |
> eclass/acct-user.eclass | 25 +++++++++++++++++++++++++ |
19 |
> 1 file changed, 25 insertions(+) |
20 |
> |
21 |
> diff --git a/eclass/acct-user.eclass b/eclass/acct-user.eclass |
22 |
> index 47890e48409a..560ae6b0ac90 100644 |
23 |
> --- a/eclass/acct-user.eclass |
24 |
> +++ b/eclass/acct-user.eclass |
25 |
> @@ -72,6 +72,11 @@ readonly ACCT_USER_NAME |
26 |
> # Overlays should set this to -1 to dynamically allocate UID. Using -1 |
27 |
> # in ::gentoo is prohibited by policy. |
28 |
> |
29 |
> |
30 |
> |
31 |
> |
32 |
> +# @ECLASS-VARIABLE: ACCT_USER_ALREADY_EXISTS |
33 |
> +# @INTERNAL |
34 |
> +# @DESCRIPTION: |
35 |
> +# Status variable which indicates if user already exists. |
36 |
|
37 |
Please prefix internal variables with an underscore. |
38 |
|
39 |
> + |
40 |
> # @ECLASS-VARIABLE: ACCT_USER_ENFORCE_ID |
41 |
> # @DESCRIPTION: |
42 |
> # If set to a non-null value, the eclass will require the user to have |
43 |
> @@ -79,6 +84,12 @@ readonly ACCT_USER_NAME |
44 |
> # the UID is taken by another user, the install will fail. |
45 |
> : ${ACCT_USER_ENFORCE_ID:=} |
46 |
> |
47 |
> |
48 |
> |
49 |
> |
50 |
> |
51 |
> |
52 |
> |
53 |
> |
54 |
> +# @ECLASS-VARIABLE: ACCT_USER_NO_MODIFY |
55 |
> +# @DESCRIPTION: |
56 |
> +# If set to a non-null value, the eclass will not make any changes |
57 |
> +# to an already existing user. |
58 |
> +: ${ACCT_USER_NO_MODIFY:=} |
59 |
|
60 |
@DEFAULT_UNSET would be better. |
61 |
|
62 |
> + |
63 |
> # @ECLASS-VARIABLE: ACCT_USER_SHELL |
64 |
> # @DESCRIPTION: |
65 |
> # The shell to use for the user. If not specified, a 'nologin' variant |
66 |
> @@ -344,6 +355,13 @@ acct-user_src_install() { |
67 |
> acct-user_pkg_preinst() { |
68 |
> debug-print-function ${FUNCNAME} "${@}" |
69 |
> |
70 |
> |
71 |
> |
72 |
> |
73 |
> |
74 |
> |
75 |
> |
76 |
> |
77 |
> |
78 |
> |
79 |
> |
80 |
> |
81 |
> |
82 |
> |
83 |
> |
84 |
> |
85 |
> + # check if user already exists |
86 |
> + ACCT_USER_ALREADY_EXISTS= |
87 |
> + if [[ -n $(egetent passwd "${ACCT_USER_NAME}") ]]; then |
88 |
> + ACCT_USER_ALREADY_EXISTS=yes |
89 |
> + fi |
90 |
> + readonly ACCT_USER_ALREADY_EXISTS |
91 |
> + |
92 |
> local groups=${ACCT_USER_GROUPS[*]} |
93 |
> enewuser ${ACCT_USER_ENFORCE_ID:+-F} -M "${ACCT_USER_NAME}" \ |
94 |
> "${ACCT_USER_ID}" "${ACCT_USER_SHELL}" "${ACCT_USER_HOME}" \ |
95 |
> @@ -379,6 +397,13 @@ acct-user_pkg_postinst() { |
96 |
> return 0 |
97 |
> fi |
98 |
> |
99 |
> |
100 |
> |
101 |
> |
102 |
> |
103 |
> |
104 |
> |
105 |
> |
106 |
> |
107 |
> |
108 |
> |
109 |
> |
110 |
> |
111 |
> |
112 |
> |
113 |
> |
114 |
> + if [[ -n ${ACCT_USER_NO_MODIFY} && -n ${ACCT_USER_ALREADY_EXISTS} ]] ; then |
115 |
> + eunlockuser "${ACCT_USER_NAME}" |
116 |
> + |
117 |
> + ewarn "User ${ACCT_USER_NAME} already exists; Not touching existing user due to set ACCT_USER_NO_MODIFY." |
118 |
|
119 |
I think you need to wrap the message, it seems to exceed 80 chars. |
120 |
|
121 |
> + return 0 |
122 |
> + fi |
123 |
> + |
124 |
> # NB: eset* functions check current value |
125 |
> esethome "${ACCT_USER_NAME}" "${ACCT_USER_HOME}" |
126 |
> esetshell "${ACCT_USER_NAME}" "${ACCT_USER_SHELL}" |
127 |
|
128 |
-- |
129 |
Best regards, |
130 |
Michał Górny |