From e0d8009d76b3a2451cb6c6ed2b241c7eff06ed60 Mon Sep 17 00:00:00 2001 From: Rob Landley Date: Fri, 26 Sep 2014 18:49:44 -0500 Subject: The only illegal characters in a username are ":" (field separator), "\n" (line separator), and "/" (filename separator). Restricting usernames to the legacy posix character allowed set (for filenames, so the $HOME directory is creatable on VFAT and similar) means you can't have UTF-8 usernames. Linux allows any character but / and NUL in filenames. Since root is creating these entries, we assume root knows what it's doing. --- toys/pending/groupadd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'toys/pending/groupadd.c') diff --git a/toys/pending/groupadd.c b/toys/pending/groupadd.c index 04c31ee5..7df0a5c3 100644 --- a/toys/pending/groupadd.c +++ b/toys/pending/groupadd.c @@ -92,11 +92,12 @@ void groupadd_main(void) update_password(SECURE_GROUP_PATH, grp->gr_name, entry); free(entry); } else { //new group to be created + char *s = *toys.optargs; + /* investigate the group to be created */ - if ((grp = getgrnam(*toys.optargs))) - error_exit("group '%s' is in use", *toys.optargs); - setlocale(LC_ALL, "C"); - is_valid_username(*toys.optargs); + if (getgrnam(s)) error_exit("'%s' in use", s); + if (s[strcspn(s, ":/\n")] || strlen(s) > LOGIN_NAME_MAX) + error_exit("bad name"); new_group(); } } -- cgit v1.2.3