Specify SANITIZER_RENAME_SYMBOL in chpass

Rename local versions of getpwent getpwnam getpwnam_r getpwuid getpwuid_r
(all of the symbols are namespaced) in order to remove symbol clash with
libc.

This program uses code directly from libc.

branches: 1.15.74;
Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on the
FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to
various string and memory copy and set functions (as well as a few system
calls and other miscellany) where known at function entry. RedHat has
evidently built all "core system packages" with this option for some time.

This option should be used at the top of Makefiles (or Makefile.inc where
this is used for subdirectories) but after any setting of LIB.

This is only useful for userland code, and cannot be used in libc or in
any code which includes the libc internals, because it overrides certain
libc functions with macros. Some effort has been made to make USE_FORT=yes
work correctly for a full-system build by having the bsd.sys.mk logic
disable the feature where it should not be used (libc, libssp iteself,
the kernel) but no attempt has been made to build the entire system with
USE_FORT and doing so will doubtless expose numerous bugs and misfeatures.

Adjust the system build so that all programs and libraries that are setuid,
directly handle network data (including serial comm data), perform
authentication, or appear likely to have (or have a history of having)
data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default,
with the exception of libc, which cannot use USE_FORT and thus uses
only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no
per-directory or in a system build will disable if desired.

use CPPFLAGS.getpwent.c=... to set file-specific cpp flags

Build custom getpwent.o only if USE_YP==no. Otherwise, chpass will not
get the current passwd entry from NIS. Problem reported by Stephen M. Jone
on tech-net.

makefile delint. use NETBSDSRCDIR as appropriate

branches: 1.11.2;
Split the notion of building Hesiod, Kerberos, S/key, and YP
infrastructure and using that infrastructure in programs.

* MKHESIOD, MKKERBEROS, MKSKEY, and MKYP control building
of the infratsructure (libraries, support programs, etc.)

* USE_HESIOD, USE_KERBEROS, USE_SKEY, and USE_YP control
building of support for using the corresponding API
in various libraries/programs that can use it.

As discussed on tech-toolchain.

use CPPFLAGS instead of CFLAGS

branches: 1.9.2;
find "namespace.h" ...

Back out the .PATH.c changes. The .depend problem (and others)
will be fixed using the new .NOPATH make feature instead.

Use .PATH.c: ...

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

merged with 4.4Lite

Patch from Giles Lean to make compilation flags more consistent.

Add RCS indentifiers.

Add YP support.

branches: 1.1.1;
Initial revision

Add capfile(5) to describe the termcap format.
Adjust various man pages and other documentation to point to capfile(5)
instead of termcap(5).
Remove getcap(3) as curses hasn't been building it for a long time.
Punt wrterm.c as tset no longer uses it.

Fix whitespace nits. Suggested by Bug Hunting.

branches: 1.23.40;
PR/29722: Andreas Kling: chpass temporary files in /etc not always unlinked

We had a (long) discussion about this in #NetBSD-code and the consensus was
that /tmp should always be sticky (+t), and as such it is safe to create
the temporary files for chpass(1) in there. We added a check to guarantee
this (and bail out otherwise) and now temporary files are created in /tmp,
not filling up /etc.

Thanks to rivo nurges et al.

Mention pwhash(1) in a few places,
suggested in PR 31125 by Stefan Schumacher.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

Describe class field correctly. Addresses PR 20370 by Pavel Cahyna.

New sentence, new line. Some mdoc cleanup.

Mentions options -l and -y as in passwd.1.
PR misc/14574 from Hiramatsu Yoshifumi.

Sort sections, punctuation fixes, sort SEE ALSO.

Whitespace cleanup.

Xref passwd.conf.

branches: 1.14.10;
Change occurrences of "UNIX" to .Ux or .At as appropriate.

capitalize title of Morris&Thompson paper, use .Ev for EDITOR

macroize BSD, NetBSD, FreeBSD and misc cleanup

add missing .Nm sections.

branches: 1.10.2;
WARNSify, fix .Nm usage, bzero -> memset

alternate -> alternative, per PR 2643

add note about Kerberos to manual page

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

Fix formatting as suggested in PR #1452

Fix formatting; PR #1194

merged with 4.4Lite

Add RCS indentifiers.

Fix various bugs in man pages (from 386BSD patch 130).

branches: 1.1.1;
Initial revision

NULL does not need a cast

static + __dead

Remove the \n and tabs from the __COPYRIGHT() strings.
Tweak to use a consistent format.

branches: 1.32.12;
pw_lock(3): ``You should finish writing to and close the file descriptor
returned by pw_lock() before calling pw_mkdb().'' While there, also
close another open file descriptor that's no longer used.

Patch from Slava Semushin <slava.semushin@gmail.com>, tested by me.

PR/29722: Andreas Kling: chpass temporary files in /etc not always unlinked

We had a (long) discussion about this in #NetBSD-code and the consensus was
that /tmp should always be sticky (+t), and as such it is safe to create
the temporary files for chpass(1) in there. We added a check to guarantee
this (and bail out otherwise) and now temporary files are created in /tmp,
not filling up /etc.

Thanks to rivo nurges et al.

Ensure yflag is initialized before trying to use it.
Detected with gcc -Wuninitialized.

branches: 1.29.2;
Kill __P(), use ANSI function declarations.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

error handling on strdup failure

Make this compiles again when compiled without YP.
From Makoto Fujiwara in private mail.

Don't leave temporary file on abnormal exit (like, interrupted by user).
Minor cosmetic chagnes while I'm here.

Mentions options -l and -y as in passwd.1.
PR misc/14574 from Hiramatsu Yoshifumi.

err/errx/warn/warnx do not need \n at the end

Update for pw_mkdb() change: restrict updates to one user's records and/or
the secure database where appropriate.

progname not used here, so don't extern it

getpwuid() and getpwnam() both support YP maps, insecure and secure.
Remove local ypgetpw{uid,nam} which don't support secure maps.
(Using chpass/chfn with secure maps and these local functions turns off
users by putting * in password entry.)

errx?/warnx? audit. do not pass variable alone, use %s. idea from openbsd

branches: 1.18.2; 1.18.10;
Fix for PR 5507 and 6686, using mostly patch by Rick Byers.

Set close-on-exec on all opened files. Partially from OpenBSD.

Better error message if opening the temp file fails.

KNF

WARNSify, fix .Nm usage, bzero -> memset

initialize variables for gcc -Wall (marked XXX)
compare getopt() result to -1, not EOF

Changes to close PR3807. (Different than in PR.)
-- don't lock passwd until data is collected.
-- save a copy of original pw data for pw_copy checking
-- Try several times to lock passwd

PR 3081: segfault due to reversed test.
Fix from Todd Kover <kovert@omniscient.com>.

Fix a semantic problem reported by Chuck Cranor:

If a user wishes to change a password on a system running YP, and
the master server is not running rpc.yppasswdd, chpass(1) would fail,
even if the user had a local entry. Fix this by checking for local
entry if master is not running rpc.yppasswd iff we defaulted to using
YP (not invoked with "-y").

XXX Unlike the similar change to passwd(1), this one duplicates some
XXX code (makes an attempt to contact rpc.yppasswdd early). This is
XXX a side-effect of the structure of this program. chpass(1) could
XXX use a re-write.

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server. This is required if the passwd database is to stay in sync
if this program is run on the YP server. Note, local passwd database
operations can still be performed by passing the -l flag.

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

Improvements to YP support from Jason Downs.

Remove unnecessary sys/signal.h header

merged with 4.4Lite

branches: 1.4.2;
tabs

Add RCS identifiers.

Add YP support.

branches: 1.1.1;
Initial revision

static + __dead

Kill __P(), use ANSI function declarations.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

fix redundant decls

const poisoning.

Use strftime and strptime.

WARNSify, fix .Nm usage, bzero -> memset

add prototypes for check_yppasswdd() and pw_yp()

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server. This is required if the passwd database is to stay in sync
if this program is run on the YP server. Note, local passwd database
operations can still be performed by passing the -l flag.

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

merged with 4.4Lite

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Fixed memory leak (CID 978341)

OK kamil@

NULL does not need a cast

Fix WARNS=4 (-Wcast-qual -Wsign-compare -Wshadow) issues.

branches: 1.19.30;
appease gcc -Wuninitialized

Kill __P(), use ANSI function declarations.

Add (unsigned char) cast to ctype functions

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

Open the file with O_NOFOLLOW, and only use if it still has one link (from
OpenBSD)

error handling on strdup failure

Don't leave temporary file on abnormal exit (like, interrupted by user).
Minor cosmetic chagnes while I'm here.

const poisoning.

Use strftime and strptime.

fix compile warnings on the alpha.

WARNSify, fix .Nm usage, bzero -> memset

remove dangerous sprintf and strcpy calls.

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server. This is required if the passwd database is to stay in sync
if this program is run on the YP server. Note, local passwd database
operations can still be performed by passing the -l flag.

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

Improvements to YP support from Jason Downs.

merged with 4.4Lite

branches: 1.3.2;
fix bug 417

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Fix WARNS=4 (-Wcast-qual -Wsign-compare -Wshadow) issues.

branches: 1.11.36;
Kill __P(), use ANSI function declarations.

Add (unsigned char) cast to ctype functions

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

Fix warnings found by gcc-current with alpha target:
There's no use assigning the output of strtoul() to a 32-bit variable
then checking that against ULONG_MAX. Instead use a "unsigned long"
as the temporary variable. Also, only check against UID_MAX/GID_MAX;
these are both going to be smaller than ULONG_MAX on both 32- and 64-bit
platforms.

We need to initialize the "save" member in the list for GECOS fields.
If the user deletes a field while editing (as an easy way of making
that field empty) then "save" for that field will not get initialized
before referencing it when constructing the new GECOS field.

const poisoning.

KNF

WARNSify, fix .Nm usage, bzero -> memset

merged with 4.4Lite

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

merged with 4.4Lite

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

merged with 4.4Lite

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

merged with 4.4Lite

branches: 1.1.1;
Initial revision

more stray \n

Fix WARNS=4 (-Wcast-qual -Wsign-compare -Wshadow) issues.

branches: 1.21.36;
Kill __P(), use ANSI function declarations.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

error handling on strdup failure

getpwuid() and getpwnam() both support YP maps, insecure and secure.
Remove local ypgetpw{uid,nam} which don't support secure maps.
(Using chpass/chfn with secure maps and these local functions turns off
users by putting * in password entry.)

More format string cleanup by sommerfeld.

plug warn() call with variable only, just in case - honor behavior of warn(NULL)

branches: 1.15.8;
Spell "privilege" correctly (correct spelling from Jonathan Stone).

branches: 1.14.2;
const poisoning.

KNF

WARNSify, fix .Nm usage, bzero -> memset

include <err.h> and <stdlib.h> for prototypes
give pw_yp() an explicit type

remove use of register.

* free up returned data if yp_master() or yp_match() failed
* simplify two case 'switch'es into 'if' statements

remove dangerous sprintf and strcpy calls.

Fix a semantic problem reported by Chuck Cranor:

If a user wishes to change a password on a system running YP, and
the master server is not running rpc.yppasswdd, chpass(1) would fail,
even if the user had a local entry. Fix this by checking for local
entry if master is not running rpc.yppasswd iff we defaulted to using
YP (not invoked with "-y").

XXX Unlike the similar change to passwd(1), this one duplicates some
XXX code (makes an attempt to contact rpc.yppasswdd early). This is
XXX a side-effect of the structure of this program. chpass(1) could
XXX use a re-write.

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server. This is required if the passwd database is to stay in sync
if this program is run on the YP server. Note, local passwd database
operations can still be performed by passing the -l flag.

merged with 4.4Lite

branches: 1.4.2;
fix same bug as in passwd

knf & small bug fix

Add RCS identifiers.

Add YP support.

Fix WARNS=4 (-Wcast-qual -Wsign-compare -Wshadow) issues.

branches: 1.6.42;
Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

We need to initialize the "save" member in the list for GECOS fields.
If the user deletes a field while editing (as an easy way of making
that field empty) then "save" for that field will not get initialized
before referencing it when constructing the new GECOS field.

WARNSify, fix .Nm usage, bzero -> memset

merged with 4.4Lite

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Kill __P(), use ANSI function declarations.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22365, verified by myself.

const poisoning.

const poisoning.

Use strftime and strptime.

WARNSify, fix .Nm usage, bzero -> memset

make comparison to NULL explicit (gcc -Wall)

remove dangerous sprintf and strcpy calls.

merged with 4.4Lite

get the expire and change dates right if they're after 1/1/2000

Add RCS identifiers.

branches: 1.1.1;
Initial revision