jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-12-04 03:49:02 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

pwd_mkdb(8): Don't copy comments from /etc/master.passwd to /etc/passwd.

Browse Source 
The intention of /etc/passwd was to support legacy applications that are
not yet converted to use modern API like getpwent(3). Comments are not
defined in the legacy format, so copying them could break these
applications. Plus, it could leak sensitive information (e.g. encrypted
form of password of an user that was commented out instead of deleted
or disabled).

PR:		bin/144652
MFC after:	1 month
This commit is contained in:
Andre Albsmeier 2010-03-11 11:53:47 +01:00 committed by Xin LI
parent 7daf96523b
commit 0deb25bd9d
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
usr.sbin/pwd_mkdb/pwd_mkdb.c
View File

@ -462,11 +462,14 @@ main(int argc, char *argv[])
error("put");
}
}
/* Create original format password file entry */
if (is_comment && makeold){ /* copy comments */
if (fprintf(oldfp, "%s\n", line) < 0)
error("write old");
} else if (makeold) {
/*
* Create original style password file entry.
*
* Don't copy comments since this could reveal encrypted
* passwords if entries have been simply commented out
* in master.passwd.
*/
if (makeold && !is_comment) {
char uidstr[20];
char gidstr[20];