Skip to content

Commit

Permalink
auth: force sync to work around an possible pw bug
Browse files Browse the repository at this point in the history
  • Loading branch information
fichtner committed Jun 25, 2015
1 parent c63ef62 commit 1b7aec7
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 11 deletions.
22 changes: 11 additions & 11 deletions src/etc/inc/auth.inc
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ function local_sync_accounts()
global $config;

/* remove local users to avoid uid conflicts */
$fd = popen('/usr/sbin/pw usershow -a', 'r');
$fd = popen('/usr/local/sbin/pwsync usershow -a', 'r');
if ($fd) {
while (!feof($fd)) {
$line = explode(':',fgets($fd));
Expand All @@ -343,14 +343,14 @@ function local_sync_accounts()
* can cause issues. Just remove crontab before run it when necessary
*/
@unlink("/var/cron/tabs/{$line[0]}");
mwexecf('/usr/sbin/pw userdel -n %s', $line[0]);
mwexecf('/usr/local/sbin/pwsync userdel -n %s', $line[0]);
}
pclose($fd);
}

/* remove local groups to avoid gid conflicts */
$gids = array();
$fd = popen('/usr/sbin/pw groupshow -a', 'r');
$fd = popen('/usr/local/sbin/pwsync groupshow -a', 'r');
if ($fd) {
while (!feof($fd)) {
$line = explode(':',fgets($fd));
Expand All @@ -363,7 +363,7 @@ function local_sync_accounts()
if ($line[2] > 65000) {
continue;
}
mwexecf('/usr/sbin/pw groupdel %s', $line[2]);
mwexecf('/usr/local/sbin/pwsync groupdel %s', $line[2]);
}
pclose($fd);
}
Expand Down Expand Up @@ -432,7 +432,7 @@ function local_user_set(&$user)
}

/* read from pw db */
$fd = popen("/usr/sbin/pw usershow -n {$user_name} 2>&1", "r");
$fd = popen("/usr/local/sbin/pwsync usershow -n {$user_name} 2>&1", "r");
$pwread = fgets($fd);
pclose($fd);
$userattrs = explode(":", trim($pwread));
Expand All @@ -446,7 +446,7 @@ function local_user_set(&$user)

$comment = str_replace(array(':', '!', '@'), ' ', $user['descr']);
/* add or mod pw db */
$cmd = "/usr/sbin/pw {$user_op} -q -u {$user_uid} -n {$user_name}".
$cmd = "/usr/local/sbin/pwsync {$user_op} -q -u {$user_uid} -n {$user_name}".
" -g {$user_group} -s {$user_shell} -d {$user_home}".
" -c ".escapeshellarg($comment)." -H 0 2>&1";
$fd = popen($cmd, 'w');
Expand All @@ -469,7 +469,7 @@ function local_user_set(&$user)
@unlink("{$user_home}/.ssh/authorized_keys");
}

mwexecf('/usr/sbin/pw %s %s', array($lock_account, $user_name), true);
mwexecf('/usr/local/sbin/pwsync %s %s', array($lock_account, $user_name), true);
}

function local_user_del($user)
Expand All @@ -478,7 +478,7 @@ function local_user_del($user)
local_user_set_groups($user);

/* delete from pw db */
mwexecf('/usr/sbin/pw userdel -n %s -r', $user['name']);
mwexecf('/usr/local/sbin/pwsync userdel -n %s -r', $user['name']);

/* Delete user from groups needs a call to write_config() */
local_group_del_user($user);
Expand Down Expand Up @@ -605,20 +605,20 @@ function local_group_set($group, $reset = false)
$group_members = implode(',', $group['member']);
}

$ret = mwexecf('/usr/sbin/pw groupshow %s', $group_name, true);
$ret = mwexecf('/usr/local/sbin/pwsync groupshow %s', $group_name, true);
if ($ret) {
$group_op = 'groupadd';
} else {
$group_op = 'groupmod';
}

mwexecf('/usr/sbin/pw %s %s -g %s -M %s', array($group_op, $group_name, $group_gid, $group_members));
mwexecf('/usr/local/sbin/pwsync %s %s -g %s -M %s', array($group_op, $group_name, $group_gid, $group_members));
}

function local_group_del($group)
{
/* delete from group db */
mwexecf('/usr/sbin/pw groupdel %s', $group['name']);
mwexecf('/usr/local/sbin/pwsync groupdel %s', $group['name']);
}

function ldap_test_connection($authcfg)
Expand Down
9 changes: 9 additions & 0 deletions src/sbin/pwsync
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#!/bin/sh

pw "${@}"
RET=${?}

# work around a missing fsync()
sync && sync

exit ${RET}

2 comments on commit 1b7aec7

@jschellevis
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably yes.... this is only a workaround for the time being.

@fichtner
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pfSense people are working on it. This is intended as a portable hot fix to be shipped without the need to build new base/kernel sets. Also experimental for now, currently being tested.

Please sign in to comment.