NetBSD PR misc/36063

Index: etc/defaults/security.conf
===================================================================
RCS file: /cvsroot/src/etc/defaults/security.conf,v
retrieving revision 1.23
diff -u -p -r1.23 security.conf
--- etc/defaults/security.conf	5 Feb 2010 16:29:02 -0000	1.23
+++ etc/defaults/security.conf	3 May 2010 16:00:26 -0000
@@ -45,3 +45,4 @@ check_passwd_permit_star=NO
 check_passwd_permit_nonalpha=NO
 max_loginlen=16
 max_grouplen=16
+duplicate_accounts="toor"
Index: etc/security
===================================================================
RCS file: /cvsroot/src/etc/security,v
retrieving revision 1.108
diff -u -p -r1.108 security
--- etc/security	5 Feb 2010 16:29:02 -0000	1.108
+++ etc/security	3 May 2010 16:00:27 -0000
@@ -287,17 +287,26 @@ if checkyesno check_passwd; then
 		column $OUTPUT
 	fi
 
-# To not exclude 'toor', a standard duplicate root account, from the duplicate
-# account test, uncomment the line below (without egrep in it)and comment
-# out the line (with egrep in it) below it.
-#
-#	< $MPBYUID uniq -d -f 1 | awk '{ print $2 }' > $TMP2
-	< $MPBYUID egrep -v '^toor ' | uniq -d -f 1 | awk '{ print $2 }' > $TMP2
+	awk -v "dupaccounts=$duplicate_accounts" \
+	'BEGIN {
+		split(dupaccounts, a, ",");
+		for (i in a) ignore[a[i]]++;
+	}
+	{
+		if ($1 in ignore) next;
+		if ($2 in accounts)
+			dups[$2] = (($2 in dups) ? dups[$2] ", " : "") $1;
+		else
+			accounts[$2] = $1;
+	}
+	END {
+		for (uid in dups)
+			printf "uid %d: %s, %s\n", \
+				uid, accounts[uid], dups[uid];
+	}' < $MPBYUID > $TMP2
 	if [ -s $TMP2 ] ; then
-		printf "\n$MP has duplicate user id's.\n"
-		while read uid; do
-			grep -w $uid $MPBYUID
-		done < $TMP2 | column
+		printf "\n$MP has duplicate user ids.\n"
+		cat $TMP2
 	fi
 fi
 
@@ -514,8 +523,13 @@ if checkyesno check_homes; then
 			printf -- "$uid $file\n"
 		fi
 	done < $MPBYPATH |
-	awk -v "usergroups=$permit_usergroups" '
-	     $1 != $4 && $4 != "root" \
+	awk -v "usergroups=$permit_usergroups" \
+	    -v "dupaccounts=$duplicate_accounts" '
+	     BEGIN {
+		split(dupaccounts, a, ",");
+		for (i in a) ignore[a[i]]++;
+	     }
+	     $1 != $4 && $4 != "root" && !($1 in ignore) \
 		{ print "user " $1 " home directory is owned by " $4 }
 	     $2 ~ /^d....w/ && (!usergroups || $5 != $1) \
 		{ print "user " $1 " home directory is group writable" }
@@ -537,8 +551,13 @@ if checkyesno check_homes; then
 			fi
 		done
 	done < $MPBYPATH |
-	awk  -v "usergroups=$permit_usergroups" '
-	     $1 != $5 && $5 != "root" \
+	awk  -v "usergroups=$permit_usergroups" \
+	     -v "dupaccounts=$duplicate_accounts" '
+	     BEGIN {
+		split(dupaccounts, a, ",");
+		for (i in a) ignore[a[i]]++;
+	     }
+	     $1 != $5 && $5 != "root" && !($1 in ignore) \
 		{ print "user " $1 " " $2 " file is owned by " $5 }
 	     $3 ~ /^-...r/ && (!usergroups || $6 != $1) \
 		{ print "user " $1 " " $2 " file is group readable" }
@@ -566,8 +585,13 @@ if checkyesno check_homes; then
 			fi
 		done
 	done < $MPBYPATH |
-	awk -v "usergroups=$permit_usergroups" '
-	     $1 != $5 && $5 != "root" \
+	awk -v "usergroups=$permit_usergroups" \
+	    -v "dupaccounts=$duplicate_accounts" '
+	     BEGIN {
+		split(dupaccounts, a, ",");
+		for (i in a) ignore[a[i]]++;
+	     }
+	     $1 != $5 && $5 != "root" && !($1 in ignore) \
 		{ print "user " $1 " " $2 " file is owned by " $5 }
 	     $3 ~ /^-....w/ && (!usergroups || $6 != $1) \
 		{ print "user " $1 " " $2 " file is group writable" }
Index: share/man/man5/security.conf.5
===================================================================
RCS file: /cvsroot/src/share/man/man5/security.conf.5,v
retrieving revision 1.37
diff -u -p -r1.37 security.conf.5
--- share/man/man5/security.conf.5	5 Feb 2010 17:23:47 -0000	1.37
+++ share/man/man5/security.conf.5	3 May 2010 16:00:27 -0000
@@ -242,6 +242,15 @@ is enabled, this determines the maximum 
 If
 .Sy check_passwd
 is enabled, this determines the maximum permitted length of login names.
+.It Sy duplicate_accounts
+A comma separated list of user accounts to ignore in the duplicate user
+ID check during the
+.Sy check_passwd
+phase and in the file ownership and permission checks during the
+.Sy check_homes
+phase.
+Defaults to
+.Dq toor .
 .It Sy backup_dir
 Change the backup directory from
 .Pa /var/backup .
