Drop Obsolete login.defs Scripts USERADD_CMD, USERDEL_PRECMD, USERDEL_POSTCMD, GROUPADD_CMD

[shundhammer]

Bugzilla

https://bugzilla.suse.com/show_bug.cgi?id=1231006

Trello

https://trello.com/c/YaAqN3hc/

Target Branch

This is for master / Factory only. SLE-15-SPx / Leap 15.x still support those scripts.

Problem

On Factory / Tumbleweed / Slowroll, after using the YaST security module, the useradd / usermod, / userdel commands complain about invalid configuration parameters:

sudo usermod -aG docker poltpolt

configuration error - unknown item 'USERADD_CMD' (notify administrator)
configuration error - unknown item 'USERDEL_PRECMD' (notify administrator)
configuration error - unknown item 'USERDEL_POSTCMD' (notify administrator)

Cause

It turned out that these parameters came from /etc/login.defs.d/70-yast.defs, written by the YaST security module:

USERADD_CMD /usr/sbin/useradd.local
USERDEL_PRECMD /usr/sbin/userdel-pre.local
USERDEL_POSTCMD /usr/sbin/userdel-post.local

Neither are those parameters described in man login.defs, nor are the corresponding commands /usr/sbin/user*.local present on any recent Tumbleweed or Slowroll.

Notice that they are only written to that file if the user uses the YaST security module at least once and writes the new security configuarion to disk; if that module is never started, the parameters are not in that file, only the UMASK 022 line.

Software Archaeology

Investigation on older releases showed that they were part of SUSE-specific extensions of the shadow suite, dating back as far as 2003.

They are still available on SLE-15-SPx or older (until back in 2003), but no longer in Factory: They were dropped with the fix for bsc#1191578, but nobody told the YaST team about that change, so the problem went unnoticed until a community user used those useradd / usermod / userdel commands after using the YaST security module.

Further investigation showed that we also keep mentioning another parameter GROUPADD_CMD that was also SUSE specific, but removed even earlier: See also bug #1121197 comment #14. We never seem to write that one at any place of our code, though; but it is present in sample login.defs files, in tests and in our definition of the file format that we use for parsing.

Upstream Parameter: USERDEL_CMD

Please notice that the USERDEL_CMD parameter is defined upstream by the shadow suite and is still available, unlike those SUSE extensions. See also man login.defs.

Fix

Removed all references to those parameters in yast-security so they are not written to that config file anymore.

Test

Manual test in a Tumbleweed VM

Related PRs

• Drop Obsolete login.defs Scripts USERADD_CMD, USERDEL_PRECMD, USERDEL_POSTCMD, USERADD_CMD yast-yast2#1313
• Drop Obsolete login.defs Scripts USERADD_CMD, USERDEL_PRECMD, USERDEL_POSTCMD, USERADD_CMD yast-autoinstallation#879
• Drop Obsolete login.defs Scripts USERADD_CMD, USERDEL_PRECMD, USERDEL_POSTCMD, USERADD_CMD yast-users#399

Notice that none of those PRs depend on one another; each one works fine by itself.

[joseivanlopez]

LGTM

[github-actions]

✅ Autosubmission job #11140062666 successfully finished
✅ Created submit request #1205093