Bug 4357

Summary: bug in adduser script causes duplicate UIDs
Product: Base System Reporter: agonzalez <agonzalez>
Component: binAssignee: Mike Makonnen <mtm>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   

Description agonzalez 1997-08-22 18:30:00 UTC 
While adding a user the other day, I noticed that if somebody else
started another adduser script before I finished adding the current
user, both would get assigned the same UID.  Now, technically, this is
not a bug, since the script asks you which UID you want to use,
however, it would be quite hard to guess if somebody else is adding a
user and what UID they're using.

Fix: 

My suggestion would be to lock the password file from the beginning
of the script and notify the user if it can't get a lock.  That way
there can only be one adduser script running at any given time.

Looking at the script, however, this does not seem like a good idea.
It uses a subroutine called 'append_file' that takes care of the
locking while appending a line to a file.  Personally, I'm going to
do the pw file lock at the beginning, and make a modified append_file
routine specifically for the password file (which will already be
locked).  Hopefully, the author will come up with a 'cleaner'
solution later on :)
How-To-Repeat: Run the adduser script and start answering the questions.  Try adding
a dumb user (test1) and get to the point where it asks for the UID.
When you get there, start an adduser script from another session and
add another dumb user (test2).  When you get to the UID prompt, you
will get the same UID for this user.  If you go through and add the
users, the script will happily add the two users with the same UID.
Comment 1 Wolfram Schneider freebsd_committer freebsd_triage 1997-08-26 17:42:36 UTC 
Responsible Changed
From-To: freebsd-bugs->wosch

Adduser is my area.
Comment 2 Wolfram Schneider freebsd_committer freebsd_triage 2002-01-13 11:55:51 UTC 
Responsible Changed
From-To: wosch->freebsd-bugs

I'm no longer the maintainer of adduser.
Comment 3 Johan Karlsson freebsd_committer freebsd_triage 2003-02-22 14:10:12 UTC 
Responsible Changed
From-To: freebsd-bugs->mtm

Over to adduser.sh author. This report was for the old 
adduser perl script but it is still a problem with 
the new sh script.
Comment 4 Mike Makonnen freebsd_committer freebsd_triage 2003-02-22 22:25:20 UTC 
State Changed
From-To: open->closed

This is no longer a problem. 
The script automatically checks to ensure that any uid it 
is given does not allready exist. Should a conflicting uid 
be created between the time it does the check and when it 
gets around to adding it, the duplicate will be rejected by pw(8).