src/confd: system users, like admin, have no shell by default

Rudimentary support for setting login shell for new users.  Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.

Follow-up to f5866ee

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

package/confd/confd.mk

@@ -11,6 +11,12 @@ CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_DEPENDENCIES = augeas jansson libite sysrepo
 CONFD_AUTORECONF = YES
 
+ifeq ($(BR2_SYSTEM_BIN_SH_BASH),y)
+CONFD_CONF_OPTS += --with-login-shell=/bin/bash
+else
+CONFD_CONF_OPTS += --with-login-shell=/bin/sh
+endif
+
 define CONFD_INSTALL_EXTRA
 	cp $(CONFD_PKGDIR)/sysrepo.conf  $(FINIT_D)/available/
 	ln -sf ../available/sysrepo.conf $(FINIT_D)/enabled/sysrepo.conf

src/confd/configure.ac

@@ -19,6 +19,16 @@ AC_CONFIG_LIBOBJ_DIR(lib)
 AC_REPLACE_FUNCS(vasprintf)
 AC_REPLACE_FUNCS(asprintf)
 
+# Check feature flags
+AC_ARG_WITH(login-shell,
+        AS_HELP_STRING([--with-login-shell=shell], [Login shell for new users, default: /bin/sh]),
+	[login_shell=$withval], [login_shell=yes])
+
+AS_IF([test "x$with_login_shell" != "xno"], [
+	AS_IF([test "x$login_shell" = "xyes"], [login_shell=/bin/sh])
+	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "$login_shell", [Default: /bin/sh])],[
+	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "/bin/sh")])
+
 # Check for pkg-config first, warn if it's not installed
 PKG_PROG_PKG_CONFIG
 

src/confd/src/ietf-system.c

@@ -619,11 +619,12 @@ static int sys_del_user(char *user)
  */
 static int sys_add_new_user(char *name)
 {
+	char *shell = LOGIN_SHELL;
 	char *sargs[] = {
-		"adduser", "-D", "-S", "-G", "wheel", name, NULL
+		"adduser", "-D", "-s", shell, "-S", "-G", "wheel", name, NULL
 	};
 	char *uargs[] = {
-		"adduser", "-D", name, NULL
+		"adduser", "-D", "-s", shell, name, NULL
 	};
 	char **args;
 	int err;
@@ -634,6 +635,9 @@ static int sys_add_new_user(char *name)
 	else
 		args = uargs;	/* user */
 
+	if (!shell || !whichp(shell))
+		args[2] = "/bin/sh";
+
 	/**
 	 * The Busybox implementation of adduser -D sets the password to "!",
 	 * which should prevent the new user from logging in until Augeas has
@@ -694,12 +698,12 @@ static sr_error_t handle_sr_passwd_update(augeas *aug, struct sr_change *change)
 		if (aug_set_dynpath(aug, hash, "etc/shadow/%s/password", user))
 			return SR_ERR_SYS;
 		DEBUG("Password updated for user %s\n", user);
-	break;
+		break;
 	case SR_OP_DELETED:
 		if (aug_set_dynpath(aug, "!", "etc/shadow/%s/password", user))
 			return SR_ERR_SYS;
 		DEBUG("Password deleted for user %s\n", user);
-	break;
+		break;
 	case SR_OP_MOVED:
 		return SR_ERR_OK;
 	}