passwd

Documentation

Overview

Package passwd reads the account databases out of the image being examined, rather than the host's.

This is the difference between correct and meaningless results for the no_user and no_group artifacts. find(1) answers -nouser by consulting the account database of the machine it runs on, so on a mounted image every file owned by a UID that happens not to exist on the examiner's workstation looks orphaned. UAC's own bodyfile2filelists.sh gets this right by reading the image's passwd file with awk; this does the same.

Index

• type DB
  • func Load(root string) *DB
  • func (d *DB) Known() bool
  • func (d *DB) KnownGroups() bool
  • func (d *DB) KnownUsers() bool

Types

type DB

type DB struct {
	UIDs  map[uint32]bool
	GIDs  map[uint32]bool
	Homes []string // deduplicated, sorted, for %user_home% expansion

	// ShellHomes is the subset belonging to accounts with a login shell, which
	// is what exclude_nologin_users selects.
	ShellHomes []string
}

DB is the account information read from one image.

func Load

func Load(root string) *DB

Load reads <root>/etc/passwd and <root>/etc/group. Missing files are not an error: an image may be partial, and the walk should still run.

func (*DB) Known

func (d *DB) Known() bool

Known reports whether anything at all was read.

func (*DB) KnownGroups

func (d *DB) KnownGroups() bool

func (*DB) KnownUsers

func (d *DB) KnownUsers() bool

KnownUsers and KnownGroups are answered separately.

They come from different files, and either can be missing on its own. Gating both on the passwd file alone means an image with a passwd but no group file marks every file no_group, while one with a group but no passwd disables no_group entirely -- opposite errors from the same conflation.