The branch main has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=cd06bf52053d463f4a3f6c0b9cb5c9f1d578e439
commit cd06bf52053d463f4a3f6c0b9cb5c9f1d578e439 Author: Baptiste Daroussin <[email protected]> AuthorDate: 2026-08-11 09:46:52 +0000 Commit: Baptiste Daroussin <[email protected]> CommitDate: 2026-08-11 11:16:57 +0000 nuageinit: accept lock_passwd for users Alias cloud-init lock_passwd key alongside locked. --- libexec/nuageinit/nuage.lua | 2 +- libexec/nuageinit/nuageinit.7 | 5 ++++- libexec/nuageinit/tests/nuageinit.sh | 30 ++++++++++++++++++++++++++++++ 3 files changed, 35 insertions(+), 2 deletions(-) diff --git a/libexec/nuageinit/nuage.lua b/libexec/nuageinit/nuage.lua index 3a9ac253fbcb..738c6dabf140 100644 --- a/libexec/nuageinit/nuage.lua +++ b/libexec/nuageinit/nuage.lua @@ -388,7 +388,7 @@ local function adduser(pwd) warnmsg(cmd) return nil end - if pwd.locked then + if pwd.lock_passwd or pwd.locked then cmd = "pw " if root then cmd = cmd .. "-R " .. root .. " " diff --git a/libexec/nuageinit/nuageinit.7 b/libexec/nuageinit/nuageinit.7 index c9c9096eee72..7e6c9154f799 100644 --- a/libexec/nuageinit/nuageinit.7 +++ b/libexec/nuageinit/nuageinit.7 @@ -555,8 +555,11 @@ The encrypted password for the user. .It Ic plain_text_passwd The password in plain text for the user. Ignored if an encrypted password is already provided. -.It Ic locked +.It Ic lock_passwd Boolean to determine if the user account should be locked. +The legacy +.Ic locked +key is also accepted. .It Ic sudo A string or an array of strings which should be appended to .Pa ${LOCALBASE}/etc/sudoers.d/90-nuageinit-users diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh index a4b0def48a86..4803ddf941ab 100644 --- a/libexec/nuageinit/tests/nuageinit.sh +++ b/libexec/nuageinit/tests/nuageinit.sh @@ -181,6 +181,35 @@ EOF atf_check -o inline:"permit persist foobar as root\ndeny bla as foobar\npermit persist bla as root cmd whoami\n" cat "${PWD}/${localbase}/etc/doas.conf" } +nocloud_userdata_cloudconfig_users_lock_passwd_head() +{ + atf_set "require.user" root +} +nocloud_userdata_cloudconfig_users_lock_passwd_body() +{ + mkdir -p media/nuageinit + printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data + mkdir -p etc + cat > etc/master.passwd << EOF +root:*:0:0::0:0:Charlie &:/root:/bin/sh +sys:*:1:0::0:0:Sys:/home/sys:/bin/sh +EOF + pwd_mkdb -d etc "${PWD}"/etc/master.passwd + cat > etc/group << EOF +wheel:*:0:root +users:*:1: +EOF + cat > media/nuageinit/user-data << 'EOF' +#cloud-config +users: + - name: lockeduser + lock_passwd: true +EOF + atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud + atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit postnet + atf_check -o match:'lockeduser:\*LOCKED\*:' cat "${PWD}"/etc/master.passwd +} + nocloud_network_head() { atf_set "require.user" root @@ -1474,6 +1503,7 @@ atf_init_test_cases() atf_add_test_case nocloud_userdata_script atf_add_test_case nocloud_user_data_script atf_add_test_case nocloud_userdata_cloudconfig_users + atf_add_test_case nocloud_userdata_cloudconfig_users_lock_passwd atf_add_test_case nocloud_network atf_add_test_case config2 atf_add_test_case config2_pubkeys
