On 2011-04-08, Landry Breuil <[email protected]> wrote:
> On Fri, Apr 08, 2011 at 07:53:51PM +0200, Frank Brodbeck wrote:
>> Hi,
>>
>> lately I was reading on misc@ [1] that there's no way to remove a user
>> from secondary groups but by hand. I also searched for a PR but couldn't
>> find one. The attached diff remedies the problem:
>>
>> # id test
>> uid=1001(test) gid=10(users) groups=10(users), 9(wsrc), 69(network),
>> 117(dialer)
>> # usermod -G wsrc,network test
>> # id test
>> uid=1001(test) gid=10(users) groups=10(users), 9(wsrc), 69(network)
>> # usermod -G wsrc,network,dialer test
>> # id test
>> uid=1001(test) gid=10(users) groups=10(users), 9(wsrc), 69(network),
>> 117(dialer)
>
> Hmm.. please no. Don't know if it's a bug or not, but i'm very used to
> -G to _add_ groups to the existing group list for a user. If i
> understand your diff correctly, one has to list all the groups it wants
> the user to be in, whereas now you just list the groups you want to add.
I don't know if the current behaviour is a bug, but it's not what
I expect from the manpage:
-G secondary-group[,group,...]
Sets the secondary groups the user will be a member of in the
/etc/group file.
"sets", not "adds to".
> So say i just installed a machine, i'm in users+wheel, i want to add
> myself to wsrc, if i do usermod -G wsrc like im used to, that'll remove
> me from users/wheel. Bye bye sudo etc. That happens to me everytime i
> use usermod on linux.
>
> Linux usermod has a '-a' flag to say 'the list after -G is the list of
> group i want to add', but i never remember it, and each time it removes
> the bazillion of default group a user needs to be in (audio, dev, video,
> etc etc)
>
> So please don't change that behaviour. If you want to remove a group for
> a user, you can still edit /etc/group.
Considering the current behaviour of OpenBSD's usermod(8) I agree
it's dangerous to change this now. But it's certainly something
people need to do on occasion (for example some of Samba's features
need this), and usermod(8) is the natural place to implement it.
Having the capability there in some form would discourage scary
things like http://marc.info/?l=openbsd-misc&m=129232689002840
So I would like to see this in usermod, in some way that doesn't
change existing behaviour of -G.
