The Linux Programming Interface
Users And Groups
（01）用户和组
Every user has a unique login name and an associated numeric user identifier (UID). Users can belong to one or more groups. Each group also has a unique name and a group identifier(GID).
(02) /etc/passwd文件
放有用户名，登录ID等信息。
（03） 密码文件 /etc/shadow
The shadow password file, /etc/shadow, was devised as a method of preventing such attacks.
(04) /etc/group
组函数文件夹
（05）获取用户和组信息
#include <pwd.h>
struct passwd *getpwnam(const char *name);
struct passwd *getpwuid(uid_t uid);
Given a login name in name, the getpwnam() function returns a pointer to a structure of the following type, containing the corresponding information from the password record:
struct passwd { char *pw_name; /* Login name (username) */ char *pw_passwd; /* Encrypted password */ uid_t pw_uid; /* User ID */ gid_t pw_gid; /* Group ID */ char *pw_gecos; /* Comment (user information) */ char *pw_dir; /* Initial working (home) directory */ char *pw_shell; /* Login shell */ };(06) getpwnam, getpwuid, getgrnam, getgrgid举例
通过uid 得到name, 通过name 得到uid，还有组。
#include <pwd.h> #include <grp.h> #include <ctype.h> #include "ugid_functions.h" /* Declares functions defined here */ /* Return name corresponding to 'uid', or NULL on error */ char * userNameFromId(uid_t uid) { struct passwd *pwd; pwd = getpwuid(uid); return (pwd == NULL) ? NULL : pwd->pw_name; } /* Return UID corresponding to 'name', or -1 on error */ uid_t userIdFromName(const char *name) { struct passwd *pwd; uid_t u; char *endptr; if (name == NULL || *name == '\0') return -1; u = strtol(name, &endptr, 10) if (*endptr == '\0') return u; pwd = getpwnam(name); if (pwd == NULL) return -1; return pwd->pw_uid; } /* Return name corresponding to 'gid', or NULL on error */ char *groupNameFromId(git_t gid) { struct group *grp; grp = getgrpid(gid); return (grp == NULL) ? NULL : grp->gr_name; } /* Return GID corresponding to 'name', or -1 on error */ gid_t groupIdFromName(const char *name) { struct group *grp; gid_t g; char *endptr; if (name == NULL || *name == '\0') return -1; g = strtol(name, &endptr, 10) if (*endptr == '\0') return g; grp = getgrnam(name); if (grp == NULL) return -1; return grp->gr_gid; }（07）得到所有的信息
#include <pwd.h> #include <stdio.h> int main() { struct passwd *pwd; while ((pwd = getpwent()) != NULL) printf("%-8s %5ld\n", pwd->pw_name, (long) pwd->pw_uid); return 0; } 输出：wang@wang:~/Documents/tlpi-dist/users_groups$ ./getall root 0 daemon 1 bin 2 sys 3 sync 4 games 5 man 6 lp 7 mail 8 news 9 uucp 10 proxy 13 www-data 33 backup 34 list 38 irc 39 gnats 41 nobody 65534 systemd-timesync 100 systemd-network 101 systemd-resolve 102 systemd-bus-proxy 103 syslog 104 _apt 105 messagebus 106 uuidd 107 lightdm 108 whoopsie 109 avahi-autoipd 110 avahi 111 dnsmasq 112 colord 113 speech-dispatcher 114 hplip 115 kernoops 116 pulse 117 rtkit 118 saned 119 usbmux 120 wang 1000 （08） 组
The getgrent(), setgrent(), and endgrent() functions perform analogous tasks fro the group file.
（09）验证登录，结果是没有权限。
#define _BSD_SOURCE /* Get getpass() declaration from <unisstd.h> */ #include <limits.h> #include <pwd.h> #include <shadow.h> #include "tlpi_hdr.h" #define _XOPEN_SOURCE /* See feature_test_macros(7) */ #include <unistd.h> int main(int argc, char *argv[]) { char *username, *password, *encrypted, *p; struct passwd *pwd; struct spwd *spwd; Boolean authOk; size_t len; long lnmax; lnmax = sysconf(_SC_LOGIN_NAME_MAX); if (lnmax == -1) lnmax = 256; username = malloc(lnmax); if (username == NULL) errExit("malloc"); printf("Username: "); fflush(stdout); if (fgets(username, lnmax, stdin) == NULL) exit(EXIT_FAILURE); len = strlen(username); if (username[len - 1] == '\n') username[len - 1] = '\0'; pwd = getpwnam(username); if (pwd == NULL) fatal("couldn't get password record"); spwd = getspnam(username); if (pwd == NULL) fatal("couldn't get password record"); spwd = getspnam(username); if (spwd == NULL && errno == EACCES) fatal("no permission to read shadow password file"); /* If there is a shadow password record, use the shadow password */ if (spwd != NULL) pwd->pw_passwd = spwd->sp_pwdp; password = getpass("Password: "); /* Encrypt password and erase cleartext version immediately */ encrypted = crypt(password, pwd->pw_passwd); for (p = password; *p != '\0';) *p++ = '\0'; if (encrypted == NULL) errExit("crypt"); authOk = strcmp(encrypted, pwd->pw_passwd) == 0; if (!authOk) { printf("Incorrect password\n"); exit(EXIT_FAILURE); } printf("Successfully authenticated: UID=%ld\n", (long) pwd->pw_uid); /* Now do authenticated work ... */ exit(EXIT_SUCCESS); } 有些悲催的输出：wang@wang:~/Documents/tlpi-dist/lib$ ./check_password Username: wang ERROR: no permission to read shadow password file
（10）总结
Each user has a unique login name and an associated numeric user ID. Users can belong to one or more groups, each of which also has a unique name and an associated numeric numeric identifier. The primary purpose of these identifiers is to establish ownership of various system resources (e.g., files) and permissions for accessing them.
A user's name and ID are defined in the /etc/passwd file, which also contains others information about the user. A user's group membership are defined by fields in the /etc/passwd/ and /etc/group files. A furher file, /etc/shadow, which can be read only by privileged processes, is used to separate the sensitive password information from the publicly available user information in /etc/passwd. Various library functions are provided for retrieving information from each of these files.
The crypt() function encrypts a passwd in the same manner as the standard login program, which is useful for program that need to authenticate users.
(11)习题
