How to create a linux user using C/C++?

Question

I would like to build a program which takes a username as parameter and creates the user and its home folder (with some hard-coded specifications like folder, and security checks like username cannot be root or an existing user).

My application needs to create users in order to give SSH access.

The program will be executed using sudo. I've read it should be written in C or C++ instead of scripts because scripts could easily be exploited.

Can you give me some advices or good practices about how to achieve this?
Should I use some Pam library? Is there any examples?
What are the possible security flaws?

I know C/C++, and running Ubuntu Lucid.

Edit:

The user will only have sudo access to run that specific command, I do not want it to be able to run a shell or bypass some programs (by changing PATH environment, for example).

As a result, for example, I will need to override the PATH, what else should I worry about?

You mean like adduser or useradd? Try looking at their source code. — Borealid
– Borealid, Commented Aug 10, 2010 at 22:50
Why is a script easier to exploit than an executable? If you have root access you have root access and their is nothing you can't do. Do it the simple way and use a script that uses the normal linux commands (and thus have been completely tested). — Loki Astari
– Loki Astari, Commented Aug 11, 2010 at 0:15
The user will only have sudo access to run that specific command, I do not want it to be able to run a shell or bypass some programs (by changing PATH environment, for example). — Weboide
– Weboide, Commented Aug 11, 2010 at 10:34

MarkR · Accepted Answer · 2010-08-10 22:53:30Z

10

Probably your best bet is to invoke useradd; it will do the right things (given appropriate parameters).

Trying to create one manually by calling the appropriate APIs is possible but not desirable.

answered Aug 10, 2010 at 22:53

MarkR

63.8k15 gold badges120 silver badges156 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Paul Nathan Over a year ago

This sounds much more desirable to me. Putting together a Perl script and then calling useradd is how I would think to solve this problem.

Ken Bloom Over a year ago

There are no "appropriate APIs" in the Linux C library.

stiemannkj1 · Accepted Answer · 2025-04-15 20:17:35Z

9

Actually, there is a C API method to create a Linux user. It is in the pwd.h include file.

Here you have a sample test:

#include <pwd.h>
#include <stdio.h>
#include <string.h>

static void createUser(char *userName, char *homeDir, int uid) {
    struct passwd * pwd = getpwent ();
    struct passwd pwd2;

    pwd =  getpwnam(userName);
    if (pwd != NULL) {
        return;
    }
    pwd2.pw_dir = homeDir;
    pwd2.pw_gecos=userName;
    pwd2.pw_name=userName;
    pwd2.pw_gid=uid;
    pwd2.pw_uid=uid;
    pwd2.pw_shell=strdup("/bin/bash");
    FILE *f = fopen("/etc/passwd", "a");
    if (f != NULL) {
        putpwent(&pwd2, f);
        fclose(f);
    }
    free (pwd2.pw_shell);
}

int main (int argc, char **argv) {
   createUser("test", "/home/test", 12345);
   return 0;
}

edited Apr 15 at 20:17

stiemannkj1

4,5443 gold badges28 silver badges46 bronze badges

answered Oct 17, 2021 at 9:36

Gabriel Buades

1011 silver badge3 bronze badges

2 Comments

Akito Over a year ago

Best answer so far. I could not accept that people were saying, you have to manually write to a file, which will break anytime you make a semantic error. Great job & thanks.

stiemannkj1 Apr 15 at 19:57

putpwent is not POSIX standard, but it is in glibc (not sure of versions) and musl libc (since 1.0.0 at least). So it's pretty broadly available.

Ken Bloom · Accepted Answer · 2010-08-10 22:59:31Z

3

There is no API for this. You just write into /etc/passwd and /etc/group (and possibly the shadow versions as well) using normal file access system calls.

answered Aug 10, 2010 at 22:59

Ken Bloom

59.1k14 gold badges114 silver badges171 bronze badges

2 Comments

Loki Astari Over a year ago

Don't forget that before modifying these values you should always acquire an exclusive lock on the files (all system commands that modify these files do that). Otherwise there is the possibility of file corruption and then you are in really bad shape.

rogerdpack Over a year ago

I think this is the "only way" if your /etc/passwd is blank and so you cannot add users to groups using adduser

Collectives™ on Stack Overflow

How to create a linux user using C/C++?

3 Answers 3

2 Comments

2 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related