Bug 10062

In Krogoth when calling "useradd -p '<encrypted_password>' ..." in EXTRA_USERS_PARAMS, it is now necessary to escape dollar signs in <encrypted password> with three prepending backslashes, whereas before Krogoth just one prepending backslash was sufficient to avoid unintended expansion.

I would suspect this change in behaviour was introduced in commit 57a525ca7271a8fe3913c61aa87cb0ba1674b4b2 - later commit 9fe3d01f27445652c3020413d66a5cdeb3c3259c apparently addresses the problem wrt. usermod call, but not useradd.

As a possible fix, I removed (locally) the "apostrophe-to-double-quote-conversion" operation from useradd (and groupadd also, for good measure) - which seemed like a safe thing to do after the change introduced in commit 9fe3d01f27445652c3020413d66a5cdeb3c3259c. The change is below:

--- a/meta/classes/useradd_base.bbclass
+++ b/meta/classes/useradd_base.bbclass
@@ -17,7 +17,6 @@ perform_groupadd () {
        local groupname=`echo "$opts" | awk '{ print $NF }'`
        local group_exists="`grep "^$groupname:" $rootdir/etc/group || true`"
        if test "x$group_exists" = "x"; then
-               opts=`echo $opts | sed s/\'/\"/g`
                eval flock -x $rootdir${sysconfdir} -c \"$PSEUDO groupadd \$opts\" || true
                group_exists="`grep "^$groupname:" $rootdir/etc/group || true`"
                if test "x$group_exists" = "x"; then
@@ -35,7 +34,6 @@ perform_useradd () {
        local username=`echo "$opts" | awk '{ print $NF }'`
        local user_exists="`grep "^$username:" $rootdir/etc/passwd || true`"
        if test "x$user_exists" = "x"; then
-               opts=`echo $opts | sed s/\'/\"/g`
                eval flock -x $rootdir${sysconfdir} -c  \"$PSEUDO useradd \$opts\" || true
                user_exists="`grep "^$username:" $rootdir/etc/passwd || true`"
                if test "x$user_exists" = "x"; then


As an example of this issue, the following entry in EXTRA_USERS_PARAMS:
"groupadd voter; useradd -p '\$6\$ASFORME\$IDONTTHINKTHAT.VOTING/IS/STUPID/' -g voter -G users voter;"
without the above change translates to following line in /etc/shadow:
"voter:.VOTING/IS/STUPID/:17015:0:99999:7:::"
Thus logging in as user 'voter' will not work against the provided (encrypted) password on the target system.

With the above "possible fix" change included, the associated resulting line in /etc/shadow is now:
"voter:$6$ASFORME$IDONTTHINKTHAT.VOTING/IS/STUPID/:17015:0:99999:7:::"
which would seem to revert the adduser dollar sign escaping behaviour to pre-Krogoth -style.