PMUL Safe useradd functionality
One of the things that becomes a big issue for customers, especially when we move to automated build processes, is “how do you allow a user to add/remove users or groups, but NOT allow them to add ‘root-capable’ accounts, or elevate their own access?” As has been well discussed in other forums such as OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html - input validation is very difficult to do properly, especially if all you’re doing is checking “are these options included in the input?” A lot of customers will simply try to grep the options for dangerous flags or mis-uses, but as documented above, this is not safe - a re-implementation of the commandline parsing is typically required for security.For a customer this month, we built a “pbuseradd” function that re-implements the “useradd” com
