[jayhemnani9910]

Fixes #368

-r removes the user from the groups listed with -G and keeps the others, in /etc/group and /etc/gshadow. It needs -G and can't be used with -a, as in GNU usermod. The plain -G and -a -G paths now go through the same closure for both files; their behaviour is unchanged.

Tests: test_remove_from_groups fails without the change; a unit test covers the -G requirement and the conflict with -a. Root suite in ubuntu:26.04: 960 passed, 0 failed; clippy and fmt clean. Against GNU usermod 4.17.4: -rG with one or more groups, a group the user is not in, a GID, a missing group, and -l with -rG give the same files and exit codes.

AI tools assisted with this contribution.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

[pierre-warnier]

@jayhemnani9910 thanks for #366, #369 and this one. I checked each against Debian's packaged shadow 4.17.4 and they match: pwck output and exit codes, groupmod -U/-a -U in both files, and usermod -rG including the usage errors and the missing-group exit 6. Together on top of main they pass the full suite.

Before I merge anything more, two things I need from you. They apply to all your open and future PRs here.

1. Clean-room confirmation. This project must contain nothing derived from the upstream shadow-utils source (shadow-maint/shadow), and the same goes for util-linux. See the warning at the top of CONTRIBUTING.md. Your PRs say AI tools assisted, which is fine. But since they did, please state in a comment:

   • what reference material you and your tools used for these changes (man pages, the packaged binaries, our own code…);
   • that neither you nor any tool read, retrieved or was given code from shadow-maint/shadow or util-linux, including through web search or a model's own recall of that code.

   If you can't confirm the second point for a given PR, say which one and I will close it. No hard feelings, but we can't take the risk.

2. Pace. These are setuid-root tools, and I read every line that touches privileges, locking or file writes. Please keep at most three PRs open here at a time.

Once I have the confirmation, I'll merge #366, #369 and #370. Then #350 after its rebase on #359.

[jayhemnani9910]

1. Reference material: the man pages, Ubuntu's packaged shadow 4.17.4 binaries run in a container (output, exit codes, resulting files), and shadow-rs's own code and tests.

   Neither I nor any tool read, retrieved, was given or recalled code from shadow-maint/shadow or util-linux, for any of my PRs here (usermod: add -m/--move-home #350, pwck: stay silent on clean files, say no changes after problems #366, groupmod: set the members in gshadow too with -U #369, usermod: add -r/--remove to leave the groups given with -G #370, groupadd, usermod: reject the reserved ID 4294967295 #372).

2. Understood. I won't open new PRs here. groupadd, usermod: reject the reserved ID 4294967295 #372 is now a draft and can wait until the others are in.

[pierre-warnier]

Thanks, that's exactly what I needed. One gap: the list covers your open PRs only. Can you confirm the same holds for the ones already merged: #339, #341, #344, #345, #349, #355, #356 and #357? Once you do, I'll merge #366, #369 and #370, then #350 after its rebase.

On pace: three open at a time is fine, you don't have to stop. Mark #372 ready when you like.

[jayhemnani9910]

Yes, the same holds for the merged ones (#339, #341, #344, #345, #349, #355, #356, #357): the same reference material, and neither I nor any tool read, retrieved, was given or recalled code from shadow-maint/shadow or util-linux for any of them.

Thanks on the pace. I'll mark #372 ready once these are in.