Merge pull request #8368 from yuwata/nss-systemd-getpwent
nss-systemd: make dynamic users enumerable by `getent`
This commit is contained in:
commit
0ba6791f46
3
TODO
3
TODO
|
@ -27,9 +27,6 @@ Features:
|
||||||
* add proper dbus APIs for the various sd_notify() commands, such as MAINPID=1
|
* add proper dbus APIs for the various sd_notify() commands, such as MAINPID=1
|
||||||
and so on, which would mean we could report errors and such.
|
and so on, which would mean we could report errors and such.
|
||||||
|
|
||||||
* nss-systemd: implement enumeration, that shows all dynamic users plus the
|
|
||||||
synthesized ones if necessary, so that "getent passwd" shows useful data.
|
|
||||||
|
|
||||||
* teach tmpfiles.d q/Q logic something sensible in the context of XFS/ext4
|
* teach tmpfiles.d q/Q logic something sensible in the context of XFS/ext4
|
||||||
project quota
|
project quota
|
||||||
|
|
||||||
|
|
|
@ -1798,6 +1798,50 @@ static int method_lookup_dynamic_user_by_uid(sd_bus_message *message, void *user
|
||||||
return sd_bus_reply_method_return(message, "s", name);
|
return sd_bus_reply_method_return(message, "s", name);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int method_get_dynamic_users(sd_bus_message *message, void *userdata, sd_bus_error *error) {
|
||||||
|
_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
|
||||||
|
Manager *m = userdata;
|
||||||
|
DynamicUser *d;
|
||||||
|
Iterator i;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
assert(message);
|
||||||
|
assert(m);
|
||||||
|
|
||||||
|
assert_cc(sizeof(uid_t) == sizeof(uint32_t));
|
||||||
|
|
||||||
|
if (!MANAGER_IS_SYSTEM(m))
|
||||||
|
return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Dynamic users are only supported in the system instance.");
|
||||||
|
|
||||||
|
r = sd_bus_message_new_method_return(message, &reply);
|
||||||
|
if (r < 0)
|
||||||
|
return r;
|
||||||
|
|
||||||
|
r = sd_bus_message_open_container(reply, 'a', "(us)");
|
||||||
|
if (r < 0)
|
||||||
|
return r;
|
||||||
|
|
||||||
|
HASHMAP_FOREACH(d, m->dynamic_users, i) {
|
||||||
|
uid_t uid;
|
||||||
|
|
||||||
|
r = dynamic_user_current(d, &uid);
|
||||||
|
if (r == -EAGAIN) /* not realized yet? */
|
||||||
|
continue;
|
||||||
|
if (r < 0)
|
||||||
|
return sd_bus_error_setf(error, SD_BUS_ERROR_FAILED, "Failed to lookup a dynamic user.");
|
||||||
|
|
||||||
|
r = sd_bus_message_append(reply, "(us)", uid, d->name);
|
||||||
|
if (r < 0)
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = sd_bus_message_close_container(reply);
|
||||||
|
if (r < 0)
|
||||||
|
return r;
|
||||||
|
|
||||||
|
return sd_bus_send(NULL, reply, NULL);
|
||||||
|
}
|
||||||
|
|
||||||
static int list_unit_files_by_patterns(sd_bus_message *message, void *userdata, sd_bus_error *error, char **states, char **patterns) {
|
static int list_unit_files_by_patterns(sd_bus_message *message, void *userdata, sd_bus_error *error, char **states, char **patterns) {
|
||||||
_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
|
_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
|
||||||
Manager *m = userdata;
|
Manager *m = userdata;
|
||||||
|
@ -2572,6 +2616,7 @@ const sd_bus_vtable bus_manager_vtable[] = {
|
||||||
SD_BUS_METHOD("SetExitCode", "y", NULL, method_set_exit_code, SD_BUS_VTABLE_UNPRIVILEGED),
|
SD_BUS_METHOD("SetExitCode", "y", NULL, method_set_exit_code, SD_BUS_VTABLE_UNPRIVILEGED),
|
||||||
SD_BUS_METHOD("LookupDynamicUserByName", "s", "u", method_lookup_dynamic_user_by_name, SD_BUS_VTABLE_UNPRIVILEGED),
|
SD_BUS_METHOD("LookupDynamicUserByName", "s", "u", method_lookup_dynamic_user_by_name, SD_BUS_VTABLE_UNPRIVILEGED),
|
||||||
SD_BUS_METHOD("LookupDynamicUserByUID", "u", "s", method_lookup_dynamic_user_by_uid, SD_BUS_VTABLE_UNPRIVILEGED),
|
SD_BUS_METHOD("LookupDynamicUserByUID", "u", "s", method_lookup_dynamic_user_by_uid, SD_BUS_VTABLE_UNPRIVILEGED),
|
||||||
|
SD_BUS_METHOD("GetDynamicUsers", NULL, "a(us)", method_get_dynamic_users, SD_BUS_VTABLE_UNPRIVILEGED),
|
||||||
|
|
||||||
SD_BUS_SIGNAL("UnitNew", "so", 0),
|
SD_BUS_SIGNAL("UnitNew", "so", 0),
|
||||||
SD_BUS_SIGNAL("UnitRemoved", "so", 0),
|
SD_BUS_SIGNAL("UnitRemoved", "so", 0),
|
||||||
|
|
|
@ -563,7 +563,7 @@ static int dynamic_user_realize(
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int dynamic_user_current(DynamicUser *d, uid_t *ret) {
|
int dynamic_user_current(DynamicUser *d, uid_t *ret) {
|
||||||
_cleanup_(unlockfp) int storage_socket0_lock = -1;
|
_cleanup_(unlockfp) int storage_socket0_lock = -1;
|
||||||
_cleanup_close_ int lock_fd = -1;
|
_cleanup_close_ int lock_fd = -1;
|
||||||
uid_t uid;
|
uid_t uid;
|
||||||
|
|
|
@ -48,6 +48,7 @@ int dynamic_user_serialize(Manager *m, FILE *f, FDSet *fds);
|
||||||
void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds);
|
void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds);
|
||||||
void dynamic_user_vacuum(Manager *m, bool close_user);
|
void dynamic_user_vacuum(Manager *m, bool close_user);
|
||||||
|
|
||||||
|
int dynamic_user_current(DynamicUser *d, uid_t *ret);
|
||||||
int dynamic_user_lookup_uid(Manager *m, uid_t uid, char **ret);
|
int dynamic_user_lookup_uid(Manager *m, uid_t uid, char **ret);
|
||||||
int dynamic_user_lookup_name(Manager *m, const char *name, uid_t *ret);
|
int dynamic_user_lookup_name(Manager *m, const char *name, uid_t *ret);
|
||||||
|
|
||||||
|
|
|
@ -140,6 +140,10 @@
|
||||||
send_interface="org.freedesktop.systemd1.Manager"
|
send_interface="org.freedesktop.systemd1.Manager"
|
||||||
send_member="LookupDynamicUserByUID"/>
|
send_member="LookupDynamicUserByUID"/>
|
||||||
|
|
||||||
|
<allow send_destination="org.freedesktop.systemd1"
|
||||||
|
send_interface="org.freedesktop.systemd1.Manager"
|
||||||
|
send_member="GetDynamicUsers"/>
|
||||||
|
|
||||||
<!-- Completely open to anyone: org.freedesktop.systemd1.Unit interface -->
|
<!-- Completely open to anyone: org.freedesktop.systemd1.Unit interface -->
|
||||||
|
|
||||||
<allow send_destination="org.freedesktop.systemd1"
|
<allow send_destination="org.freedesktop.systemd1"
|
||||||
|
|
|
@ -19,13 +19,17 @@
|
||||||
***/
|
***/
|
||||||
|
|
||||||
#include <nss.h>
|
#include <nss.h>
|
||||||
|
#include <pthread.h>
|
||||||
|
|
||||||
#include "sd-bus.h"
|
#include "sd-bus.h"
|
||||||
|
|
||||||
#include "alloc-util.h"
|
#include "alloc-util.h"
|
||||||
#include "bus-common-errors.h"
|
#include "bus-common-errors.h"
|
||||||
|
#include "dirent-util.h"
|
||||||
#include "env-util.h"
|
#include "env-util.h"
|
||||||
|
#include "fd-util.h"
|
||||||
#include "fs-util.h"
|
#include "fs-util.h"
|
||||||
|
#include "list.h"
|
||||||
#include "macro.h"
|
#include "macro.h"
|
||||||
#include "nss-util.h"
|
#include "nss-util.h"
|
||||||
#include "signal-util.h"
|
#include "signal-util.h"
|
||||||
|
@ -34,6 +38,11 @@
|
||||||
#include "user-util.h"
|
#include "user-util.h"
|
||||||
#include "util.h"
|
#include "util.h"
|
||||||
|
|
||||||
|
#define DYNAMIC_USER_GECOS "Dynamic User"
|
||||||
|
#define DYNAMIC_USER_PASSWD "*" /* locked */
|
||||||
|
#define DYNAMIC_USER_DIR "/"
|
||||||
|
#define DYNAMIC_USER_SHELL "/sbin/nologin"
|
||||||
|
|
||||||
static const struct passwd root_passwd = {
|
static const struct passwd root_passwd = {
|
||||||
.pw_name = (char*) "root",
|
.pw_name = (char*) "root",
|
||||||
.pw_passwd = (char*) "x", /* see shadow file */
|
.pw_passwd = (char*) "x", /* see shadow file */
|
||||||
|
@ -68,8 +77,40 @@ static const struct group nobody_group = {
|
||||||
.gr_mem = (char*[]) { NULL },
|
.gr_mem = (char*[]) { NULL },
|
||||||
};
|
};
|
||||||
|
|
||||||
|
typedef struct UserEntry UserEntry;
|
||||||
|
typedef struct GetentData GetentData;
|
||||||
|
|
||||||
|
struct UserEntry {
|
||||||
|
uid_t id;
|
||||||
|
char *name;
|
||||||
|
|
||||||
|
GetentData *data;
|
||||||
|
LIST_FIELDS(UserEntry, entries);
|
||||||
|
};
|
||||||
|
|
||||||
|
struct GetentData {
|
||||||
|
/* As explained in NOTES section of getpwent_r(3) as 'getpwent_r() is not really
|
||||||
|
* reentrant since it shares the reading position in the stream with all other threads',
|
||||||
|
* we need to protect the data in UserEntry from multithreaded programs which may call
|
||||||
|
* setpwent(), getpwent_r(), or endpwent() simultaneously. So, each function locks the
|
||||||
|
* data by using the mutex below. */
|
||||||
|
pthread_mutex_t mutex;
|
||||||
|
|
||||||
|
UserEntry *position;
|
||||||
|
LIST_HEAD(UserEntry, entries);
|
||||||
|
};
|
||||||
|
|
||||||
|
static GetentData getpwent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL };
|
||||||
|
static GetentData getgrent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL };
|
||||||
|
|
||||||
NSS_GETPW_PROTOTYPES(systemd);
|
NSS_GETPW_PROTOTYPES(systemd);
|
||||||
NSS_GETGR_PROTOTYPES(systemd);
|
NSS_GETGR_PROTOTYPES(systemd);
|
||||||
|
enum nss_status _nss_systemd_endpwent(void) _public_;
|
||||||
|
enum nss_status _nss_systemd_setpwent(int stayopen) _public_;
|
||||||
|
enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) _public_;
|
||||||
|
enum nss_status _nss_systemd_endgrent(void) _public_;
|
||||||
|
enum nss_status _nss_systemd_setgrent(int stayopen) _public_;
|
||||||
|
enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) _public_;
|
||||||
|
|
||||||
static int direct_lookup_name(const char *name, uid_t *ret) {
|
static int direct_lookup_name(const char *name, uid_t *ret) {
|
||||||
_cleanup_free_ char *s = NULL;
|
_cleanup_free_ char *s = NULL;
|
||||||
|
@ -115,6 +156,9 @@ enum nss_status _nss_systemd_getpwnam_r(
|
||||||
char *buffer, size_t buflen,
|
char *buffer, size_t buflen,
|
||||||
int *errnop) {
|
int *errnop) {
|
||||||
|
|
||||||
|
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
||||||
|
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
||||||
|
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
||||||
uint32_t translated;
|
uint32_t translated;
|
||||||
size_t l;
|
size_t l;
|
||||||
int bypass, r;
|
int bypass, r;
|
||||||
|
@ -150,16 +194,18 @@ enum nss_status _nss_systemd_getpwnam_r(
|
||||||
|
|
||||||
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||||
if (bypass <= 0) {
|
if (bypass <= 0) {
|
||||||
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
|
||||||
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
|
||||||
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
|
||||||
|
|
||||||
r = sd_bus_open_system(&bus);
|
r = sd_bus_open_system(&bus);
|
||||||
if (r < 0) {
|
if (r < 0)
|
||||||
bypass = 1;
|
bypass = 1;
|
||||||
goto direct_lookup;
|
}
|
||||||
}
|
|
||||||
|
|
||||||
|
if (bypass > 0) {
|
||||||
|
r = direct_lookup_name(name, (uid_t*) &translated);
|
||||||
|
if (r == -ENOENT)
|
||||||
|
goto not_found;
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
} else {
|
||||||
r = sd_bus_call_method(bus,
|
r = sd_bus_call_method(bus,
|
||||||
"org.freedesktop.systemd1",
|
"org.freedesktop.systemd1",
|
||||||
"/org/freedesktop/systemd1",
|
"/org/freedesktop/systemd1",
|
||||||
|
@ -181,16 +227,6 @@ enum nss_status _nss_systemd_getpwnam_r(
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
|
|
||||||
direct_lookup:
|
|
||||||
if (bypass > 0) {
|
|
||||||
/* Access the dynamic UID allocation directly if we are called from dbus-daemon, see above. */
|
|
||||||
r = direct_lookup_name(name, (uid_t*) &translated);
|
|
||||||
if (r == -ENOENT)
|
|
||||||
goto not_found;
|
|
||||||
if (r < 0)
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
l = strlen(name);
|
l = strlen(name);
|
||||||
if (buflen < l+1) {
|
if (buflen < l+1) {
|
||||||
*errnop = ERANGE;
|
*errnop = ERANGE;
|
||||||
|
@ -202,10 +238,10 @@ direct_lookup:
|
||||||
pwd->pw_name = buffer;
|
pwd->pw_name = buffer;
|
||||||
pwd->pw_uid = (uid_t) translated;
|
pwd->pw_uid = (uid_t) translated;
|
||||||
pwd->pw_gid = (uid_t) translated;
|
pwd->pw_gid = (uid_t) translated;
|
||||||
pwd->pw_gecos = (char*) "Dynamic User";
|
pwd->pw_gecos = (char*) DYNAMIC_USER_GECOS;
|
||||||
pwd->pw_passwd = (char*) "*"; /* locked */
|
pwd->pw_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
pwd->pw_dir = (char*) "/";
|
pwd->pw_dir = (char*) DYNAMIC_USER_DIR;
|
||||||
pwd->pw_shell = (char*) "/sbin/nologin";
|
pwd->pw_shell = (char*) DYNAMIC_USER_SHELL;
|
||||||
|
|
||||||
*errnop = 0;
|
*errnop = 0;
|
||||||
return NSS_STATUS_SUCCESS;
|
return NSS_STATUS_SUCCESS;
|
||||||
|
@ -262,11 +298,20 @@ enum nss_status _nss_systemd_getpwuid_r(
|
||||||
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||||
if (bypass <= 0) {
|
if (bypass <= 0) {
|
||||||
r = sd_bus_open_system(&bus);
|
r = sd_bus_open_system(&bus);
|
||||||
if (r < 0) {
|
if (r < 0)
|
||||||
bypass = 1;
|
bypass = 1;
|
||||||
goto direct_lookup;
|
}
|
||||||
}
|
|
||||||
|
|
||||||
|
if (bypass > 0) {
|
||||||
|
r = direct_lookup_uid(uid, &direct);
|
||||||
|
if (r == -ENOENT)
|
||||||
|
goto not_found;
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
translated = direct;
|
||||||
|
|
||||||
|
} else {
|
||||||
r = sd_bus_call_method(bus,
|
r = sd_bus_call_method(bus,
|
||||||
"org.freedesktop.systemd1",
|
"org.freedesktop.systemd1",
|
||||||
"/org/freedesktop/systemd1",
|
"/org/freedesktop/systemd1",
|
||||||
|
@ -288,18 +333,6 @@ enum nss_status _nss_systemd_getpwuid_r(
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
|
|
||||||
direct_lookup:
|
|
||||||
if (bypass > 0) {
|
|
||||||
r = direct_lookup_uid(uid, &direct);
|
|
||||||
if (r == -ENOENT)
|
|
||||||
goto not_found;
|
|
||||||
if (r < 0)
|
|
||||||
goto fail;
|
|
||||||
|
|
||||||
translated = direct;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
l = strlen(translated) + 1;
|
l = strlen(translated) + 1;
|
||||||
if (buflen < l) {
|
if (buflen < l) {
|
||||||
*errnop = ERANGE;
|
*errnop = ERANGE;
|
||||||
|
@ -311,10 +344,10 @@ direct_lookup:
|
||||||
pwd->pw_name = buffer;
|
pwd->pw_name = buffer;
|
||||||
pwd->pw_uid = uid;
|
pwd->pw_uid = uid;
|
||||||
pwd->pw_gid = uid;
|
pwd->pw_gid = uid;
|
||||||
pwd->pw_gecos = (char*) "Dynamic User";
|
pwd->pw_gecos = (char*) DYNAMIC_USER_GECOS;
|
||||||
pwd->pw_passwd = (char*) "*"; /* locked */
|
pwd->pw_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
pwd->pw_dir = (char*) "/";
|
pwd->pw_dir = (char*) DYNAMIC_USER_DIR;
|
||||||
pwd->pw_shell = (char*) "/sbin/nologin";
|
pwd->pw_shell = (char*) DYNAMIC_USER_SHELL;
|
||||||
|
|
||||||
*errnop = 0;
|
*errnop = 0;
|
||||||
return NSS_STATUS_SUCCESS;
|
return NSS_STATUS_SUCCESS;
|
||||||
|
@ -336,6 +369,9 @@ enum nss_status _nss_systemd_getgrnam_r(
|
||||||
char *buffer, size_t buflen,
|
char *buffer, size_t buflen,
|
||||||
int *errnop) {
|
int *errnop) {
|
||||||
|
|
||||||
|
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
||||||
|
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
||||||
|
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
||||||
uint32_t translated;
|
uint32_t translated;
|
||||||
size_t l;
|
size_t l;
|
||||||
int bypass, r;
|
int bypass, r;
|
||||||
|
@ -368,16 +404,18 @@ enum nss_status _nss_systemd_getgrnam_r(
|
||||||
|
|
||||||
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||||
if (bypass <= 0) {
|
if (bypass <= 0) {
|
||||||
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
|
||||||
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
|
||||||
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
|
||||||
|
|
||||||
r = sd_bus_open_system(&bus);
|
r = sd_bus_open_system(&bus);
|
||||||
if (r < 0) {
|
if (r < 0)
|
||||||
bypass = 1;
|
bypass = 1;
|
||||||
goto direct_lookup;
|
}
|
||||||
}
|
|
||||||
|
|
||||||
|
if (bypass > 0) {
|
||||||
|
r = direct_lookup_name(name, (uid_t*) &translated);
|
||||||
|
if (r == -ENOENT)
|
||||||
|
goto not_found;
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
} else {
|
||||||
r = sd_bus_call_method(bus,
|
r = sd_bus_call_method(bus,
|
||||||
"org.freedesktop.systemd1",
|
"org.freedesktop.systemd1",
|
||||||
"/org/freedesktop/systemd1",
|
"/org/freedesktop/systemd1",
|
||||||
|
@ -399,16 +437,6 @@ enum nss_status _nss_systemd_getgrnam_r(
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
|
|
||||||
direct_lookup:
|
|
||||||
if (bypass > 0) {
|
|
||||||
/* Access the dynamic GID allocation directly if we are called from dbus-daemon, see above. */
|
|
||||||
r = direct_lookup_name(name, (uid_t*) &translated);
|
|
||||||
if (r == -ENOENT)
|
|
||||||
goto not_found;
|
|
||||||
if (r < 0)
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
l = sizeof(char*) + strlen(name) + 1;
|
l = sizeof(char*) + strlen(name) + 1;
|
||||||
if (buflen < l) {
|
if (buflen < l) {
|
||||||
*errnop = ERANGE;
|
*errnop = ERANGE;
|
||||||
|
@ -420,7 +448,7 @@ direct_lookup:
|
||||||
|
|
||||||
gr->gr_name = buffer + sizeof(char*);
|
gr->gr_name = buffer + sizeof(char*);
|
||||||
gr->gr_gid = (gid_t) translated;
|
gr->gr_gid = (gid_t) translated;
|
||||||
gr->gr_passwd = (char*) "*"; /* locked */
|
gr->gr_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
gr->gr_mem = (char**) buffer;
|
gr->gr_mem = (char**) buffer;
|
||||||
|
|
||||||
*errnop = 0;
|
*errnop = 0;
|
||||||
|
@ -478,11 +506,20 @@ enum nss_status _nss_systemd_getgrgid_r(
|
||||||
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||||
if (bypass <= 0) {
|
if (bypass <= 0) {
|
||||||
r = sd_bus_open_system(&bus);
|
r = sd_bus_open_system(&bus);
|
||||||
if (r < 0) {
|
if (r < 0)
|
||||||
bypass = 1;
|
bypass = 1;
|
||||||
goto direct_lookup;
|
}
|
||||||
}
|
|
||||||
|
|
||||||
|
if (bypass > 0) {
|
||||||
|
r = direct_lookup_uid(gid, &direct);
|
||||||
|
if (r == -ENOENT)
|
||||||
|
goto not_found;
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
translated = direct;
|
||||||
|
|
||||||
|
} else {
|
||||||
r = sd_bus_call_method(bus,
|
r = sd_bus_call_method(bus,
|
||||||
"org.freedesktop.systemd1",
|
"org.freedesktop.systemd1",
|
||||||
"/org/freedesktop/systemd1",
|
"/org/freedesktop/systemd1",
|
||||||
|
@ -504,17 +541,6 @@ enum nss_status _nss_systemd_getgrgid_r(
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
|
|
||||||
direct_lookup:
|
|
||||||
if (bypass > 0) {
|
|
||||||
r = direct_lookup_uid(gid, &direct);
|
|
||||||
if (r == -ENOENT)
|
|
||||||
goto not_found;
|
|
||||||
if (r < 0)
|
|
||||||
goto fail;
|
|
||||||
|
|
||||||
translated = direct;
|
|
||||||
}
|
|
||||||
|
|
||||||
l = sizeof(char*) + strlen(translated) + 1;
|
l = sizeof(char*) + strlen(translated) + 1;
|
||||||
if (buflen < l) {
|
if (buflen < l) {
|
||||||
*errnop = ERANGE;
|
*errnop = ERANGE;
|
||||||
|
@ -526,7 +552,7 @@ direct_lookup:
|
||||||
|
|
||||||
gr->gr_name = buffer + sizeof(char*);
|
gr->gr_name = buffer + sizeof(char*);
|
||||||
gr->gr_gid = gid;
|
gr->gr_gid = gid;
|
||||||
gr->gr_passwd = (char*) "*"; /* locked */
|
gr->gr_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
gr->gr_mem = (char**) buffer;
|
gr->gr_mem = (char**) buffer;
|
||||||
|
|
||||||
*errnop = 0;
|
*errnop = 0;
|
||||||
|
@ -540,3 +566,299 @@ fail:
|
||||||
*errnop = -r;
|
*errnop = -r;
|
||||||
return NSS_STATUS_UNAVAIL;
|
return NSS_STATUS_UNAVAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void user_entry_free(UserEntry *p) {
|
||||||
|
if (!p)
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (p->data)
|
||||||
|
LIST_REMOVE(entries, p->data->entries, p);
|
||||||
|
|
||||||
|
free(p->name);
|
||||||
|
free(p);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int user_entry_add(GetentData *data, const char *name, uid_t id) {
|
||||||
|
UserEntry *p;
|
||||||
|
|
||||||
|
assert(data);
|
||||||
|
|
||||||
|
/* This happens when User= or Group= already exists statically. */
|
||||||
|
if (!uid_is_dynamic(id))
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
|
p = new0(UserEntry, 1);
|
||||||
|
if (!p)
|
||||||
|
return -ENOMEM;
|
||||||
|
|
||||||
|
p->name = strdup(name);
|
||||||
|
if (!p->name) {
|
||||||
|
free(p);
|
||||||
|
return -ENOMEM;
|
||||||
|
}
|
||||||
|
p->id = id;
|
||||||
|
p->data = data;
|
||||||
|
|
||||||
|
LIST_PREPEND(entries, data->entries, p);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static void systemd_endent(GetentData *data) {
|
||||||
|
UserEntry *p;
|
||||||
|
|
||||||
|
assert(data);
|
||||||
|
|
||||||
|
while ((p = data->entries))
|
||||||
|
user_entry_free(p);
|
||||||
|
|
||||||
|
data->position = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
static enum nss_status nss_systemd_endent(GetentData *p) {
|
||||||
|
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_lock(&p->mutex) == 0);
|
||||||
|
systemd_endent(p);
|
||||||
|
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||||
|
|
||||||
|
return NSS_STATUS_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_endpwent(void) {
|
||||||
|
return nss_systemd_endent(&getpwent_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_endgrent(void) {
|
||||||
|
return nss_systemd_endent(&getgrent_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int direct_enumeration(GetentData *p) {
|
||||||
|
_cleanup_closedir_ DIR *d = NULL;
|
||||||
|
struct dirent *de;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
assert(p);
|
||||||
|
|
||||||
|
d = opendir("/run/systemd/dynamic-uid/");
|
||||||
|
if (!d)
|
||||||
|
return -errno;
|
||||||
|
|
||||||
|
FOREACH_DIRENT(de, d, return -errno) {
|
||||||
|
_cleanup_free_ char *name = NULL;
|
||||||
|
uid_t uid, verified;
|
||||||
|
|
||||||
|
if (!dirent_is_file(de))
|
||||||
|
continue;
|
||||||
|
|
||||||
|
r = parse_uid(de->d_name, &uid);
|
||||||
|
if (r < 0)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
r = direct_lookup_uid(uid, &name);
|
||||||
|
if (r == -ENOMEM)
|
||||||
|
return r;
|
||||||
|
if (r < 0)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
r = direct_lookup_name(name, &verified);
|
||||||
|
if (r < 0)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (uid != verified)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
r = user_entry_add(p, name, uid);
|
||||||
|
if (r == -ENOMEM)
|
||||||
|
return r;
|
||||||
|
if (r < 0)
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static enum nss_status systemd_setent(GetentData *p) {
|
||||||
|
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
||||||
|
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
||||||
|
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
||||||
|
const char *name;
|
||||||
|
uid_t id;
|
||||||
|
int bypass, r;
|
||||||
|
|
||||||
|
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||||
|
|
||||||
|
assert(p);
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_lock(&p->mutex) == 0);
|
||||||
|
|
||||||
|
systemd_endent(p);
|
||||||
|
|
||||||
|
if (getenv_bool_secure("SYSTEMD_NSS_DYNAMIC_BYPASS") > 0)
|
||||||
|
goto finish;
|
||||||
|
|
||||||
|
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||||
|
|
||||||
|
if (bypass <= 0) {
|
||||||
|
r = sd_bus_open_system(&bus);
|
||||||
|
if (r < 0)
|
||||||
|
bypass = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bypass > 0) {
|
||||||
|
r = direct_enumeration(p);
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = sd_bus_call_method(bus,
|
||||||
|
"org.freedesktop.systemd1",
|
||||||
|
"/org/freedesktop/systemd1",
|
||||||
|
"org.freedesktop.systemd1.Manager",
|
||||||
|
"GetDynamicUsers",
|
||||||
|
&error,
|
||||||
|
&reply,
|
||||||
|
NULL);
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
r = sd_bus_message_enter_container(reply, 'a', "(us)");
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
while ((r = sd_bus_message_read(reply, "(us)", &id, &name)) > 0) {
|
||||||
|
r = user_entry_add(p, name, id);
|
||||||
|
if (r == -ENOMEM)
|
||||||
|
goto fail;
|
||||||
|
if (r < 0)
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
r = sd_bus_message_exit_container(reply);
|
||||||
|
if (r < 0)
|
||||||
|
goto fail;
|
||||||
|
|
||||||
|
finish:
|
||||||
|
p->position = p->entries;
|
||||||
|
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||||
|
|
||||||
|
return NSS_STATUS_SUCCESS;
|
||||||
|
|
||||||
|
fail:
|
||||||
|
systemd_endent(p);
|
||||||
|
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||||
|
|
||||||
|
return NSS_STATUS_UNAVAIL;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_setpwent(int stayopen) {
|
||||||
|
return systemd_setent(&getpwent_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_setgrent(int stayopen) {
|
||||||
|
return systemd_setent(&getgrent_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) {
|
||||||
|
enum nss_status ret;
|
||||||
|
UserEntry *p;
|
||||||
|
size_t len;
|
||||||
|
|
||||||
|
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||||
|
|
||||||
|
assert(result);
|
||||||
|
assert(buffer);
|
||||||
|
assert(errnop);
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_lock(&getpwent_data.mutex) == 0);
|
||||||
|
|
||||||
|
LIST_FOREACH(entries, p, getpwent_data.position) {
|
||||||
|
len = strlen(p->name) + 1;
|
||||||
|
if (buflen < len) {
|
||||||
|
*errnop = ERANGE;
|
||||||
|
ret = NSS_STATUS_TRYAGAIN;
|
||||||
|
goto finalize;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(buffer, p->name, len);
|
||||||
|
|
||||||
|
result->pw_name = buffer;
|
||||||
|
result->pw_uid = p->id;
|
||||||
|
result->pw_gid = p->id;
|
||||||
|
result->pw_gecos = (char*) DYNAMIC_USER_GECOS;
|
||||||
|
result->pw_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
|
result->pw_dir = (char*) DYNAMIC_USER_DIR;
|
||||||
|
result->pw_shell = (char*) DYNAMIC_USER_SHELL;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
if (!p) {
|
||||||
|
*errnop = ENOENT;
|
||||||
|
ret = NSS_STATUS_NOTFOUND;
|
||||||
|
goto finalize;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* On success, step to the next entry. */
|
||||||
|
p = p->entries_next;
|
||||||
|
ret = NSS_STATUS_SUCCESS;
|
||||||
|
|
||||||
|
finalize:
|
||||||
|
/* Save position for the next call. */
|
||||||
|
getpwent_data.position = p;
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_unlock(&getpwent_data.mutex) == 0);
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) {
|
||||||
|
enum nss_status ret;
|
||||||
|
UserEntry *p;
|
||||||
|
size_t len;
|
||||||
|
|
||||||
|
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||||
|
|
||||||
|
assert(result);
|
||||||
|
assert(buffer);
|
||||||
|
assert(errnop);
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_lock(&getgrent_data.mutex) == 0);
|
||||||
|
|
||||||
|
LIST_FOREACH(entries, p, getgrent_data.position) {
|
||||||
|
len = sizeof(char*) + strlen(p->name) + 1;
|
||||||
|
if (buflen < len) {
|
||||||
|
*errnop = ERANGE;
|
||||||
|
ret = NSS_STATUS_TRYAGAIN;
|
||||||
|
goto finalize;
|
||||||
|
}
|
||||||
|
|
||||||
|
memzero(buffer, sizeof(char*));
|
||||||
|
strcpy(buffer + sizeof(char*), p->name);
|
||||||
|
|
||||||
|
result->gr_name = buffer + sizeof(char*);
|
||||||
|
result->gr_gid = p->id;
|
||||||
|
result->gr_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||||
|
result->gr_mem = (char**) buffer;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
if (!p) {
|
||||||
|
*errnop = ENOENT;
|
||||||
|
ret = NSS_STATUS_NOTFOUND;
|
||||||
|
goto finalize;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* On success, step to the next entry. */
|
||||||
|
p = p->entries_next;
|
||||||
|
ret = NSS_STATUS_SUCCESS;
|
||||||
|
|
||||||
|
finalize:
|
||||||
|
/* Save position for the next call. */
|
||||||
|
getgrent_data.position = p;
|
||||||
|
|
||||||
|
assert_se(pthread_mutex_unlock(&getgrent_data.mutex) == 0);
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
|
@ -13,7 +13,13 @@
|
||||||
global:
|
global:
|
||||||
_nss_systemd_getpwnam_r;
|
_nss_systemd_getpwnam_r;
|
||||||
_nss_systemd_getpwuid_r;
|
_nss_systemd_getpwuid_r;
|
||||||
|
_nss_systemd_endpwent;
|
||||||
|
_nss_systemd_setpwent;
|
||||||
|
_nss_systemd_getpwent_r;
|
||||||
_nss_systemd_getgrnam_r;
|
_nss_systemd_getgrnam_r;
|
||||||
_nss_systemd_getgrgid_r;
|
_nss_systemd_getgrgid_r;
|
||||||
|
_nss_systemd_endgrent;
|
||||||
|
_nss_systemd_setgrent;
|
||||||
|
_nss_systemd_getgrent_r;
|
||||||
local: *;
|
local: *;
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in New Issue