037b0a47b0
Previously we'd used the existance of a specific AF_UNIX socket in the abstract namespace as lock for disabling lookup recursions. (for breaking out of the loop: userdb synthesized from nss → nss synthesized from userdb → userdb synthesized from nss → …) I did it like that because it promised to work the same both in static and in dynmically linked environments and is accessible easily from any programming language. However, it has a weakness regarding reuse attacks: the socket is securely hashed (siphash) from the thread ID in combination with the AT_RANDOM secret. Thus it should not be guessable from an attacker in advance. That's only true if a thread takes the lock only once and keeps it forever. However, if a thread takes and releases it multiple times an attacker might monitor that and quickly take the lock after the first iteration for follow-up iterations. It's not a big issue given that userdb (as the primary user for this) never released the lock and we never made the concept a public interface, and it was only included in one release so far, but it's something that deserves fixing. (moreover it's a local DoS only, only permitting to disable native userdb lookups) With this rework the libnss_systemd.so.2 module will now export two additional symbols. These symbols are not used by glibc, but can be used by arbitrary programs: one can be used to disable nss-systemd, the other to check if it is currently disabled. The lock is per-thread. It's slightly less pretty, since it requires people to manually link against C code via dlopen()/dlsym(), but it should work safely without the aforementioned weakness.
42 lines
1.9 KiB
C
42 lines
1.9 KiB
C
/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
#pragma once
|
|
|
|
#include <sys/socket.h>
|
|
#include <sys/un.h>
|
|
|
|
#include "group-record.h"
|
|
#include "user-record.h"
|
|
|
|
/* Inquire local services for user/group records */
|
|
|
|
typedef struct UserDBIterator UserDBIterator;
|
|
|
|
UserDBIterator *userdb_iterator_free(UserDBIterator *iterator);
|
|
DEFINE_TRIVIAL_CLEANUP_FUNC(UserDBIterator*, userdb_iterator_free);
|
|
|
|
typedef enum UserDBFlags {
|
|
USERDB_AVOID_NSS = 1 << 0, /* don't do client-side nor server-side NSS */
|
|
USERDB_AVOID_SHADOW = 1 << 1, /* don't do client-side shadow calls (server side might happen though) */
|
|
USERDB_AVOID_DYNAMIC_USER = 1 << 2, /* exclude looking up in io.systemd.DynamicUser */
|
|
USERDB_AVOID_MULTIPLEXER = 1 << 3, /* exclude looking up via io.systemd.Multiplexer */
|
|
USERDB_DONT_SYNTHESIZE = 1 << 4, /* don't synthesize root/nobody */
|
|
} UserDBFlags;
|
|
|
|
int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret);
|
|
int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret);
|
|
int userdb_all(UserDBFlags flags, UserDBIterator **ret);
|
|
int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret);
|
|
|
|
int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret);
|
|
int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret);
|
|
int groupdb_all(UserDBFlags flags, UserDBIterator **ret);
|
|
int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret);
|
|
|
|
int membershipdb_by_user(const char *name, UserDBFlags flags, UserDBIterator **ret);
|
|
int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator **ret);
|
|
int membershipdb_all(UserDBFlags flags, UserDBIterator **ret);
|
|
int membershipdb_iterator_get(UserDBIterator *iterator, char **user, char **group);
|
|
int membershipdb_by_group_strv(const char *name, UserDBFlags flags, char ***ret);
|
|
|
|
int userdb_block_nss_systemd(int b);
|