037b0a47b0
Previously we'd used the existance of a specific AF_UNIX socket in the abstract namespace as lock for disabling lookup recursions. (for breaking out of the loop: userdb synthesized from nss → nss synthesized from userdb → userdb synthesized from nss → …) I did it like that because it promised to work the same both in static and in dynmically linked environments and is accessible easily from any programming language. However, it has a weakness regarding reuse attacks: the socket is securely hashed (siphash) from the thread ID in combination with the AT_RANDOM secret. Thus it should not be guessable from an attacker in advance. That's only true if a thread takes the lock only once and keeps it forever. However, if a thread takes and releases it multiple times an attacker might monitor that and quickly take the lock after the first iteration for follow-up iterations. It's not a big issue given that userdb (as the primary user for this) never released the lock and we never made the concept a public interface, and it was only included in one release so far, but it's something that deserves fixing. (moreover it's a local DoS only, only permitting to disable native userdb lookups) With this rework the libnss_systemd.so.2 module will now export two additional symbols. These symbols are not used by glibc, but can be used by arbitrary programs: one can be used to disable nss-systemd, the other to check if it is currently disabled. The lock is per-thread. It's slightly less pretty, since it requires people to manually link against C code via dlopen()/dlsym(), but it should work safely without the aforementioned weakness.
29 lines
874 B
Plaintext
29 lines
874 B
Plaintext
/***
|
|
SPDX-License-Identifier: LGPL-2.1+
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
***/
|
|
|
|
{
|
|
global:
|
|
_nss_systemd_getpwnam_r;
|
|
_nss_systemd_getpwuid_r;
|
|
_nss_systemd_endpwent;
|
|
_nss_systemd_setpwent;
|
|
_nss_systemd_getpwent_r;
|
|
_nss_systemd_getgrnam_r;
|
|
_nss_systemd_getgrgid_r;
|
|
_nss_systemd_endgrent;
|
|
_nss_systemd_setgrent;
|
|
_nss_systemd_getgrent_r;
|
|
_nss_systemd_initgroups_dyn;
|
|
|
|
/* These two are not used by glibc, but can be used by apps to explicitly disable nss-systemd for the calling thread. */
|
|
_nss_systemd_block;
|
|
_nss_systemd_is_blocked;
|
|
local: *;
|
|
};
|