[22686] | 1 | /* |
---|
| 2 | * nonlocal-group.c |
---|
| 3 | * group database for nss_nonlocal proxy |
---|
| 4 | * |
---|
[22714] | 5 | * Copyright © 2007 Anders Kaseorg <andersk@mit.edu> and Tim Abbott |
---|
| 6 | * <tabbott@mit.edu> |
---|
[22686] | 7 | * |
---|
| 8 | * Permission is hereby granted, free of charge, to any person |
---|
| 9 | * obtaining a copy of this software and associated documentation |
---|
| 10 | * files (the "Software"), to deal in the Software without |
---|
| 11 | * restriction, including without limitation the rights to use, copy, |
---|
| 12 | * modify, merge, publish, distribute, sublicense, and/or sell copies |
---|
| 13 | * of the Software, and to permit persons to whom the Software is |
---|
| 14 | * furnished to do so, subject to the following conditions: |
---|
| 15 | * |
---|
| 16 | * The above copyright notice and this permission notice shall be |
---|
| 17 | * included in all copies or substantial portions of the Software. |
---|
| 18 | * |
---|
| 19 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
---|
| 20 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
---|
| 21 | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
---|
| 22 | * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS |
---|
| 23 | * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
---|
| 24 | * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
---|
| 25 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
---|
| 26 | * SOFTWARE. |
---|
| 27 | */ |
---|
| 28 | |
---|
| 29 | #define _GNU_SOURCE |
---|
| 30 | #include <sys/types.h> |
---|
| 31 | #include <unistd.h> |
---|
| 32 | #include <stdlib.h> |
---|
| 33 | #include <stdint.h> |
---|
| 34 | #include <string.h> |
---|
| 35 | #include <dlfcn.h> |
---|
| 36 | #include <stdio.h> |
---|
| 37 | #include <syslog.h> |
---|
| 38 | #include <errno.h> |
---|
| 39 | #include <grp.h> |
---|
| 40 | #include <nss.h> |
---|
| 41 | #include "nsswitch-internal.h" |
---|
| 42 | #include "nonlocal.h" |
---|
| 43 | |
---|
[22714] | 44 | #define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users" |
---|
| 45 | #define MAGIC_LOCAL_GROUPNAME "nss-local-users" |
---|
[22686] | 46 | |
---|
| 47 | |
---|
[23113] | 48 | enum nss_status |
---|
| 49 | _nss_nonlocal_getgrnam_r(const char *name, struct group *grp, |
---|
| 50 | char *buffer, size_t buflen, int *errnop); |
---|
| 51 | |
---|
| 52 | enum nss_status |
---|
| 53 | _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp, |
---|
| 54 | char *buffer, size_t buflen, int *errnop); |
---|
| 55 | |
---|
| 56 | |
---|
[22686] | 57 | static service_user * |
---|
| 58 | nss_group_nonlocal_database(void) |
---|
| 59 | { |
---|
| 60 | static service_user *nip = NULL; |
---|
| 61 | if (nip == NULL) |
---|
| 62 | __nss_database_lookup("group_nonlocal", NULL, "", &nip); |
---|
[22714] | 63 | |
---|
[22686] | 64 | return nip; |
---|
| 65 | } |
---|
| 66 | |
---|
| 67 | |
---|
| 68 | enum nss_status |
---|
| 69 | check_nonlocal_gid(const char *user, gid_t gid, int *errnop) |
---|
| 70 | { |
---|
[23113] | 71 | static const char *fct_name = "getgrgid_r"; |
---|
| 72 | static service_user *startp = NULL; |
---|
| 73 | static void *fct_start = NULL; |
---|
| 74 | enum nss_status status; |
---|
| 75 | service_user *nip; |
---|
| 76 | union { |
---|
| 77 | enum nss_status (*l)(gid_t gid, struct group *grp, |
---|
| 78 | char *buffer, size_t buflen, int *errnop); |
---|
| 79 | void *ptr; |
---|
| 80 | } fct; |
---|
[22686] | 81 | struct group gbuf; |
---|
| 82 | int old_errno = errno; |
---|
[23113] | 83 | |
---|
[24122] | 84 | size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX); |
---|
[22686] | 85 | char *buf = malloc(buflen); |
---|
| 86 | if (buf == NULL) { |
---|
| 87 | *errnop = ENOMEM; |
---|
| 88 | errno = old_errno; |
---|
| 89 | return NSS_STATUS_TRYAGAIN; |
---|
| 90 | } |
---|
[23113] | 91 | |
---|
| 92 | if (fct_start == NULL && |
---|
| 93 | __nss_group_lookup(&startp, fct_name, &fct_start) != 0) { |
---|
| 94 | free(buf); |
---|
| 95 | return NSS_STATUS_UNAVAIL; |
---|
| 96 | } |
---|
| 97 | nip = startp; |
---|
| 98 | fct.ptr = fct_start; |
---|
| 99 | do { |
---|
[23829] | 100 | morebuf: |
---|
[23113] | 101 | if (fct.l == _nss_nonlocal_getgrgid_r) |
---|
| 102 | status = NSS_STATUS_NOTFOUND; |
---|
| 103 | else |
---|
| 104 | status = DL_CALL_FCT(fct.l, (gid, &gbuf, buf, buflen, errnop)); |
---|
[23829] | 105 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) { |
---|
| 106 | free(buf); |
---|
| 107 | buflen *= 2; |
---|
| 108 | buf = malloc(buflen); |
---|
| 109 | if (buf == NULL) { |
---|
| 110 | *errnop = ENOMEM; |
---|
| 111 | errno = old_errno; |
---|
| 112 | return NSS_STATUS_TRYAGAIN; |
---|
| 113 | } |
---|
| 114 | goto morebuf; |
---|
| 115 | } |
---|
[23113] | 116 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 117 | |
---|
| 118 | if (status == NSS_STATUS_SUCCESS) { |
---|
[24584] | 119 | syslog(LOG_WARNING, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user); |
---|
[22686] | 120 | status = NSS_STATUS_NOTFOUND; |
---|
[23113] | 121 | } else if (status != NSS_STATUS_TRYAGAIN) { |
---|
| 122 | status = NSS_STATUS_SUCCESS; |
---|
[22686] | 123 | } |
---|
[23113] | 124 | |
---|
[22686] | 125 | free(buf); |
---|
| 126 | return status; |
---|
| 127 | } |
---|
| 128 | |
---|
[22714] | 129 | enum nss_status |
---|
[24122] | 130 | check_nonlocal_group(const char *user, struct group *grp, int *errnop) |
---|
| 131 | { |
---|
| 132 | enum nss_status status = NSS_STATUS_SUCCESS; |
---|
| 133 | int old_errno = errno; |
---|
| 134 | char *end; |
---|
| 135 | unsigned long gid; |
---|
| 136 | |
---|
| 137 | errno = 0; |
---|
| 138 | gid = strtoul(grp->gr_name, &end, 10); |
---|
| 139 | if (errno == 0 && *end == '\0' && (gid_t)gid == gid) |
---|
| 140 | status = check_nonlocal_gid(user, gid, errnop); |
---|
| 141 | errno = old_errno; |
---|
| 142 | if (status != NSS_STATUS_SUCCESS) |
---|
| 143 | return status; |
---|
| 144 | |
---|
| 145 | return check_nonlocal_gid(user, grp->gr_gid, errnop); |
---|
| 146 | } |
---|
| 147 | |
---|
| 148 | enum nss_status |
---|
[23829] | 149 | get_local_group(const char *name, struct group *grp, char **buffer, int *errnop) |
---|
[22714] | 150 | { |
---|
[23113] | 151 | static const char *fct_name = "getgrnam_r"; |
---|
| 152 | static service_user *startp = NULL; |
---|
| 153 | static void *fct_start = NULL; |
---|
| 154 | enum nss_status status; |
---|
| 155 | service_user *nip; |
---|
| 156 | union { |
---|
| 157 | enum nss_status (*l)(const char *name, struct group *grp, |
---|
| 158 | char *buffer, size_t buflen, int *errnop); |
---|
| 159 | void *ptr; |
---|
| 160 | } fct; |
---|
[23829] | 161 | size_t buflen; |
---|
[22714] | 162 | int old_errno = errno; |
---|
[23113] | 163 | |
---|
[23829] | 164 | buflen = sysconf(_SC_GETGR_R_SIZE_MAX); |
---|
| 165 | *buffer = malloc(buflen); |
---|
| 166 | if (*buffer == NULL) { |
---|
[22714] | 167 | *errnop = ENOMEM; |
---|
| 168 | errno = old_errno; |
---|
| 169 | return NSS_STATUS_TRYAGAIN; |
---|
| 170 | } |
---|
[23113] | 171 | |
---|
| 172 | if (fct_start == NULL && |
---|
| 173 | __nss_group_lookup(&startp, fct_name, &fct_start) != 0) { |
---|
[23829] | 174 | free(*buffer); |
---|
| 175 | *buffer = NULL; |
---|
[23113] | 176 | return NSS_STATUS_UNAVAIL; |
---|
| 177 | } |
---|
| 178 | nip = startp; |
---|
| 179 | fct.ptr = fct_start; |
---|
| 180 | do { |
---|
[23829] | 181 | morebuf: |
---|
[23113] | 182 | if (fct.l == _nss_nonlocal_getgrnam_r) |
---|
| 183 | status = NSS_STATUS_NOTFOUND; |
---|
| 184 | else |
---|
[23829] | 185 | status = DL_CALL_FCT(fct.l, (name, grp, *buffer, buflen, errnop)); |
---|
| 186 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) { |
---|
| 187 | free(*buffer); |
---|
| 188 | buflen *= 2; |
---|
| 189 | *buffer = malloc(buflen); |
---|
| 190 | if (*buffer == NULL) { |
---|
| 191 | *errnop = ENOMEM; |
---|
| 192 | errno = old_errno; |
---|
| 193 | return NSS_STATUS_TRYAGAIN; |
---|
| 194 | } |
---|
| 195 | goto morebuf; |
---|
| 196 | } |
---|
[23113] | 197 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 198 | |
---|
[23829] | 199 | if (status != NSS_STATUS_SUCCESS) { |
---|
| 200 | free(*buffer); |
---|
| 201 | *buffer = NULL; |
---|
[23113] | 202 | } |
---|
[22755] | 203 | |
---|
[22714] | 204 | return status; |
---|
| 205 | } |
---|
[22686] | 206 | |
---|
| 207 | static service_user *grent_nip = NULL; |
---|
| 208 | static void *grent_fct_start; |
---|
| 209 | static union { |
---|
| 210 | enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen, |
---|
| 211 | int *errnop); |
---|
| 212 | void *ptr; |
---|
| 213 | } grent_fct; |
---|
| 214 | static const char *grent_fct_name = "getgrent_r"; |
---|
| 215 | |
---|
| 216 | enum nss_status |
---|
| 217 | _nss_nonlocal_setgrent(int stayopen) |
---|
| 218 | { |
---|
| 219 | static const char *fct_name = "setgrent"; |
---|
| 220 | static void *fct_start = NULL; |
---|
| 221 | enum nss_status status; |
---|
| 222 | service_user *nip; |
---|
| 223 | union { |
---|
| 224 | enum nss_status (*l)(int stayopen); |
---|
| 225 | void *ptr; |
---|
| 226 | } fct; |
---|
| 227 | |
---|
| 228 | nip = nss_group_nonlocal_database(); |
---|
| 229 | if (nip == NULL) |
---|
| 230 | return NSS_STATUS_UNAVAIL; |
---|
| 231 | if (fct_start == NULL) |
---|
| 232 | fct_start = __nss_lookup_function(nip, fct_name); |
---|
| 233 | fct.ptr = fct_start; |
---|
| 234 | do { |
---|
| 235 | if (fct.ptr == NULL) |
---|
| 236 | status = NSS_STATUS_UNAVAIL; |
---|
| 237 | else |
---|
| 238 | status = DL_CALL_FCT(fct.l, (stayopen)); |
---|
| 239 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 240 | if (status != NSS_STATUS_SUCCESS) |
---|
| 241 | return status; |
---|
| 242 | |
---|
| 243 | grent_nip = nip; |
---|
| 244 | if (grent_fct_start == NULL) |
---|
| 245 | grent_fct_start = __nss_lookup_function(nip, grent_fct_name); |
---|
| 246 | grent_fct.ptr = grent_fct_start; |
---|
| 247 | return NSS_STATUS_SUCCESS; |
---|
| 248 | } |
---|
| 249 | |
---|
| 250 | enum nss_status |
---|
| 251 | _nss_nonlocal_endgrent(void) |
---|
| 252 | { |
---|
| 253 | static const char *fct_name = "endgrent"; |
---|
| 254 | static void *fct_start = NULL; |
---|
| 255 | enum nss_status status; |
---|
| 256 | service_user *nip; |
---|
| 257 | union { |
---|
| 258 | enum nss_status (*l)(void); |
---|
| 259 | void *ptr; |
---|
| 260 | } fct; |
---|
| 261 | |
---|
| 262 | grent_nip = NULL; |
---|
| 263 | |
---|
| 264 | nip = nss_group_nonlocal_database(); |
---|
| 265 | if (nip == NULL) |
---|
| 266 | return NSS_STATUS_UNAVAIL; |
---|
| 267 | if (fct_start == NULL) |
---|
| 268 | fct_start = __nss_lookup_function(nip, fct_name); |
---|
| 269 | fct.ptr = fct_start; |
---|
| 270 | do { |
---|
| 271 | if (fct.ptr == NULL) |
---|
| 272 | status = NSS_STATUS_UNAVAIL; |
---|
| 273 | else |
---|
| 274 | status = DL_CALL_FCT(fct.l, ()); |
---|
| 275 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 276 | return status; |
---|
| 277 | } |
---|
| 278 | |
---|
| 279 | enum nss_status |
---|
| 280 | _nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen, |
---|
| 281 | int *errnop) |
---|
| 282 | { |
---|
| 283 | enum nss_status status; |
---|
[22768] | 284 | |
---|
| 285 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 286 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22768] | 287 | return NSS_STATUS_UNAVAIL; |
---|
| 288 | |
---|
[22686] | 289 | if (grent_nip == NULL) { |
---|
| 290 | status = _nss_nonlocal_setgrent(0); |
---|
| 291 | if (status != NSS_STATUS_SUCCESS) |
---|
| 292 | return status; |
---|
| 293 | } |
---|
| 294 | do { |
---|
| 295 | if (grent_fct.ptr == NULL) |
---|
| 296 | status = NSS_STATUS_UNAVAIL; |
---|
| 297 | else { |
---|
| 298 | int nonlocal_errno; |
---|
| 299 | do |
---|
| 300 | status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop)); |
---|
| 301 | while (status == NSS_STATUS_SUCCESS && |
---|
[24122] | 302 | check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS); |
---|
[22686] | 303 | } |
---|
| 304 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) |
---|
| 305 | return status; |
---|
| 306 | |
---|
| 307 | if (status == NSS_STATUS_SUCCESS) |
---|
| 308 | return NSS_STATUS_SUCCESS; |
---|
| 309 | } while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0); |
---|
| 310 | |
---|
| 311 | grent_nip = NULL; |
---|
| 312 | return NSS_STATUS_NOTFOUND; |
---|
| 313 | } |
---|
| 314 | |
---|
| 315 | |
---|
| 316 | enum nss_status |
---|
| 317 | _nss_nonlocal_getgrnam_r(const char *name, struct group *grp, |
---|
| 318 | char *buffer, size_t buflen, int *errnop) |
---|
| 319 | { |
---|
| 320 | static const char *fct_name = "getgrnam_r"; |
---|
| 321 | static void *fct_start = NULL; |
---|
| 322 | enum nss_status status; |
---|
| 323 | service_user *nip; |
---|
| 324 | union { |
---|
| 325 | enum nss_status (*l)(const char *name, struct group *grp, |
---|
| 326 | char *buffer, size_t buflen, int *errnop); |
---|
| 327 | void *ptr; |
---|
| 328 | } fct; |
---|
| 329 | |
---|
[22768] | 330 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 331 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22714] | 332 | return NSS_STATUS_UNAVAIL; |
---|
| 333 | |
---|
[22686] | 334 | nip = nss_group_nonlocal_database(); |
---|
| 335 | if (nip == NULL) |
---|
| 336 | return NSS_STATUS_UNAVAIL; |
---|
| 337 | if (fct_start == NULL) |
---|
| 338 | fct_start = __nss_lookup_function(nip, fct_name); |
---|
| 339 | fct.ptr = fct_start; |
---|
| 340 | do { |
---|
| 341 | if (fct.ptr == NULL) |
---|
| 342 | status = NSS_STATUS_UNAVAIL; |
---|
| 343 | else |
---|
| 344 | status = DL_CALL_FCT(fct.l, (name, grp, buffer, buflen, errnop)); |
---|
| 345 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) |
---|
| 346 | break; |
---|
| 347 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 348 | if (status != NSS_STATUS_SUCCESS) |
---|
| 349 | return status; |
---|
| 350 | |
---|
[24122] | 351 | if (strcmp(name, grp->gr_name) != 0) { |
---|
| 352 | syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name); |
---|
| 353 | return NSS_STATUS_NOTFOUND; |
---|
| 354 | } |
---|
| 355 | |
---|
| 356 | return check_nonlocal_group(name, grp, errnop); |
---|
[22686] | 357 | } |
---|
| 358 | |
---|
| 359 | enum nss_status |
---|
| 360 | _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp, |
---|
| 361 | char *buffer, size_t buflen, int *errnop) |
---|
| 362 | { |
---|
| 363 | static const char *fct_name = "getgrgid_r"; |
---|
| 364 | static void *fct_start = NULL; |
---|
| 365 | enum nss_status status; |
---|
| 366 | service_user *nip; |
---|
| 367 | union { |
---|
| 368 | enum nss_status (*l)(gid_t gid, struct group *grp, |
---|
| 369 | char *buffer, size_t buflen, int *errnop); |
---|
| 370 | void *ptr; |
---|
| 371 | } fct; |
---|
| 372 | |
---|
[22768] | 373 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 374 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22686] | 375 | return NSS_STATUS_UNAVAIL; |
---|
| 376 | |
---|
| 377 | nip = nss_group_nonlocal_database(); |
---|
| 378 | if (nip == NULL) |
---|
| 379 | return NSS_STATUS_UNAVAIL; |
---|
| 380 | if (fct_start == NULL) |
---|
| 381 | fct_start = __nss_lookup_function(nip, fct_name); |
---|
| 382 | fct.ptr = fct_start; |
---|
| 383 | do { |
---|
| 384 | if (fct.ptr == NULL) |
---|
| 385 | status = NSS_STATUS_UNAVAIL; |
---|
| 386 | else |
---|
| 387 | status = DL_CALL_FCT(fct.l, (gid, grp, buffer, buflen, errnop)); |
---|
| 388 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) |
---|
| 389 | break; |
---|
| 390 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 391 | if (status != NSS_STATUS_SUCCESS) |
---|
| 392 | return status; |
---|
| 393 | |
---|
[24122] | 394 | return check_nonlocal_group(grp->gr_name, grp, errnop); |
---|
[22686] | 395 | } |
---|
| 396 | |
---|
| 397 | enum nss_status |
---|
| 398 | _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start, |
---|
| 399 | long int *size, gid_t **groupsp, long int limit, |
---|
| 400 | int *errnop) |
---|
| 401 | { |
---|
| 402 | static const char *fct_name = "initgroups_dyn"; |
---|
| 403 | static void *fct_start = NULL; |
---|
| 404 | enum nss_status status; |
---|
| 405 | service_user *nip; |
---|
| 406 | union { |
---|
| 407 | enum nss_status (*l)(const char *user, gid_t group, long int *start, |
---|
| 408 | long int *size, gid_t **groupsp, long int limit, |
---|
| 409 | int *errnop); |
---|
| 410 | void *ptr; |
---|
| 411 | } fct; |
---|
[22755] | 412 | |
---|
| 413 | struct group local_users_group, nonlocal_users_group; |
---|
| 414 | gid_t local_users_gid, gid; |
---|
[22714] | 415 | int is_local = 0; |
---|
[22755] | 416 | char *buffer; |
---|
[24122] | 417 | int old_errno; |
---|
| 418 | int in, out, i; |
---|
[22686] | 419 | |
---|
[22755] | 420 | /* Check that the user is a nonlocal user before adding any groups. */ |
---|
[22714] | 421 | status = check_nonlocal_user(user, errnop); |
---|
[23113] | 422 | if (status == NSS_STATUS_TRYAGAIN) |
---|
| 423 | return status; |
---|
| 424 | else if (status != NSS_STATUS_SUCCESS) |
---|
[22714] | 425 | is_local = 1; |
---|
| 426 | |
---|
[24122] | 427 | old_errno = errno; |
---|
[22755] | 428 | |
---|
[22714] | 429 | status = get_local_group(MAGIC_LOCAL_GROUPNAME, |
---|
[23829] | 430 | &local_users_group, &buffer, errnop); |
---|
[23113] | 431 | if (status == NSS_STATUS_SUCCESS) { |
---|
| 432 | local_users_gid = local_users_group.gr_gid; |
---|
| 433 | free(buffer); |
---|
[23829] | 434 | } else if (status == NSS_STATUS_TRYAGAIN) { |
---|
[23113] | 435 | return status; |
---|
| 436 | } else { |
---|
[22714] | 437 | syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", |
---|
| 438 | MAGIC_LOCAL_GROUPNAME); |
---|
[22755] | 439 | local_users_gid = -1; |
---|
[23113] | 440 | } |
---|
[22755] | 441 | |
---|
| 442 | if (is_local) { |
---|
| 443 | gid = local_users_gid; |
---|
| 444 | } else { |
---|
| 445 | status = get_local_group(MAGIC_NONLOCAL_GROUPNAME, |
---|
[23829] | 446 | &nonlocal_users_group, &buffer, errnop); |
---|
[23113] | 447 | if (status == NSS_STATUS_SUCCESS) { |
---|
| 448 | gid = nonlocal_users_group.gr_gid; |
---|
| 449 | free(buffer); |
---|
[23829] | 450 | } else if (status == NSS_STATUS_TRYAGAIN) { |
---|
[23113] | 451 | return status; |
---|
| 452 | } else { |
---|
[22755] | 453 | syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", |
---|
| 454 | MAGIC_NONLOCAL_GROUPNAME); |
---|
| 455 | gid = -1; |
---|
[23113] | 456 | } |
---|
[22714] | 457 | } |
---|
[22755] | 458 | |
---|
| 459 | if (gid != -1) { |
---|
| 460 | int i; |
---|
| 461 | for (i = 0; i < *start; ++i) |
---|
| 462 | if ((*groupsp)[i] == gid) |
---|
| 463 | break; |
---|
| 464 | if (i >= *start) { |
---|
| 465 | if (*start + 1 > *size) { |
---|
| 466 | gid_t *newgroups; |
---|
| 467 | long int newsize = 2 * *size; |
---|
| 468 | if (limit > 0) { |
---|
| 469 | if (*size >= limit) |
---|
| 470 | return NSS_STATUS_SUCCESS; |
---|
| 471 | if (newsize > limit) |
---|
| 472 | newsize = limit; |
---|
| 473 | } |
---|
[23133] | 474 | newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0])); |
---|
[22755] | 475 | if (newgroups == NULL) { |
---|
| 476 | *errnop = ENOMEM; |
---|
| 477 | errno = old_errno; |
---|
| 478 | return NSS_STATUS_TRYAGAIN; |
---|
| 479 | } |
---|
| 480 | *groupsp = newgroups; |
---|
| 481 | *size = newsize; |
---|
| 482 | } |
---|
| 483 | (*groupsp)[(*start)++] = gid; |
---|
[22714] | 484 | } |
---|
| 485 | } |
---|
| 486 | |
---|
[22755] | 487 | if (is_local) |
---|
| 488 | return NSS_STATUS_SUCCESS; |
---|
| 489 | |
---|
[24122] | 490 | in = out = *start; |
---|
[22755] | 491 | |
---|
[22686] | 492 | nip = nss_group_nonlocal_database(); |
---|
| 493 | if (nip == NULL) |
---|
| 494 | return NSS_STATUS_UNAVAIL; |
---|
| 495 | if (fct_start == NULL) |
---|
| 496 | fct_start = __nss_lookup_function(nip, fct_name); |
---|
| 497 | fct.ptr = fct_start; |
---|
| 498 | |
---|
| 499 | do { |
---|
| 500 | if (fct.ptr == NULL) |
---|
| 501 | status = NSS_STATUS_UNAVAIL; |
---|
| 502 | else |
---|
| 503 | status = DL_CALL_FCT(fct.l, (user, group, start, size, groupsp, limit, errnop)); |
---|
| 504 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) |
---|
| 505 | break; |
---|
| 506 | } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); |
---|
| 507 | if (status != NSS_STATUS_SUCCESS) |
---|
| 508 | return status; |
---|
| 509 | |
---|
| 510 | for (; in < *start; ++in) { |
---|
| 511 | int nonlocal_errno = *errnop; |
---|
| 512 | |
---|
| 513 | for (i = 0; i < out; ++i) |
---|
| 514 | if ((*groupsp)[i] == (*groupsp)[in]) |
---|
| 515 | break; |
---|
| 516 | if (i < out) |
---|
| 517 | continue; |
---|
| 518 | |
---|
[22755] | 519 | /* Don't let users get into MAGIC_LOCAL_GROUPNAME from nonlocal reasons. */ |
---|
| 520 | if (local_users_gid == (*groupsp)[in]) { |
---|
| 521 | syslog(LOG_WARNING, "nss_nonlocal: Nonlocal user %s removed from special local users group %s", |
---|
| 522 | user, MAGIC_LOCAL_GROUPNAME); |
---|
| 523 | continue; |
---|
| 524 | } |
---|
| 525 | |
---|
[22686] | 526 | status = check_nonlocal_gid(user, (*groupsp)[in], &nonlocal_errno); |
---|
| 527 | if (status == NSS_STATUS_SUCCESS) { |
---|
[22755] | 528 | (*groupsp)[out++] = (*groupsp)[in]; |
---|
[23113] | 529 | } else if (status == NSS_STATUS_TRYAGAIN) { |
---|
[22686] | 530 | *start = out; |
---|
| 531 | *errnop = nonlocal_errno; |
---|
| 532 | return status; |
---|
| 533 | } |
---|
| 534 | } |
---|
| 535 | |
---|
| 536 | *start = out; |
---|
| 537 | return NSS_STATUS_SUCCESS; |
---|
| 538 | } |
---|