[22686] | 1 | /* |
---|
| 2 | * nonlocal-passwd.c |
---|
| 3 | * passwd database for nss_nonlocal proxy. |
---|
| 4 | * |
---|
[24585] | 5 | * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim |
---|
| 6 | * Abbott <tabbott@mit.edu> |
---|
[22686] | 7 | * |
---|
[24585] | 8 | * This file is part of nss_nonlocal. |
---|
[22686] | 9 | * |
---|
[24585] | 10 | * nss_nonlocal is free software; you can redistribute it and/or |
---|
| 11 | * modify it under the terms of the GNU Lesser General Public License |
---|
| 12 | * as published by the Free Software Foundation; either version 2.1 of |
---|
| 13 | * the License, or (at your option) any later version. |
---|
[22686] | 14 | * |
---|
[24585] | 15 | * nss_nonlocal is distributed in the hope that it will be useful, but |
---|
| 16 | * WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 17 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
---|
| 18 | * Lesser General Public License for more details. |
---|
| 19 | * |
---|
| 20 | * You should have received a copy of the GNU Lesser General Public |
---|
| 21 | * License along with nss_nonlocal; if not, write to the Free Software |
---|
| 22 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
---|
| 23 | * 02110-1301 USA |
---|
[22686] | 24 | */ |
---|
| 25 | |
---|
| 26 | |
---|
| 27 | #define _GNU_SOURCE |
---|
[26035] | 28 | |
---|
[22686] | 29 | #include <sys/types.h> |
---|
[26035] | 30 | #include <dlfcn.h> |
---|
| 31 | #include <errno.h> |
---|
| 32 | #include <nss.h> |
---|
| 33 | #include <pwd.h> |
---|
| 34 | #include <stdbool.h> |
---|
| 35 | #include <stddef.h> |
---|
[22686] | 36 | #include <stdlib.h> |
---|
| 37 | #include <string.h> |
---|
| 38 | #include <syslog.h> |
---|
[26035] | 39 | #include <unistd.h> |
---|
| 40 | |
---|
[22686] | 41 | #include "nsswitch-internal.h" |
---|
| 42 | #include "nonlocal.h" |
---|
| 43 | |
---|
| 44 | |
---|
[23113] | 45 | enum nss_status |
---|
| 46 | _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd, |
---|
| 47 | char *buffer, size_t buflen, int *errnop); |
---|
| 48 | enum nss_status |
---|
| 49 | _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd, |
---|
| 50 | char *buffer, size_t buflen, int *errnop); |
---|
[22686] | 51 | |
---|
[23113] | 52 | |
---|
[25083] | 53 | static service_user *__nss_passwd_nonlocal_database; |
---|
| 54 | |
---|
| 55 | static int |
---|
| 56 | internal_function |
---|
| 57 | __nss_passwd_nonlocal_lookup(service_user **ni, const char *fct_name, |
---|
| 58 | void **fctp) |
---|
[22686] | 59 | { |
---|
[25083] | 60 | if (__nss_passwd_nonlocal_database == NULL |
---|
| 61 | && __nss_database_lookup("passwd_nonlocal", NULL, NULL, |
---|
| 62 | &__nss_passwd_nonlocal_database) < 0) |
---|
| 63 | return -1; |
---|
[22686] | 64 | |
---|
[25083] | 65 | *ni = __nss_passwd_nonlocal_database; |
---|
| 66 | |
---|
| 67 | *fctp = __nss_lookup_function(*ni, fct_name); |
---|
| 68 | return 0; |
---|
[22686] | 69 | } |
---|
| 70 | |
---|
| 71 | |
---|
| 72 | enum nss_status |
---|
| 73 | check_nonlocal_uid(const char *user, uid_t uid, int *errnop) |
---|
| 74 | { |
---|
[23113] | 75 | enum nss_status status; |
---|
[22686] | 76 | struct passwd pwbuf; |
---|
[25083] | 77 | char *buf; |
---|
[24122] | 78 | size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX); |
---|
[25083] | 79 | const struct walk_nss w = { |
---|
| 80 | .lookup = &__nss_passwd_lookup, .fct_name = "getpwuid_r", |
---|
| 81 | .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen |
---|
| 82 | }; |
---|
| 83 | const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r; |
---|
| 84 | #define args (uid, &pwbuf, buf, buflen, errnop) |
---|
| 85 | #include "walk_nss.h" |
---|
| 86 | #undef args |
---|
[23113] | 87 | |
---|
| 88 | if (status == NSS_STATUS_SUCCESS) { |
---|
[22686] | 89 | syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name); |
---|
[25083] | 90 | free(buf); |
---|
[22686] | 91 | status = NSS_STATUS_NOTFOUND; |
---|
[23113] | 92 | } else if (status != NSS_STATUS_TRYAGAIN) { |
---|
| 93 | status = NSS_STATUS_SUCCESS; |
---|
[22686] | 94 | } |
---|
[23113] | 95 | |
---|
[22686] | 96 | return status; |
---|
| 97 | } |
---|
| 98 | |
---|
[22714] | 99 | enum nss_status |
---|
[24122] | 100 | check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop) |
---|
| 101 | { |
---|
| 102 | enum nss_status status = NSS_STATUS_SUCCESS; |
---|
| 103 | int old_errno = errno; |
---|
| 104 | char *end; |
---|
| 105 | unsigned long uid; |
---|
| 106 | |
---|
| 107 | errno = 0; |
---|
| 108 | uid = strtoul(pwd->pw_name, &end, 10); |
---|
[25083] | 109 | if (errno == 0 && *end == '\0' && (uid_t)uid == uid) { |
---|
| 110 | errno = old_errno; |
---|
[24122] | 111 | status = check_nonlocal_uid(user, uid, errnop); |
---|
[25083] | 112 | } else { |
---|
| 113 | errno = old_errno; |
---|
| 114 | } |
---|
[24122] | 115 | if (status != NSS_STATUS_SUCCESS) |
---|
| 116 | return status; |
---|
| 117 | |
---|
| 118 | return check_nonlocal_uid(user, pwd->pw_uid, errnop); |
---|
| 119 | } |
---|
| 120 | |
---|
| 121 | enum nss_status |
---|
[22714] | 122 | check_nonlocal_user(const char *user, int *errnop) |
---|
| 123 | { |
---|
[23113] | 124 | enum nss_status status; |
---|
[22714] | 125 | struct passwd pwbuf; |
---|
[25083] | 126 | char *buf; |
---|
[24122] | 127 | size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX); |
---|
[25083] | 128 | const struct walk_nss w = { |
---|
| 129 | .lookup = __nss_passwd_lookup, .fct_name = "getpwnam_r", |
---|
| 130 | .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen |
---|
| 131 | }; |
---|
| 132 | const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r; |
---|
| 133 | #define args (user, &pwbuf, buf, buflen, errnop) |
---|
| 134 | #include "walk_nss.h" |
---|
| 135 | #undef args |
---|
[23113] | 136 | |
---|
[25083] | 137 | if (status == NSS_STATUS_SUCCESS) { |
---|
[23113] | 138 | free(buf); |
---|
[22714] | 139 | status = NSS_STATUS_NOTFOUND; |
---|
[25083] | 140 | } else if (status != NSS_STATUS_TRYAGAIN) { |
---|
[23113] | 141 | status = NSS_STATUS_SUCCESS; |
---|
[25083] | 142 | } |
---|
[23113] | 143 | |
---|
[22714] | 144 | return status; |
---|
| 145 | } |
---|
[22686] | 146 | |
---|
[25083] | 147 | enum nss_status |
---|
| 148 | get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer, |
---|
| 149 | int *errnop) |
---|
| 150 | { |
---|
| 151 | enum nss_status status; |
---|
| 152 | size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX); |
---|
| 153 | const struct walk_nss w = { |
---|
| 154 | .lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r", |
---|
| 155 | .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen |
---|
| 156 | }; |
---|
| 157 | const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL; |
---|
| 158 | #define args (name, pwd, *buffer, buflen, errnop) |
---|
| 159 | #include "walk_nss.h" |
---|
| 160 | #undef args |
---|
| 161 | return status; |
---|
| 162 | } |
---|
[22755] | 163 | |
---|
[25083] | 164 | |
---|
[26035] | 165 | static bool pwent_initialized = false; |
---|
[25083] | 166 | static service_user *pwent_startp, *pwent_nip; |
---|
[22686] | 167 | static void *pwent_fct_start; |
---|
| 168 | static union { |
---|
| 169 | enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen, |
---|
| 170 | int *errnop); |
---|
| 171 | void *ptr; |
---|
| 172 | } pwent_fct; |
---|
| 173 | static const char *pwent_fct_name = "getpwent_r"; |
---|
| 174 | |
---|
| 175 | enum nss_status |
---|
| 176 | _nss_nonlocal_setpwent(int stayopen) |
---|
| 177 | { |
---|
| 178 | enum nss_status status; |
---|
[25083] | 179 | const struct walk_nss w = { |
---|
| 180 | .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "setpwent", |
---|
| 181 | .status = &status |
---|
| 182 | }; |
---|
| 183 | const __typeof__(&_nss_nonlocal_setpwent) self = NULL; |
---|
| 184 | #define args (stayopen) |
---|
| 185 | #include "walk_nss.h" |
---|
| 186 | #undef args |
---|
[22686] | 187 | if (status != NSS_STATUS_SUCCESS) |
---|
| 188 | return status; |
---|
| 189 | |
---|
[26035] | 190 | if (!pwent_initialized) { |
---|
[25083] | 191 | __nss_passwd_nonlocal_lookup(&pwent_startp, pwent_fct_name, |
---|
| 192 | &pwent_fct_start); |
---|
[26035] | 193 | __sync_synchronize(); |
---|
| 194 | pwent_initialized = true; |
---|
| 195 | } |
---|
[25083] | 196 | pwent_nip = pwent_startp; |
---|
[22686] | 197 | pwent_fct.ptr = pwent_fct_start; |
---|
| 198 | return NSS_STATUS_SUCCESS; |
---|
| 199 | } |
---|
| 200 | |
---|
| 201 | enum nss_status |
---|
| 202 | _nss_nonlocal_endpwent(void) |
---|
| 203 | { |
---|
| 204 | enum nss_status status; |
---|
[25083] | 205 | const struct walk_nss w = { |
---|
| 206 | .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "endpwent", |
---|
[26035] | 207 | .status = &status, .all_values = 1, |
---|
[25083] | 208 | }; |
---|
| 209 | const __typeof__(&_nss_nonlocal_endpwent) self = NULL; |
---|
[22686] | 210 | |
---|
| 211 | pwent_nip = NULL; |
---|
| 212 | |
---|
[25083] | 213 | #define args () |
---|
| 214 | #include "walk_nss.h" |
---|
| 215 | #undef args |
---|
[22686] | 216 | return status; |
---|
| 217 | } |
---|
| 218 | |
---|
| 219 | enum nss_status |
---|
| 220 | _nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen, |
---|
| 221 | int *errnop) |
---|
| 222 | { |
---|
| 223 | enum nss_status status; |
---|
[22768] | 224 | |
---|
| 225 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 226 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22768] | 227 | return NSS_STATUS_UNAVAIL; |
---|
| 228 | |
---|
[22686] | 229 | if (pwent_nip == NULL) { |
---|
| 230 | status = _nss_nonlocal_setpwent(0); |
---|
| 231 | if (status != NSS_STATUS_SUCCESS) |
---|
| 232 | return status; |
---|
| 233 | } |
---|
| 234 | do { |
---|
| 235 | if (pwent_fct.ptr == NULL) |
---|
| 236 | status = NSS_STATUS_UNAVAIL; |
---|
| 237 | else { |
---|
| 238 | int nonlocal_errno; |
---|
| 239 | do |
---|
[22768] | 240 | status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop)); |
---|
[22686] | 241 | while (status == NSS_STATUS_SUCCESS && |
---|
[24122] | 242 | check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS); |
---|
[22686] | 243 | } |
---|
| 244 | if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) |
---|
| 245 | return status; |
---|
| 246 | |
---|
| 247 | if (status == NSS_STATUS_SUCCESS) |
---|
| 248 | return NSS_STATUS_SUCCESS; |
---|
| 249 | } while (__nss_next(&pwent_nip, pwent_fct_name, &pwent_fct.ptr, status, 0) == 0); |
---|
| 250 | |
---|
| 251 | pwent_nip = NULL; |
---|
| 252 | return NSS_STATUS_NOTFOUND; |
---|
| 253 | } |
---|
| 254 | |
---|
| 255 | |
---|
| 256 | enum nss_status |
---|
| 257 | _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd, |
---|
| 258 | char *buffer, size_t buflen, int *errnop) |
---|
| 259 | { |
---|
| 260 | enum nss_status status; |
---|
| 261 | int group_errno; |
---|
[25083] | 262 | const struct walk_nss w = { |
---|
| 263 | .lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r", |
---|
| 264 | .status = &status, .errnop = errnop |
---|
| 265 | }; |
---|
| 266 | const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL; |
---|
[22686] | 267 | |
---|
[22768] | 268 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 269 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22714] | 270 | return NSS_STATUS_UNAVAIL; |
---|
| 271 | |
---|
[25083] | 272 | #define args (name, pwd, buffer, buflen, errnop) |
---|
| 273 | #include "walk_nss.h" |
---|
| 274 | #undef args |
---|
[22686] | 275 | if (status != NSS_STATUS_SUCCESS) |
---|
| 276 | return status; |
---|
| 277 | |
---|
[24122] | 278 | if (strcmp(name, pwd->pw_name) != 0) { |
---|
| 279 | syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name); |
---|
| 280 | return NSS_STATUS_NOTFOUND; |
---|
| 281 | } |
---|
| 282 | |
---|
| 283 | status = check_nonlocal_passwd(name, pwd, errnop); |
---|
[22686] | 284 | if (status != NSS_STATUS_SUCCESS) |
---|
| 285 | return status; |
---|
| 286 | |
---|
[25083] | 287 | if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) != |
---|
[22686] | 288 | NSS_STATUS_SUCCESS) |
---|
| 289 | pwd->pw_gid = 65534 /* nogroup */; |
---|
| 290 | return NSS_STATUS_SUCCESS; |
---|
| 291 | } |
---|
| 292 | |
---|
| 293 | enum nss_status |
---|
| 294 | _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd, |
---|
| 295 | char *buffer, size_t buflen, int *errnop) |
---|
| 296 | { |
---|
| 297 | enum nss_status status; |
---|
| 298 | int group_errno; |
---|
[25083] | 299 | const struct walk_nss w = { |
---|
| 300 | .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "getpwuid_r", |
---|
| 301 | .status = &status, .errnop = errnop |
---|
| 302 | }; |
---|
| 303 | const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL; |
---|
[22686] | 304 | |
---|
[22768] | 305 | char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); |
---|
[23113] | 306 | if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') |
---|
[22686] | 307 | return NSS_STATUS_UNAVAIL; |
---|
| 308 | |
---|
[25083] | 309 | #define args (uid, pwd, buffer, buflen, errnop) |
---|
| 310 | #include "walk_nss.h" |
---|
| 311 | #undef args |
---|
[22686] | 312 | if (status != NSS_STATUS_SUCCESS) |
---|
| 313 | return status; |
---|
| 314 | |
---|
[24585] | 315 | if (uid != pwd->pw_uid) { |
---|
| 316 | syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid); |
---|
| 317 | return NSS_STATUS_NOTFOUND; |
---|
| 318 | } |
---|
| 319 | |
---|
[24122] | 320 | status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop); |
---|
[22686] | 321 | if (status != NSS_STATUS_SUCCESS) |
---|
| 322 | return status; |
---|
| 323 | |
---|
[25083] | 324 | if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) != |
---|
[22686] | 325 | NSS_STATUS_SUCCESS) |
---|
| 326 | pwd->pw_gid = 65534 /* nogroup */; |
---|
| 327 | return NSS_STATUS_SUCCESS; |
---|
| 328 | } |
---|