]> andersk Git - nss_nonlocal.git/blame - nonlocal-passwd.c
Guard one-time initialization with memory barriers
[nss_nonlocal.git] / nonlocal-passwd.c
CommitLineData
f6903667
AK
1/*
2 * nonlocal-passwd.c
3 * passwd database for nss_nonlocal proxy.
4 *
96a1ee0f
AK
5 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
6 * Abbott <tabbott@mit.edu>
f6903667 7 *
96a1ee0f 8 * This file is part of nss_nonlocal.
f6903667 9 *
96a1ee0f
AK
10 * nss_nonlocal is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public License
12 * as published by the Free Software Foundation; either version 2.1 of
13 * the License, or (at your option) any later version.
f6903667 14 *
96a1ee0f
AK
15 * nss_nonlocal is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
19 *
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with nss_nonlocal; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
23 * 02110-1301 USA
f6903667
AK
24 */
25
26
27#define _GNU_SOURCE
dc397f8f 28
f6903667 29#include <sys/types.h>
f6903667 30#include <dlfcn.h>
f6903667 31#include <errno.h>
f6903667 32#include <nss.h>
dc397f8f
AK
33#include <pwd.h>
34#include <stdbool.h>
35#include <stddef.h>
36#include <stdlib.h>
37#include <string.h>
38#include <syslog.h>
39#include <unistd.h>
40
f6903667
AK
41#include "nsswitch-internal.h"
42#include "nonlocal.h"
43
c1812233
AK
44
45enum nss_status
46_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
47 char *buffer, size_t buflen, int *errnop);
48enum nss_status
49_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
50 char *buffer, size_t buflen, int *errnop);
f7293a54 51
f6903667 52
cbb0e3ea
AK
53static service_user *__nss_passwd_nonlocal_database;
54
55static int
56internal_function
57__nss_passwd_nonlocal_lookup(service_user **ni, const char *fct_name,
58 void **fctp)
f6903667 59{
cbb0e3ea
AK
60 if (__nss_passwd_nonlocal_database == NULL
61 && __nss_database_lookup("passwd_nonlocal", NULL, NULL,
62 &__nss_passwd_nonlocal_database) < 0)
63 return -1;
64
65 *ni = __nss_passwd_nonlocal_database;
f6903667 66
cbb0e3ea
AK
67 *fctp = __nss_lookup_function(*ni, fct_name);
68 return 0;
f6903667
AK
69}
70
71
f6903667
AK
72enum nss_status
73check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
74{
30fb3957 75 enum nss_status status;
f7293a54 76 struct passwd pwbuf;
cbb0e3ea 77 char *buf;
8870ee9c 78 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
cbb0e3ea
AK
79 const struct walk_nss w = {
80 .lookup = &__nss_passwd_lookup, .fct_name = "getpwuid_r",
81 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
82 };
83 const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;
84#define args (uid, &pwbuf, buf, buflen, errnop)
85#include "walk_nss.h"
86#undef args
30fb3957
AK
87
88 if (status == NSS_STATUS_SUCCESS) {
f7293a54 89 syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
cbb0e3ea 90 free(buf);
f6903667 91 status = NSS_STATUS_NOTFOUND;
30fb3957
AK
92 } else if (status != NSS_STATUS_TRYAGAIN) {
93 status = NSS_STATUS_SUCCESS;
f6903667 94 }
30fb3957 95
f6903667
AK
96 return status;
97}
98
cf338316
AK
99enum nss_status
100check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop)
101{
a07a7616
AK
102 enum nss_status status = NSS_STATUS_SUCCESS;
103 int old_errno = errno;
104 char *end;
105 unsigned long uid;
106
107 errno = 0;
108 uid = strtoul(pwd->pw_name, &end, 10);
f4061d47
AK
109 if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {
110 errno = old_errno;
a07a7616 111 status = check_nonlocal_uid(user, uid, errnop);
f4061d47
AK
112 } else {
113 errno = old_errno;
114 }
a07a7616
AK
115 if (status != NSS_STATUS_SUCCESS)
116 return status;
117
cf338316
AK
118 return check_nonlocal_uid(user, pwd->pw_uid, errnop);
119}
120
48479fc7
TA
121enum nss_status
122check_nonlocal_user(const char *user, int *errnop)
123{
30fb3957 124 enum nss_status status;
48479fc7 125 struct passwd pwbuf;
cbb0e3ea 126 char *buf;
8870ee9c 127 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
cbb0e3ea
AK
128 const struct walk_nss w = {
129 .lookup = __nss_passwd_lookup, .fct_name = "getpwnam_r",
130 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
131 };
132 const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;
133#define args (user, &pwbuf, buf, buflen, errnop)
134#include "walk_nss.h"
135#undef args
30fb3957 136
cbb0e3ea 137 if (status == NSS_STATUS_SUCCESS) {
30fb3957 138 free(buf);
30fb3957 139 status = NSS_STATUS_NOTFOUND;
cbb0e3ea 140 } else if (status != NSS_STATUS_TRYAGAIN) {
30fb3957 141 status = NSS_STATUS_SUCCESS;
cbb0e3ea 142 }
30fb3957 143
48479fc7
TA
144 return status;
145}
f6903667 146
775f7dc3
AK
147enum nss_status
148get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer,
149 int *errnop)
150{
151 enum nss_status status;
152 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
153 const struct walk_nss w = {
154 .lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
155 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
156 };
157 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
158#define args (name, pwd, *buffer, buflen, errnop)
159#include "walk_nss.h"
160#undef args
161 return status;
162}
163
1e78305d 164
48939704 165static bool pwent_initialized = false;
cbb0e3ea 166static service_user *pwent_startp, *pwent_nip;
f6903667
AK
167static void *pwent_fct_start;
168static union {
169 enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen,
170 int *errnop);
171 void *ptr;
172} pwent_fct;
173static const char *pwent_fct_name = "getpwent_r";
174
175enum nss_status
176_nss_nonlocal_setpwent(int stayopen)
177{
f6903667 178 enum nss_status status;
cbb0e3ea
AK
179 const struct walk_nss w = {
180 .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "setpwent",
181 .status = &status
182 };
183 const __typeof__(&_nss_nonlocal_setpwent) self = NULL;
184#define args (stayopen)
185#include "walk_nss.h"
186#undef args
f6903667
AK
187 if (status != NSS_STATUS_SUCCESS)
188 return status;
189
48939704 190 if (!pwent_initialized) {
cbb0e3ea
AK
191 __nss_passwd_nonlocal_lookup(&pwent_startp, pwent_fct_name,
192 &pwent_fct_start);
48939704
AK
193 __sync_synchronize();
194 pwent_initialized = true;
195 }
cbb0e3ea 196 pwent_nip = pwent_startp;
f6903667
AK
197 pwent_fct.ptr = pwent_fct_start;
198 return NSS_STATUS_SUCCESS;
199}
200
201enum nss_status
202_nss_nonlocal_endpwent(void)
203{
f6903667 204 enum nss_status status;
cbb0e3ea
AK
205 const struct walk_nss w = {
206 .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "endpwent",
207 .status = &status
208 };
209 const __typeof__(&_nss_nonlocal_endpwent) self = NULL;
f6903667
AK
210
211 pwent_nip = NULL;
212
cbb0e3ea
AK
213#define args ()
214#include "walk_nss.h"
215#undef args
f6903667
AK
216 return status;
217}
218
219enum nss_status
220_nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen,
221 int *errnop)
222{
223 enum nss_status status;
a360549e
TA
224
225 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233 226 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
a360549e
TA
227 return NSS_STATUS_UNAVAIL;
228
f6903667
AK
229 if (pwent_nip == NULL) {
230 status = _nss_nonlocal_setpwent(0);
231 if (status != NSS_STATUS_SUCCESS)
232 return status;
233 }
234 do {
235 if (pwent_fct.ptr == NULL)
236 status = NSS_STATUS_UNAVAIL;
237 else {
238 int nonlocal_errno;
239 do
a360549e 240 status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));
f6903667 241 while (status == NSS_STATUS_SUCCESS &&
cf338316 242 check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);
f6903667
AK
243 }
244 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
245 return status;
246
247 if (status == NSS_STATUS_SUCCESS)
248 return NSS_STATUS_SUCCESS;
249 } while (__nss_next(&pwent_nip, pwent_fct_name, &pwent_fct.ptr, status, 0) == 0);
250
251 pwent_nip = NULL;
252 return NSS_STATUS_NOTFOUND;
253}
254
255
256enum nss_status
257_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
258 char *buffer, size_t buflen, int *errnop)
259{
f6903667 260 enum nss_status status;
f6903667 261 int group_errno;
cbb0e3ea
AK
262 const struct walk_nss w = {
263 .lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
264 .status = &status, .errnop = errnop
265 };
266 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
f6903667 267
a360549e 268 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233 269 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
48479fc7
TA
270 return NSS_STATUS_UNAVAIL;
271
cbb0e3ea
AK
272#define args (name, pwd, buffer, buflen, errnop)
273#include "walk_nss.h"
274#undef args
f6903667
AK
275 if (status != NSS_STATUS_SUCCESS)
276 return status;
277
22562df0
AK
278 if (strcmp(name, pwd->pw_name) != 0) {
279 syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);
280 return NSS_STATUS_NOTFOUND;
281 }
282
cf338316 283 status = check_nonlocal_passwd(name, pwd, errnop);
f6903667
AK
284 if (status != NSS_STATUS_SUCCESS)
285 return status;
286
25468b96 287 if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=
f6903667
AK
288 NSS_STATUS_SUCCESS)
289 pwd->pw_gid = 65534 /* nogroup */;
290 return NSS_STATUS_SUCCESS;
291}
292
293enum nss_status
294_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
295 char *buffer, size_t buflen, int *errnop)
296{
f6903667 297 enum nss_status status;
f6903667 298 int group_errno;
cbb0e3ea
AK
299 const struct walk_nss w = {
300 .lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "getpwuid_r",
301 .status = &status, .errnop = errnop
302 };
303 const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;
f6903667 304
a360549e 305 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233 306 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
f6903667
AK
307 return NSS_STATUS_UNAVAIL;
308
cbb0e3ea
AK
309#define args (uid, pwd, buffer, buflen, errnop)
310#include "walk_nss.h"
311#undef args
f6903667
AK
312 if (status != NSS_STATUS_SUCCESS)
313 return status;
314
8027fdc4
AK
315 if (uid != pwd->pw_uid) {
316 syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);
317 return NSS_STATUS_NOTFOUND;
318 }
319
cf338316 320 status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);
f6903667
AK
321 if (status != NSS_STATUS_SUCCESS)
322 return status;
323
25468b96 324 if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=
f6903667
AK
325 NSS_STATUS_SUCCESS)
326 pwd->pw_gid = 65534 /* nogroup */;
327 return NSS_STATUS_SUCCESS;
328}
This page took 0.095496 seconds and 5 git commands to generate.