[nss_nonlocal.git] / nonlocal-passwd.c

/*
 * nonlocal-passwd.c
 * passwd database for nss_nonlocal proxy.
 *
 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
 * Abbott <tabbott@mit.edu>
 *
 * This file is part of nss_nonlocal.
 *
 * nss_nonlocal is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * nss_nonlocal is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with nss_nonlocal; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301  USA
 */


#define _GNU_SOURCE

#include <sys/types.h>
#include <dlfcn.h>
#include <errno.h>
#include <nss.h>
#include <pwd.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>

#include "nsswitch-internal.h"
#include "nonlocal.h"


enum nss_status
_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
			 char *buffer, size_t buflen, int *errnop);
enum nss_status
_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
			 char *buffer, size_t buflen, int *errnop);


static service_user *__nss_passwd_nonlocal_database;

static int
internal_function
__nss_passwd_nonlocal_lookup(service_user **ni, const char *fct_name,
			     void **fctp)
{
    if (__nss_passwd_nonlocal_database == NULL
	&& __nss_database_lookup("passwd_nonlocal", NULL, NULL,
				 &__nss_passwd_nonlocal_database) < 0)
	return -1;

    *ni = __nss_passwd_nonlocal_database;

    *fctp = __nss_lookup_function(*ni, fct_name);
    return 0;
}


enum nss_status
check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
{
    enum nss_status status;
    struct passwd pwbuf;
    char *buf;
    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
    const struct walk_nss w = {
	.lookup = &__nss_passwd_lookup, .fct_name = "getpwuid_r",
	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
    };
    const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;
#define args (uid, &pwbuf, buf, buflen, errnop)
#include "walk_nss.h"
#undef args

    if (status == NSS_STATUS_SUCCESS) {
	syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
	free(buf);
	status = NSS_STATUS_NOTFOUND;
    } else if (status != NSS_STATUS_TRYAGAIN) {
	status = NSS_STATUS_SUCCESS;
    }

    return status;
}

enum nss_status
check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop)
{
    enum nss_status status = NSS_STATUS_SUCCESS;
    int old_errno = errno;
    char *end;
    unsigned long uid;

    errno = 0;
    uid = strtoul(pwd->pw_name, &end, 10);
    if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {
	errno = old_errno;
	status = check_nonlocal_uid(user, uid, errnop);
    } else {
	errno = old_errno;
    }
    if (status != NSS_STATUS_SUCCESS)
	return status;

    return check_nonlocal_uid(user, pwd->pw_uid, errnop);
}

enum nss_status
check_nonlocal_user(const char *user, int *errnop)
{
    enum nss_status status;
    struct passwd pwbuf;
    char *buf;
    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
    const struct walk_nss w = {
	.lookup = __nss_passwd_lookup, .fct_name = "getpwnam_r",
	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
    };
    const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;
#define args (user, &pwbuf, buf, buflen, errnop)
#include "walk_nss.h"
#undef args

    if (status == NSS_STATUS_SUCCESS) {
	free(buf);
	status = NSS_STATUS_NOTFOUND;
    } else if (status != NSS_STATUS_TRYAGAIN) {
	status = NSS_STATUS_SUCCESS;
    }

    return status;
}

enum nss_status
get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer,
		    int *errnop)
{
    enum nss_status status;
    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
    const struct walk_nss w = {
	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
    };
    const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
#define args (name, pwd, *buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    return status;
}


static bool pwent_initialized = false;
static service_user *pwent_startp, *pwent_nip;
static void *pwent_fct_start;
static union {
    enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen,
			 int *errnop);
    void *ptr;
} pwent_fct;
static const char *pwent_fct_name = "getpwent_r";

enum nss_status
_nss_nonlocal_setpwent(int stayopen)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "setpwent",
	.status = &status
    };
    const __typeof__(&_nss_nonlocal_setpwent) self = NULL;
#define args (stayopen)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (!pwent_initialized) {
	__nss_passwd_nonlocal_lookup(&pwent_startp, pwent_fct_name,
				     &pwent_fct_start);
	__sync_synchronize();
	pwent_initialized = true;
    }
    pwent_nip = pwent_startp;
    pwent_fct.ptr = pwent_fct_start;
    return NSS_STATUS_SUCCESS;
}

enum nss_status
_nss_nonlocal_endpwent(void)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "endpwent",
	.status = &status
    };
    const __typeof__(&_nss_nonlocal_endpwent) self = NULL;

    pwent_nip = NULL;

#define args ()
#include "walk_nss.h"
#undef args
    return status;
}

enum nss_status
_nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen,
			 int *errnop)
{
    enum nss_status status;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

    if (pwent_nip == NULL) {
	status = _nss_nonlocal_setpwent(0);
	if (status != NSS_STATUS_SUCCESS)
	    return status;
    }
    do {
	if (pwent_fct.ptr == NULL)
	    status = NSS_STATUS_UNAVAIL;
	else {
	    int nonlocal_errno;
	    do
		status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));
	    while (status == NSS_STATUS_SUCCESS &&
		   check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);
	}
	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
	    return status;

	if (status == NSS_STATUS_SUCCESS)
	    return NSS_STATUS_SUCCESS;
    } while (__nss_next(&pwent_nip, pwent_fct_name, &pwent_fct.ptr, status, 0) == 0);

    pwent_nip = NULL;
    return NSS_STATUS_NOTFOUND;
}


enum nss_status
_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
			 char *buffer, size_t buflen, int *errnop)
{
    enum nss_status status;
    int group_errno;
    const struct walk_nss w = {
	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
	.status = &status, .errnop = errnop
    };
    const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

#define args (name, pwd, buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (strcmp(name, pwd->pw_name) != 0) {
	syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);
	return NSS_STATUS_NOTFOUND;
    }

    status = check_nonlocal_passwd(name, pwd, errnop);
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=
	NSS_STATUS_SUCCESS)
	pwd->pw_gid = 65534 /* nogroup */;
    return NSS_STATUS_SUCCESS;
}

enum nss_status
_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
			 char *buffer, size_t buflen, int *errnop)
{
    enum nss_status status;
    int group_errno;
    const struct walk_nss w = {
	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "getpwuid_r",
	.status = &status, .errnop = errnop
    };
    const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

#define args (uid, pwd, buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (uid != pwd->pw_uid) {
	syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);
	return NSS_STATUS_NOTFOUND;
    }

    status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=
	NSS_STATUS_SUCCESS)
	pwd->pw_gid = 65534 /* nogroup */;
    return NSS_STATUS_SUCCESS;
}
Commit	Line	Data
f6903667 AK	1	/*
	2	* nonlocal-passwd.c
	3	* passwd database for nss_nonlocal proxy.
	4	*
96a1ee0f AK	5	* Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
96a1ee0f AK	6	* Abbott <tabbott@mit.edu>
f6903667	7	*
96a1ee0f	8	* This file is part of nss_nonlocal.
f6903667	9	*
96a1ee0f AK	10	* nss_nonlocal is free software; you can redistribute it and/or
	11	* modify it under the terms of the GNU Lesser General Public License
	12	* as published by the Free Software Foundation; either version 2.1 of
	13	* the License, or (at your option) any later version.
f6903667	14	*
96a1ee0f AK	15	* nss_nonlocal is distributed in the hope that it will be useful, but
	16	* WITHOUT ANY WARRANTY; without even the implied warranty of
	17	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	18	* Lesser General Public License for more details.
	19	*
	20	* You should have received a copy of the GNU Lesser General Public
	21	* License along with nss_nonlocal; if not, write to the Free Software
	22	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
	23	* 02110-1301 USA
f6903667 AK	24	*/
	25
	26
	27	#define _GNU_SOURCE
dc397f8f	28
f6903667	29	#include <sys/types.h>
f6903667	30	#include <dlfcn.h>
f6903667	31	#include <errno.h>
f6903667	32	#include <nss.h>
dc397f8f AK	33	#include <pwd.h>
	34	#include <stdbool.h>
	35	#include <stddef.h>
	36	#include <stdlib.h>
	37	#include <string.h>
	38	#include <syslog.h>
	39	#include <unistd.h>
	40
f6903667 AK	41	#include "nsswitch-internal.h"
	42	#include "nonlocal.h"
	43
c1812233 AK	44
	45	enum nss_status
	46	_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
	47	char buffer, size_t buflen, int errnop);
	48	enum nss_status
	49	_nss_nonlocal_getpwnam_r(const char name, struct passwd pwd,
	50	char buffer, size_t buflen, int errnop);
f7293a54	51
f6903667	52
cbb0e3ea AK	53	static service_user *__nss_passwd_nonlocal_database;
	54
	55	static int
	56	internal_function
	57	__nss_passwd_nonlocal_lookup(service_user *ni, const char fct_name,
	58	void **fctp)
f6903667	59	{
cbb0e3ea AK	60	if (__nss_passwd_nonlocal_database == NULL
	61	&& __nss_database_lookup("passwd_nonlocal", NULL, NULL,
	62	&__nss_passwd_nonlocal_database) < 0)
	63	return -1;
	64
	65	*ni = __nss_passwd_nonlocal_database;
f6903667	66
cbb0e3ea AK	67	fctp = __nss_lookup_function(ni, fct_name);
cbb0e3ea AK	68	return 0;
f6903667 AK	69	}
	70
	71
f6903667 AK	72	enum nss_status
	73	check_nonlocal_uid(const char user, uid_t uid, int errnop)
	74	{
30fb3957	75	enum nss_status status;
f7293a54	76	struct passwd pwbuf;
cbb0e3ea	77	char *buf;
8870ee9c	78	size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
cbb0e3ea AK	79	const struct walk_nss w = {
	80	.lookup = &__nss_passwd_lookup, .fct_name = "getpwuid_r",
	81	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
	82	};
	83	const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;
	84	#define args (uid, &pwbuf, buf, buflen, errnop)
	85	#include "walk_nss.h"
	86	#undef args
30fb3957 AK	87
30fb3957 AK	88	if (status == NSS_STATUS_SUCCESS) {
f7293a54	89	syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
cbb0e3ea	90	free(buf);
f6903667	91	status = NSS_STATUS_NOTFOUND;
30fb3957 AK	92	} else if (status != NSS_STATUS_TRYAGAIN) {
30fb3957 AK	93	status = NSS_STATUS_SUCCESS;
f6903667	94	}
30fb3957	95
f6903667 AK	96	return status;
	97	}
	98
cf338316 AK	99	enum nss_status
	100	check_nonlocal_passwd(const char user, struct passwd pwd, int *errnop)
	101	{
a07a7616 AK	102	enum nss_status status = NSS_STATUS_SUCCESS;
	103	int old_errno = errno;
	104	char *end;
	105	unsigned long uid;
	106
	107	errno = 0;
	108	uid = strtoul(pwd->pw_name, &end, 10);
f4061d47 AK	109	if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {
f4061d47 AK	110	errno = old_errno;
a07a7616	111	status = check_nonlocal_uid(user, uid, errnop);
f4061d47 AK	112	} else {
	113	errno = old_errno;
	114	}
a07a7616 AK	115	if (status != NSS_STATUS_SUCCESS)
	116	return status;
	117
cf338316 AK	118	return check_nonlocal_uid(user, pwd->pw_uid, errnop);
	119	}
	120
48479fc7 TA	121	enum nss_status
	122	check_nonlocal_user(const char user, int errnop)
	123	{
30fb3957	124	enum nss_status status;
48479fc7	125	struct passwd pwbuf;
cbb0e3ea	126	char *buf;
8870ee9c	127	size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
cbb0e3ea AK	128	const struct walk_nss w = {
	129	.lookup = __nss_passwd_lookup, .fct_name = "getpwnam_r",
	130	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
	131	};
	132	const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;
	133	#define args (user, &pwbuf, buf, buflen, errnop)
	134	#include "walk_nss.h"
	135	#undef args
30fb3957	136
cbb0e3ea	137	if (status == NSS_STATUS_SUCCESS) {
30fb3957	138	free(buf);
30fb3957	139	status = NSS_STATUS_NOTFOUND;
cbb0e3ea	140	} else if (status != NSS_STATUS_TRYAGAIN) {
30fb3957	141	status = NSS_STATUS_SUCCESS;
cbb0e3ea	142	}
30fb3957	143
48479fc7 TA	144	return status;
48479fc7 TA	145	}
f6903667	146
775f7dc3 AK	147	enum nss_status
	148	get_nonlocal_passwd(const char name, struct passwd pwd, char **buffer,
	149	int *errnop)
	150	{
	151	enum nss_status status;
	152	size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
	153	const struct walk_nss w = {
	154	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
	155	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
	156	};
	157	const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
	158	#define args (name, pwd, *buffer, buflen, errnop)
	159	#include "walk_nss.h"
	160	#undef args
	161	return status;
	162	}
	163
1e78305d	164
48939704	165	static bool pwent_initialized = false;
cbb0e3ea	166	static service_user pwent_startp, pwent_nip;
f6903667 AK	167	static void *pwent_fct_start;
	168	static union {
	169	enum nss_status (l)(struct passwd pwd, char *buffer, size_t buflen,
	170	int *errnop);
	171	void *ptr;
	172	} pwent_fct;
	173	static const char *pwent_fct_name = "getpwent_r";
	174
	175	enum nss_status
	176	_nss_nonlocal_setpwent(int stayopen)
	177	{
f6903667	178	enum nss_status status;
cbb0e3ea AK	179	const struct walk_nss w = {
	180	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "setpwent",
	181	.status = &status
	182	};
	183	const __typeof__(&_nss_nonlocal_setpwent) self = NULL;
	184	#define args (stayopen)
	185	#include "walk_nss.h"
	186	#undef args
f6903667 AK	187	if (status != NSS_STATUS_SUCCESS)
	188	return status;
	189
48939704	190	if (!pwent_initialized) {
cbb0e3ea AK	191	__nss_passwd_nonlocal_lookup(&pwent_startp, pwent_fct_name,
cbb0e3ea AK	192	&pwent_fct_start);
48939704 AK	193	__sync_synchronize();
	194	pwent_initialized = true;
	195	}
cbb0e3ea	196	pwent_nip = pwent_startp;
f6903667 AK	197	pwent_fct.ptr = pwent_fct_start;
	198	return NSS_STATUS_SUCCESS;
	199	}
	200
	201	enum nss_status
	202	_nss_nonlocal_endpwent(void)
	203	{
f6903667	204	enum nss_status status;
cbb0e3ea AK	205	const struct walk_nss w = {
	206	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "endpwent",
	207	.status = &status
	208	};
	209	const __typeof__(&_nss_nonlocal_endpwent) self = NULL;
f6903667 AK	210
	211	pwent_nip = NULL;
	212
cbb0e3ea AK	213	#define args ()
	214	#include "walk_nss.h"
	215	#undef args
f6903667 AK	216	return status;
	217	}
	218
	219	enum nss_status
	220	_nss_nonlocal_getpwent_r(struct passwd pwd, char buffer, size_t buflen,
	221	int *errnop)
	222	{
	223	enum nss_status status;
a360549e TA	224
a360549e TA	225	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	226	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
a360549e TA	227	return NSS_STATUS_UNAVAIL;
a360549e TA	228
f6903667 AK	229	if (pwent_nip == NULL) {
	230	status = _nss_nonlocal_setpwent(0);
	231	if (status != NSS_STATUS_SUCCESS)
	232	return status;
	233	}
	234	do {
	235	if (pwent_fct.ptr == NULL)
	236	status = NSS_STATUS_UNAVAIL;
	237	else {
	238	int nonlocal_errno;
	239	do
a360549e	240	status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));
f6903667	241	while (status == NSS_STATUS_SUCCESS &&
cf338316	242	check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);
f6903667 AK	243	}
	244	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
	245	return status;
	246
	247	if (status == NSS_STATUS_SUCCESS)
	248	return NSS_STATUS_SUCCESS;
	249	} while (__nss_next(&pwent_nip, pwent_fct_name, &pwent_fct.ptr, status, 0) == 0);
	250
	251	pwent_nip = NULL;
	252	return NSS_STATUS_NOTFOUND;
	253	}
	254
	255
	256	enum nss_status
	257	_nss_nonlocal_getpwnam_r(const char name, struct passwd pwd,
	258	char buffer, size_t buflen, int errnop)
	259	{
f6903667	260	enum nss_status status;
f6903667	261	int group_errno;
cbb0e3ea AK	262	const struct walk_nss w = {
	263	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
	264	.status = &status, .errnop = errnop
	265	};
	266	const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
f6903667	267
a360549e	268	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	269	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
48479fc7 TA	270	return NSS_STATUS_UNAVAIL;
48479fc7 TA	271
cbb0e3ea AK	272	#define args (name, pwd, buffer, buflen, errnop)
	273	#include "walk_nss.h"
	274	#undef args
f6903667 AK	275	if (status != NSS_STATUS_SUCCESS)
	276	return status;
	277
22562df0 AK	278	if (strcmp(name, pwd->pw_name) != 0) {
	279	syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);
	280	return NSS_STATUS_NOTFOUND;
	281	}
	282
cf338316	283	status = check_nonlocal_passwd(name, pwd, errnop);
f6903667 AK	284	if (status != NSS_STATUS_SUCCESS)
	285	return status;
	286
25468b96	287	if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=
f6903667 AK	288	NSS_STATUS_SUCCESS)
	289	pwd->pw_gid = 65534 /* nogroup */;
	290	return NSS_STATUS_SUCCESS;
	291	}
	292
	293	enum nss_status
	294	_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
	295	char buffer, size_t buflen, int errnop)
	296	{
f6903667	297	enum nss_status status;
f6903667	298	int group_errno;
cbb0e3ea AK	299	const struct walk_nss w = {
	300	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "getpwuid_r",
	301	.status = &status, .errnop = errnop
	302	};
	303	const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;
f6903667	304
a360549e	305	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	306	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
f6903667 AK	307	return NSS_STATUS_UNAVAIL;
f6903667 AK	308
cbb0e3ea AK	309	#define args (uid, pwd, buffer, buflen, errnop)
	310	#include "walk_nss.h"
	311	#undef args
f6903667 AK	312	if (status != NSS_STATUS_SUCCESS)
	313	return status;
	314
8027fdc4 AK	315	if (uid != pwd->pw_uid) {
	316	syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);
	317	return NSS_STATUS_NOTFOUND;
	318	}
	319
cf338316	320	status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);
f6903667 AK	321	if (status != NSS_STATUS_SUCCESS)
	322	return status;
	323
25468b96	324	if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=
f6903667 AK	325	NSS_STATUS_SUCCESS)
	326	pwd->pw_gid = 65534 /* nogroup */;
	327	return NSS_STATUS_SUCCESS;
	328	}