[nss_nonlocal.git] / nonlocal-group.c

/*
 * nonlocal-group.c
 * group database for nss_nonlocal proxy
 *
 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
 * Abbott <tabbott@mit.edu>
 *
 * This file is part of nss_nonlocal.
 *
 * nss_nonlocal is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * nss_nonlocal is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with nss_nonlocal; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301  USA
 */

#define _GNU_SOURCE
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <dlfcn.h>
#include <stdio.h>
#include <syslog.h>
#include <errno.h>
#include <grp.h>
#include <nss.h>
#include "nsswitch-internal.h"
#include "nonlocal.h"

/*
 * If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
 * users will be automatically added to it.
 */
#define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"

/*
 * If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
 * will be automatically added to it.
 */
#define MAGIC_LOCAL_GROUPNAME "nss-local-users"


enum nss_status
_nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
			 char *buffer, size_t buflen, int *errnop);

enum nss_status
_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
			 char *buffer, size_t buflen, int *errnop);


static service_user *__nss_group_nonlocal_database;

static int
internal_function
__nss_group_nonlocal_lookup(service_user **ni, const char *fct_name,
			    void **fctp)
{
    if (__nss_group_nonlocal_database == NULL
	&& __nss_database_lookup("group_nonlocal", NULL, NULL,
				 &__nss_group_nonlocal_database) < 0)
	return -1;

    *ni = __nss_group_nonlocal_database;

    *fctp = __nss_lookup_function(*ni, fct_name);
    return 0;
}


enum nss_status
check_nonlocal_gid(const char *user, gid_t gid, int *errnop)
{
    enum nss_status status;
    struct group gbuf;
    char *buf;
    size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
    const struct walk_nss w = {
	.lookup = &__nss_group_lookup, .fct_name = "getgrgid_r",
	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
    };
    const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
#define args (gid, &gbuf, buf, buflen, errnop)
#include "walk_nss.h"
#undef args

    if (status == NSS_STATUS_SUCCESS) {
	syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
	free(buf);
	status = NSS_STATUS_NOTFOUND;
    } else if (status != NSS_STATUS_TRYAGAIN) {
	status = NSS_STATUS_SUCCESS;
    }

    return status;
}

enum nss_status
check_nonlocal_group(const char *user, struct group *grp, int *errnop)
{
    enum nss_status status = NSS_STATUS_SUCCESS;
    int old_errno = errno;
    char *end;
    unsigned long gid;

    errno = 0;
    gid = strtoul(grp->gr_name, &end, 10);
    if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
	errno = old_errno;
	status = check_nonlocal_gid(user, gid, errnop);
    } else
	errno = old_errno;
    if (status != NSS_STATUS_SUCCESS)
	return status;

    return check_nonlocal_gid(user, grp->gr_gid, errnop);
}

enum nss_status
get_local_group(const char *name, struct group *grp, char **buffer, int *errnop)
{
    enum nss_status status;
    size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
    const struct walk_nss w = {
	.lookup = &__nss_group_lookup, .fct_name = "getgrnam_r",
	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
    };
    const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
#define args (name, grp, *buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    return status;
}

static service_user *grent_startp, *grent_nip;
static void *grent_fct_start;
static union {
    enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen,
			 int *errnop);
    void *ptr;
} grent_fct;
static const char *grent_fct_name = "getgrent_r";

enum nss_status
_nss_nonlocal_setgrent(int stayopen)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "setgrent",
	.status = &status
    };
    const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
#define args (stayopen)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (grent_fct_start == NULL)
	__nss_group_nonlocal_lookup(&grent_startp, grent_fct_name,
				    &grent_fct_start);
    grent_nip = grent_startp;
    grent_fct.ptr = grent_fct_start;
    return NSS_STATUS_SUCCESS;
}

enum nss_status
_nss_nonlocal_endgrent(void)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "endgrent",
	.status = &status
    };
    const __typeof__(&_nss_nonlocal_endgrent) self = NULL;

    grent_nip = NULL;

#define args ()
#include "walk_nss.h"
#undef args
    return status;
}

enum nss_status
_nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen,
			 int *errnop)
{
    enum nss_status status;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

    if (grent_nip == NULL) {
	status = _nss_nonlocal_setgrent(0);
	if (status != NSS_STATUS_SUCCESS)
	    return status;
    }
    do {
	if (grent_fct.ptr == NULL)
	    status = NSS_STATUS_UNAVAIL;
	else {
	    int nonlocal_errno;
	    do
		status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
	    while (status == NSS_STATUS_SUCCESS &&
		   check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
	}
	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
	    return status;

	if (status == NSS_STATUS_SUCCESS)
	    return NSS_STATUS_SUCCESS;
    } while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0);

    grent_nip = NULL;
    return NSS_STATUS_NOTFOUND;
}


enum nss_status
_nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
			 char *buffer, size_t buflen, int *errnop)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrnam_r",
	.status = &status, .errnop = errnop
    };
    const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

#define args (name, grp, buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (strcmp(name, grp->gr_name) != 0) {
	syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
	return NSS_STATUS_NOTFOUND;
    }

    return check_nonlocal_group(name, grp, errnop);
}

enum nss_status
_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
			 char *buffer, size_t buflen, int *errnop)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrgid_r",
	.status = &status, .errnop = errnop
    };
    const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;

    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
	return NSS_STATUS_UNAVAIL;

#define args (gid, grp, buffer, buflen, errnop)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
	return status;

    if (gid != grp->gr_gid) {
	syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
	return NSS_STATUS_NOTFOUND;
    }

    return check_nonlocal_group(grp->gr_name, grp, errnop);
}

static bool
add_group(gid_t group, long int *start, long int *size, gid_t **groupsp,
	  long int limit, int *errnop, enum nss_status *status)
{
    int i, old_errno = errno;
    for (i = 0; i < *start; ++i)
	if ((*groupsp)[i] == group)
	    return true;
    if (*start + 1 > *size) {
	gid_t *newgroups;
	long int newsize = 2 * *size;
	if (limit > 0) {
	    if (*size >= limit) {
		*status = NSS_STATUS_SUCCESS;
		return false;
	    }
	    if (newsize > limit)
		newsize = limit;
	}
	newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0]));
	errno = old_errno;
	if (newgroups == NULL) {
	    *errnop = ENOMEM;
	    *status = NSS_STATUS_TRYAGAIN;
	    return false;
	}
	*groupsp = newgroups;
	*size = newsize;
    }
    (*groupsp)[(*start)++] = group;
    return true;
}

enum nss_status
_nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
			     long int *size, gid_t **groupsp, long int limit,
			     int *errnop)
{
    enum nss_status status;
    const struct walk_nss w = {
	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "initgroups_dyn",
	.status = &status, .errnop = errnop
    };
    const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;

    struct group local_users_group, nonlocal_users_group;
    bool is_nonlocal = true;
    char *buffer;
    int in, out, i;

    /* Check that the user is a nonlocal user before adding any groups. */
    status = check_nonlocal_user(user, errnop);
    if (status == NSS_STATUS_TRYAGAIN) {
	return status;
    } else if (status != NSS_STATUS_SUCCESS) {
	is_nonlocal = false;

	status = get_local_group(MAGIC_LOCAL_GROUPNAME,
				 &local_users_group, &buffer, errnop);
	if (status == NSS_STATUS_SUCCESS) {
	    free(buffer);
	    if (!add_group(local_users_group.gr_gid, start, size, groupsp,
			   limit, errnop, &status))
		return status;
	} else if (status == NSS_STATUS_TRYAGAIN) {
	    return status;
	} else {
	    syslog(LOG_WARNING,
		   "nss_nonlocal: Group %s does not exist locally!",
		   MAGIC_LOCAL_GROUPNAME);
	}
    }

    status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
			     &nonlocal_users_group, &buffer, errnop);
    if (status == NSS_STATUS_SUCCESS) {
	free(buffer);
	if (is_nonlocal) {
	    if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
			   limit, errnop, &status))
		return status;
	}
    } else if (status == NSS_STATUS_TRYAGAIN) {
	if (is_nonlocal)
	    return status;
    } else {
	syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
	       MAGIC_NONLOCAL_GROUPNAME);
    }

    if (!is_nonlocal)
	return NSS_STATUS_SUCCESS;

    in = out = *start;

#define args (user, group, start, size, groupsp, limit, errnop)
#include "walk_nss.h"
#undef args
    if (status != NSS_STATUS_SUCCESS)
        return status;

    for (; in < *start; ++in) {
	int nonlocal_errno = *errnop;

	for (i = 0; i < out; ++i)
	    if ((*groupsp)[i] == (*groupsp)[in])
		break;
	if (i < out)
	    continue;

	status = check_nonlocal_gid(user, (*groupsp)[in], &nonlocal_errno);
	if (status == NSS_STATUS_SUCCESS) {
	    (*groupsp)[out++] = (*groupsp)[in];
	} else if (status == NSS_STATUS_TRYAGAIN) {
	    *start = out;
	    *errnop = nonlocal_errno;
	    return status;
	}
    }

    *start = out;
    return NSS_STATUS_SUCCESS;
}
Commit	Line	Data
f6903667 AK	1	/*
	2	* nonlocal-group.c
	3	* group database for nss_nonlocal proxy
	4	*
96a1ee0f AK	5	* Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
96a1ee0f AK	6	* Abbott <tabbott@mit.edu>
f6903667	7	*
96a1ee0f	8	* This file is part of nss_nonlocal.
f6903667	9	*
96a1ee0f AK	10	* nss_nonlocal is free software; you can redistribute it and/or
	11	* modify it under the terms of the GNU Lesser General Public License
	12	* as published by the Free Software Foundation; either version 2.1 of
	13	* the License, or (at your option) any later version.
f6903667	14	*
96a1ee0f AK	15	* nss_nonlocal is distributed in the hope that it will be useful, but
	16	* WITHOUT ANY WARRANTY; without even the implied warranty of
	17	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	18	* Lesser General Public License for more details.
	19	*
	20	* You should have received a copy of the GNU Lesser General Public
	21	* License along with nss_nonlocal; if not, write to the Free Software
	22	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
	23	* 02110-1301 USA
f6903667 AK	24	*/
	25
	26	#define _GNU_SOURCE
	27	#include <sys/types.h>
	28	#include <unistd.h>
	29	#include <stdlib.h>
	30	#include <stdint.h>
	31	#include <string.h>
	32	#include <dlfcn.h>
	33	#include <stdio.h>
	34	#include <syslog.h>
	35	#include <errno.h>
	36	#include <grp.h>
	37	#include <nss.h>
	38	#include "nsswitch-internal.h"
	39	#include "nonlocal.h"
	40
6ca16423 AK	41	/*
	42	* If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
	43	* users will be automatically added to it.
	44	*/
48479fc7	45	#define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"
6ca16423 AK	46
	47	/*
	48	* If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
	49	* will be automatically added to it.
	50	*/
48479fc7	51	#define MAGIC_LOCAL_GROUPNAME "nss-local-users"
f7293a54	52
f6903667	53
c1812233 AK	54	enum nss_status
	55	_nss_nonlocal_getgrnam_r(const char name, struct group grp,
	56	char buffer, size_t buflen, int errnop);
	57
	58	enum nss_status
	59	_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
	60	char buffer, size_t buflen, int errnop);
	61
	62
cbb0e3ea AK	63	static service_user *__nss_group_nonlocal_database;
	64
	65	static int
	66	internal_function
	67	__nss_group_nonlocal_lookup(service_user *ni, const char fct_name,
	68	void **fctp)
f6903667	69	{
cbb0e3ea AK	70	if (__nss_group_nonlocal_database == NULL
	71	&& __nss_database_lookup("group_nonlocal", NULL, NULL,
	72	&__nss_group_nonlocal_database) < 0)
	73	return -1;
	74
	75	*ni = __nss_group_nonlocal_database;
48479fc7	76
cbb0e3ea AK	77	fctp = __nss_lookup_function(ni, fct_name);
cbb0e3ea AK	78	return 0;
f6903667 AK	79	}
	80
	81
f6903667 AK	82	enum nss_status
	83	check_nonlocal_gid(const char user, gid_t gid, int errnop)
	84	{
30fb3957	85	enum nss_status status;
f7293a54	86	struct group gbuf;
cbb0e3ea	87	char *buf;
8870ee9c	88	size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
cbb0e3ea AK	89	const struct walk_nss w = {
	90	.lookup = &__nss_group_lookup, .fct_name = "getgrgid_r",
	91	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
	92	};
	93	const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
	94	#define args (gid, &gbuf, buf, buflen, errnop)
	95	#include "walk_nss.h"
	96	#undef args
30fb3957 AK	97
30fb3957 AK	98	if (status == NSS_STATUS_SUCCESS) {
21b6ddd9	99	syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
cbb0e3ea	100	free(buf);
f6903667	101	status = NSS_STATUS_NOTFOUND;
30fb3957 AK	102	} else if (status != NSS_STATUS_TRYAGAIN) {
30fb3957 AK	103	status = NSS_STATUS_SUCCESS;
f6903667	104	}
30fb3957	105
f6903667 AK	106	return status;
	107	}
	108
cf338316 AK	109	enum nss_status
	110	check_nonlocal_group(const char user, struct group grp, int *errnop)
	111	{
a07a7616 AK	112	enum nss_status status = NSS_STATUS_SUCCESS;
	113	int old_errno = errno;
	114	char *end;
	115	unsigned long gid;
	116
	117	errno = 0;
	118	gid = strtoul(grp->gr_name, &end, 10);
f4061d47 AK	119	if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
f4061d47 AK	120	errno = old_errno;
a07a7616	121	status = check_nonlocal_gid(user, gid, errnop);
f4061d47 AK	122	} else
f4061d47 AK	123	errno = old_errno;
a07a7616 AK	124	if (status != NSS_STATUS_SUCCESS)
	125	return status;
	126
cf338316 AK	127	return check_nonlocal_gid(user, grp->gr_gid, errnop);
	128	}
	129
48479fc7	130	enum nss_status
8aa9014e	131	get_local_group(const char name, struct group grp, char *buffer, int errnop)
48479fc7	132	{
30fb3957	133	enum nss_status status;
cbb0e3ea AK	134	size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
	135	const struct walk_nss w = {
	136	.lookup = &__nss_group_lookup, .fct_name = "getgrnam_r",
	137	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
	138	};
	139	const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
	140	#define args (name, grp, *buffer, buflen, errnop)
	141	#include "walk_nss.h"
	142	#undef args
48479fc7 TA	143	return status;
48479fc7 TA	144	}
f6903667	145
cbb0e3ea	146	static service_user grent_startp, grent_nip;
f6903667 AK	147	static void *grent_fct_start;
	148	static union {
	149	enum nss_status (l)(struct group grp, char *buffer, size_t buflen,
	150	int *errnop);
	151	void *ptr;
	152	} grent_fct;
	153	static const char *grent_fct_name = "getgrent_r";
	154
	155	enum nss_status
	156	_nss_nonlocal_setgrent(int stayopen)
	157	{
f6903667	158	enum nss_status status;
cbb0e3ea AK	159	const struct walk_nss w = {
	160	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "setgrent",
	161	.status = &status
	162	};
	163	const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
	164	#define args (stayopen)
	165	#include "walk_nss.h"
	166	#undef args
f6903667 AK	167	if (status != NSS_STATUS_SUCCESS)
	168	return status;
	169
f6903667	170	if (grent_fct_start == NULL)
cbb0e3ea AK	171	__nss_group_nonlocal_lookup(&grent_startp, grent_fct_name,
	172	&grent_fct_start);
	173	grent_nip = grent_startp;
f6903667 AK	174	grent_fct.ptr = grent_fct_start;
	175	return NSS_STATUS_SUCCESS;
	176	}
	177
	178	enum nss_status
	179	_nss_nonlocal_endgrent(void)
	180	{
f6903667	181	enum nss_status status;
cbb0e3ea AK	182	const struct walk_nss w = {
	183	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "endgrent",
	184	.status = &status
	185	};
	186	const __typeof__(&_nss_nonlocal_endgrent) self = NULL;
f6903667 AK	187
	188	grent_nip = NULL;
	189
cbb0e3ea AK	190	#define args ()
	191	#include "walk_nss.h"
	192	#undef args
f6903667 AK	193	return status;
	194	}
	195
	196	enum nss_status
	197	_nss_nonlocal_getgrent_r(struct group grp, char buffer, size_t buflen,
	198	int *errnop)
	199	{
	200	enum nss_status status;
a360549e TA	201
a360549e TA	202	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	203	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
a360549e TA	204	return NSS_STATUS_UNAVAIL;
a360549e TA	205
f6903667 AK	206	if (grent_nip == NULL) {
	207	status = _nss_nonlocal_setgrent(0);
	208	if (status != NSS_STATUS_SUCCESS)
	209	return status;
	210	}
	211	do {
	212	if (grent_fct.ptr == NULL)
	213	status = NSS_STATUS_UNAVAIL;
	214	else {
	215	int nonlocal_errno;
	216	do
	217	status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
	218	while (status == NSS_STATUS_SUCCESS &&
cf338316	219	check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
f6903667 AK	220	}
	221	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
	222	return status;
	223
	224	if (status == NSS_STATUS_SUCCESS)
	225	return NSS_STATUS_SUCCESS;
	226	} while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0);
	227
	228	grent_nip = NULL;
	229	return NSS_STATUS_NOTFOUND;
	230	}
	231
	232
	233	enum nss_status
	234	_nss_nonlocal_getgrnam_r(const char name, struct group grp,
	235	char buffer, size_t buflen, int errnop)
	236	{
f6903667	237	enum nss_status status;
cbb0e3ea AK	238	const struct walk_nss w = {
	239	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrnam_r",
	240	.status = &status, .errnop = errnop
	241	};
	242	const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;
f6903667	243
a360549e	244	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	245	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
48479fc7 TA	246	return NSS_STATUS_UNAVAIL;
48479fc7 TA	247
cbb0e3ea AK	248	#define args (name, grp, buffer, buflen, errnop)
	249	#include "walk_nss.h"
	250	#undef args
f6903667 AK	251	if (status != NSS_STATUS_SUCCESS)
	252	return status;
	253
22562df0 AK	254	if (strcmp(name, grp->gr_name) != 0) {
	255	syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
	256	return NSS_STATUS_NOTFOUND;
	257	}
	258
cf338316	259	return check_nonlocal_group(name, grp, errnop);
f6903667 AK	260	}
	261
	262	enum nss_status
	263	_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
	264	char buffer, size_t buflen, int errnop)
	265	{
f6903667	266	enum nss_status status;
cbb0e3ea AK	267	const struct walk_nss w = {
	268	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrgid_r",
	269	.status = &status, .errnop = errnop
	270	};
	271	const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;
f6903667	272
a360549e	273	char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
c1812233	274	if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
f6903667 AK	275	return NSS_STATUS_UNAVAIL;
f6903667 AK	276
cbb0e3ea AK	277	#define args (gid, grp, buffer, buflen, errnop)
	278	#include "walk_nss.h"
	279	#undef args
f6903667 AK	280	if (status != NSS_STATUS_SUCCESS)
	281	return status;
	282
8027fdc4 AK	283	if (gid != grp->gr_gid) {
	284	syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
	285	return NSS_STATUS_NOTFOUND;
	286	}
	287
cf338316	288	return check_nonlocal_group(grp->gr_name, grp, errnop);
f6903667 AK	289	}
f6903667 AK	290
dfc6e292 AK	291	static bool
	292	add_group(gid_t group, long int start, long int size, gid_t **groupsp,
	293	long int limit, int errnop, enum nss_status status)
	294	{
	295	int i, old_errno = errno;
	296	for (i = 0; i < *start; ++i)
	297	if ((*groupsp)[i] == group)
	298	return true;
	299	if (start + 1 > size) {
	300	gid_t *newgroups;
	301	long int newsize = 2 * *size;
	302	if (limit > 0) {
	303	if (*size >= limit) {
	304	*status = NSS_STATUS_SUCCESS;
	305	return false;
	306	}
	307	if (newsize > limit)
	308	newsize = limit;
	309	}
	310	newgroups = realloc(groupsp, newsize sizeof((*groupsp)[0]));
	311	errno = old_errno;
	312	if (newgroups == NULL) {
	313	*errnop = ENOMEM;
	314	*status = NSS_STATUS_TRYAGAIN;
	315	return false;
	316	}
	317	*groupsp = newgroups;
	318	*size = newsize;
	319	}
	320	(groupsp)[(start)++] = group;
	321	return true;
	322	}
	323
f6903667 AK	324	enum nss_status
	325	_nss_nonlocal_initgroups_dyn(const char user, gid_t group, long int start,
	326	long int size, gid_t *groupsp, long int limit,
	327	int *errnop)
	328	{
f6903667	329	enum nss_status status;
cbb0e3ea AK	330	const struct walk_nss w = {
	331	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "initgroups_dyn",
	332	.status = &status, .errnop = errnop
	333	};
	334	const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;
1e78305d AK	335
1e78305d AK	336	struct group local_users_group, nonlocal_users_group;
b3831d60	337	bool is_nonlocal = true;
1e78305d	338	char *buffer;
d7bf1d11	339	int in, out, i;
48479fc7	340
1e78305d	341	/* Check that the user is a nonlocal user before adding any groups. */
48479fc7	342	status = check_nonlocal_user(user, errnop);
3010a54b	343	if (status == NSS_STATUS_TRYAGAIN) {
48479fc7	344	return status;
3010a54b	345	} else if (status != NSS_STATUS_SUCCESS) {
b3831d60	346	is_nonlocal = false;
48479fc7	347
3010a54b AK	348	status = get_local_group(MAGIC_LOCAL_GROUPNAME,
	349	&local_users_group, &buffer, errnop);
	350	if (status == NSS_STATUS_SUCCESS) {
	351	free(buffer);
	352	if (!add_group(local_users_group.gr_gid, start, size, groupsp,
	353	limit, errnop, &status))
	354	return status;
	355	} else if (status == NSS_STATUS_TRYAGAIN) {
dfc6e292	356	return status;
3010a54b AK	357	} else {
	358	syslog(LOG_WARNING,
	359	"nss_nonlocal: Group %s does not exist locally!",
	360	MAGIC_LOCAL_GROUPNAME);
	361	}
a4e1e153 AK	362	}
	363
	364	status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
	365	&nonlocal_users_group, &buffer, errnop);
	366	if (status == NSS_STATUS_SUCCESS) {
	367	free(buffer);
	368	if (is_nonlocal) {
dfc6e292 AK	369	if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
	370	limit, errnop, &status))
	371	return status;
1e78305d	372	}
a4e1e153 AK	373	} else if (status == NSS_STATUS_TRYAGAIN) {
	374	if (is_nonlocal)
	375	return status;
	376	} else {
	377	syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
	378	MAGIC_NONLOCAL_GROUPNAME);
48479fc7	379	}
f6903667	380
b3831d60	381	if (!is_nonlocal)
1e78305d AK	382	return NSS_STATUS_SUCCESS;
1e78305d AK	383
d7bf1d11	384	in = out = *start;
1e78305d	385
cbb0e3ea AK	386	#define args (user, group, start, size, groupsp, limit, errnop)
	387	#include "walk_nss.h"
	388	#undef args
f6903667 AK	389	if (status != NSS_STATUS_SUCCESS)
	390	return status;
	391
	392	for (; in < *start; ++in) {
	393	int nonlocal_errno = *errnop;
	394
	395	for (i = 0; i < out; ++i)
	396	if ((groupsp)[i] == (groupsp)[in])
	397	break;
	398	if (i < out)
	399	continue;
	400
	401	status = check_nonlocal_gid(user, (*groupsp)[in], &nonlocal_errno);
	402	if (status == NSS_STATUS_SUCCESS) {
1e78305d	403	(groupsp)[out++] = (groupsp)[in];
5879a696	404	} else if (status == NSS_STATUS_TRYAGAIN) {
f6903667 AK	405	*start = out;
	406	*errnop = nonlocal_errno;
	407	return status;
	408	}
	409	}
	410
	411	*start = out;
	412	return NSS_STATUS_SUCCESS;
	413	}