3 * passwd database for nss_nonlocal proxy.
5 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
6 * Abbott <tabbott@mit.edu>
8 * This file is part of nss_nonlocal.
10 * nss_nonlocal is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public License
12 * as published by the Free Software Foundation; either version 2.1 of
13 * the License, or (at your option) any later version.
15 * nss_nonlocal is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with nss_nonlocal; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
29 #include <sys/types.h>
41 #include "nsswitch-internal.h"
46 _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
47 char *buffer, size_t buflen, int *errnop);
49 _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
50 char *buffer, size_t buflen, int *errnop);
53 static service_user *__nss_passwd_nonlocal_database;
57 __nss_passwd_nonlocal_lookup2(service_user **ni, const char *fct_name,
58 const char *fct2_name, void **fctp)
60 if (__nss_passwd_nonlocal_database == NULL
61 && __nss_database_lookup("passwd_nonlocal", NULL, NULL,
62 &__nss_passwd_nonlocal_database) < 0)
65 *ni = __nss_passwd_nonlocal_database;
67 *fctp = __nss_lookup_function(*ni, fct_name);
68 if (*fctp == NULL && fct2_name != NULL)
69 *fctp = __nss_lookup_function(*ni, fct2_name);
75 check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
77 enum nss_status status;
80 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
81 const struct walk_nss w = {
82 .lookup2 = &__nss_passwd_lookup2, .fct_name = "getpwuid_r",
83 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
85 const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;
86 #define args (uid, &pwbuf, buf, buflen, errnop)
90 if (status == NSS_STATUS_SUCCESS) {
91 syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
93 status = NSS_STATUS_NOTFOUND;
94 } else if (status != NSS_STATUS_TRYAGAIN) {
95 status = NSS_STATUS_SUCCESS;
102 check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop)
104 enum nss_status status = NSS_STATUS_SUCCESS;
105 int old_errno = errno;
110 uid = strtoul(pwd->pw_name, &end, 10);
111 if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {
113 status = check_nonlocal_uid(user, uid, errnop);
117 if (status != NSS_STATUS_SUCCESS)
120 return check_nonlocal_uid(user, pwd->pw_uid, errnop);
124 check_nonlocal_user(const char *user, int *errnop)
126 enum nss_status status;
129 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
130 const struct walk_nss w = {
131 .lookup2 = __nss_passwd_lookup2, .fct_name = "getpwnam_r",
132 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
134 const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;
135 #define args (user, &pwbuf, buf, buflen, errnop)
136 #include "walk_nss.h"
139 if (status == NSS_STATUS_SUCCESS) {
141 status = NSS_STATUS_NOTFOUND;
142 } else if (status != NSS_STATUS_TRYAGAIN) {
143 status = NSS_STATUS_SUCCESS;
150 get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer,
153 enum nss_status status;
154 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
155 const struct walk_nss w = {
156 .lookup2 = __nss_passwd_nonlocal_lookup2, .fct_name = "getpwnam_r",
157 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
159 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
160 #define args (name, pwd, *buffer, buflen, errnop)
161 #include "walk_nss.h"
167 static bool pwent_initialized = false;
168 static service_user *pwent_startp, *pwent_nip;
169 static void *pwent_fct_start;
171 enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen,
175 static const char *pwent_fct_name = "getpwent_r";
178 _nss_nonlocal_setpwent(int stayopen)
180 enum nss_status status;
181 const struct walk_nss w = {
182 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "setpwent",
185 const __typeof__(&_nss_nonlocal_setpwent) self = NULL;
186 #define args (stayopen)
187 #include "walk_nss.h"
189 if (status != NSS_STATUS_SUCCESS)
192 if (!pwent_initialized) {
193 __nss_passwd_nonlocal_lookup2(&pwent_startp, pwent_fct_name, NULL,
195 __sync_synchronize();
196 pwent_initialized = true;
198 pwent_nip = pwent_startp;
199 pwent_fct.ptr = pwent_fct_start;
200 return NSS_STATUS_SUCCESS;
204 _nss_nonlocal_endpwent(void)
206 enum nss_status status;
207 const struct walk_nss w = {
208 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "endpwent",
209 .status = &status, .all_values = 1,
211 const __typeof__(&_nss_nonlocal_endpwent) self = NULL;
216 #include "walk_nss.h"
222 _nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen,
225 enum nss_status status;
227 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
228 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
229 return NSS_STATUS_UNAVAIL;
231 if (pwent_nip == NULL) {
232 status = _nss_nonlocal_setpwent(0);
233 if (status != NSS_STATUS_SUCCESS)
237 if (pwent_fct.ptr == NULL)
238 status = NSS_STATUS_UNAVAIL;
242 status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));
243 while (status == NSS_STATUS_SUCCESS &&
244 check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);
246 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
249 if (status == NSS_STATUS_SUCCESS)
250 return NSS_STATUS_SUCCESS;
251 } while (__nss_next2(&pwent_nip, pwent_fct_name, 0, &pwent_fct.ptr, status,
255 return NSS_STATUS_NOTFOUND;
260 _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
261 char *buffer, size_t buflen, int *errnop)
263 enum nss_status status;
265 const struct walk_nss w = {
266 .lookup2 = __nss_passwd_nonlocal_lookup2, .fct_name = "getpwnam_r",
267 .status = &status, .errnop = errnop
269 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
271 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
272 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
273 return NSS_STATUS_UNAVAIL;
275 #define args (name, pwd, buffer, buflen, errnop)
276 #include "walk_nss.h"
278 if (status != NSS_STATUS_SUCCESS)
281 if (strcmp(name, pwd->pw_name) != 0) {
282 syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);
283 return NSS_STATUS_NOTFOUND;
286 status = check_nonlocal_passwd(name, pwd, errnop);
287 if (status != NSS_STATUS_SUCCESS)
290 if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=
292 pwd->pw_gid = 65534 /* nogroup */;
293 return NSS_STATUS_SUCCESS;
297 _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
298 char *buffer, size_t buflen, int *errnop)
300 enum nss_status status;
302 const struct walk_nss w = {
303 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "getpwuid_r",
304 .status = &status, .errnop = errnop
306 const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;
308 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
309 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
310 return NSS_STATUS_UNAVAIL;
312 #define args (uid, pwd, buffer, buflen, errnop)
313 #include "walk_nss.h"
315 if (status != NSS_STATUS_SUCCESS)
318 if (uid != pwd->pw_uid) {
319 syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);
320 return NSS_STATUS_NOTFOUND;
323 status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);
324 if (status != NSS_STATUS_SUCCESS)
327 if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=
329 pwd->pw_gid = 65534 /* nogroup */;
330 return NSS_STATUS_SUCCESS;