3 * group database for nss_nonlocal proxy
5 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
6 * Abbott <tabbott@mit.edu>
8 * This file is part of nss_nonlocal.
10 * nss_nonlocal is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public License
12 * as published by the Free Software Foundation; either version 2.1 of
13 * the License, or (at your option) any later version.
15 * nss_nonlocal is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with nss_nonlocal; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
27 #include <sys/types.h>
38 #include "nsswitch-internal.h"
42 * If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
43 * users will be automatically added to it.
45 #define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"
48 * If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
49 * will be automatically added to it.
51 #define MAGIC_LOCAL_GROUPNAME "nss-local-users"
55 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
56 char *buffer, size_t buflen, int *errnop);
59 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
60 char *buffer, size_t buflen, int *errnop);
63 static service_user *__nss_group_nonlocal_database;
67 __nss_group_nonlocal_lookup(service_user **ni, const char *fct_name,
70 if (__nss_group_nonlocal_database == NULL
71 && __nss_database_lookup("group_nonlocal", NULL, NULL,
72 &__nss_group_nonlocal_database) < 0)
75 *ni = __nss_group_nonlocal_database;
77 *fctp = __nss_lookup_function(*ni, fct_name);
83 check_nonlocal_gid(const char *user, gid_t gid, int *errnop)
85 enum nss_status status;
88 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
89 const struct walk_nss w = {
90 .lookup = &__nss_group_lookup, .fct_name = "getgrgid_r",
91 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
93 const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
94 #define args (gid, &gbuf, buf, buflen, errnop)
98 if (status == NSS_STATUS_SUCCESS) {
99 syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
101 status = NSS_STATUS_NOTFOUND;
102 } else if (status != NSS_STATUS_TRYAGAIN) {
103 status = NSS_STATUS_SUCCESS;
110 check_nonlocal_group(const char *user, struct group *grp, int *errnop)
112 enum nss_status status = NSS_STATUS_SUCCESS;
113 int old_errno = errno;
118 gid = strtoul(grp->gr_name, &end, 10);
119 if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
121 status = check_nonlocal_gid(user, gid, errnop);
124 if (status != NSS_STATUS_SUCCESS)
127 return check_nonlocal_gid(user, grp->gr_gid, errnop);
131 get_local_group(const char *name, struct group *grp, char **buffer, int *errnop)
133 enum nss_status status;
134 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
135 const struct walk_nss w = {
136 .lookup = &__nss_group_lookup, .fct_name = "getgrnam_r",
137 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
139 const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
140 #define args (name, grp, *buffer, buflen, errnop)
141 #include "walk_nss.h"
146 static service_user *grent_startp, *grent_nip;
147 static void *grent_fct_start;
149 enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen,
153 static const char *grent_fct_name = "getgrent_r";
156 _nss_nonlocal_setgrent(int stayopen)
158 enum nss_status status;
159 const struct walk_nss w = {
160 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "setgrent",
163 const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
164 #define args (stayopen)
165 #include "walk_nss.h"
167 if (status != NSS_STATUS_SUCCESS)
170 if (grent_fct_start == NULL)
171 __nss_group_nonlocal_lookup(&grent_startp, grent_fct_name,
173 grent_nip = grent_startp;
174 grent_fct.ptr = grent_fct_start;
175 return NSS_STATUS_SUCCESS;
179 _nss_nonlocal_endgrent(void)
181 enum nss_status status;
182 const struct walk_nss w = {
183 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "endgrent",
186 const __typeof__(&_nss_nonlocal_endgrent) self = NULL;
191 #include "walk_nss.h"
197 _nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen,
200 enum nss_status status;
202 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
203 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
204 return NSS_STATUS_UNAVAIL;
206 if (grent_nip == NULL) {
207 status = _nss_nonlocal_setgrent(0);
208 if (status != NSS_STATUS_SUCCESS)
212 if (grent_fct.ptr == NULL)
213 status = NSS_STATUS_UNAVAIL;
217 status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
218 while (status == NSS_STATUS_SUCCESS &&
219 check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
221 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
224 if (status == NSS_STATUS_SUCCESS)
225 return NSS_STATUS_SUCCESS;
226 } while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0);
229 return NSS_STATUS_NOTFOUND;
234 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
235 char *buffer, size_t buflen, int *errnop)
237 enum nss_status status;
238 const struct walk_nss w = {
239 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrnam_r",
240 .status = &status, .errnop = errnop
242 const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;
244 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
245 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
246 return NSS_STATUS_UNAVAIL;
248 #define args (name, grp, buffer, buflen, errnop)
249 #include "walk_nss.h"
251 if (status != NSS_STATUS_SUCCESS)
254 if (strcmp(name, grp->gr_name) != 0) {
255 syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
256 return NSS_STATUS_NOTFOUND;
259 return check_nonlocal_group(name, grp, errnop);
263 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
264 char *buffer, size_t buflen, int *errnop)
266 enum nss_status status;
267 const struct walk_nss w = {
268 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrgid_r",
269 .status = &status, .errnop = errnop
271 const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;
273 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
274 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
275 return NSS_STATUS_UNAVAIL;
277 #define args (gid, grp, buffer, buflen, errnop)
278 #include "walk_nss.h"
280 if (status != NSS_STATUS_SUCCESS)
283 if (gid != grp->gr_gid) {
284 syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
285 return NSS_STATUS_NOTFOUND;
288 return check_nonlocal_group(grp->gr_name, grp, errnop);
292 add_group(gid_t group, long int *start, long int *size, gid_t **groupsp,
293 long int limit, int *errnop, enum nss_status *status)
295 int i, old_errno = errno;
296 for (i = 0; i < *start; ++i)
297 if ((*groupsp)[i] == group)
299 if (*start + 1 > *size) {
301 long int newsize = 2 * *size;
303 if (*size >= limit) {
304 *status = NSS_STATUS_SUCCESS;
310 newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0]));
312 if (newgroups == NULL) {
314 *status = NSS_STATUS_TRYAGAIN;
317 *groupsp = newgroups;
320 (*groupsp)[(*start)++] = group;
325 _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
326 long int *size, gid_t **groupsp, long int limit,
329 enum nss_status status;
330 const struct walk_nss w = {
331 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "initgroups_dyn",
332 .status = &status, .errnop = errnop
334 const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;
336 struct group local_users_group, nonlocal_users_group;
337 bool is_nonlocal = true;
341 /* Check that the user is a nonlocal user before adding any groups. */
342 status = check_nonlocal_user(user, errnop);
343 if (status == NSS_STATUS_TRYAGAIN) {
345 } else if (status != NSS_STATUS_SUCCESS) {
348 status = get_local_group(MAGIC_LOCAL_GROUPNAME,
349 &local_users_group, &buffer, errnop);
350 if (status == NSS_STATUS_SUCCESS) {
352 if (!add_group(local_users_group.gr_gid, start, size, groupsp,
353 limit, errnop, &status))
355 } else if (status == NSS_STATUS_TRYAGAIN) {
359 "nss_nonlocal: Group %s does not exist locally!",
360 MAGIC_LOCAL_GROUPNAME);
364 status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
365 &nonlocal_users_group, &buffer, errnop);
366 if (status == NSS_STATUS_SUCCESS) {
369 if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
370 limit, errnop, &status))
373 } else if (status == NSS_STATUS_TRYAGAIN) {
377 syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
378 MAGIC_NONLOCAL_GROUPNAME);
382 return NSS_STATUS_SUCCESS;
386 #define args (user, group, start, size, groupsp, limit, errnop)
387 #include "walk_nss.h"
389 if (status != NSS_STATUS_SUCCESS)
392 for (; in < *start; ++in) {
393 int nonlocal_errno = *errnop;
395 for (i = 0; i < out; ++i)
396 if ((*groupsp)[i] == (*groupsp)[in])
401 status = check_nonlocal_gid(user, (*groupsp)[in], &nonlocal_errno);
402 if (status == NSS_STATUS_SUCCESS) {
403 (*groupsp)[out++] = (*groupsp)[in];
404 } else if (status == NSS_STATUS_TRYAGAIN) {
406 *errnop = nonlocal_errno;
412 return NSS_STATUS_SUCCESS;