3 * group database for nss_nonlocal proxy
5 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
6 * Abbott <tabbott@mit.edu>
8 * This file is part of nss_nonlocal.
10 * nss_nonlocal is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public License
12 * as published by the Free Software Foundation; either version 2.1 of
13 * the License, or (at your option) any later version.
15 * nss_nonlocal is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with nss_nonlocal; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
27 #include <sys/types.h>
39 #include "nsswitch-internal.h"
43 * If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
44 * users will be automatically added to it. Furthermore, if a local
45 * user is added to this group, then that user will inherit any
46 * nonlocal gids from a nonlocal user of the same name, as
49 #define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"
52 * If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
53 * will be automatically added to it.
55 #define MAGIC_LOCAL_GROUPNAME "nss-local-users"
58 * If the MAGIC_NONLOCAL_USERNAME local user is added to a local
59 * group, then the local group will inherit the nonlocal membership of
60 * a group of the same gid.
62 #define MAGIC_NONLOCAL_USERNAME "nss-nonlocal-users"
66 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
67 char *buffer, size_t buflen, int *errnop);
70 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
71 char *buffer, size_t buflen, int *errnop);
74 static service_user *__nss_group_nonlocal_database;
78 __nss_group_nonlocal_lookup(service_user **ni, const char *fct_name,
81 if (__nss_group_nonlocal_database == NULL
82 && __nss_database_lookup("group_nonlocal", NULL, NULL,
83 &__nss_group_nonlocal_database) < 0)
86 *ni = __nss_group_nonlocal_database;
88 *fctp = __nss_lookup_function(*ni, fct_name);
94 check_nonlocal_gid(const char *user, const char *group, gid_t gid, int *errnop)
96 enum nss_status status;
99 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
100 const struct walk_nss w = {
101 .lookup = &__nss_group_lookup, .fct_name = "getgrgid_r",
102 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
104 const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
105 #define args (gid, &gbuf, buf, buflen, errnop)
106 #include "walk_nss.h"
109 if (status == NSS_STATUS_TRYAGAIN)
111 else if (status != NSS_STATUS_SUCCESS)
112 return NSS_STATUS_SUCCESS;
114 if (group == NULL || strcmp(gbuf.gr_name, group) == 0) {
116 for (mem = gbuf.gr_mem; *mem != NULL; mem++)
117 if (strcmp(*mem, MAGIC_NONLOCAL_USERNAME) == 0) {
118 status = check_nonlocal_user(*mem, errnop);
119 if (status == NSS_STATUS_TRYAGAIN) {
122 } else if (status == NSS_STATUS_NOTFOUND) {
124 return NSS_STATUS_SUCCESS;
130 syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
132 return NSS_STATUS_NOTFOUND;
136 check_nonlocal_group(const char *user, struct group *grp, int *errnop)
138 enum nss_status status = NSS_STATUS_SUCCESS;
139 int old_errno = errno;
144 gid = strtoul(grp->gr_name, &end, 10);
145 if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
147 status = check_nonlocal_gid(user, grp->gr_name, gid, errnop);
150 if (status != NSS_STATUS_SUCCESS)
153 return check_nonlocal_gid(user, grp->gr_name, grp->gr_gid, errnop);
157 get_local_group(const char *name, struct group *grp, char **buffer, int *errnop)
159 enum nss_status status;
160 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
161 const struct walk_nss w = {
162 .lookup = &__nss_group_lookup, .fct_name = "getgrnam_r",
163 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
165 const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
166 #define args (name, grp, *buffer, buflen, errnop)
167 #include "walk_nss.h"
172 static service_user *grent_startp, *grent_nip;
173 static void *grent_fct_start;
175 enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen,
179 static const char *grent_fct_name = "getgrent_r";
182 _nss_nonlocal_setgrent(int stayopen)
184 enum nss_status status;
185 const struct walk_nss w = {
186 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "setgrent",
189 const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
190 #define args (stayopen)
191 #include "walk_nss.h"
193 if (status != NSS_STATUS_SUCCESS)
196 if (grent_fct_start == NULL)
197 __nss_group_nonlocal_lookup(&grent_startp, grent_fct_name,
199 grent_nip = grent_startp;
200 grent_fct.ptr = grent_fct_start;
201 return NSS_STATUS_SUCCESS;
205 _nss_nonlocal_endgrent(void)
207 enum nss_status status;
208 const struct walk_nss w = {
209 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "endgrent",
212 const __typeof__(&_nss_nonlocal_endgrent) self = NULL;
217 #include "walk_nss.h"
223 _nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen,
226 enum nss_status status;
228 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
229 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
230 return NSS_STATUS_UNAVAIL;
232 if (grent_nip == NULL) {
233 status = _nss_nonlocal_setgrent(0);
234 if (status != NSS_STATUS_SUCCESS)
238 if (grent_fct.ptr == NULL)
239 status = NSS_STATUS_UNAVAIL;
243 status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
244 while (status == NSS_STATUS_SUCCESS &&
245 check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
247 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
250 if (status == NSS_STATUS_SUCCESS)
251 return NSS_STATUS_SUCCESS;
252 } while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0);
255 return NSS_STATUS_NOTFOUND;
260 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
261 char *buffer, size_t buflen, int *errnop)
263 enum nss_status status;
264 const struct walk_nss w = {
265 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrnam_r",
266 .status = &status, .errnop = errnop
268 const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;
270 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
271 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
272 return NSS_STATUS_UNAVAIL;
274 #define args (name, grp, buffer, buflen, errnop)
275 #include "walk_nss.h"
277 if (status != NSS_STATUS_SUCCESS)
280 if (strcmp(name, grp->gr_name) != 0) {
281 syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
282 return NSS_STATUS_NOTFOUND;
285 return check_nonlocal_group(name, grp, errnop);
289 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
290 char *buffer, size_t buflen, int *errnop)
292 enum nss_status status;
293 const struct walk_nss w = {
294 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrgid_r",
295 .status = &status, .errnop = errnop
297 const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;
299 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
300 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
301 return NSS_STATUS_UNAVAIL;
303 #define args (gid, grp, buffer, buflen, errnop)
304 #include "walk_nss.h"
306 if (status != NSS_STATUS_SUCCESS)
309 if (gid != grp->gr_gid) {
310 syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
311 return NSS_STATUS_NOTFOUND;
314 return check_nonlocal_group(grp->gr_name, grp, errnop);
318 add_group(gid_t group, long int *start, long int *size, gid_t **groupsp,
319 long int limit, int *errnop, enum nss_status *status)
321 int i, old_errno = errno;
322 for (i = 0; i < *start; ++i)
323 if ((*groupsp)[i] == group)
325 if (*start + 1 > *size) {
327 long int newsize = 2 * *size;
329 if (*size >= limit) {
330 *status = NSS_STATUS_SUCCESS;
336 newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0]));
338 if (newgroups == NULL) {
340 *status = NSS_STATUS_TRYAGAIN;
343 *groupsp = newgroups;
346 (*groupsp)[(*start)++] = group;
351 _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
352 long int *size, gid_t **groupsp, long int limit,
355 enum nss_status status;
356 const struct walk_nss w = {
357 .lookup = &__nss_group_nonlocal_lookup, .fct_name = "initgroups_dyn",
358 .status = &status, .errnop = errnop
360 const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;
362 struct group local_users_group, nonlocal_users_group;
363 bool is_nonlocal = true;
367 /* Check that the user is a nonlocal user, or a member of the
368 * MAGIC_NONLOCAL_GROUPNAME group, before adding any groups. */
369 status = check_nonlocal_user(user, errnop);
370 if (status == NSS_STATUS_TRYAGAIN) {
372 } else if (status != NSS_STATUS_SUCCESS) {
375 status = get_local_group(MAGIC_LOCAL_GROUPNAME,
376 &local_users_group, &buffer, errnop);
377 if (status == NSS_STATUS_SUCCESS) {
379 if (!add_group(local_users_group.gr_gid, start, size, groupsp,
380 limit, errnop, &status))
382 } else if (status == NSS_STATUS_TRYAGAIN) {
386 "nss_nonlocal: Group %s does not exist locally!",
387 MAGIC_LOCAL_GROUPNAME);
391 status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
392 &nonlocal_users_group, &buffer, errnop);
393 if (status == NSS_STATUS_SUCCESS) {
396 if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
397 limit, errnop, &status))
401 for (i = 0; i < *start; ++i) {
402 if ((*groupsp)[i] == nonlocal_users_group.gr_gid) {
411 int nonlocal_errno = *errnop;
412 status = get_nonlocal_passwd(user, &pwbuf, &buf, errnop);
414 if (status == NSS_STATUS_SUCCESS) {
415 nonlocal_errno = *errnop;
416 status = check_nonlocal_gid(user, NULL, pwbuf.pw_gid,
421 if (status == NSS_STATUS_SUCCESS) {
422 if (!add_group(pwbuf.pw_gid, start, size, groupsp, limit,
425 } else if (status == NSS_STATUS_TRYAGAIN) {
426 *errnop = nonlocal_errno;
431 } else if (status == NSS_STATUS_TRYAGAIN) {
435 syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
436 MAGIC_NONLOCAL_GROUPNAME);
440 return NSS_STATUS_SUCCESS;
444 #define args (user, group, start, size, groupsp, limit, errnop)
445 #include "walk_nss.h"
447 if (status != NSS_STATUS_SUCCESS)
450 for (; in < *start; ++in) {
451 int nonlocal_errno = *errnop;
453 for (i = 0; i < out; ++i)
454 if ((*groupsp)[i] == (*groupsp)[in])
459 status = check_nonlocal_gid(user, NULL, (*groupsp)[in],
461 if (status == NSS_STATUS_SUCCESS) {
462 (*groupsp)[out++] = (*groupsp)[in];
463 } else if (status == NSS_STATUS_TRYAGAIN) {
465 *errnop = nonlocal_errno;
471 return NSS_STATUS_SUCCESS;