3 * group database for nss_nonlocal proxy
5 * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
6 * Abbott <tabbott@mit.edu>
8 * This file is part of nss_nonlocal.
10 * nss_nonlocal is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public License
12 * as published by the Free Software Foundation; either version 2.1 of
13 * the License, or (at your option) any later version.
15 * nss_nonlocal is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with nss_nonlocal; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
28 #include <sys/types.h>
41 #include "nsswitch-internal.h"
45 * If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
46 * users will be automatically added to it. Furthermore, if a local
47 * user is added to this group, then that user will inherit any
48 * nonlocal gids from a nonlocal user of the same name, as
51 #define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"
54 * If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
55 * will be automatically added to it.
57 #define MAGIC_LOCAL_GROUPNAME "nss-local-users"
60 * If the MAGIC_NONLOCAL_USERNAME local user is added to a local
61 * group, then the local group will inherit the nonlocal membership of
62 * a group of the same gid.
64 #define MAGIC_NONLOCAL_USERNAME "nss-nonlocal-users"
68 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
69 char *buffer, size_t buflen, int *errnop);
72 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
73 char *buffer, size_t buflen, int *errnop);
76 static service_user *__nss_group_nonlocal_database;
80 __nss_group_nonlocal_lookup2(service_user **ni, const char *fct_name,
81 const char *fct2_name, void **fctp)
83 if (__nss_group_nonlocal_database == NULL
84 && __nss_database_lookup("group_nonlocal", NULL, NULL,
85 &__nss_group_nonlocal_database) < 0)
88 *ni = __nss_group_nonlocal_database;
90 *fctp = __nss_lookup_function(*ni, fct_name);
91 if (*fctp == NULL && fct2_name != NULL)
92 *fctp = __nss_lookup_function(*ni, fct2_name);
98 check_nonlocal_gid(const char *user, const char *group, gid_t gid, int *errnop)
100 enum nss_status status;
103 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
104 const struct walk_nss w = {
105 .lookup2 = &__nss_group_lookup2, .fct_name = "getgrgid_r",
106 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
108 const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
109 #define args (gid, &gbuf, buf, buflen, errnop)
110 #include "walk_nss.h"
113 if (status == NSS_STATUS_TRYAGAIN)
115 else if (status != NSS_STATUS_SUCCESS)
116 return NSS_STATUS_SUCCESS;
118 if (group == NULL || strcmp(gbuf.gr_name, group) == 0) {
120 for (mem = gbuf.gr_mem; *mem != NULL; mem++)
121 if (strcmp(*mem, MAGIC_NONLOCAL_USERNAME) == 0) {
122 status = check_nonlocal_user(*mem, errnop);
123 if (status == NSS_STATUS_TRYAGAIN) {
126 } else if (status == NSS_STATUS_NOTFOUND) {
128 return NSS_STATUS_SUCCESS;
134 syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
136 return NSS_STATUS_NOTFOUND;
140 check_nonlocal_group(const char *user, struct group *grp, int *errnop)
142 enum nss_status status = NSS_STATUS_SUCCESS;
143 int old_errno = errno;
148 gid = strtoul(grp->gr_name, &end, 10);
149 if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
151 status = check_nonlocal_gid(user, grp->gr_name, gid, errnop);
154 if (status != NSS_STATUS_SUCCESS)
157 return check_nonlocal_gid(user, grp->gr_name, grp->gr_gid, errnop);
161 get_local_group(const char *name, struct group *grp, char **buffer, int *errnop)
163 enum nss_status status;
164 size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
165 const struct walk_nss w = {
166 .lookup2 = &__nss_group_lookup2, .fct_name = "getgrnam_r",
167 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
169 const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
170 #define args (name, grp, *buffer, buflen, errnop)
171 #include "walk_nss.h"
176 static bool grent_initialized = false;
177 static service_user *grent_startp, *grent_nip;
178 static void *grent_fct_start;
180 enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen,
184 static const char *grent_fct_name = "getgrent_r";
187 _nss_nonlocal_setgrent(int stayopen)
189 enum nss_status status;
190 const struct walk_nss w = {
191 .lookup2 = &__nss_group_nonlocal_lookup2, .fct_name = "setgrent",
194 const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
195 #define args (stayopen)
196 #include "walk_nss.h"
198 if (status != NSS_STATUS_SUCCESS)
201 if (!grent_initialized) {
202 __nss_group_nonlocal_lookup2(&grent_startp, grent_fct_name, NULL,
204 __sync_synchronize();
205 grent_initialized = true;
207 grent_nip = grent_startp;
208 grent_fct.ptr = grent_fct_start;
209 return NSS_STATUS_SUCCESS;
213 _nss_nonlocal_endgrent(void)
215 enum nss_status status;
216 const struct walk_nss w = {
217 .lookup2 = &__nss_group_nonlocal_lookup2, .fct_name = "endgrent",
218 .status = &status, .all_values = 1,
220 const __typeof__(&_nss_nonlocal_endgrent) self = NULL;
225 #include "walk_nss.h"
231 _nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen,
234 enum nss_status status;
236 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
237 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
238 return NSS_STATUS_UNAVAIL;
240 if (grent_nip == NULL) {
241 status = _nss_nonlocal_setgrent(0);
242 if (status != NSS_STATUS_SUCCESS)
246 if (grent_fct.ptr == NULL)
247 status = NSS_STATUS_UNAVAIL;
251 status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
252 while (status == NSS_STATUS_SUCCESS &&
253 check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
255 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
258 if (status == NSS_STATUS_SUCCESS)
259 return NSS_STATUS_SUCCESS;
260 } while (__nss_next2(&grent_nip, grent_fct_name, NULL, &grent_fct.ptr,
264 return NSS_STATUS_NOTFOUND;
269 _nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
270 char *buffer, size_t buflen, int *errnop)
272 enum nss_status status;
273 const struct walk_nss w = {
274 .lookup2 = &__nss_group_nonlocal_lookup2, .fct_name = "getgrnam_r",
275 .status = &status, .errnop = errnop
277 const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;
279 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
280 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
281 return NSS_STATUS_UNAVAIL;
283 #define args (name, grp, buffer, buflen, errnop)
284 #include "walk_nss.h"
286 if (status != NSS_STATUS_SUCCESS)
289 if (strcmp(name, grp->gr_name) != 0) {
290 syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
291 return NSS_STATUS_NOTFOUND;
294 return check_nonlocal_group(name, grp, errnop);
298 _nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
299 char *buffer, size_t buflen, int *errnop)
301 enum nss_status status;
302 const struct walk_nss w = {
303 .lookup2 = &__nss_group_nonlocal_lookup2, .fct_name = "getgrgid_r",
304 .status = &status, .errnop = errnop
306 const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;
308 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
309 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
310 return NSS_STATUS_UNAVAIL;
312 #define args (gid, grp, buffer, buflen, errnop)
313 #include "walk_nss.h"
315 if (status != NSS_STATUS_SUCCESS)
318 if (gid != grp->gr_gid) {
319 syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
320 return NSS_STATUS_NOTFOUND;
323 return check_nonlocal_group(grp->gr_name, grp, errnop);
327 add_group(gid_t group, long int *start, long int *size, gid_t **groupsp,
328 long int limit, int *errnop, enum nss_status *status)
330 int i, old_errno = errno;
331 for (i = 0; i < *start; ++i)
332 if ((*groupsp)[i] == group)
334 if (*start + 1 > *size) {
336 long int newsize = 2 * *size;
338 if (*size >= limit) {
339 *status = NSS_STATUS_SUCCESS;
345 newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0]));
347 if (newgroups == NULL) {
349 *status = NSS_STATUS_TRYAGAIN;
352 *groupsp = newgroups;
355 (*groupsp)[(*start)++] = group;
360 _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
361 long int *size, gid_t **groupsp, long int limit,
364 enum nss_status status;
365 const struct walk_nss w = {
366 .lookup2 = &__nss_group_nonlocal_lookup2, .fct_name = "initgroups_dyn",
367 .status = &status, .all_values = 1, .errnop = errnop
369 const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;
371 struct group local_users_group, nonlocal_users_group;
372 bool is_nonlocal = true;
376 /* Check that the user is a nonlocal user, or a member of the
377 * MAGIC_NONLOCAL_GROUPNAME group, before adding any groups. */
378 status = check_nonlocal_user(user, errnop);
379 if (status == NSS_STATUS_TRYAGAIN) {
381 } else if (status != NSS_STATUS_SUCCESS) {
384 status = get_local_group(MAGIC_LOCAL_GROUPNAME,
385 &local_users_group, &buffer, errnop);
386 if (status == NSS_STATUS_SUCCESS) {
388 if (!add_group(local_users_group.gr_gid, start, size, groupsp,
389 limit, errnop, &status))
391 } else if (status == NSS_STATUS_TRYAGAIN) {
395 "nss_nonlocal: Group %s does not exist locally!",
396 MAGIC_LOCAL_GROUPNAME);
400 status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
401 &nonlocal_users_group, &buffer, errnop);
402 if (status == NSS_STATUS_SUCCESS) {
405 if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
406 limit, errnop, &status))
410 for (i = 0; i < *start; ++i) {
411 if ((*groupsp)[i] == nonlocal_users_group.gr_gid) {
420 int nonlocal_errno = *errnop;
421 status = get_nonlocal_passwd(user, &pwbuf, &buf, errnop);
423 if (status == NSS_STATUS_SUCCESS) {
424 nonlocal_errno = *errnop;
425 status = check_nonlocal_gid(user, NULL, pwbuf.pw_gid,
430 if (status == NSS_STATUS_SUCCESS) {
431 if (!add_group(pwbuf.pw_gid, start, size, groupsp, limit,
434 } else if (status == NSS_STATUS_TRYAGAIN) {
435 *errnop = nonlocal_errno;
440 } else if (status == NSS_STATUS_TRYAGAIN) {
444 syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
445 MAGIC_NONLOCAL_GROUPNAME);
449 return NSS_STATUS_SUCCESS;
453 #define args (user, group, start, size, groupsp, limit, errnop)
454 #include "walk_nss.h"
456 if (status == NSS_STATUS_NOTFOUND || status == NSS_STATUS_UNAVAIL)
457 return NSS_STATUS_SUCCESS;
458 else if (status != NSS_STATUS_SUCCESS)
461 for (; in < *start; ++in) {
462 int nonlocal_errno = *errnop;
464 for (i = 0; i < out; ++i)
465 if ((*groupsp)[i] == (*groupsp)[in])
470 status = check_nonlocal_gid(user, NULL, (*groupsp)[in],
472 if (status == NSS_STATUS_SUCCESS) {
473 (*groupsp)[out++] = (*groupsp)[in];
474 } else if (status == NSS_STATUS_TRYAGAIN) {
476 *errnop = nonlocal_errno;
482 return NSS_STATUS_SUCCESS;