andersk Git - nss_nonlocal.git/blob

1 /*

2 * nonlocal-passwd.c

3 * passwd database for nss_nonlocal proxy.

4 *

6 * Abbott <tabbott@mit.edu>

7 *

8 * This file is part of nss_nonlocal.

9 *

10 * nss_nonlocal is free software; you can redistribute it and/or

11 * modify it under the terms of the GNU Lesser General Public License

12 * as published by the Free Software Foundation; either version 2.1 of

13 * the License, or (at your option) any later version.

14 *

15 * nss_nonlocal is distributed in the hope that it will be useful, but

16 * WITHOUT ANY WARRANTY; without even the implied warranty of

17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

18 * Lesser General Public License for more details.

19 *

20 * You should have received a copy of the GNU Lesser General Public

21 * License along with nss_nonlocal; if not, write to the Free Software

22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

23 * 02110-1301 USA

24 */

27 #define _GNU_SOURCE

29 #include <sys/types.h>

30 #include <dlfcn.h>

31 #include <errno.h>

32 #include <nss.h>

33 #include <pwd.h>

34 #include <stdbool.h>

35 #include <stddef.h>

36 #include <stdlib.h>

37 #include <string.h>

38 #include <syslog.h>

39 #include <unistd.h>

41 #include "nsswitch-internal.h"

42 #include "nonlocal.h"

45 enum nss_status

46 _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,

47 char *buffer, size_t buflen, int *errnop);

48 enum nss_status

49 _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,

50 char *buffer, size_t buflen, int *errnop);

53 static service_user *__nss_passwd_nonlocal_database;

55 static int

56 internal_function

57 __nss_passwd_nonlocal_lookup2(service_user **ni, const char *fct_name,

58 const char *fct2_name, void **fctp)

59 {

60 if (__nss_passwd_nonlocal_database == NULL

61 && __nss_database_lookup("passwd_nonlocal", NULL, NULL,

62 &__nss_passwd_nonlocal_database) < 0)

63 return -1;

65 *ni = __nss_passwd_nonlocal_database;

67 *fctp = __nss_lookup_function(*ni, fct_name);

68 if (*fctp == NULL && fct2_name != NULL)

69 *fctp = __nss_lookup_function(*ni, fct2_name);

70 return 0;

71 }

74 enum nss_status

75 check_nonlocal_uid(const char *user, uid_t uid, int *errnop)

76 {

77 enum nss_status status;

78 struct passwd pwbuf;

79 char *buf;

80 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);

81 const struct walk_nss w = {

82 .lookup2 = &__nss_passwd_lookup2, .fct_name = "getpwuid_r",

83 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen

84 };

85 const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;

86 #define args (uid, &pwbuf, buf, buflen, errnop)

87 #include "walk_nss.h"

88 #undef args

90 if (status == NSS_STATUS_SUCCESS) {

91 syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);

92 free(buf);

93 status = NSS_STATUS_NOTFOUND;

94 } else if (status != NSS_STATUS_TRYAGAIN) {

95 status = NSS_STATUS_SUCCESS;

96 }

98 return status;

99 }

100

101 enum nss_status

102 check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop)

103 {

104 enum nss_status status = NSS_STATUS_SUCCESS;

105 int old_errno = errno;

106 char *end;

107 unsigned long uid;

108

109 errno = 0;

110 uid = strtoul(pwd->pw_name, &end, 10);

111 if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {

112 errno = old_errno;

113 status = check_nonlocal_uid(user, uid, errnop);

114 } else {

115 errno = old_errno;

116 }

117 if (status != NSS_STATUS_SUCCESS)

118 return status;

119

120 return check_nonlocal_uid(user, pwd->pw_uid, errnop);

121 }

122

123 enum nss_status

124 check_nonlocal_user(const char *user, int *errnop)

125 {

126 enum nss_status status;

127 struct passwd pwbuf;

128 char *buf;

129 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);

130 const struct walk_nss w = {

131 .lookup2 = __nss_passwd_lookup2, .fct_name = "getpwnam_r",

132 .status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen

133 };

134 const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;

135 #define args (user, &pwbuf, buf, buflen, errnop)

136 #include "walk_nss.h"

137 #undef args

138

139 if (status == NSS_STATUS_SUCCESS) {

140 free(buf);

141 status = NSS_STATUS_NOTFOUND;

142 } else if (status != NSS_STATUS_TRYAGAIN) {

143 status = NSS_STATUS_SUCCESS;

144 }

145

146 return status;

147 }

148

149 enum nss_status

150 get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer,

151 int *errnop)

152 {

153 enum nss_status status;

154 size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);

155 const struct walk_nss w = {

156 .lookup2 = __nss_passwd_nonlocal_lookup2, .fct_name = "getpwnam_r",

157 .status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen

158 };

159 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;

160 #define args (name, pwd, *buffer, buflen, errnop)

161 #include "walk_nss.h"

162 #undef args

163 return status;

164 }

165

166

167 static bool pwent_initialized = false;

168 static service_user *pwent_startp, *pwent_nip;

169 static void *pwent_fct_start;

170 static union {

171 enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen,

172 int *errnop);

173 void *ptr;

174 } pwent_fct;

175 static const char *pwent_fct_name = "getpwent_r";

176

177 enum nss_status

178 _nss_nonlocal_setpwent(int stayopen)

179 {

180 enum nss_status status;

181 const struct walk_nss w = {

182 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "setpwent",

183 .status = &status

184 };

185 const __typeof__(&_nss_nonlocal_setpwent) self = NULL;

186 #define args (stayopen)

187 #include "walk_nss.h"

188 #undef args

189 if (status != NSS_STATUS_SUCCESS)

190 return status;

191

192 if (!pwent_initialized) {

193 __nss_passwd_nonlocal_lookup2(&pwent_startp, pwent_fct_name, NULL,

194 &pwent_fct_start);

195 __sync_synchronize();

196 pwent_initialized = true;

197 }

198 pwent_nip = pwent_startp;

199 pwent_fct.ptr = pwent_fct_start;

200 return NSS_STATUS_SUCCESS;

201 }

202

203 enum nss_status

204 _nss_nonlocal_endpwent(void)

205 {

206 enum nss_status status;

207 const struct walk_nss w = {

208 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "endpwent",

209 .status = &status, .all_values = 1,

210 };

211 const __typeof__(&_nss_nonlocal_endpwent) self = NULL;

212

213 pwent_nip = NULL;

214

215 #define args ()

216 #include "walk_nss.h"

217 #undef args

218 return status;

219 }

220

221 enum nss_status

222 _nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen,

223 int *errnop)

224 {

225 enum nss_status status;

226

227 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);

228 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')

229 return NSS_STATUS_UNAVAIL;

230

231 if (pwent_nip == NULL) {

232 status = _nss_nonlocal_setpwent(0);

233 if (status != NSS_STATUS_SUCCESS)

234 return status;

235 }

236 do {

237 if (pwent_fct.ptr == NULL)

238 status = NSS_STATUS_UNAVAIL;

239 else {

240 int nonlocal_errno;

241 do

242 status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));

243 while (status == NSS_STATUS_SUCCESS &&

244 check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);

245 }

246 if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)

247 return status;

248

249 if (status == NSS_STATUS_SUCCESS)

250 return NSS_STATUS_SUCCESS;

251 } while (__nss_next2(&pwent_nip, pwent_fct_name, 0, &pwent_fct.ptr, status,

252 0) == 0);

253

254 pwent_nip = NULL;

255 return NSS_STATUS_NOTFOUND;

256 }

257

258

259 enum nss_status

260 _nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,

261 char *buffer, size_t buflen, int *errnop)

262 {

263 enum nss_status status;

264 int group_errno;

265 const struct walk_nss w = {

266 .lookup2 = __nss_passwd_nonlocal_lookup2, .fct_name = "getpwnam_r",

267 .status = &status, .errnop = errnop

268 };

269 const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;

270

271 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);

272 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')

273 return NSS_STATUS_UNAVAIL;

274

275 #define args (name, pwd, buffer, buflen, errnop)

276 #include "walk_nss.h"

277 #undef args

278 if (status != NSS_STATUS_SUCCESS)

279 return status;

280

281 if (strcmp(name, pwd->pw_name) != 0) {

282 syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);

283 return NSS_STATUS_NOTFOUND;

284 }

285

286 status = check_nonlocal_passwd(name, pwd, errnop);

287 if (status != NSS_STATUS_SUCCESS)

288 return status;

289

290 if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=

291 NSS_STATUS_SUCCESS)

292 pwd->pw_gid = 65534 /* nogroup */;

293 return NSS_STATUS_SUCCESS;

294 }

295

296 enum nss_status

297 _nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,

298 char *buffer, size_t buflen, int *errnop)

299 {

300 enum nss_status status;

301 int group_errno;

302 const struct walk_nss w = {

303 .lookup2 = &__nss_passwd_nonlocal_lookup2, .fct_name = "getpwuid_r",

304 .status = &status, .errnop = errnop

305 };

306 const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;

307

308 char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);

309 if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')

310 return NSS_STATUS_UNAVAIL;

311

312 #define args (uid, pwd, buffer, buflen, errnop)

313 #include "walk_nss.h"

314 #undef args

315 if (status != NSS_STATUS_SUCCESS)

316 return status;

317

318 if (uid != pwd->pw_uid) {

319 syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);

320 return NSS_STATUS_NOTFOUND;

321 }

322

323 status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);

324 if (status != NSS_STATUS_SUCCESS)

325 return status;

326

327 if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=

328 NSS_STATUS_SUCCESS)

329 pwd->pw_gid = 65534 /* nogroup */;

330 return NSS_STATUS_SUCCESS;

331 }