X-Git-Url: http://andersk.mit.edu/gitweb/nss_nonlocal.git/blobdiff_plain/f7293a540408a83631cd04ec767962f60b96610f..d690fc67dd4b2a842601ab57fce05e9d7b9b315b:/nonlocal-group.c diff --git a/nonlocal-group.c b/nonlocal-group.c index aa2e390..56caa44 100644 --- a/nonlocal-group.c +++ b/nonlocal-group.c @@ -2,7 +2,8 @@ * nonlocal-group.c * group database for nss_nonlocal proxy * - * Copyright © 2007 Anders Kaseorg + * Copyright © 2007 Anders Kaseorg and Tim Abbott + * * * Permission is hereby granted, free of charge, to any person * obtaining a copy of this software and associated documentation @@ -41,6 +42,8 @@ #include "nonlocal.h" #define MAGIC_LOCAL_GR_BUFLEN (sysconf(_SC_GETGR_R_SIZE_MAX) + 7) +#define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users" +#define MAGIC_LOCAL_GROUPNAME "nss-local-users" static service_user * @@ -49,7 +52,7 @@ nss_group_nonlocal_database(void) static service_user *nip = NULL; if (nip == NULL) __nss_database_lookup("group_nonlocal", NULL, "", &nip); - + return nip; } @@ -83,6 +86,65 @@ check_nonlocal_gid(const char *user, gid_t gid, int *errnop) return status; } +enum nss_status +get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen, int *errnop) +{ + enum nss_status status = NSS_STATUS_NOTFOUND; + struct group gbuf; + struct group *gbufp = &gbuf; + int ret, n; + int old_errno = errno; + int len = MAGIC_LOCAL_GR_BUFLEN; + char *buf = malloc(len); + if (buf == NULL) { + *errnop = ENOMEM; + errno = old_errno; + return NSS_STATUS_TRYAGAIN; + } + errno = 0; + ret = getgrnam_r(name, gbufp, buf, len, &gbufp); + if (ret != 0) { + *errnop = old_errno; + status = NSS_STATUS_TRYAGAIN; + } else if (gbufp != NULL) { + status = NSS_STATUS_SUCCESS; + + n = snprintf(buffer, buflen, "%s", gbufp->gr_name); + if (n < 0 || n >= buflen) { + *errnop = ERANGE; + status = NSS_STATUS_TRYAGAIN; + goto get_local_group_done; + } + grp->gr_name = buffer; + buffer += n; + buflen -= n; + + n = snprintf(buffer, buflen, "%s", gbufp->gr_passwd); + if (n < 0 || n >= buflen) { + *errnop = ERANGE; + status = NSS_STATUS_TRYAGAIN; + goto get_local_group_done; + } + grp->gr_passwd = buffer; + buffer += n; + buflen -= n; + + grp->gr_gid = gbufp->gr_gid; + + if (buflen < sizeof(void *)) { + *errnop = ERANGE; + status = NSS_STATUS_TRYAGAIN; + goto get_local_group_done; + } + *(void **)buffer = NULL; + buffer += sizeof(void *); + buflen -= sizeof(void *); + } + get_local_group_done: + free(buf); + errno = old_errno; + return status; +} static service_user *grent_nip = NULL; static void *grent_fct_start; @@ -202,6 +264,9 @@ _nss_nonlocal_getgrnam_r(const char *name, struct group *grp, void *ptr; } fct; + if (buflen == MAGIC_LOCAL_GR_BUFLEN) + return NSS_STATUS_UNAVAIL; + nip = nss_group_nonlocal_database(); if (nip == NULL) return NSS_STATUS_UNAVAIL; @@ -274,6 +339,98 @@ _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start, int *errnop); void *ptr; } fct; + + struct group local_users_group, nonlocal_users_group; + gid_t local_users_gid, gid; + int is_local = 0; + int buflen; + char *buffer; + + /* Check that the user is a nonlocal user before adding any groups. */ + status = check_nonlocal_user(user, errnop); + if (status == NSS_STATUS_NOTFOUND) + is_local = 1; + else if (status != NSS_STATUS_SUCCESS) + return status; + + int old_errno = errno; + + buflen = sysconf(_SC_GETGR_R_SIZE_MAX); + buffer = malloc(buflen); + if (buffer == NULL) { + *errnop = ENOMEM; + errno = old_errno; + return NSS_STATUS_TRYAGAIN; + } + status = get_local_group(MAGIC_LOCAL_GROUPNAME, + &local_users_group, buffer, buflen, errnop); + if (status == NSS_STATUS_NOTFOUND) { + syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", + MAGIC_LOCAL_GROUPNAME); + local_users_gid = -1; + } else if (status != NSS_STATUS_SUCCESS) { + return status; + } else + local_users_gid = local_users_group.gr_gid; + free(buffer); + + if (is_local) { + gid = local_users_gid; + } else { + buflen = sysconf(_SC_GETGR_R_SIZE_MAX); + buffer = malloc(buflen); + if (buffer == NULL) { + *errnop = ENOMEM; + errno = old_errno; + return NSS_STATUS_TRYAGAIN; + } + status = get_local_group(MAGIC_NONLOCAL_GROUPNAME, + &nonlocal_users_group, buffer, buflen, errnop); + if (status == NSS_STATUS_NOTFOUND) { + syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", + MAGIC_NONLOCAL_GROUPNAME); + gid = -1; + } else if (status != NSS_STATUS_SUCCESS) { + errno = old_errno; + return status; + } else + gid = nonlocal_users_group.gr_gid; + free(buffer); + } + + if (gid != -1) { + int i; + for (i = 0; i < *start; ++i) + if ((*groupsp)[i] == gid) + break; + if (i >= *start) { + if (*start + 1 > *size) { + gid_t *newgroups; + long int newsize = 2 * *size; + if (limit > 0) { + if (*size >= limit) + return NSS_STATUS_SUCCESS; + if (newsize > limit) + newsize = limit; + } + newgroups = realloc(*groupsp, *size * sizeof((*groupsp)[0])); + if (newgroups == NULL) { + *errnop = ENOMEM; + errno = old_errno; + return NSS_STATUS_TRYAGAIN; + } + *groupsp = newgroups; + *size = newsize; + } + (*groupsp)[(*start)++] = gid; + } + } + + errno = old_errno; + + if (is_local) + return NSS_STATUS_SUCCESS; + int in = *start, out = *start, i; nip = nss_group_nonlocal_database(); @@ -303,6 +460,13 @@ _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start, if (i < out) continue; + /* Don't let users get into MAGIC_LOCAL_GROUPNAME from nonlocal reasons. */ + if (local_users_gid == (*groupsp)[in]) { + syslog(LOG_WARNING, "nss_nonlocal: Nonlocal user %s removed from special local users group %s", + user, MAGIC_LOCAL_GROUPNAME); + continue; + } + status = check_nonlocal_gid(user, (*groupsp)[in], &nonlocal_errno); if (status == NSS_STATUS_SUCCESS) { (*groupsp)[out++] = (*groupsp)[in];