summaryrefslogtreecommitdiffstats
path: root/src/nss-systemd (follow)
Commit message (Collapse)AuthorAgeFilesLines
* tree-wide: drop doubled empty linesYu Watanabe2024-10-071-1/+0
|
* env-util: rename getenv_bool_secure() → secure_getenv_bool()Lennart Poettering2024-02-282-7/+7
| | | | | | The glibc API is behind the wrapper is called "secure_getenv()", hence our wrapper really should keep the order too, otherwise things are just too confusing.
* meson: Fix version script handlingJan Janssen2023-09-261-1/+1
| | | | | | Build targets should have a link dependency on the version scripts they use. This also uses absolute paths in anticipation for meson 1.3 needlessly deprecating file to string conversions.
* meson: move declarations of nss modulesYu Watanabe2023-07-311-0/+13
|
* Include <threads.h> if possible to get thread_local definitionCristian Rodríguez2023-03-061-0/+1
| | | | | | | | | | | | IN C23, thread_local is a reserved keyword and we shall therefore do nothing to redefine it. glibc has it defined for older standard version with the right conditions. v2 by Yu Watanabe: Move the definition to missing_threads.h like the way we define e.g. missing syscalls or missing definitions, and include it by the users. Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
* various: try to use DEFAULT_USER_SHELL for root tooZbigniew Jędrzejewski-Szmek2022-08-241-27/+33
| | | | | | | | | | | | | | | | | | | /bin/sh as a shell is punishing. There is no good reason to make the occasional root login unpleasant. Since /bin/sh is usually /bin/bash in compat mode, i.e. if one is available, the other will be too, /bin/bash is almost as good as a default. But to avoid a regression in the situation where /bin/bash (or DEFAULT_USER_SHELL) is not installed, we check with access() and fall back to /bin/sh. This should make this change in behaviour less risky. (FWIW, e.g. Fedora/RHEL use /bin/bash as default for root.) This is a follow-up of sorts for 53350c7bbade8c5f357aa3d1029ef9b2208ea675, which added the default-user-shell option, but most likely with the idea of using /bin/bash less ;) Fixes #24369.
* Use descriptive name for nobodyZbigniew Jędrzejewski-Szmek2022-05-271-1/+1
| | | | | | | This matches the changes pushed to Fedora [1,2]. [1] https://fedoraproject.org/wiki/Changes/RenameNobodyUser [2] https://pagure.io/setup/c/f6fdb5ffc87fc8f1acc211867fef4e3f0856edfc
* strv: make iterator in STRV_FOREACH() declaread in the loopYu Watanabe2022-03-191-1/+1
| | | | This also avoids multiple evaluations in STRV_FOREACH_BACKWARDS()
* nss: only read logging config from environment variablesZbigniew Jędrzejewski-Szmek2022-01-111-1/+1
| | | | | | | | | | | | | log_parse_environment() uses should_parse_proc_cmdline() to determine whether it should parse settings from the kernel command line. But the checks that should_parse_proc_cmdline() apply to the whole process, and we could get a positive answer also when log_parse_environment() was called from one of the nss modules. In case of nss-modules, we don't want to look at the kernel command line. log_parse_environment_variables() that only looks at the environment variables is split out and used in the nss modules. Fixes #22020.
* nss: drop dummy setup_logging() helpersZbigniew Jędrzejewski-Szmek2022-01-111-6/+1
| | | | | | log_parse_environment() stopped being a macro in 9fdee66f2d9. As reported by @bauen1 in https://github.com/systemd/systemd/issues/22020, the comment was out of date.
* nss-systemd: fix alignment of gr_memYu Watanabe2021-12-311-2/+2
| | | | | | Follow-up for 1e65eb8f9b7d567462030b2e625998d77677e636. Fixes #21935.
* nss-systemd: fix required buffer size calculationYu Watanabe2021-12-301-2/+2
| | | | | | | | This also fixes the pointer assigned to the gr_mem element of struct group. Fixes a bug introduced by 47fd7fa6c650d7a0ac41bc89747e3b866ffb9534. Fixes #21935.
* tree-wide: mark set-but-not-used variables as unused to make LLVM happyFrantisek Sumsal2021-09-151-2/+2
| | | | | | | | | | | | | | LLVM 13 introduced `-Wunused-but-set-variable` diagnostic flag, which trips over some intentionally set-but-not-used variables or variables attached to cleanup handlers with side effects (`_cleanup_umask_`, `_cleanup_(notify_on_cleanup)`, `_cleanup_(restore_sigsetp)`, etc.): ``` ../src/basic/process-util.c:1257:46: error: variable 'saved_ssp' set but not used [-Werror,-Wunused-but-set-variable] _cleanup_(restore_sigsetp) sigset_t *saved_ssp = NULL; ^ 1 error generated. ```
* nss-systemd: ensure returned strings point into provided bufferMichael Catanzaro2021-09-091-36/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jamie Bainbridge found an issue where glib's g_get_user_database_entry() may crash after doing: ``` error = getpwnam_r (logname, &pwd, buffer, bufsize, &pw); // ... pw->pw_name[0] = g_ascii_toupper (pw->pw_name[0]); ``` in order to uppercase the first letter of the user's real name. This is a glib bug, because there is a different codepath that gets the pwd from vanilla getpwnam instead of getpwnam_r as shown here. When the pwd struct is returned by getpwnam, its fields point to static data owned by glibc/NSS, and so it must not be modified by the caller. After much debugging, Jamie Bainbridge has fixed this in https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2244 by making a copy of the data before modifying it, and that resolves all problems for glib. Yay! However, glib is crashing even when getpwnam_r is used instead of getpwnam! According to getpwnam_r(3), the strings in the pwd struct are supposed to be pointers into the buffer passed by the caller, so glib should be able to safely edit it directly in this case, so long as it doesn't try to increase the size of any of the strings. Problem is various functions throughout nss-systemd.c return synthesized records declared at the top of the file. These records are returned directly and so contain pointers to static strings owned by libsystemd-nss. systemd must instead copy all the strings into the provided buffer. This crash is reproducible if nss-systemd is listed first on the passwd line in /etc/nsswitch.conf, and the application looks up one of the synthesized user accounts "root" or "nobody", and finally the application attempts to edit one of the strings in the returned struct. All our synthesized records for the other struct types have the same problem, so this commit fixes them all at once. Fixes #20679
* nss-systemd: pack pw_passwd result into supplied bufferMichael Catanzaro2021-09-081-2/+4
| | | | | | | | | | | | | | | | | getpwnam_r() guarantees that the strings in the struct passwd that it returns are pointers into the buffer allocated by the application and passed to getpwnam_r(). This means applications may choose to modify the strings in place, as long as the length of the strings is not increased. So it's wrong for us to return a static string here, we really do have to copy it into the application-provided buffer like we do for all the other strings. This is only a theoretical problem since it would be very weird for an application to modify the pw_passwd field, but I spotted this when investigating a similar crash caused by glib editing a different field. See also: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2244
* fix typoYu Watanabe2021-05-141-1/+1
|
* nss-systemd: synthesize NSS shadow/gshadow records from userdb, as wellLennart Poettering2021-05-084-4/+460
| | | | | | | This ensures we not only synthesize regular paswd/group records of userdb records, but shadow records as well. This should make sure that userdb can be used as comprehensive superset of the classic passwd/group/shadow/gshadow functionality.
* nss-systemd: set USERDB_SUPPRESS_SHADOW flag when looking up user recordsLennart Poettering2021-05-081-6/+6
| | | | | | | | | | | | | | | | | Setting the flags means we won#t try to read the data from /etc/shadow when reading a user record, thus slightly making conversion quicker and reducing the chance of generating MAC faults, because we needlessly access a privileged resource. Previously, passing the flag didn't matter, when converting our JSON records to NSS since the flag only had an effect on whether to use NSS getspnam() and related calls or not. But given that we turn off NSS anyway as backend for this conversion (since we want to avoid NSS loops, where we turn NSS data to our JSON user records, and then to NSS forever and ever) it was unnecessary to pass it. This changed in one of the previous commits however, where we added support for reading user definitions from drop-in files, with separate drop-in files for the shadow data.
* userdb: rename userdb lookup flags a bitLennart Poettering2021-05-072-3/+3
| | | | | | | | | | | | | Let's use "exclude" for flags that really exclude records from our lookup. Let's use "avoid" referring to concepts that when flag is set we'll not use but we have a fallback path for that should yield the same result. Let' use "suppress" for suppressing partial info, even if we return the record otherwise. So far we used "avoid" for all these cases, which was confusing. Whiel we are at it, let's reassign the bits a bit, leaving some space for bits follow-up commits are going to add.
* nss-systemd: make llvm work-around for used _cleanup_ explicitLennart Poettering2021-05-071-16/+14
|
* nss-systemd: properly handle empty membership listsLennart Poettering2021-05-072-4/+7
| | | | | | | When we are queried for membership lists on a system that has exactly zero, then we'll return ESRCH immediately instead of at EOF. Which is OK, but we need to handle this in various places, and not get confused by it.
* nss-systemd: reset the right fieldLennart Poettering2021-05-061-1/+1
|
* user-util: add generic definition for special password hash values in ↵Lennart Poettering2021-05-062-6/+7
| | | | | | | | | | | | | | /etc/passwd + /etc/shadow Let's add three defines for the 3 special cases of passwords. Some of our tools used different values for the "locked"/"invalid" case, let's settle on using "!*" which means the password is both locked *and* invalid. Other tools like to use "!!" for this case, which however is less than ideal I think, since the this could also be a considered an entry with an empty password, that can be enabled again by unlocking it twice.
* nss-systemd: initialize loggingZbigniew Jędrzejewski-Szmek2020-12-101-10/+25
|
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-095-5/+5
|
* tree-wide: assorted coccinelle fixesFrantisek Sumsal2020-10-091-1/+1
|
* shared: merge {user,group}-record-nss.{c,h}Zbigniew Jędrzejewski-Szmek2020-09-012-2/+2
| | | | | They both are both short and contain similar parts and various helper will be shared between both parts of the code so it's easier to use a single file.
* userdb: replace recursion lockLennart Poettering2020-06-234-63/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously we'd used the existance of a specific AF_UNIX socket in the abstract namespace as lock for disabling lookup recursions. (for breaking out of the loop: userdb synthesized from nss → nss synthesized from userdb → userdb synthesized from nss → …) I did it like that because it promised to work the same both in static and in dynmically linked environments and is accessible easily from any programming language. However, it has a weakness regarding reuse attacks: the socket is securely hashed (siphash) from the thread ID in combination with the AT_RANDOM secret. Thus it should not be guessable from an attacker in advance. That's only true if a thread takes the lock only once and keeps it forever. However, if a thread takes and releases it multiple times an attacker might monitor that and quickly take the lock after the first iteration for follow-up iterations. It's not a big issue given that userdb (as the primary user for this) never released the lock and we never made the concept a public interface, and it was only included in one release so far, but it's something that deserves fixing. (moreover it's a local DoS only, only permitting to disable native userdb lookups) With this rework the libnss_systemd.so.2 module will now export two additional symbols. These symbols are not used by glibc, but can be used by arbitrary programs: one can be used to disable nss-systemd, the other to check if it is currently disabled. The lock is per-thread. It's slightly less pretty, since it requires people to manually link against C code via dlopen()/dlsym(), but it should work safely without the aforementioned weakness.
* nss-systemd: skip /etc/gshadow look-ups when we just need the GID of a groupLennart Poettering2020-06-231-1/+1
|
* nss-systemd: don't synthesize root/nobody when iteratingLennart Poettering2020-04-231-2/+8
| | | | Fixes: #15160
* tree-wide: spellcheck using codespellZbigniew Jędrzejewski-Szmek2020-04-161-1/+1
| | | | Fixes #15436.
* Merge pull request #15377 from poettering/userdb-no-shadowZbigniew Jędrzejewski-Szmek2020-04-112-3/+3
|\ | | | | don't try to access shadow from logind
| * userdb: when doing client-side NSS look-ups optionally avoid shadow look-upsLennart Poettering2020-04-092-3/+3
| |
* | user-util: rework how we validate user namesLennart Poettering2020-04-081-3/+3
|/ | | | | | | | | | | | | | | | | | | | | | | | | This reworks the user validation infrastructure. There are now two modes. In regular mode we are strict and test against a strict set of valid chars. And in "relaxed" mode we just filter out some really obvious, dangerous stuff. i.e. strict is whitelisting what is OK, but "relaxed" is blacklisting what is really not OK. The idea is that we use strict mode whenver we allocate a new user (i.e. in sysusers.d or homed), while "relaxed" mode is when we process users registered elsewhere, (i.e. userdb, logind, …) The requirements on user name validity vary wildly. SSSD thinks its fine to embedd "@" for example, while the suggested NAME_REGEX field on Debian does not even allow uppercase chars… This effectively liberaralizes a lot what we expect from usernames. The code that warns about questionnable user names is now optional and only used at places such as unit file parsing, so that it doesn't show up on every userdb query, but only when processing configuration files that know better. Fixes: #15149 #15090
* nss-systemd: use _cleanup_ for pthread_mutex_{lock,unlock}Zbigniew Jędrzejewski-Szmek2020-03-281-62/+39
| | | | v2: separate the declaration from the assignment to appease clang.
* nss-systemd: add missing jump to unlock mutexZbigniew Jędrzejewski-Szmek2020-03-281-2/+3
| | | | CID#1412415.
* userdb: fix lookup of groups defined by homedZbigniew Jędrzejewski-Szmek2020-03-011-1/+1
|
* Fix two typosZbigniew Jędrzejewski-Szmek2020-03-011-1/+1
|
* nss: hook up nss-systemd with userdb varlink bitsLennart Poettering2020-01-154-566/+741
| | | | | | | | | | | This changes nss-systemd to use the new varlink user/group APIs for looking up everything. (This also changes the factory /etc/nsswitch.conf line to use for hooking up nss-system to use glibc's [SUCCESS=merge] feature so that we can properly merge group membership lists). Fixes: #12492
* meson: make nologin path build time configurableMichael Biebl2019-07-181-2/+2
| | | | | | | | | Some distros install nologin as /usr/sbin/nologin, others as /sbin/nologin. Since we can't really on merged-usr everywhere (where the path wouldn't matter), make the path build time configurable via -Dnologin-path=. Closes #13028
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+1
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* nss: unportect errno before writing to NSS' *errnopLennart Poettering2019-02-081-0/+10
| | | | Fixes: #11321
* Revert "nss: prevent PROTECT_ERRNO from squashing changes to *errnop"Zbigniew Jędrzejewski-Szmek2019-01-101-8/+8
| | | | | | | This reverts commit b26c90411343d74b15deb24bd87077848e316dab. I don't see anythign wrong, but Ubuntu autopkgtest CI started failing fairly consistently since this was merged. Let's see if reverting fixes things.
* nss: prevent PROTECT_ERRNO from squashing changes to *errnopSam Morris2019-01-101-8/+8
| | | | | | | glibc passes in &errno for errnop, which means PROTECT_ERRNO ends up squashing our intentional changes to *errnop. Fixes #11321.
* nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESSYu Watanabe2018-07-251-48/+26
| | | | | | | | | This also adds PROTECT_ERRNO for all nss module functions. C.f. glibc NSS documents https://www.gnu.org/software/libc/manual/html_node/NSS-Modules-Interface.html and discussion in https://sourceware.org/bugzilla/show_bug.cgi?id=23410. Fixes #9585.
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-3/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-142-4/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* nss-systemd: make dynamic users enumerable by `getent`Yu Watanabe2018-03-212-0/+338
| | | | | | This adds `setpwent()`, `getpwent_r()`, `endpwent()`, `setgrent()`, `getgrent_r()`, and `endgrent()` interfaces to nss-systemd library. Thus, dynamic users can be enumerated by e.g. `getent passwd` command.
* nss-systemd: define dynamic user propertiesYu Watanabe2018-03-211-10/+15
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-01 23:39:55 +0100