mirror of
https://github.com/Dasharo/systemd.git
synced 2026-03-06 15:02:31 -08:00
nss-systemd: make dynamic users enumerable by getent
This adds `setpwent()`, `getpwent_r()`, `endpwent()`, `setgrent()`, `getgrent_r()`, and `endgrent()` interfaces to nss-systemd library. Thus, dynamic users can be enumerated by e.g. `getent passwd` command.
This commit is contained in:
Yu Watanabe
@@ -19,13 +19,17 @@
|
||||
***/
|
||||
|
||||
#include <nss.h>
|
||||
#include <pthread.h>
|
||||
|
||||
#include "sd-bus.h"
|
||||
|
||||
#include "alloc-util.h"
|
||||
#include "bus-common-errors.h"
|
||||
#include "dirent-util.h"
|
||||
#include "env-util.h"
|
||||
#include "fd-util.h"
|
||||
#include "fs-util.h"
|
||||
#include "list.h"
|
||||
#include "macro.h"
|
||||
#include "nss-util.h"
|
||||
#include "signal-util.h"
|
||||
@@ -73,8 +77,40 @@ static const struct group nobody_group = {
|
||||
.gr_mem = (char*[]) { NULL },
|
||||
};
|
||||
|
||||
typedef struct UserEntry UserEntry;
|
||||
typedef struct GetentData GetentData;
|
||||
|
||||
struct UserEntry {
|
||||
uid_t id;
|
||||
char *name;
|
||||
|
||||
GetentData *data;
|
||||
LIST_FIELDS(UserEntry, entries);
|
||||
};
|
||||
|
||||
struct GetentData {
|
||||
/* As explained in NOTES section of getpwent_r(3) as 'getpwent_r() is not really
|
||||
* reentrant since it shares the reading position in the stream with all other threads',
|
||||
* we need to protect the data in UserEntry from multithreaded programs which may call
|
||||
* setpwent(), getpwent_r(), or endpwent() simultaneously. So, each function locks the
|
||||
* data by using the mutex below. */
|
||||
pthread_mutex_t mutex;
|
||||
|
||||
UserEntry *position;
|
||||
LIST_HEAD(UserEntry, entries);
|
||||
};
|
||||
|
||||
static GetentData getpwent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL };
|
||||
static GetentData getgrent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL };
|
||||
|
||||
NSS_GETPW_PROTOTYPES(systemd);
|
||||
NSS_GETGR_PROTOTYPES(systemd);
|
||||
enum nss_status _nss_systemd_endpwent(void) _public_;
|
||||
enum nss_status _nss_systemd_setpwent(int stayopen) _public_;
|
||||
enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) _public_;
|
||||
enum nss_status _nss_systemd_endgrent(void) _public_;
|
||||
enum nss_status _nss_systemd_setgrent(int stayopen) _public_;
|
||||
enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) _public_;
|
||||
|
||||
static int direct_lookup_name(const char *name, uid_t *ret) {
|
||||
_cleanup_free_ char *s = NULL;
|
||||
@@ -530,3 +566,299 @@ fail:
|
||||
*errnop = -r;
|
||||
return NSS_STATUS_UNAVAIL;
|
||||
}
|
||||
|
||||
static void user_entry_free(UserEntry *p) {
|
||||
if (!p)
|
||||
return;
|
||||
|
||||
if (p->data)
|
||||
LIST_REMOVE(entries, p->data->entries, p);
|
||||
|
||||
free(p->name);
|
||||
free(p);
|
||||
}
|
||||
|
||||
static int user_entry_add(GetentData *data, const char *name, uid_t id) {
|
||||
UserEntry *p;
|
||||
|
||||
assert(data);
|
||||
|
||||
/* This happens when User= or Group= already exists statically. */
|
||||
if (!uid_is_dynamic(id))
|
||||
return -EINVAL;
|
||||
|
||||
p = new0(UserEntry, 1);
|
||||
if (!p)
|
||||
return -ENOMEM;
|
||||
|
||||
p->name = strdup(name);
|
||||
if (!p->name) {
|
||||
free(p);
|
||||
return -ENOMEM;
|
||||
}
|
||||
p->id = id;
|
||||
p->data = data;
|
||||
|
||||
LIST_PREPEND(entries, data->entries, p);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void systemd_endent(GetentData *data) {
|
||||
UserEntry *p;
|
||||
|
||||
assert(data);
|
||||
|
||||
while ((p = data->entries))
|
||||
user_entry_free(p);
|
||||
|
||||
data->position = NULL;
|
||||
}
|
||||
|
||||
static enum nss_status nss_systemd_endent(GetentData *p) {
|
||||
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||
|
||||
assert_se(pthread_mutex_lock(&p->mutex) == 0);
|
||||
systemd_endent(p);
|
||||
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||
|
||||
return NSS_STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_endpwent(void) {
|
||||
return nss_systemd_endent(&getpwent_data);
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_endgrent(void) {
|
||||
return nss_systemd_endent(&getgrent_data);
|
||||
}
|
||||
|
||||
static int direct_enumeration(GetentData *p) {
|
||||
_cleanup_closedir_ DIR *d = NULL;
|
||||
struct dirent *de;
|
||||
int r;
|
||||
|
||||
assert(p);
|
||||
|
||||
d = opendir("/run/systemd/dynamic-uid/");
|
||||
if (!d)
|
||||
return -errno;
|
||||
|
||||
FOREACH_DIRENT(de, d, return -errno) {
|
||||
_cleanup_free_ char *name = NULL;
|
||||
uid_t uid, verified;
|
||||
|
||||
if (!dirent_is_file(de))
|
||||
continue;
|
||||
|
||||
r = parse_uid(de->d_name, &uid);
|
||||
if (r < 0)
|
||||
continue;
|
||||
|
||||
r = direct_lookup_uid(uid, &name);
|
||||
if (r == -ENOMEM)
|
||||
return r;
|
||||
if (r < 0)
|
||||
continue;
|
||||
|
||||
r = direct_lookup_name(name, &verified);
|
||||
if (r < 0)
|
||||
continue;
|
||||
|
||||
if (uid != verified)
|
||||
continue;
|
||||
|
||||
r = user_entry_add(p, name, uid);
|
||||
if (r == -ENOMEM)
|
||||
return r;
|
||||
if (r < 0)
|
||||
continue;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static enum nss_status systemd_setent(GetentData *p) {
|
||||
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
||||
_cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
|
||||
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
|
||||
const char *name;
|
||||
uid_t id;
|
||||
int bypass, r;
|
||||
|
||||
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||
|
||||
assert(p);
|
||||
|
||||
assert_se(pthread_mutex_lock(&p->mutex) == 0);
|
||||
|
||||
systemd_endent(p);
|
||||
|
||||
if (getenv_bool_secure("SYSTEMD_NSS_DYNAMIC_BYPASS") > 0)
|
||||
goto finish;
|
||||
|
||||
bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS");
|
||||
|
||||
if (bypass <= 0) {
|
||||
r = sd_bus_open_system(&bus);
|
||||
if (r < 0)
|
||||
bypass = 1;
|
||||
}
|
||||
|
||||
if (bypass > 0) {
|
||||
r = direct_enumeration(p);
|
||||
if (r < 0)
|
||||
goto fail;
|
||||
|
||||
goto finish;
|
||||
}
|
||||
|
||||
r = sd_bus_call_method(bus,
|
||||
"org.freedesktop.systemd1",
|
||||
"/org/freedesktop/systemd1",
|
||||
"org.freedesktop.systemd1.Manager",
|
||||
"GetDynamicUsers",
|
||||
&error,
|
||||
&reply,
|
||||
NULL);
|
||||
if (r < 0)
|
||||
goto fail;
|
||||
|
||||
r = sd_bus_message_enter_container(reply, 'a', "(us)");
|
||||
if (r < 0)
|
||||
goto fail;
|
||||
|
||||
while ((r = sd_bus_message_read(reply, "(us)", &id, &name)) > 0) {
|
||||
r = user_entry_add(p, name, id);
|
||||
if (r == -ENOMEM)
|
||||
goto fail;
|
||||
if (r < 0)
|
||||
continue;
|
||||
}
|
||||
if (r < 0)
|
||||
goto fail;
|
||||
|
||||
r = sd_bus_message_exit_container(reply);
|
||||
if (r < 0)
|
||||
goto fail;
|
||||
|
||||
finish:
|
||||
p->position = p->entries;
|
||||
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||
|
||||
return NSS_STATUS_SUCCESS;
|
||||
|
||||
fail:
|
||||
systemd_endent(p);
|
||||
assert_se(pthread_mutex_unlock(&p->mutex) == 0);
|
||||
|
||||
return NSS_STATUS_UNAVAIL;
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_setpwent(int stayopen) {
|
||||
return systemd_setent(&getpwent_data);
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_setgrent(int stayopen) {
|
||||
return systemd_setent(&getgrent_data);
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) {
|
||||
enum nss_status ret;
|
||||
UserEntry *p;
|
||||
size_t len;
|
||||
|
||||
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||
|
||||
assert(result);
|
||||
assert(buffer);
|
||||
assert(errnop);
|
||||
|
||||
assert_se(pthread_mutex_lock(&getpwent_data.mutex) == 0);
|
||||
|
||||
LIST_FOREACH(entries, p, getpwent_data.position) {
|
||||
len = strlen(p->name) + 1;
|
||||
if (buflen < len) {
|
||||
*errnop = ERANGE;
|
||||
ret = NSS_STATUS_TRYAGAIN;
|
||||
goto finalize;
|
||||
}
|
||||
|
||||
memcpy(buffer, p->name, len);
|
||||
|
||||
result->pw_name = buffer;
|
||||
result->pw_uid = p->id;
|
||||
result->pw_gid = p->id;
|
||||
result->pw_gecos = (char*) DYNAMIC_USER_GECOS;
|
||||
result->pw_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||
result->pw_dir = (char*) DYNAMIC_USER_DIR;
|
||||
result->pw_shell = (char*) DYNAMIC_USER_SHELL;
|
||||
break;
|
||||
}
|
||||
if (!p) {
|
||||
*errnop = ENOENT;
|
||||
ret = NSS_STATUS_NOTFOUND;
|
||||
goto finalize;
|
||||
}
|
||||
|
||||
/* On success, step to the next entry. */
|
||||
p = p->entries_next;
|
||||
ret = NSS_STATUS_SUCCESS;
|
||||
|
||||
finalize:
|
||||
/* Save position for the next call. */
|
||||
getpwent_data.position = p;
|
||||
|
||||
assert_se(pthread_mutex_unlock(&getpwent_data.mutex) == 0);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) {
|
||||
enum nss_status ret;
|
||||
UserEntry *p;
|
||||
size_t len;
|
||||
|
||||
BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
|
||||
|
||||
assert(result);
|
||||
assert(buffer);
|
||||
assert(errnop);
|
||||
|
||||
assert_se(pthread_mutex_lock(&getgrent_data.mutex) == 0);
|
||||
|
||||
LIST_FOREACH(entries, p, getgrent_data.position) {
|
||||
len = sizeof(char*) + strlen(p->name) + 1;
|
||||
if (buflen < len) {
|
||||
*errnop = ERANGE;
|
||||
ret = NSS_STATUS_TRYAGAIN;
|
||||
goto finalize;
|
||||
}
|
||||
|
||||
memzero(buffer, sizeof(char*));
|
||||
strcpy(buffer + sizeof(char*), p->name);
|
||||
|
||||
result->gr_name = buffer + sizeof(char*);
|
||||
result->gr_gid = p->id;
|
||||
result->gr_passwd = (char*) DYNAMIC_USER_PASSWD;
|
||||
result->gr_mem = (char**) buffer;
|
||||
break;
|
||||
}
|
||||
if (!p) {
|
||||
*errnop = ENOENT;
|
||||
ret = NSS_STATUS_NOTFOUND;
|
||||
goto finalize;
|
||||
}
|
||||
|
||||
/* On success, step to the next entry. */
|
||||
p = p->entries_next;
|
||||
ret = NSS_STATUS_SUCCESS;
|
||||
|
||||
finalize:
|
||||
/* Save position for the next call. */
|
||||
getgrent_data.position = p;
|
||||
|
||||
assert_se(pthread_mutex_unlock(&getgrent_data.mutex) == 0);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
@@ -13,7 +13,13 @@
|
||||
global:
|
||||
_nss_systemd_getpwnam_r;
|
||||
_nss_systemd_getpwuid_r;
|
||||
_nss_systemd_endpwent;
|
||||
_nss_systemd_setpwent;
|
||||
_nss_systemd_getpwent_r;
|
||||
_nss_systemd_getgrnam_r;
|
||||
_nss_systemd_getgrgid_r;
|
||||
_nss_systemd_endgrent;
|
||||
_nss_systemd_setgrent;
|
||||
_nss_systemd_getgrent_r;
|
||||
local: *;
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user