diff options
author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2018-03-21 13:39:03 +0900 |
---|---|---|
committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2018-03-21 13:39:03 +0900 |
commit | 12c2c56dcbd03dde58c89d3d96c19da7bee04881 (patch) | |
tree | b65169da68878e4e211a07f0c55dc1542fbddb3e /src/nss-systemd/nss-systemd.c | |
parent | 9b5eaef3d10544ae0c65f6671f2bb97f7fe1d090 (diff) | |
download | systemd-12c2c56dcbd03dde58c89d3d96c19da7bee04881.tar.gz |
nss-systemd: make dynamic users enumerable by `getent`
This adds `setpwent()`, `getpwent_r()`, `endpwent()`, `setgrent()`,
`getgrent_r()`, and `endgrent()` interfaces to nss-systemd library.
Thus, dynamic users can be enumerated by e.g. `getent passwd` command.
Diffstat (limited to 'src/nss-systemd/nss-systemd.c')
-rw-r--r-- | src/nss-systemd/nss-systemd.c | 332 |
1 files changed, 332 insertions, 0 deletions
diff --git a/src/nss-systemd/nss-systemd.c b/src/nss-systemd/nss-systemd.c index a8705e6677..d5a061a551 100644 --- a/src/nss-systemd/nss-systemd.c +++ b/src/nss-systemd/nss-systemd.c @@ -19,13 +19,17 @@ ***/ #include <nss.h> +#include <pthread.h> #include "sd-bus.h" #include "alloc-util.h" #include "bus-common-errors.h" +#include "dirent-util.h" #include "env-util.h" +#include "fd-util.h" #include "fs-util.h" +#include "list.h" #include "macro.h" #include "nss-util.h" #include "signal-util.h" @@ -73,8 +77,40 @@ static const struct group nobody_group = { .gr_mem = (char*[]) { NULL }, }; +typedef struct UserEntry UserEntry; +typedef struct GetentData GetentData; + +struct UserEntry { + uid_t id; + char *name; + + GetentData *data; + LIST_FIELDS(UserEntry, entries); +}; + +struct GetentData { + /* As explained in NOTES section of getpwent_r(3) as 'getpwent_r() is not really + * reentrant since it shares the reading position in the stream with all other threads', + * we need to protect the data in UserEntry from multithreaded programs which may call + * setpwent(), getpwent_r(), or endpwent() simultaneously. So, each function locks the + * data by using the mutex below. */ + pthread_mutex_t mutex; + + UserEntry *position; + LIST_HEAD(UserEntry, entries); +}; + +static GetentData getpwent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL }; +static GetentData getgrent_data = { PTHREAD_MUTEX_INITIALIZER, NULL, NULL }; + NSS_GETPW_PROTOTYPES(systemd); NSS_GETGR_PROTOTYPES(systemd); +enum nss_status _nss_systemd_endpwent(void) _public_; +enum nss_status _nss_systemd_setpwent(int stayopen) _public_; +enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) _public_; +enum nss_status _nss_systemd_endgrent(void) _public_; +enum nss_status _nss_systemd_setgrent(int stayopen) _public_; +enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) _public_; static int direct_lookup_name(const char *name, uid_t *ret) { _cleanup_free_ char *s = NULL; @@ -530,3 +566,299 @@ fail: *errnop = -r; return NSS_STATUS_UNAVAIL; } + +static void user_entry_free(UserEntry *p) { + if (!p) + return; + + if (p->data) + LIST_REMOVE(entries, p->data->entries, p); + + free(p->name); + free(p); +} + +static int user_entry_add(GetentData *data, const char *name, uid_t id) { + UserEntry *p; + + assert(data); + + /* This happens when User= or Group= already exists statically. */ + if (!uid_is_dynamic(id)) + return -EINVAL; + + p = new0(UserEntry, 1); + if (!p) + return -ENOMEM; + + p->name = strdup(name); + if (!p->name) { + free(p); + return -ENOMEM; + } + p->id = id; + p->data = data; + + LIST_PREPEND(entries, data->entries, p); + + return 0; +} + +static void systemd_endent(GetentData *data) { + UserEntry *p; + + assert(data); + + while ((p = data->entries)) + user_entry_free(p); + + data->position = NULL; +} + +static enum nss_status nss_systemd_endent(GetentData *p) { + BLOCK_SIGNALS(NSS_SIGNALS_BLOCK); + + assert_se(pthread_mutex_lock(&p->mutex) == 0); + systemd_endent(p); + assert_se(pthread_mutex_unlock(&p->mutex) == 0); + + return NSS_STATUS_SUCCESS; +} + +enum nss_status _nss_systemd_endpwent(void) { + return nss_systemd_endent(&getpwent_data); +} + +enum nss_status _nss_systemd_endgrent(void) { + return nss_systemd_endent(&getgrent_data); +} + +static int direct_enumeration(GetentData *p) { + _cleanup_closedir_ DIR *d = NULL; + struct dirent *de; + int r; + + assert(p); + + d = opendir("/run/systemd/dynamic-uid/"); + if (!d) + return -errno; + + FOREACH_DIRENT(de, d, return -errno) { + _cleanup_free_ char *name = NULL; + uid_t uid, verified; + + if (!dirent_is_file(de)) + continue; + + r = parse_uid(de->d_name, &uid); + if (r < 0) + continue; + + r = direct_lookup_uid(uid, &name); + if (r == -ENOMEM) + return r; + if (r < 0) + continue; + + r = direct_lookup_name(name, &verified); + if (r < 0) + continue; + + if (uid != verified) + continue; + + r = user_entry_add(p, name, uid); + if (r == -ENOMEM) + return r; + if (r < 0) + continue; + } + + return 0; +} + +static enum nss_status systemd_setent(GetentData *p) { + _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; + _cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL; + _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL; + const char *name; + uid_t id; + int bypass, r; + + BLOCK_SIGNALS(NSS_SIGNALS_BLOCK); + + assert(p); + + assert_se(pthread_mutex_lock(&p->mutex) == 0); + + systemd_endent(p); + + if (getenv_bool_secure("SYSTEMD_NSS_DYNAMIC_BYPASS") > 0) + goto finish; + + bypass = getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS"); + + if (bypass <= 0) { + r = sd_bus_open_system(&bus); + if (r < 0) + bypass = 1; + } + + if (bypass > 0) { + r = direct_enumeration(p); + if (r < 0) + goto fail; + + goto finish; + } + + r = sd_bus_call_method(bus, + "org.freedesktop.systemd1", + "/org/freedesktop/systemd1", + "org.freedesktop.systemd1.Manager", + "GetDynamicUsers", + &error, + &reply, + NULL); + if (r < 0) + goto fail; + + r = sd_bus_message_enter_container(reply, 'a', "(us)"); + if (r < 0) + goto fail; + + while ((r = sd_bus_message_read(reply, "(us)", &id, &name)) > 0) { + r = user_entry_add(p, name, id); + if (r == -ENOMEM) + goto fail; + if (r < 0) + continue; + } + if (r < 0) + goto fail; + + r = sd_bus_message_exit_container(reply); + if (r < 0) + goto fail; + +finish: + p->position = p->entries; + assert_se(pthread_mutex_unlock(&p->mutex) == 0); + + return NSS_STATUS_SUCCESS; + +fail: + systemd_endent(p); + assert_se(pthread_mutex_unlock(&p->mutex) == 0); + + return NSS_STATUS_UNAVAIL; +} + +enum nss_status _nss_systemd_setpwent(int stayopen) { + return systemd_setent(&getpwent_data); +} + +enum nss_status _nss_systemd_setgrent(int stayopen) { + return systemd_setent(&getgrent_data); +} + +enum nss_status _nss_systemd_getpwent_r(struct passwd *result, char *buffer, size_t buflen, int *errnop) { + enum nss_status ret; + UserEntry *p; + size_t len; + + BLOCK_SIGNALS(NSS_SIGNALS_BLOCK); + + assert(result); + assert(buffer); + assert(errnop); + + assert_se(pthread_mutex_lock(&getpwent_data.mutex) == 0); + + LIST_FOREACH(entries, p, getpwent_data.position) { + len = strlen(p->name) + 1; + if (buflen < len) { + *errnop = ERANGE; + ret = NSS_STATUS_TRYAGAIN; + goto finalize; + } + + memcpy(buffer, p->name, len); + + result->pw_name = buffer; + result->pw_uid = p->id; + result->pw_gid = p->id; + result->pw_gecos = (char*) DYNAMIC_USER_GECOS; + result->pw_passwd = (char*) DYNAMIC_USER_PASSWD; + result->pw_dir = (char*) DYNAMIC_USER_DIR; + result->pw_shell = (char*) DYNAMIC_USER_SHELL; + break; + } + if (!p) { + *errnop = ENOENT; + ret = NSS_STATUS_NOTFOUND; + goto finalize; + } + + /* On success, step to the next entry. */ + p = p->entries_next; + ret = NSS_STATUS_SUCCESS; + +finalize: + /* Save position for the next call. */ + getpwent_data.position = p; + + assert_se(pthread_mutex_unlock(&getpwent_data.mutex) == 0); + + return ret; +} + +enum nss_status _nss_systemd_getgrent_r(struct group *result, char *buffer, size_t buflen, int *errnop) { + enum nss_status ret; + UserEntry *p; + size_t len; + + BLOCK_SIGNALS(NSS_SIGNALS_BLOCK); + + assert(result); + assert(buffer); + assert(errnop); + + assert_se(pthread_mutex_lock(&getgrent_data.mutex) == 0); + + LIST_FOREACH(entries, p, getgrent_data.position) { + len = sizeof(char*) + strlen(p->name) + 1; + if (buflen < len) { + *errnop = ERANGE; + ret = NSS_STATUS_TRYAGAIN; + goto finalize; + } + + memzero(buffer, sizeof(char*)); + strcpy(buffer + sizeof(char*), p->name); + + result->gr_name = buffer + sizeof(char*); + result->gr_gid = p->id; + result->gr_passwd = (char*) DYNAMIC_USER_PASSWD; + result->gr_mem = (char**) buffer; + break; + } + if (!p) { + *errnop = ENOENT; + ret = NSS_STATUS_NOTFOUND; + goto finalize; + } + + /* On success, step to the next entry. */ + p = p->entries_next; + ret = NSS_STATUS_SUCCESS; + +finalize: + /* Save position for the next call. */ + getgrent_data.position = p; + + assert_se(pthread_mutex_unlock(&getgrent_data.mutex) == 0); + + return ret; +} |