Skip to content

Commit 2d9123c

Browse files
keszybzkeszybz
authored
Merge pull request systemd#15377 from poettering/userdb-no-shadow
don't try to access shadow from logind
2 parents edc8dd2 + b062ca6 commit 2d9123c

File tree

11 files changed

+89
-57
lines changed

11 files changed

+89
-57
lines changed

‎src/home/pam_systemd_home.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -877,7 +877,6 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
877877
if (FLAGS_SET(flags, PAM_PRELIM_CHECK))
878878
return PAM_SUCCESS;
879879

880-
881880
old_secret = user_record_new();
882881
if (!old_secret)
883882
return pam_log_oom(handle);

‎src/login/logind-core.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ int manager_add_user_by_name(
171171
assert(m);
172172
assert(name);
173173

174-
r = userdb_by_name(name, 0, &ur);
174+
r = userdb_by_name(name, USERDB_AVOID_SHADOW, &ur);
175175
if (r < 0)
176176
return r;
177177

@@ -189,7 +189,7 @@ int manager_add_user_by_uid(
189189
assert(m);
190190
assert(uid_is_valid(uid));
191191

192-
r = userdb_by_uid(uid, 0, &ur);
192+
r = userdb_by_uid(uid, USERDB_AVOID_SHADOW, &ur);
193193
if (r < 0)
194194
return r;
195195

‎src/nss-systemd/nss-systemd.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,7 @@ enum nss_status _nss_systemd_getgrent_r(
482482
}
483483
}
484484

485-
r = nss_group_record_by_name(group_name, &gr);
485+
r = nss_group_record_by_name(group_name, false, &gr);
486486
if (r == -ESRCH)
487487
continue;
488488
if (r < 0) {

‎src/nss-systemd/userdb-glue.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ enum nss_status userdb_getgrnam(
251251
if (lock_fd < 0 && lock_fd != -EBUSY)
252252
return lock_fd;
253253

254-
r = nss_group_record_by_name(name, &g);
254+
r = nss_group_record_by_name(name, false, &g);
255255
if (r == -ESRCH)
256256
return NSS_STATUS_NOTFOUND;
257257
if (r < 0) {
@@ -310,7 +310,7 @@ enum nss_status userdb_getgrgid(
310310
if (lock_fd < 0 && lock_fd != -EBUSY)
311311
return lock_fd;
312312

313-
r = nss_group_record_by_gid(gid, &g);
313+
r = nss_group_record_by_gid(gid, false, &g);
314314
if (r == -ESRCH)
315315
return NSS_STATUS_NOTFOUND;
316316

‎src/shared/group-record-nss.c‎

Lines changed: 34 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -106,12 +106,16 @@ int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **re
106106
}
107107
}
108108

109-
int nss_group_record_by_name(const char *name, GroupRecord **ret) {
109+
int nss_group_record_by_name(
110+
const char *name,
111+
bool with_shadow,
112+
GroupRecord **ret) {
113+
110114
_cleanup_free_ char *buf = NULL, *sbuf = NULL;
111115
struct group grp, *result;
112116
bool incomplete = false;
113117
size_t buflen = 4096;
114-
struct sgrp sgrp;
118+
struct sgrp sgrp, *sresult = NULL;
115119
int r;
116120

117121
assert(name);
@@ -141,26 +145,34 @@ int nss_group_record_by_name(const char *name, GroupRecord **ret) {
141145
buf = mfree(buf);
142146
}
143147

144-
r = nss_sgrp_for_group(result, &sgrp, &sbuf);
145-
if (r < 0) {
146-
log_debug_errno(r, "Failed to do shadow lookup for group %s, ignoring: %m", result->gr_name);
147-
incomplete = ERRNO_IS_PRIVILEGE(r);
148-
}
149-
150-
r = nss_group_to_group_record(result, r >= 0 ? &sgrp : NULL, ret);
148+
if (with_shadow) {
149+
r = nss_sgrp_for_group(result, &sgrp, &sbuf);
150+
if (r < 0) {
151+
log_debug_errno(r, "Failed to do shadow lookup for group %s, ignoring: %m", result->gr_name);
152+
incomplete = ERRNO_IS_PRIVILEGE(r);
153+
} else
154+
sresult = &sgrp;
155+
} else
156+
incomplete = true;
157+
158+
r = nss_group_to_group_record(result, sresult, ret);
151159
if (r < 0)
152160
return r;
153161

154162
(*ret)->incomplete = incomplete;
155163
return 0;
156164
}
157165

158-
int nss_group_record_by_gid(gid_t gid, GroupRecord **ret) {
166+
int nss_group_record_by_gid(
167+
gid_t gid,
168+
bool with_shadow,
169+
GroupRecord **ret) {
170+
159171
_cleanup_free_ char *buf = NULL, *sbuf = NULL;
160172
struct group grp, *result;
161173
bool incomplete = false;
162174
size_t buflen = 4096;
163-
struct sgrp sgrp;
175+
struct sgrp sgrp, *sresult = NULL;
164176
int r;
165177

166178
assert(ret);
@@ -188,13 +200,17 @@ int nss_group_record_by_gid(gid_t gid, GroupRecord **ret) {
188200
buf = mfree(buf);
189201
}
190202

191-
r = nss_sgrp_for_group(result, &sgrp, &sbuf);
192-
if (r < 0) {
193-
log_debug_errno(r, "Failed to do shadow lookup for group %s, ignoring: %m", result->gr_name);
194-
incomplete = ERRNO_IS_PRIVILEGE(r);
195-
}
196-
197-
r = nss_group_to_group_record(result, r >= 0 ? &sgrp : NULL, ret);
203+
if (with_shadow) {
204+
r = nss_sgrp_for_group(result, &sgrp, &sbuf);
205+
if (r < 0) {
206+
log_debug_errno(r, "Failed to do shadow lookup for group %s, ignoring: %m", result->gr_name);
207+
incomplete = ERRNO_IS_PRIVILEGE(r);
208+
} else
209+
sresult = &sgrp;
210+
} else
211+
incomplete = true;
212+
213+
r = nss_group_to_group_record(result, sresult, ret);
198214
if (r < 0)
199215
return r;
200216

‎src/shared/group-record-nss.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@
1111
int nss_group_to_group_record(const struct group *grp, const struct sgrp *sgrp, GroupRecord **ret);
1212
int nss_sgrp_for_group(const struct group *grp, struct sgrp *ret_sgrp, char **ret_buffer);
1313

14-
int nss_group_record_by_name(const char *name, GroupRecord **ret);
15-
int nss_group_record_by_gid(gid_t gid, GroupRecord **ret);
14+
int nss_group_record_by_name(const char *name, bool with_shadow, GroupRecord **ret);
15+
int nss_group_record_by_gid(gid_t gid, bool with_shadow, GroupRecord **ret);

‎src/shared/user-record-nss.c‎

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -161,12 +161,16 @@ int nss_spwd_for_passwd(const struct passwd *pwd, struct spwd *ret_spwd, char **
161161
}
162162
}
163163

164-
int nss_user_record_by_name(const char *name, UserRecord **ret) {
164+
int nss_user_record_by_name(
165+
const char *name,
166+
bool with_shadow,
167+
UserRecord **ret) {
168+
165169
_cleanup_free_ char *buf = NULL, *sbuf = NULL;
166170
struct passwd pwd, *result;
167171
bool incomplete = false;
168172
size_t buflen = 4096;
169-
struct spwd spwd;
173+
struct spwd spwd, *sresult = NULL;
170174
int r;
171175

172176
assert(name);
@@ -197,26 +201,34 @@ int nss_user_record_by_name(const char *name, UserRecord **ret) {
197201
buf = mfree(buf);
198202
}
199203

200-
r = nss_spwd_for_passwd(result, &spwd, &sbuf);
201-
if (r < 0) {
202-
log_debug_errno(r, "Failed to do shadow lookup for user %s, ignoring: %m", name);
203-
incomplete = ERRNO_IS_PRIVILEGE(r);
204-
}
204+
if (with_shadow) {
205+
r = nss_spwd_for_passwd(result, &spwd, &sbuf);
206+
if (r < 0) {
207+
log_debug_errno(r, "Failed to do shadow lookup for user %s, ignoring: %m", name);
208+
incomplete = ERRNO_IS_PRIVILEGE(r);
209+
} else
210+
sresult = &spwd;
211+
} else
212+
incomplete = true;
205213

206-
r = nss_passwd_to_user_record(result, r >= 0 ? &spwd : NULL, ret);
214+
r = nss_passwd_to_user_record(result, sresult, ret);
207215
if (r < 0)
208216
return r;
209217

210218
(*ret)->incomplete = incomplete;
211219
return 0;
212220
}
213221

214-
int nss_user_record_by_uid(uid_t uid, UserRecord **ret) {
222+
int nss_user_record_by_uid(
223+
uid_t uid,
224+
bool with_shadow,
225+
UserRecord **ret) {
226+
215227
_cleanup_free_ char *buf = NULL, *sbuf = NULL;
216228
struct passwd pwd, *result;
217229
bool incomplete = false;
218230
size_t buflen = 4096;
219-
struct spwd spwd;
231+
struct spwd spwd, *sresult = NULL;
220232
int r;
221233

222234
assert(ret);
@@ -245,13 +257,17 @@ int nss_user_record_by_uid(uid_t uid, UserRecord **ret) {
245257
buf = mfree(buf);
246258
}
247259

248-
r = nss_spwd_for_passwd(result, &spwd, &sbuf);
249-
if (r < 0) {
250-
log_debug_errno(r, "Failed to do shadow lookup for UID " UID_FMT ", ignoring: %m", uid);
251-
incomplete = ERRNO_IS_PRIVILEGE(r);
252-
}
260+
if (with_shadow) {
261+
r = nss_spwd_for_passwd(result, &spwd, &sbuf);
262+
if (r < 0) {
263+
log_debug_errno(r, "Failed to do shadow lookup for UID " UID_FMT ", ignoring: %m", uid);
264+
incomplete = ERRNO_IS_PRIVILEGE(r);
265+
} else
266+
sresult = &spwd;
267+
} else
268+
incomplete = true;
253269

254-
r = nss_passwd_to_user_record(result, r >= 0 ? &spwd : NULL, ret);
270+
r = nss_passwd_to_user_record(result, sresult, ret);
255271
if (r < 0)
256272
return r;
257273

‎src/shared/user-record-nss.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@
1111
int nss_passwd_to_user_record(const struct passwd *pwd, const struct spwd *spwd, UserRecord **ret);
1212
int nss_spwd_for_passwd(const struct passwd *pwd, struct spwd *ret_spwd, char **ret_buffer);
1313

14-
int nss_user_record_by_name(const char *name, UserRecord **ret);
15-
int nss_user_record_by_uid(uid_t uid, UserRecord **ret);
14+
int nss_user_record_by_name(const char *name, bool with_shadow, UserRecord **ret);
15+
int nss_user_record_by_uid(uid_t uid, bool with_shadow, UserRecord **ret);

‎src/shared/userdb.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -614,7 +614,7 @@ int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret) {
614614
iterator->nss_lock = r;
615615

616616
/* Client-side NSS fallback */
617-
r = nss_user_record_by_name(name, ret);
617+
r = nss_user_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
618618
if (r >= 0)
619619
return r;
620620
}
@@ -661,7 +661,7 @@ int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret) {
661661
iterator->nss_lock = r;
662662

663663
/* Client-side NSS fallback */
664-
r = nss_user_record_by_uid(uid, ret);
664+
r = nss_user_record_by_uid(uid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
665665
if (r >= 0)
666666
return r;
667667
}
@@ -819,7 +819,7 @@ int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret) {
819819
if (r >= 0 || r == -EBUSY) {
820820
iterator->nss_lock = r;
821821

822-
r = nss_group_record_by_name(name, ret);
822+
r = nss_group_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
823823
if (r >= 0)
824824
return r;
825825
}
@@ -865,7 +865,7 @@ int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret) {
865865
if (r >= 0 || r == -EBUSY) {
866866
iterator->nss_lock = r;
867867

868-
r = nss_group_record_by_gid(gid, ret);
868+
r = nss_group_record_by_gid(gid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
869869
if (r >= 0)
870870
return r;
871871
}
@@ -1046,7 +1046,7 @@ int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator **
10461046
return iterator->nss_lock;
10471047

10481048
/* We ignore all errors here, since the group might be defined by a userdb native service, and we queried them already above. */
1049-
(void) nss_group_record_by_name(name, &gr);
1049+
(void) nss_group_record_by_name(name, false, &gr);
10501050
if (gr) {
10511051
iterator->members_of_group = strv_copy(gr->members);
10521052
if (!iterator->members_of_group)

‎src/shared/userdb.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(UserDBIterator*, userdb_iterator_free);
1616

1717
typedef enum UserDBFlags {
1818
USERDB_AVOID_NSS = 1 << 0, /* don't do client-side nor server-side NSS */
19-
USERDB_AVOID_DYNAMIC_USER = 1 << 1, /* exclude looking up in io.systemd.DynamicUser */
20-
USERDB_AVOID_MULTIPLEXER = 1 << 2, /* exclude looking up via io.systemd.Multiplexer */
21-
USERDB_DONT_SYNTHESIZE = 1 << 3, /* don't synthesize root/nobody */
19+
USERDB_AVOID_SHADOW = 1 << 1, /* don't do client-side shadow calls (server side might happen though) */
20+
USERDB_AVOID_DYNAMIC_USER = 1 << 2, /* exclude looking up in io.systemd.DynamicUser */
21+
USERDB_AVOID_MULTIPLEXER = 1 << 3, /* exclude looking up via io.systemd.Multiplexer */
22+
USERDB_DONT_SYNTHESIZE = 1 << 4, /* don't synthesize root/nobody */
2223
} UserDBFlags;
2324

2425
int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret);

0 commit comments

Comments
 (0)