Index: rver/common/oursrc/nss_nonlocal/Makefile =================================================================== --- /server/common/oursrc/nss_nonlocal/Makefile (revision 781) +++ (revision ) @@ -1,35 +1,0 @@ -exec_prefix = / -libdir = $(exec_prefix)/lib - -INSTALL = install -CC = gcc -CFLAGS = -O2 -Wall - -ALL_CFLAGS = $(CFLAGS) -fPIC -ALL_LDFLAGS = $(LDFLAGS) -shared -Wl,-x - -all: libnss_nonlocal.so.2 linktest - -OBJS = nonlocal-passwd.o nonlocal-group.o nonlocal-shadow.o - -libnss_nonlocal.so.2: $(OBJS) libnss_nonlocal.map - $(CC) -o $@ $(ALL_LDFLAGS) -Wl,-soname,$@ -Wl,--version-script=libnss_nonlocal.map $(OBJS) $(LOADLIBES) $(LDLIBS) - -%.o: %.c - $(CC) -c $(ALL_CFLAGS) $(CPPFLAGS) $< - -nonlocal-passwd.o: nonlocal-passwd.c nsswitch-internal.h nonlocal.h -nonlocal-group.o: nonlocal-group.c nsswitch-internal.h nonlocal.h -nonlocal-shadow.o: nonlocal-shadow.c nsswitch-internal.h nonlocal.h - -linktest: libnss_nonlocal.so.2 - $(CC) $(LDFLAGS) -nostdlib -Wl,--entry=0 -o /dev/null $^ - -install: libnss_nonlocal.so.2 - $(INSTALL) -d $(DESTDIR)$(libdir) - $(INSTALL) -m a+r,u+w $< $(DESTDIR)$(libdir)/ - -clean: - rm -f *.so.* *.o - -.PHONY: all linktest install clean Index: /server/common/oursrc/nss_nonlocal/Makefile.am =================================================================== --- /server/common/oursrc/nss_nonlocal/Makefile.am (revision 782) +++ /server/common/oursrc/nss_nonlocal/Makefile.am (revision 782) @@ -0,0 +1,16 @@ +lib_LTLIBRARIES = libnss_nonlocal.la +libnss_nonlocal_la_SOURCES = \ + nonlocal-passwd.c nonlocal-group.c nonlocal-shadow.c \ + nonlocal.h nsswitch-internal.h +libnss_nonlocal_la_LDFLAGS = \ + -version-info 2:0:0 \ + -export-symbols-regex '^_nss_nonlocal_' + +noinst_PROGRAMS = .linktest +_linktest_SOURCES = +_linktest_LDADD = libnss_nonlocal.la +_linktest_LDFLAGS = -nostdlib -entry=0 + +install-exec-hook: + rm -f $(DESTDIR)$(libdir)/libnss_nonlocal.so + rm -f $(DESTDIR)$(libdir)/libnss_nonlocal.la Index: /server/common/oursrc/nss_nonlocal/configure.ac =================================================================== --- /server/common/oursrc/nss_nonlocal/configure.ac (revision 782) +++ /server/common/oursrc/nss_nonlocal/configure.ac (revision 782) @@ -0,0 +1,20 @@ +AC_INIT([nss_nonlocal], [1.7], [andersk@mit.edu]) +AC_CANONICAL_TARGET +AM_INIT_AUTOMAKE([-Wall -Werror foreign]) + +AC_PREFIX_DEFAULT([/]) +AC_DISABLE_STATIC +AC_PROG_CC +AC_PROG_INSTALL +AC_PROG_LIBTOOL + +case "$target_cpu" in + i386 | i486 | i586 | i686 | i786) + AC_DEFINE([USE_REGPARMS], [], + [Define if the regparm attribute shall be used for local functions (gcc on ix86 only).]) + ;; +esac + +AC_CONFIG_HEADERS([config.h]) +AC_CONFIG_FILES([Makefile]) +AC_OUTPUT Index: rver/common/oursrc/nss_nonlocal/libnss_nonlocal.map =================================================================== --- /server/common/oursrc/nss_nonlocal/libnss_nonlocal.map (revision 781) +++ (revision ) @@ -1,24 +1,0 @@ -GLIBC_2.0 { - global: - _nss_nonlocal_setpwent; - _nss_nonlocal_endpwent; - _nss_nonlocal_getpwent_r; - _nss_nonlocal_getpwuid_r; - _nss_nonlocal_getpwnam_r; - - _nss_nonlocal_setspent; - _nss_nonlocal_endspent; - _nss_nonlocal_getspent_r; - _nss_nonlocal_getspnam_r; - - _nss_nonlocal_setgrent; - _nss_nonlocal_endgrent; - _nss_nonlocal_getgrent_r; - _nss_nonlocal_getgrgid_r; - _nss_nonlocal_getgrnam_r; - - _nss_nonlocal_initgroups_dyn; - - local: - *; -}; Index: /server/common/oursrc/nss_nonlocal/nonlocal-group.c =================================================================== --- /server/common/oursrc/nss_nonlocal/nonlocal-group.c (revision 781) +++ /server/common/oursrc/nss_nonlocal/nonlocal-group.c (revision 782) @@ -42,7 +42,15 @@ #include "nonlocal.h" -#define MAGIC_LOCAL_GR_BUFLEN (sysconf(_SC_GETGR_R_SIZE_MAX) + 7) #define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users" #define MAGIC_LOCAL_GROUPNAME "nss-local-users" + + +enum nss_status +_nss_nonlocal_getgrnam_r(const char *name, struct group *grp, + char *buffer, size_t buflen, int *errnop); + +enum nss_status +_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp, + char *buffer, size_t buflen, int *errnop); @@ -61,10 +69,18 @@ check_nonlocal_gid(const char *user, gid_t gid, int *errnop) { - enum nss_status status = NSS_STATUS_SUCCESS; + static const char *fct_name = "getgrgid_r"; + static service_user *startp = NULL; + static void *fct_start = NULL; + enum nss_status status; + service_user *nip; + union { + enum nss_status (*l)(gid_t gid, struct group *grp, + char *buffer, size_t buflen, int *errnop); + void *ptr; + } fct; struct group gbuf; - struct group *gbufp = &gbuf; - int ret; int old_errno = errno; - int buflen = MAGIC_LOCAL_GR_BUFLEN; + + int buflen = sysconf(_SC_GETGR_R_SIZE_MAX); char *buf = malloc(buflen); if (buf == NULL) { @@ -73,15 +89,29 @@ return NSS_STATUS_TRYAGAIN; } - errno = 0; - ret = getgrgid_r(gid, gbufp, buf, buflen, &gbufp); - if (ret != 0) { - *errnop = old_errno; - status = NSS_STATUS_TRYAGAIN; - } else if (gbufp != NULL) { + + if (fct_start == NULL && + __nss_group_lookup(&startp, fct_name, &fct_start) != 0) { + free(buf); + return NSS_STATUS_UNAVAIL; + } + nip = startp; + fct.ptr = fct_start; + do { + if (fct.l == _nss_nonlocal_getgrgid_r) + status = NSS_STATUS_NOTFOUND; + else + status = DL_CALL_FCT(fct.l, (gid, &gbuf, buf, buflen, errnop)); + if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) + break; + } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); + + if (status == NSS_STATUS_SUCCESS) { syslog(LOG_WARNING, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user); status = NSS_STATUS_NOTFOUND; - } + } else if (status != NSS_STATUS_TRYAGAIN) { + status = NSS_STATUS_SUCCESS; + } + free(buf); - errno = old_errno; return status; } @@ -90,10 +120,19 @@ get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen, int *errnop) { - enum nss_status status = NSS_STATUS_NOTFOUND; + static const char *fct_name = "getgrnam_r"; + static service_user *startp = NULL; + static void *fct_start = NULL; + enum nss_status status; + service_user *nip; + union { + enum nss_status (*l)(const char *name, struct group *grp, + char *buffer, size_t buflen, int *errnop); + void *ptr; + } fct; struct group gbuf; - struct group *gbufp = &gbuf; - int ret, n; + int n; int old_errno = errno; - int len = MAGIC_LOCAL_GR_BUFLEN; + + int len = sysconf(_SC_GETGR_R_SIZE_MAX); char *buf = malloc(len); if (buf == NULL) { @@ -102,46 +141,57 @@ return NSS_STATUS_TRYAGAIN; } - errno = 0; - ret = getgrnam_r(name, gbufp, buf, len, &gbufp); - if (ret != 0) { - *errnop = old_errno; + + if (fct_start == NULL && + __nss_group_lookup(&startp, fct_name, &fct_start) != 0) { + free(buf); + return NSS_STATUS_UNAVAIL; + } + nip = startp; + fct.ptr = fct_start; + do { + if (fct.l == _nss_nonlocal_getgrnam_r) + status = NSS_STATUS_NOTFOUND; + else + status = DL_CALL_FCT(fct.l, (name, &gbuf, buf, buflen, errnop)); + if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) + break; + } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); + + if (status != NSS_STATUS_SUCCESS) + goto get_local_group_done; + + n = snprintf(buffer, buflen, "%s", gbuf.gr_name); + if (n < 0 || n >= buflen) { + *errnop = ERANGE; status = NSS_STATUS_TRYAGAIN; - } else if (gbufp != NULL) { - status = NSS_STATUS_SUCCESS; - - n = snprintf(buffer, buflen, "%s", gbufp->gr_name); - if (n < 0 || n >= buflen) { - *errnop = ERANGE; - status = NSS_STATUS_TRYAGAIN; - goto get_local_group_done; - } - grp->gr_name = buffer; - buffer += n; - buflen -= n; - - n = snprintf(buffer, buflen, "%s", gbufp->gr_passwd); - if (n < 0 || n >= buflen) { - *errnop = ERANGE; - status = NSS_STATUS_TRYAGAIN; - goto get_local_group_done; - } - grp->gr_passwd = buffer; - buffer += n; - buflen -= n; - - grp->gr_gid = gbufp->gr_gid; - - if (buflen < sizeof(void *)) { - *errnop = ERANGE; - status = NSS_STATUS_TRYAGAIN; - goto get_local_group_done; - } - *(void **)buffer = NULL; - buffer += sizeof(void *); - buflen -= sizeof(void *); - } + goto get_local_group_done; + } + grp->gr_name = buffer; + buffer += n; + buflen -= n; + + n = snprintf(buffer, buflen, "%s", gbuf.gr_passwd); + if (n < 0 || n >= buflen) { + *errnop = ERANGE; + status = NSS_STATUS_TRYAGAIN; + goto get_local_group_done; + } + grp->gr_passwd = buffer; + buffer += n; + buflen -= n; + + grp->gr_gid = gbuf.gr_gid; + + if (buflen < sizeof(void *)) { + *errnop = ERANGE; + status = NSS_STATUS_TRYAGAIN; + goto get_local_group_done; + } + *(void **)buffer = NULL; + buffer += sizeof(void *); + buflen -= sizeof(void *); + get_local_group_done: free(buf); - errno = old_errno; return status; } @@ -226,6 +276,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_GR_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; @@ -272,6 +321,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_GR_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; @@ -311,6 +359,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_GR_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; @@ -359,8 +406,8 @@ /* Check that the user is a nonlocal user before adding any groups. */ status = check_nonlocal_user(user, errnop); - if (status == NSS_STATUS_NOTFOUND) + if (status == NSS_STATUS_TRYAGAIN) + return status; + else if (status != NSS_STATUS_SUCCESS) is_local = 1; - else if (status != NSS_STATUS_SUCCESS) - return status; int old_errno = errno; @@ -375,12 +422,14 @@ status = get_local_group(MAGIC_LOCAL_GROUPNAME, &local_users_group, buffer, buflen, errnop); - if (status == NSS_STATUS_NOTFOUND) { + if (status == NSS_STATUS_SUCCESS) { + local_users_gid = local_users_group.gr_gid; + } else if (status == NSS_STATUS_TRYAGAIN) { + free(buffer); + return status; + } else { syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", MAGIC_LOCAL_GROUPNAME); local_users_gid = -1; - } else if (status != NSS_STATUS_SUCCESS) { - return status; - } else - local_users_gid = local_users_group.gr_gid; + } free(buffer); @@ -397,13 +446,14 @@ status = get_local_group(MAGIC_NONLOCAL_GROUPNAME, &nonlocal_users_group, buffer, buflen, errnop); - if (status == NSS_STATUS_NOTFOUND) { + if (status == NSS_STATUS_SUCCESS) { + gid = nonlocal_users_group.gr_gid; + } else if (status == NSS_STATUS_TRYAGAIN) { + free(buffer); + return status; + } else { syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!", MAGIC_NONLOCAL_GROUPNAME); gid = -1; - } else if (status != NSS_STATUS_SUCCESS) { - errno = old_errno; - return status; - } else - gid = nonlocal_users_group.gr_gid; + } free(buffer); } @@ -437,6 +487,4 @@ } - errno = old_errno; - if (is_local) return NSS_STATUS_SUCCESS; @@ -481,5 +529,5 @@ if (status == NSS_STATUS_SUCCESS) { (*groupsp)[out++] = (*groupsp)[in]; - } else if (status != NSS_STATUS_NOTFOUND) { + } else if (status == NSS_STATUS_TRYAGAIN) { *start = out; *errnop = nonlocal_errno; Index: /server/common/oursrc/nss_nonlocal/nonlocal-passwd.c =================================================================== --- /server/common/oursrc/nss_nonlocal/nonlocal-passwd.c (revision 781) +++ /server/common/oursrc/nss_nonlocal/nonlocal-passwd.c (revision 782) @@ -44,5 +44,11 @@ #include "nonlocal.h" -#define MAGIC_LOCAL_PW_BUFLEN (sysconf(_SC_GETPW_R_SIZE_MAX) + 7) + +enum nss_status +_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd, + char *buffer, size_t buflen, int *errnop); +enum nss_status +_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd, + char *buffer, size_t buflen, int *errnop); @@ -61,10 +67,18 @@ check_nonlocal_uid(const char *user, uid_t uid, int *errnop) { - enum nss_status status = NSS_STATUS_SUCCESS; + static const char *fct_name = "getpwuid_r"; + static service_user *startp = NULL; + static void *fct_start = NULL; + enum nss_status status; + service_user *nip; + union { + enum nss_status (*l)(uid_t uid, struct passwd *pwd, + char *buffer, size_t buflen, int *errnop); + void *ptr; + } fct; struct passwd pwbuf; - struct passwd *pwbufp = &pwbuf; - int ret; int old_errno = errno; - int buflen = MAGIC_LOCAL_PW_BUFLEN; + + int buflen = sysconf(_SC_GETPW_R_SIZE_MAX); char *buf = malloc(buflen); if (buf == NULL) { @@ -73,15 +87,29 @@ return NSS_STATUS_TRYAGAIN; } - errno = 0; - ret = getpwuid_r(uid, pwbufp, buf, buflen, &pwbufp); - if (ret != 0) { - *errnop = errno; - status = NSS_STATUS_TRYAGAIN; - } else if (pwbufp != NULL) { + + if (fct_start == NULL && + __nss_passwd_lookup(&startp, fct_name, &fct_start) != 0) { + free(buf); + return NSS_STATUS_UNAVAIL; + } + nip = startp; + fct.ptr = fct_start; + do { + if (fct.l == _nss_nonlocal_getpwuid_r) + status = NSS_STATUS_NOTFOUND; + else + status = DL_CALL_FCT(fct.l, (uid, &pwbuf, buf, buflen, errnop)); + if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) + break; + } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); + + if (status == NSS_STATUS_SUCCESS) { syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name); status = NSS_STATUS_NOTFOUND; - } + } else if (status != NSS_STATUS_TRYAGAIN) { + status = NSS_STATUS_SUCCESS; + } + free(buf); - errno = old_errno; return status; } @@ -90,10 +118,18 @@ check_nonlocal_user(const char *user, int *errnop) { - enum nss_status status = NSS_STATUS_SUCCESS; + static const char *fct_name = "getpwnam_r"; + static service_user *startp = NULL; + static void *fct_start = NULL; + enum nss_status status; + service_user *nip; + union { + enum nss_status (*l)(const char *name, struct passwd *pwd, + char *buffer, size_t buflen, int *errnop); + void *ptr; + } fct; struct passwd pwbuf; - struct passwd *pwbufp = &pwbuf; - int ret; int old_errno = errno; - int buflen = MAGIC_LOCAL_PW_BUFLEN; + + int buflen = sysconf(_SC_GETPW_R_SIZE_MAX); char *buf = malloc(buflen); if (buf == NULL) { @@ -102,14 +138,27 @@ return NSS_STATUS_TRYAGAIN; } - errno = 0; - ret = getpwnam_r(user, pwbufp, buf, buflen, &pwbufp); - if (ret != 0) { - *errnop = errno; - status = NSS_STATUS_TRYAGAIN; - } else if (pwbufp != NULL) { + + if (fct_start == NULL && + __nss_passwd_lookup(&startp, fct_name, &fct_start) != 0) { + free(buf); + return NSS_STATUS_UNAVAIL; + } + nip = startp; + fct.ptr = fct_start; + do { + if (fct.l == _nss_nonlocal_getpwnam_r) + status = NSS_STATUS_NOTFOUND; + else + status = DL_CALL_FCT(fct.l, (user, &pwbuf, buf, buflen, errnop)); + if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE) + break; + } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0); + + if (status == NSS_STATUS_SUCCESS) status = NSS_STATUS_NOTFOUND; - } + else if (status != NSS_STATUS_TRYAGAIN) + status = NSS_STATUS_SUCCESS; + free(buf); - errno = old_errno; return status; } @@ -195,6 +244,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_PW_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; @@ -242,6 +290,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_PW_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; @@ -289,6 +336,5 @@ char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV); - if (buflen == MAGIC_LOCAL_PW_BUFLEN || - (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')) + if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0') return NSS_STATUS_UNAVAIL; Index: /server/common/oursrc/nss_nonlocal/nonlocal.h =================================================================== --- /server/common/oursrc/nss_nonlocal/nonlocal.h (revision 781) +++ /server/common/oursrc/nss_nonlocal/nonlocal.h (revision 782) @@ -1,7 +1,12 @@ #ifndef NONLOCAL_H #define NONLOCAL_H + +#include "config.h" + enum nss_status check_nonlocal_uid(const char *user, uid_t uid, int *errnop); enum nss_status check_nonlocal_gid(const char *user, gid_t gid, int *errnop); enum nss_status check_nonlocal_user(const char *user, int *errnop); + #define NONLOCAL_IGNORE_ENV "NSS_NONLOCAL_IGNORE" + #endif /* NON_LOCAL_H */ Index: /server/common/oursrc/nss_nonlocal/nsswitch-internal.h =================================================================== --- /server/common/oursrc/nss_nonlocal/nsswitch-internal.h (revision 781) +++ /server/common/oursrc/nss_nonlocal/nsswitch-internal.h (revision 782) @@ -7,20 +7,28 @@ #define NSSWITCH_INTERNAL_H +#include "config.h" + +/* glibc/config.h.in */ +#if defined USE_REGPARMS && !defined PROF && !defined __BOUNDED_POINTERS__ +# define internal_function __attribute__ ((regparm (3), stdcall)) +#else +# define internal_function +#endif + +/* glibc/nss/nsswitch.h */ typedef struct service_user service_user; -extern int -__nss_next (service_user **ni, const char *fct_name, void **fctp, int status, - int all_values); +extern int __nss_next (service_user **ni, const char *fct_name, void **fctp, + int status, int all_values); +extern int __nss_database_lookup (const char *database, + const char *alternative_name, + const char *defconfig, service_user **ni); +extern void *__nss_lookup_function (service_user *ni, const char *fct_name); -extern int -__nss_database_lookup (const char *database, - const char *alternative_name, - const char *defconfig, service_user **ni); - -extern int -__nss_configure_lookup (const char *dbname, const char *service_line); - -extern void -*__nss_lookup_function (service_user *ni, const char *fct_name); +/* glibc/nss/XXX-lookup.c */ +extern int __nss_passwd_lookup (service_user **ni, const char *fct_name, + void **fctp) internal_function; +extern int __nss_group_lookup (service_user **ni, const char *fct_name, + void **fctp) internal_function; #endif /* NSSWITCH_INTERNAL_H */ Index: /server/fedora/specs/nss_nonlocal.spec =================================================================== --- /server/fedora/specs/nss_nonlocal.spec (revision 781) +++ /server/fedora/specs/nss_nonlocal.spec (revision 782) @@ -2,7 +2,10 @@ Group: System Environment/Libraries Name: nss_nonlocal -Version: 1.6 +Version: 1.7 Release: 0 URL: http://debathena.mit.edu/nss_nonlocal/ +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: libtool License: GPL Source: %{name}.tar.gz @@ -17,10 +20,21 @@ %setup -q -n %{name} +cat >find_requires.sh <