1 | /* Copyright (C) 1989, 1991-2016 Free Software Foundation, Inc. |
2 | This file is part of the GNU C Library. |
3 | |
4 | The GNU C Library is free software; you can redistribute it and/or |
5 | modify it under the terms of the GNU Lesser General Public |
6 | License as published by the Free Software Foundation; either |
7 | version 2.1 of the License, or (at your option) any later version. |
8 | |
9 | The GNU C Library is distributed in the hope that it will be useful, |
10 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
12 | Lesser General Public License for more details. |
13 | |
14 | You should have received a copy of the GNU Lesser General Public |
15 | License along with the GNU C Library; if not, see |
16 | <http://www.gnu.org/licenses/>. */ |
17 | |
18 | #include <assert.h> |
19 | #include <errno.h> |
20 | #include <grp.h> |
21 | #include <limits.h> |
22 | #include <stdlib.h> |
23 | #include <string.h> |
24 | #include <unistd.h> |
25 | #include <sys/param.h> |
26 | #include <sys/types.h> |
27 | #include <nsswitch.h> |
28 | #include <scratch_buffer.h> |
29 | |
30 | #include "../nscd/nscd-client.h" |
31 | #include "../nscd/nscd_proto.h" |
32 | |
33 | |
34 | /* Type of the lookup function. */ |
35 | typedef enum nss_status (*initgroups_dyn_function) (const char *, gid_t, |
36 | long int *, long int *, |
37 | gid_t **, long int, int *); |
38 | |
39 | /* The lookup function for the first entry of this service. */ |
40 | extern int __nss_group_lookup (service_user **nip, const char *name, |
41 | void **fctp); |
42 | extern void *__nss_lookup_function (service_user *ni, const char *fct_name); |
43 | |
44 | extern service_user *__nss_group_database attribute_hidden; |
45 | service_user *__nss_initgroups_database; |
46 | static bool use_initgroups_entry; |
47 | |
48 | |
49 | #include "compat-initgroups.c" |
50 | |
51 | |
52 | static int |
53 | internal_getgrouplist (const char *user, gid_t group, long int *size, |
54 | gid_t **groupsp, long int limit) |
55 | { |
56 | #ifdef USE_NSCD |
57 | if (__nss_not_use_nscd_group > 0 |
58 | && ++__nss_not_use_nscd_group > NSS_NSCD_RETRY) |
59 | __nss_not_use_nscd_group = 0; |
60 | if (!__nss_not_use_nscd_group |
61 | && !__nss_database_custom[NSS_DBSIDX_group]) |
62 | { |
63 | int n = __nscd_getgrouplist (user, group, size, groupsp, limit); |
64 | if (n >= 0) |
65 | return n; |
66 | |
67 | /* nscd is not usable. */ |
68 | __nss_not_use_nscd_group = 1; |
69 | } |
70 | #endif |
71 | |
72 | enum nss_status status = NSS_STATUS_UNAVAIL; |
73 | int no_more = 0; |
74 | |
75 | /* Never store more than the starting *SIZE number of elements. */ |
76 | assert (*size > 0); |
77 | (*groupsp)[0] = group; |
78 | /* Start is one, because we have the first group as parameter. */ |
79 | long int start = 1; |
80 | |
81 | if (__nss_initgroups_database == NULL) |
82 | { |
83 | if (__nss_database_lookup ("initgroups" , NULL, "" , |
84 | &__nss_initgroups_database) < 0) |
85 | { |
86 | if (__nss_group_database == NULL) |
87 | no_more = __nss_database_lookup ("group" , NULL, "compat files" , |
88 | &__nss_group_database); |
89 | |
90 | __nss_initgroups_database = __nss_group_database; |
91 | } |
92 | else |
93 | use_initgroups_entry = true; |
94 | } |
95 | else |
96 | /* __nss_initgroups_database might have been set through |
97 | __nss_configure_lookup in which case use_initgroups_entry was |
98 | not set here. */ |
99 | use_initgroups_entry = __nss_initgroups_database != __nss_group_database; |
100 | |
101 | service_user *nip = __nss_initgroups_database; |
102 | while (! no_more) |
103 | { |
104 | long int prev_start = start; |
105 | |
106 | initgroups_dyn_function fct = __nss_lookup_function (nip, |
107 | "initgroups_dyn" ); |
108 | if (fct == NULL) |
109 | status = compat_call (nip, user, group, &start, size, groupsp, |
110 | limit, &errno); |
111 | else |
112 | status = DL_CALL_FCT (fct, (user, group, &start, size, groupsp, |
113 | limit, &errno)); |
114 | |
115 | /* Remove duplicates. */ |
116 | long int cnt = prev_start; |
117 | while (cnt < start) |
118 | { |
119 | long int inner; |
120 | for (inner = 0; inner < prev_start; ++inner) |
121 | if ((*groupsp)[inner] == (*groupsp)[cnt]) |
122 | break; |
123 | |
124 | if (inner < prev_start) |
125 | (*groupsp)[cnt] = (*groupsp)[--start]; |
126 | else |
127 | ++cnt; |
128 | } |
129 | |
130 | /* This is really only for debugging. */ |
131 | if (NSS_STATUS_TRYAGAIN > status || status > NSS_STATUS_RETURN) |
132 | __libc_fatal ("illegal status in internal_getgrouplist" ); |
133 | |
134 | /* For compatibility reason we will continue to look for more |
135 | entries using the next service even though data has already |
136 | been found if the nsswitch.conf file contained only a 'groups' |
137 | line and no 'initgroups' line. If the latter is available |
138 | we always respect the status. This means that the default |
139 | for successful lookups is to return. */ |
140 | if ((use_initgroups_entry || status != NSS_STATUS_SUCCESS) |
141 | && nss_next_action (nip, status) == NSS_ACTION_RETURN) |
142 | break; |
143 | |
144 | if (nip->next == NULL) |
145 | no_more = -1; |
146 | else |
147 | nip = nip->next; |
148 | } |
149 | |
150 | return start; |
151 | } |
152 | |
153 | /* Store at most *NGROUPS members of the group set for USER into |
154 | *GROUPS. Also include GROUP. The actual number of groups found is |
155 | returned in *NGROUPS. Return -1 if the if *NGROUPS is too small. */ |
156 | int |
157 | getgrouplist (const char *user, gid_t group, gid_t *groups, int *ngroups) |
158 | { |
159 | long int size = MAX (1, *ngroups); |
160 | |
161 | gid_t *newgroups = (gid_t *) malloc (size * sizeof (gid_t)); |
162 | if (__glibc_unlikely (newgroups == NULL)) |
163 | /* No more memory. */ |
164 | // XXX This is wrong. The user provided memory, we have to use |
165 | // XXX it. The internal functions must be called with the user |
166 | // XXX provided buffer and not try to increase the size if it is |
167 | // XXX too small. For initgroups a flag could say: increase size. |
168 | return -1; |
169 | |
170 | int total = internal_getgrouplist (user, group, &size, &newgroups, -1); |
171 | |
172 | memcpy (groups, newgroups, MIN (*ngroups, total) * sizeof (gid_t)); |
173 | |
174 | free (newgroups); |
175 | |
176 | int retval = total > *ngroups ? -1 : total; |
177 | *ngroups = total; |
178 | |
179 | return retval; |
180 | } |
181 | |
182 | nss_interface_function (getgrouplist) |
183 | |
184 | /* Initialize the group set for the current user |
185 | by reading the group database and using all groups |
186 | of which USER is a member. Also include GROUP. */ |
187 | int |
188 | initgroups (const char *user, gid_t group) |
189 | { |
190 | #if defined NGROUPS_MAX && NGROUPS_MAX == 0 |
191 | |
192 | /* No extra groups allowed. */ |
193 | return 0; |
194 | |
195 | #else |
196 | |
197 | long int size; |
198 | gid_t *groups; |
199 | int ngroups; |
200 | int result; |
201 | |
202 | /* We always use sysconf even if NGROUPS_MAX is defined. That way, the |
203 | limit can be raised in the kernel configuration without having to |
204 | recompile libc. */ |
205 | long int limit = __sysconf (_SC_NGROUPS_MAX); |
206 | |
207 | if (limit > 0) |
208 | /* We limit the size of the intially allocated array. */ |
209 | size = MIN (limit, 64); |
210 | else |
211 | /* No fixed limit on groups. Pick a starting buffer size. */ |
212 | size = 16; |
213 | |
214 | groups = (gid_t *) malloc (size * sizeof (gid_t)); |
215 | if (__glibc_unlikely (groups == NULL)) |
216 | /* No more memory. */ |
217 | return -1; |
218 | |
219 | ngroups = internal_getgrouplist (user, group, &size, &groups, limit); |
220 | |
221 | /* Try to set the maximum number of groups the kernel can handle. */ |
222 | do |
223 | result = setgroups (ngroups, groups); |
224 | while (result == -1 && errno == EINVAL && --ngroups > 0); |
225 | |
226 | free (groups); |
227 | |
228 | return result; |
229 | #endif |
230 | } |
231 | |
232 | nss_interface_function (initgroups) |
233 | |