1/* Copyright (C) 1996-2016 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Thorsten Kukuk <kukuk@suse.de>, 1996.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
18
19#include <ctype.h>
20#include <errno.h>
21#include <fcntl.h>
22#include <grp.h>
23#include <nss.h>
24#include <nsswitch.h>
25#include <stdio_ext.h>
26#include <string.h>
27#include <rpc/types.h>
28#include <libc-lock.h>
29#include <kernel-features.h>
30
31static service_user *ni;
32static enum nss_status (*nss_setgrent) (int stayopen);
33static enum nss_status (*nss_getgrnam_r) (const char *name,
34 struct group * grp, char *buffer,
35 size_t buflen, int *errnop);
36static enum nss_status (*nss_getgrgid_r) (gid_t gid, struct group * grp,
37 char *buffer, size_t buflen,
38 int *errnop);
39static enum nss_status (*nss_getgrent_r) (struct group * grp, char *buffer,
40 size_t buflen, int *errnop);
41static enum nss_status (*nss_endgrent) (void);
42
43/* Get the declaration of the parser function. */
44#define ENTNAME grent
45#define STRUCTURE group
46#define EXTERN_PARSER
47#include <nss/nss_files/files-parse.c>
48
49/* Structure for remembering -group members ... */
50#define BLACKLIST_INITIAL_SIZE 512
51#define BLACKLIST_INCREMENT 256
52struct blacklist_t
53{
54 char *data;
55 int current;
56 int size;
57};
58
59struct ent_t
60{
61 bool_t files;
62 enum nss_status setent_status;
63 FILE *stream;
64 struct blacklist_t blacklist;
65};
66typedef struct ent_t ent_t;
67
68static ent_t ext_ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
69
70/* Protect global state against multiple changers. */
71__libc_lock_define_initialized (static, lock)
72
73/* Positive if O_CLOEXEC is supported, negative if it is not supported,
74 zero if it is still undecided. This variable is shared with the
75 other compat functions. */
76#ifdef __ASSUME_O_CLOEXEC
77# define __compat_have_cloexec 1
78#else
79# ifdef O_CLOEXEC
80int __compat_have_cloexec;
81# else
82# define __compat_have_cloexec -1
83# endif
84#endif
85
86/* Prototypes for local functions. */
87static void blacklist_store_name (const char *, ent_t *);
88static int in_blacklist (const char *, int, ent_t *);
89
90/* Initialize the NSS interface/functions. The calling function must
91 hold the lock. */
92static void
93init_nss_interface (void)
94{
95 if (__nss_database_lookup ("group_compat", NULL, "nis", &ni) >= 0)
96 {
97 nss_setgrent = __nss_lookup_function (ni, "setgrent");
98 nss_getgrnam_r = __nss_lookup_function (ni, "getgrnam_r");
99 nss_getgrgid_r = __nss_lookup_function (ni, "getgrgid_r");
100 nss_getgrent_r = __nss_lookup_function (ni, "getgrent_r");
101 nss_endgrent = __nss_lookup_function (ni, "endgrent");
102 }
103}
104
105static enum nss_status
106internal_setgrent (ent_t *ent, int stayopen, int needent)
107{
108 enum nss_status status = NSS_STATUS_SUCCESS;
109
110 ent->files = TRUE;
111
112 if (ent->blacklist.data != NULL)
113 {
114 ent->blacklist.current = 1;
115 ent->blacklist.data[0] = '|';
116 ent->blacklist.data[1] = '\0';
117 }
118 else
119 ent->blacklist.current = 0;
120
121 if (ent->stream == NULL)
122 {
123 ent->stream = fopen ("/etc/group", "rme");
124
125 if (ent->stream == NULL)
126 status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
127 else
128 {
129 /* We have to make sure the file is `closed on exec'. */
130 int result = 0;
131
132 if (__compat_have_cloexec <= 0)
133 {
134 int flags;
135 result = flags = fcntl (fileno_unlocked (ent->stream), F_GETFD,
136 0);
137 if (result >= 0)
138 {
139#if defined O_CLOEXEC && !defined __ASSUME_O_CLOEXEC
140 if (__compat_have_cloexec == 0)
141 __compat_have_cloexec = (flags & FD_CLOEXEC) ? 1 : -1;
142
143 if (__compat_have_cloexec < 0)
144#endif
145 {
146 flags |= FD_CLOEXEC;
147 result = fcntl (fileno_unlocked (ent->stream), F_SETFD,
148 flags);
149 }
150 }
151 }
152
153 if (result < 0)
154 {
155 /* Something went wrong. Close the stream and return a
156 failure. */
157 fclose (ent->stream);
158 ent->stream = NULL;
159 status = NSS_STATUS_UNAVAIL;
160 }
161 else
162 /* We take care of locking ourself. */
163 __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
164 }
165 }
166 else
167 rewind (ent->stream);
168
169 if (needent && status == NSS_STATUS_SUCCESS && nss_setgrent)
170 ent->setent_status = nss_setgrent (stayopen);
171
172 return status;
173}
174
175
176enum nss_status
177_nss_compat_setgrent (int stayopen)
178{
179 enum nss_status result;
180
181 __libc_lock_lock (lock);
182
183 if (ni == NULL)
184 init_nss_interface ();
185
186 result = internal_setgrent (&ext_ent, stayopen, 1);
187
188 __libc_lock_unlock (lock);
189
190 return result;
191}
192
193
194static enum nss_status
195internal_endgrent (ent_t *ent)
196{
197 if (ent->stream != NULL)
198 {
199 fclose (ent->stream);
200 ent->stream = NULL;
201 }
202
203 if (ent->blacklist.data != NULL)
204 {
205 ent->blacklist.current = 1;
206 ent->blacklist.data[0] = '|';
207 ent->blacklist.data[1] = '\0';
208 }
209 else
210 ent->blacklist.current = 0;
211
212 return NSS_STATUS_SUCCESS;
213}
214
215enum nss_status
216_nss_compat_endgrent (void)
217{
218 enum nss_status result;
219
220 __libc_lock_lock (lock);
221
222 if (nss_endgrent)
223 nss_endgrent ();
224
225 result = internal_endgrent (&ext_ent);
226
227 __libc_lock_unlock (lock);
228
229 return result;
230}
231
232/* get the next group from NSS (+ entry) */
233static enum nss_status
234getgrent_next_nss (struct group *result, ent_t *ent, char *buffer,
235 size_t buflen, int *errnop)
236{
237 if (!nss_getgrent_r)
238 return NSS_STATUS_UNAVAIL;
239
240 /* If the setgrent call failed, say so. */
241 if (ent->setent_status != NSS_STATUS_SUCCESS)
242 return ent->setent_status;
243
244 do
245 {
246 enum nss_status status;
247
248 if ((status = nss_getgrent_r (result, buffer, buflen, errnop)) !=
249 NSS_STATUS_SUCCESS)
250 return status;
251 }
252 while (in_blacklist (result->gr_name, strlen (result->gr_name), ent));
253
254 return NSS_STATUS_SUCCESS;
255}
256
257/* This function handle the +group entrys in /etc/group */
258static enum nss_status
259getgrnam_plusgroup (const char *name, struct group *result, ent_t *ent,
260 char *buffer, size_t buflen, int *errnop)
261{
262 if (!nss_getgrnam_r)
263 return NSS_STATUS_UNAVAIL;
264
265 enum nss_status status = nss_getgrnam_r (name, result, buffer, buflen,
266 errnop);
267 if (status != NSS_STATUS_SUCCESS)
268 return status;
269
270 if (in_blacklist (result->gr_name, strlen (result->gr_name), ent))
271 return NSS_STATUS_NOTFOUND;
272
273 /* We found the entry. */
274 return NSS_STATUS_SUCCESS;
275}
276
277static enum nss_status
278getgrent_next_file (struct group *result, ent_t *ent,
279 char *buffer, size_t buflen, int *errnop)
280{
281 struct parser_data *data = (void *) buffer;
282 while (1)
283 {
284 fpos_t pos;
285 int parse_res = 0;
286 char *p;
287
288 do
289 {
290 /* We need at least 3 characters for one line. */
291 if (__glibc_unlikely (buflen < 3))
292 {
293 erange:
294 *errnop = ERANGE;
295 return NSS_STATUS_TRYAGAIN;
296 }
297
298 fgetpos (ent->stream, &pos);
299 buffer[buflen - 1] = '\xff';
300 p = fgets_unlocked (buffer, buflen, ent->stream);
301 if (p == NULL && feof_unlocked (ent->stream))
302 return NSS_STATUS_NOTFOUND;
303
304 if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
305 {
306 erange_reset:
307 fsetpos (ent->stream, &pos);
308 goto erange;
309 }
310
311 /* Terminate the line for any case. */
312 buffer[buflen - 1] = '\0';
313
314 /* Skip leading blanks. */
315 while (isspace (*p))
316 ++p;
317 }
318 while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
319 /* Parse the line. If it is invalid, loop to
320 get the next line of the file to parse. */
321 !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
322 errnop)));
323
324 if (__glibc_unlikely (parse_res == -1))
325 /* The parser ran out of space. */
326 goto erange_reset;
327
328 if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
329 /* This is a real entry. */
330 break;
331
332 /* -group */
333 if (result->gr_name[0] == '-' && result->gr_name[1] != '\0'
334 && result->gr_name[1] != '@')
335 {
336 blacklist_store_name (&result->gr_name[1], ent);
337 continue;
338 }
339
340 /* +group */
341 if (result->gr_name[0] == '+' && result->gr_name[1] != '\0'
342 && result->gr_name[1] != '@')
343 {
344 size_t len = strlen (result->gr_name);
345 char buf[len];
346 enum nss_status status;
347
348 /* Store the group in the blacklist for the "+" at the end of
349 /etc/group */
350 memcpy (buf, &result->gr_name[1], len);
351 status = getgrnam_plusgroup (&result->gr_name[1], result, ent,
352 buffer, buflen, errnop);
353 blacklist_store_name (buf, ent);
354 if (status == NSS_STATUS_SUCCESS) /* We found the entry. */
355 break;
356 else if (status == NSS_STATUS_RETURN /* We couldn't parse the entry*/
357 || status == NSS_STATUS_NOTFOUND) /* No group in NIS */
358 continue;
359 else
360 {
361 if (status == NSS_STATUS_TRYAGAIN)
362 /* The parser ran out of space. */
363 goto erange_reset;
364
365 return status;
366 }
367 }
368
369 /* +:... */
370 if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
371 {
372 ent->files = FALSE;
373
374 return getgrent_next_nss (result, ent, buffer, buflen, errnop);
375 }
376 }
377
378 return NSS_STATUS_SUCCESS;
379}
380
381
382enum nss_status
383_nss_compat_getgrent_r (struct group *grp, char *buffer, size_t buflen,
384 int *errnop)
385{
386 enum nss_status result = NSS_STATUS_SUCCESS;
387
388 __libc_lock_lock (lock);
389
390 /* Be prepared that the setgrent function was not called before. */
391 if (ni == NULL)
392 init_nss_interface ();
393
394 if (ext_ent.stream == NULL)
395 result = internal_setgrent (&ext_ent, 1, 1);
396
397 if (result == NSS_STATUS_SUCCESS)
398 {
399 if (ext_ent.files)
400 result = getgrent_next_file (grp, &ext_ent, buffer, buflen, errnop);
401 else
402 result = getgrent_next_nss (grp, &ext_ent, buffer, buflen, errnop);
403 }
404 __libc_lock_unlock (lock);
405
406 return result;
407}
408
409/* Searches in /etc/group and the NIS/NIS+ map for a special group */
410static enum nss_status
411internal_getgrnam_r (const char *name, struct group *result, ent_t *ent,
412 char *buffer, size_t buflen, int *errnop)
413{
414 struct parser_data *data = (void *) buffer;
415 while (1)
416 {
417 fpos_t pos;
418 int parse_res = 0;
419 char *p;
420
421 do
422 {
423 /* We need at least 3 characters for one line. */
424 if (__glibc_unlikely (buflen < 3))
425 {
426 erange:
427 *errnop = ERANGE;
428 return NSS_STATUS_TRYAGAIN;
429 }
430
431 fgetpos (ent->stream, &pos);
432 buffer[buflen - 1] = '\xff';
433 p = fgets_unlocked (buffer, buflen, ent->stream);
434 if (p == NULL && feof_unlocked (ent->stream))
435 return NSS_STATUS_NOTFOUND;
436
437 if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
438 {
439 erange_reset:
440 fsetpos (ent->stream, &pos);
441 goto erange;
442 }
443
444 /* Terminate the line for any case. */
445 buffer[buflen - 1] = '\0';
446
447 /* Skip leading blanks. */
448 while (isspace (*p))
449 ++p;
450 }
451 while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
452 /* Parse the line. If it is invalid, loop to
453 get the next line of the file to parse. */
454 !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
455 errnop)));
456
457 if (__glibc_unlikely (parse_res == -1))
458 /* The parser ran out of space. */
459 goto erange_reset;
460
461 /* This is a real entry. */
462 if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
463 {
464 if (strcmp (result->gr_name, name) == 0)
465 return NSS_STATUS_SUCCESS;
466 else
467 continue;
468 }
469
470 /* -group */
471 if (result->gr_name[0] == '-' && result->gr_name[1] != '\0')
472 {
473 if (strcmp (&result->gr_name[1], name) == 0)
474 return NSS_STATUS_NOTFOUND;
475 else
476 continue;
477 }
478
479 /* +group */
480 if (result->gr_name[0] == '+' && result->gr_name[1] != '\0')
481 {
482 if (strcmp (name, &result->gr_name[1]) == 0)
483 {
484 enum nss_status status;
485
486 status = getgrnam_plusgroup (name, result, ent,
487 buffer, buflen, errnop);
488 if (status == NSS_STATUS_RETURN)
489 /* We couldn't parse the entry */
490 continue;
491 else
492 return status;
493 }
494 }
495 /* +:... */
496 if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
497 {
498 enum nss_status status;
499
500 status = getgrnam_plusgroup (name, result, ent,
501 buffer, buflen, errnop);
502 if (status == NSS_STATUS_RETURN)
503 /* We couldn't parse the entry */
504 continue;
505 else
506 return status;
507 }
508 }
509
510 return NSS_STATUS_SUCCESS;
511}
512
513enum nss_status
514_nss_compat_getgrnam_r (const char *name, struct group *grp,
515 char *buffer, size_t buflen, int *errnop)
516{
517 ent_t ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
518 enum nss_status result;
519
520 if (name[0] == '-' || name[0] == '+')
521 return NSS_STATUS_NOTFOUND;
522
523 __libc_lock_lock (lock);
524
525 if (ni == NULL)
526 init_nss_interface ();
527
528 __libc_lock_unlock (lock);
529
530 result = internal_setgrent (&ent, 0, 0);
531
532 if (result == NSS_STATUS_SUCCESS)
533 result = internal_getgrnam_r (name, grp, &ent, buffer, buflen, errnop);
534
535 internal_endgrent (&ent);
536
537 return result;
538}
539
540/* Searches in /etc/group and the NIS/NIS+ map for a special group id */
541static enum nss_status
542internal_getgrgid_r (gid_t gid, struct group *result, ent_t *ent,
543 char *buffer, size_t buflen, int *errnop)
544{
545 struct parser_data *data = (void *) buffer;
546 while (1)
547 {
548 fpos_t pos;
549 int parse_res = 0;
550 char *p;
551
552 do
553 {
554 /* We need at least 3 characters for one line. */
555 if (__glibc_unlikely (buflen < 3))
556 {
557 erange:
558 *errnop = ERANGE;
559 return NSS_STATUS_TRYAGAIN;
560 }
561
562 fgetpos (ent->stream, &pos);
563 buffer[buflen - 1] = '\xff';
564 p = fgets_unlocked (buffer, buflen, ent->stream);
565 if (p == NULL && feof_unlocked (ent->stream))
566 return NSS_STATUS_NOTFOUND;
567
568 if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
569 {
570 erange_reset:
571 fsetpos (ent->stream, &pos);
572 goto erange;
573 }
574
575 /* Terminate the line for any case. */
576 buffer[buflen - 1] = '\0';
577
578 /* Skip leading blanks. */
579 while (isspace (*p))
580 ++p;
581 }
582 while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
583 /* Parse the line. If it is invalid, loop to
584 get the next line of the file to parse. */
585 !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
586 errnop)));
587
588 if (__glibc_unlikely (parse_res == -1))
589 /* The parser ran out of space. */
590 goto erange_reset;
591
592 /* This is a real entry. */
593 if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
594 {
595 if (result->gr_gid == gid)
596 return NSS_STATUS_SUCCESS;
597 else
598 continue;
599 }
600
601 /* -group */
602 if (result->gr_name[0] == '-' && result->gr_name[1] != '\0')
603 {
604 blacklist_store_name (&result->gr_name[1], ent);
605 continue;
606 }
607
608 /* +group */
609 if (result->gr_name[0] == '+' && result->gr_name[1] != '\0')
610 {
611 /* Yes, no +1, see the memcpy call below. */
612 size_t len = strlen (result->gr_name);
613 char buf[len];
614 enum nss_status status;
615
616 /* Store the group in the blacklist for the "+" at the end of
617 /etc/group */
618 memcpy (buf, &result->gr_name[1], len);
619 status = getgrnam_plusgroup (&result->gr_name[1], result, ent,
620 buffer, buflen, errnop);
621 blacklist_store_name (buf, ent);
622 if (status == NSS_STATUS_SUCCESS && result->gr_gid == gid)
623 break;
624 else
625 continue;
626 }
627 /* +:... */
628 if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
629 {
630 if (!nss_getgrgid_r)
631 return NSS_STATUS_UNAVAIL;
632
633 enum nss_status status = nss_getgrgid_r (gid, result, buffer, buflen,
634 errnop);
635 if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
636 return NSS_STATUS_NOTFOUND;
637 else
638 return status;
639 }
640 }
641
642 return NSS_STATUS_SUCCESS;
643}
644
645enum nss_status
646_nss_compat_getgrgid_r (gid_t gid, struct group *grp,
647 char *buffer, size_t buflen, int *errnop)
648{
649 ent_t ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
650 enum nss_status result;
651
652 __libc_lock_lock (lock);
653
654 if (ni == NULL)
655 init_nss_interface ();
656
657 __libc_lock_unlock (lock);
658
659 result = internal_setgrent (&ent, 0, 0);
660
661 if (result == NSS_STATUS_SUCCESS)
662 result = internal_getgrgid_r (gid, grp, &ent, buffer, buflen, errnop);
663
664 internal_endgrent (&ent);
665
666 return result;
667}
668
669
670/* Support routines for remembering -@netgroup and -user entries.
671 The names are stored in a single string with `|' as separator. */
672static void
673blacklist_store_name (const char *name, ent_t *ent)
674{
675 int namelen = strlen (name);
676 char *tmp;
677
678 /* first call, setup cache */
679 if (ent->blacklist.size == 0)
680 {
681 ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
682 ent->blacklist.data = malloc (ent->blacklist.size);
683 if (ent->blacklist.data == NULL)
684 return;
685 ent->blacklist.data[0] = '|';
686 ent->blacklist.data[1] = '\0';
687 ent->blacklist.current = 1;
688 }
689 else
690 {
691 if (in_blacklist (name, namelen, ent))
692 return; /* no duplicates */
693
694 if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
695 {
696 ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
697 tmp = realloc (ent->blacklist.data, ent->blacklist.size);
698 if (tmp == NULL)
699 {
700 free (ent->blacklist.data);
701 ent->blacklist.size = 0;
702 return;
703 }
704 ent->blacklist.data = tmp;
705 }
706 }
707
708 tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
709 *tmp++ = '|';
710 *tmp = '\0';
711 ent->blacklist.current += namelen + 1;
712
713 return;
714}
715
716/* returns TRUE if ent->blacklist contains name, else FALSE */
717static bool_t
718in_blacklist (const char *name, int namelen, ent_t *ent)
719{
720 char buf[namelen + 3];
721 char *cp;
722
723 if (ent->blacklist.data == NULL)
724 return FALSE;
725
726 buf[0] = '|';
727 cp = stpcpy (&buf[1], name);
728 *cp++ = '|';
729 *cp = '\0';
730 return strstr (ent->blacklist.data, buf) != NULL;
731}
732