1/* Copyright (C) 1989, 1991-2017 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
8
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
13
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <http://www.gnu.org/licenses/>. */
17
18#include <assert.h>
19#include <errno.h>
20#include <grp.h>
21#include <limits.h>
22#include <stdlib.h>
23#include <string.h>
24#include <unistd.h>
25#include <sys/param.h>
26#include <sys/types.h>
27#include <nsswitch.h>
28#include <scratch_buffer.h>
29
30#include "../nscd/nscd-client.h"
31#include "../nscd/nscd_proto.h"
32
33
34/* Type of the lookup function. */
35typedef enum nss_status (*initgroups_dyn_function) (const char *, gid_t,
36 long int *, long int *,
37 gid_t **, long int, int *);
38
39/* The lookup function for the first entry of this service. */
40extern int __nss_group_lookup (service_user **nip, const char *name,
41 void **fctp);
42extern void *__nss_lookup_function (service_user *ni, const char *fct_name);
43
44extern service_user *__nss_group_database attribute_hidden;
45service_user *__nss_initgroups_database;
46static bool use_initgroups_entry;
47
48
49#include "compat-initgroups.c"
50
51
52static int
53internal_getgrouplist (const char *user, gid_t group, long int *size,
54 gid_t **groupsp, long int limit)
55{
56#ifdef USE_NSCD
57 if (__nss_not_use_nscd_group > 0
58 && ++__nss_not_use_nscd_group > NSS_NSCD_RETRY)
59 __nss_not_use_nscd_group = 0;
60 if (!__nss_not_use_nscd_group
61 && !__nss_database_custom[NSS_DBSIDX_group])
62 {
63 int n = __nscd_getgrouplist (user, group, size, groupsp, limit);
64 if (n >= 0)
65 return n;
66
67 /* nscd is not usable. */
68 __nss_not_use_nscd_group = 1;
69 }
70#endif
71
72 enum nss_status status = NSS_STATUS_UNAVAIL;
73 int no_more = 0;
74
75 /* Never store more than the starting *SIZE number of elements. */
76 assert (*size > 0);
77 (*groupsp)[0] = group;
78 /* Start is one, because we have the first group as parameter. */
79 long int start = 1;
80
81 if (__nss_initgroups_database == NULL)
82 {
83 if (__nss_database_lookup ("initgroups", NULL, "",
84 &__nss_initgroups_database) < 0)
85 {
86 if (__nss_group_database == NULL)
87 no_more = __nss_database_lookup ("group", NULL, "compat files",
88 &__nss_group_database);
89
90 __nss_initgroups_database = __nss_group_database;
91 }
92 else
93 use_initgroups_entry = true;
94 }
95 else
96 /* __nss_initgroups_database might have been set through
97 __nss_configure_lookup in which case use_initgroups_entry was
98 not set here. */
99 use_initgroups_entry = __nss_initgroups_database != __nss_group_database;
100
101 service_user *nip = __nss_initgroups_database;
102 while (! no_more)
103 {
104 long int prev_start = start;
105
106 initgroups_dyn_function fct = __nss_lookup_function (nip,
107 "initgroups_dyn");
108 if (fct == NULL)
109 status = compat_call (nip, user, group, &start, size, groupsp,
110 limit, &errno);
111 else
112 status = DL_CALL_FCT (fct, (user, group, &start, size, groupsp,
113 limit, &errno));
114
115 /* Remove duplicates. */
116 long int cnt = prev_start;
117 while (cnt < start)
118 {
119 long int inner;
120 for (inner = 0; inner < prev_start; ++inner)
121 if ((*groupsp)[inner] == (*groupsp)[cnt])
122 break;
123
124 if (inner < prev_start)
125 (*groupsp)[cnt] = (*groupsp)[--start];
126 else
127 ++cnt;
128 }
129
130 /* This is really only for debugging. */
131 if (NSS_STATUS_TRYAGAIN > status || status > NSS_STATUS_RETURN)
132 __libc_fatal ("illegal status in internal_getgrouplist");
133
134 /* For compatibility reason we will continue to look for more
135 entries using the next service even though data has already
136 been found if the nsswitch.conf file contained only a 'groups'
137 line and no 'initgroups' line. If the latter is available
138 we always respect the status. This means that the default
139 for successful lookups is to return. */
140 if ((use_initgroups_entry || status != NSS_STATUS_SUCCESS)
141 && nss_next_action (nip, status) == NSS_ACTION_RETURN)
142 break;
143
144 if (nip->next == NULL)
145 no_more = -1;
146 else
147 nip = nip->next;
148 }
149
150 return start;
151}
152
153/* Store at most *NGROUPS members of the group set for USER into
154 *GROUPS. Also include GROUP. The actual number of groups found is
155 returned in *NGROUPS. Return -1 if the if *NGROUPS is too small. */
156int
157getgrouplist (const char *user, gid_t group, gid_t *groups, int *ngroups)
158{
159 long int size = MAX (1, *ngroups);
160
161 gid_t *newgroups = (gid_t *) malloc (size * sizeof (gid_t));
162 if (__glibc_unlikely (newgroups == NULL))
163 /* No more memory. */
164 // XXX This is wrong. The user provided memory, we have to use
165 // XXX it. The internal functions must be called with the user
166 // XXX provided buffer and not try to increase the size if it is
167 // XXX too small. For initgroups a flag could say: increase size.
168 return -1;
169
170 int total = internal_getgrouplist (user, group, &size, &newgroups, -1);
171
172 memcpy (groups, newgroups, MIN (*ngroups, total) * sizeof (gid_t));
173
174 free (newgroups);
175
176 int retval = total > *ngroups ? -1 : total;
177 *ngroups = total;
178
179 return retval;
180}
181
182nss_interface_function (getgrouplist)
183
184/* Initialize the group set for the current user
185 by reading the group database and using all groups
186 of which USER is a member. Also include GROUP. */
187int
188initgroups (const char *user, gid_t group)
189{
190#if defined NGROUPS_MAX && NGROUPS_MAX == 0
191
192 /* No extra groups allowed. */
193 return 0;
194
195#else
196
197 long int size;
198 gid_t *groups;
199 int ngroups;
200 int result;
201
202 /* We always use sysconf even if NGROUPS_MAX is defined. That way, the
203 limit can be raised in the kernel configuration without having to
204 recompile libc. */
205 long int limit = __sysconf (_SC_NGROUPS_MAX);
206
207 if (limit > 0)
208 /* We limit the size of the intially allocated array. */
209 size = MIN (limit, 64);
210 else
211 /* No fixed limit on groups. Pick a starting buffer size. */
212 size = 16;
213
214 groups = (gid_t *) malloc (size * sizeof (gid_t));
215 if (__glibc_unlikely (groups == NULL))
216 /* No more memory. */
217 return -1;
218
219 ngroups = internal_getgrouplist (user, group, &size, &groups, limit);
220
221 /* Try to set the maximum number of groups the kernel can handle. */
222 do
223 result = setgroups (ngroups, groups);
224 while (result == -1 && errno == EINVAL && --ngroups > 0);
225
226 free (groups);
227
228 return result;
229#endif
230}
231
232nss_interface_function (initgroups)
233