SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

userdbd: avoid sending gshadow hash to unprivileged callers via varlink

Browse Source 
Reported on yeswehack as YWH-PGM9780-59

Follow-up for d093b62c94
This commit is contained in:
Luca Boccassi
2026-02-25 02:52:37 +01:00
committed by Mike Yuan
parent afcea7d235
commit 1012c6ce76
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/userdb/userwork.c
+1 -1
View File
@@ -270,7 +270,7 @@ static int build_group_json(sd_varlink *link, GroupRecord *gr, sd_json_variant *
(FLAGS_SET(gr->mask, USER_RECORD_PRIVILEGED) &&
!FLAGS_SET(stripped->mask, USER_RECORD_PRIVILEGED));
v = sd_json_variant_ref(gr->json);
v = sd_json_variant_ref(stripped->json);
r = add_nss_service(&v);
if (r < 0)
return r;
test/units/TEST-74-AUX-UTILS.varlinkctl.sh
+13
View File
@@ -52,6 +52,19 @@ if command -v userdbctl >/dev/null; then
varlinkctl call --more -j /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetMemberships '{ "service" : "io.systemd.Multiplexer" }' --graceful=io.systemd.UserDatabase.NoRecordFound | jq --seq .
varlinkctl call --oneway /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetMemberships '{ "service" : "io.systemd.Multiplexer" }'
(! varlinkctl call --oneway /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetMemberships '{ "service" : "io.systemd.Multiplexer" }' | grep .)
if command -v openssl >/dev/null && command -v groupadd >/dev/null; then
group=haldo
salt=waldo
getent group "$group" >/dev/null 2>&1 || groupadd "$group"
HASH="$(openssl passwd -6 -salt "$salt" baldo)"
groupmod -p "$HASH" "$group"
(! run0 -u testuser varlinkctl call --json=pretty \
/run/systemd/userdb/io.systemd.Multiplexer \
io.systemd.UserDatabase.GetGroupRecord \
'{"groupName":"haldo","service":"io.systemd.NameServiceSwitch"}' | grep waldo)
fi
fi
IDL_FILE="$(mktemp)"