some user record fixes (#36776)

Fixes: https://github.com/systemd/systemd/issues/36775

src/home/homectl.c

@@ -2664,7 +2664,7 @@ static int acquire_group_list(char ***ret) {
                                 if (r < 0 && r != -ESRCH)
                                         return log_debug_errno(r, "Failed to check if matching user exists for group '%s': %m", gr->group_name);
 
-                                if (r >= 0 && ur->gid == gr->gid)
+                                if (r >= 0 && user_record_gid(ur) == gr->gid)
                                         continue;
                         }
 

src/home/homework.c

@@ -1062,7 +1062,7 @@ static int copy_skel(UserRecord *h, int root_fd, const char *skel) {
         assert(h);
         assert(root_fd >= 0);
 
-        r = copy_tree_at(AT_FDCWD, skel, root_fd, ".", h->uid, h->gid, COPY_MERGE|COPY_REPLACE, NULL, NULL);
+        r = copy_tree_at(AT_FDCWD, skel, root_fd, ".", h->uid, user_record_gid(h), COPY_MERGE|COPY_REPLACE, NULL, NULL);
         if (r == -ENOENT) {
                 log_info("Skeleton directory %s missing, ignoring.", skel);
                 return 0;

src/login/logind-core.c

@@ -195,6 +195,9 @@ int manager_add_user_by_name(
         if (r < 0)
                 return r;
 
+        if (!uid_is_valid(ur->uid)) /* Refuse users without UID */
+                return -ESRCH;
+
         return manager_add_user(m, ur, ret_user);
 }
 

src/login/pam_systemd.c

@@ -241,6 +241,11 @@ static int acquire_user_record(
                         return PAM_USER_UNKNOWN;
                 }
 
+                if (!uid_is_valid(ur->uid)) {
+                        pam_syslog_errno(handle, LOG_ERR, r, "User record of user '%s' has no UID, refusing: %m", username);
+                        return PAM_USER_UNKNOWN;
+                }
+
                 r = sd_json_variant_format(ur->json, 0, &formatted);
                 if (r < 0)
                         return pam_syslog_errno(handle, LOG_ERR, r, "Failed to format user JSON: %m");

src/nspawn/nspawn-bind-user.c

@@ -93,7 +93,7 @@ static int convert_user(
 
         assert(u);
         assert(g);
-        assert(u->gid == g->gid);
+        assert(user_record_gid(u) == g->gid);
 
         r = check_etc_passwd_collisions(directory, u->user_name, UID_INVALID);
         if (r < 0)
@@ -244,13 +244,17 @@ int bind_user_prepare(
                  * UID is safer. */
                 if (user_record_is_root(u))
                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'root' user not supported, sorry.");
+
                 if (user_record_is_nobody(u))
                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'nobody' user not supported, sorry.");
 
+                if (!uid_is_valid(u->uid))
+                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot bind user with no UID, refusing.");
+
                 if (u->uid >= uid_shift && u->uid < uid_shift + uid_range)
                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID of user '%s' to map is already in container UID range, refusing.", u->user_name);
 
-                r = groupdb_by_gid(u->gid, /* match= */ NULL, USERDB_DONT_SYNTHESIZE_INTRINSIC|USERDB_DONT_SYNTHESIZE_FOREIGN, &g);
+                r = groupdb_by_gid(user_record_gid(u), /* match= */ NULL, USERDB_DONT_SYNTHESIZE_INTRINSIC|USERDB_DONT_SYNTHESIZE_FOREIGN, &g);
                 if (r < 0)
                         return log_error_errno(r, "Failed to resolve group of user '%s': %m", u->user_name);
 
@@ -279,11 +283,11 @@ int bind_user_prepare(
                 if (!GREEDY_REALLOC(c->data, c->n_data + 1))
                         return log_oom();
 
-                sm = strdup(u->home_directory);
+                sm = strdup(user_record_home_directory(u));
                 if (!sm)
                         return log_oom();
 
-                sd = strdup(cu->home_directory);
+                sd = strdup(user_record_home_directory(cu));
                 if (!sd)
                         return log_oom();
 

src/shared/user-record-nss.c

@@ -141,7 +141,7 @@ int nss_passwd_to_user_record(
                         &hr->json,
                         SD_JSON_BUILD_PAIR("userName", SD_JSON_BUILD_STRING(hr->user_name)),
                         SD_JSON_BUILD_PAIR("uid", SD_JSON_BUILD_UNSIGNED(hr->uid)),
-                        SD_JSON_BUILD_PAIR("gid", SD_JSON_BUILD_UNSIGNED(hr->gid)),
+                        SD_JSON_BUILD_PAIR("gid", SD_JSON_BUILD_UNSIGNED(user_record_gid(hr))),
                         SD_JSON_BUILD_PAIR_CONDITION(!!hr->real_name, "realName", SD_JSON_BUILD_STRING(hr->real_name)),
                         SD_JSON_BUILD_PAIR_CONDITION(!!hr->home_directory, "homeDirectory", SD_JSON_BUILD_STRING(hr->home_directory)),
                         SD_JSON_BUILD_PAIR_CONDITION(!!hr->shell, "shell", SD_JSON_BUILD_STRING(hr->shell)),

src/shared/user-record-show.c

@@ -216,18 +216,18 @@ void user_record_show(UserRecord *hr, bool show_full_group_info) {
         }
         if (uid_is_valid(hr->uid))
                 printf("         UID: " UID_FMT "\n", hr->uid);
-        if (gid_is_valid(hr->gid)) {
+        if (gid_is_valid(user_record_gid(hr))) {
                 if (show_full_group_info) {
                         _cleanup_(group_record_unrefp) GroupRecord *gr = NULL;
 
-                        r = groupdb_by_gid(hr->gid, /* match= */ NULL, /* flags= */ 0, &gr);
+                        r = groupdb_by_gid(user_record_gid(hr), /* match= */ NULL, /* flags= */ 0, &gr);
                         if (r < 0) {
                                 errno = -r;
-                                printf("         GID: " GID_FMT " (unresolvable: %m)\n", hr->gid);
+                                printf("         GID: " GID_FMT " (unresolvable: %m)\n", user_record_gid(hr));
                         } else
-                                printf("         GID: " GID_FMT " (%s)\n", hr->gid, gr->group_name);
+                                printf("         GID: " GID_FMT " (%s)\n", user_record_gid(hr), gr->group_name);
                 } else
-                        printf("         GID: " GID_FMT "\n", hr->gid);
+                        printf("         GID: " GID_FMT "\n", user_record_gid(hr));
         } else if (uid_is_valid(hr->uid)) /* Show UID as GID if not separately configured */
                 printf("         GID: " GID_FMT "\n", (gid_t) hr->uid);