core: do not provide non-dynamic user through DBus/Varlink
With a service with DynamicUser= with static user or group, e.g.,
```
$ systemd-run -p DynamicUser=yes -p Group=disk sleep infinity
```
previously the lookup by name and ID through DBus/Varlink are inconsistent:
```
$ busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LookupDynamicUserByUID "u" 6
Call failed: Dynamic user ID 6 does not exist.
$ busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LookupDynamicUserByName "s" disk
u 6
$ userdbctl group 6
Group name: disk
Disposition: system
GID: 6
Passwords: 1
Service: io.systemd.NameServiceSwitch
$ userdbctl group disk
Group name: disk
Disposition: dynamic
GID: 6
Description: Dynamic Group
Service: io.systemd.DynamicUser
```
With this change, the results of these methods are consistent.
Fixes #40228.
This commit is contained in:
+11
-2
@@ -695,11 +695,20 @@ int dynamic_user_lookup_name(Manager *m, const char *name, uid_t *ret) {
|
||||
if (!d)
|
||||
return -ESRCH;
|
||||
|
||||
r = dynamic_user_current(d, ret);
|
||||
uid_t uid;
|
||||
r = dynamic_user_current(d, &uid);
|
||||
if (r == -EAGAIN) /* not realized yet? */
|
||||
return -ESRCH;
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
return r;
|
||||
if (!uid_is_dynamic(uid))
|
||||
return -ESRCH;
|
||||
|
||||
if (ret)
|
||||
*ret = uid;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int dynamic_creds_make(Manager *m, const char *user, const char *group, DynamicCreds **ret) {
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
#include "json-util.h"
|
||||
#include "manager.h"
|
||||
#include "string-util.h"
|
||||
#include "uid-classification.h"
|
||||
#include "user-util.h"
|
||||
#include "varlink-dynamic-user.h"
|
||||
|
||||
@@ -91,6 +92,9 @@ int vl_method_get_user_record(sd_varlink *link, sd_json_variant *parameters, sd_
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
if (!uid_is_dynamic(uid))
|
||||
continue;
|
||||
|
||||
if (!user_match_lookup_parameters(&p, d->name, uid))
|
||||
continue;
|
||||
|
||||
@@ -199,6 +203,9 @@ int vl_method_get_group_record(sd_varlink *link, sd_json_variant *parameters, sd
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
if (!gid_is_dynamic((gid_t) uid))
|
||||
continue;
|
||||
|
||||
if (!group_match_lookup_parameters(&p, d->name, (gid_t) uid))
|
||||
continue;
|
||||
|
||||
|
||||
@@ -59,3 +59,13 @@ if [[ ! -v ASAN_OPTIONS ]]; then
|
||||
assert_rc 2 systemd-run -q -t --property SystemCallFilter=~open_tree getent group definitelynotarealgroup
|
||||
systemctl start systemd-userdbd.socket systemd-userdbd.service
|
||||
fi
|
||||
|
||||
# For issue 40228
|
||||
UNIT="sleep$RANDOM"
|
||||
DISK_GID=$(userdbctl -j group disk | jq .gid)
|
||||
systemd-run -p DynamicUser=yes -p Group=disk -u "$UNIT" sleep infinity
|
||||
userdbctl group disk | grep -F 'io.systemd.NameServiceSwitch' >/dev/null
|
||||
userdbctl group "$DISK_GID" | grep -F 'io.systemd.NameServiceSwitch' >/dev/null
|
||||
(! busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LookupDynamicUserByName "s" disk)
|
||||
(! busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LookupDynamicUserByUID "u" "$DISK_GID")
|
||||
systemctl stop "$UNIT"
|
||||
|
||||
Reference in New Issue
Block a user