From 27a5a22f0354568e1c7e6292689ad947aa16aaac Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 30 Apr 2021 23:08:21 +0200 Subject: [PATCH 1/5] userdb: count NSS records too --- src/shared/userdb.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/shared/userdb.c b/src/shared/userdb.c index 0d471a2f94..e188123e2e 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -750,6 +750,8 @@ int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) { if (ret) (*ret)->incomplete = incomplete; + + iterator->n_found++; return r; } @@ -948,6 +950,8 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) { if (ret) (*ret)->incomplete = incomplete; + + iterator->n_found++; return r; } From 77fe7d15931cc17c933ae8778c4161112783dc79 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 30 Apr 2021 23:08:55 +0200 Subject: [PATCH 2/5] userdb: remove unnecesary repeated if check --- src/shared/userdb.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/shared/userdb.c b/src/shared/userdb.c index e188123e2e..149a8e1a0e 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -776,11 +776,11 @@ int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) { iterator->n_found++; return synthetic_nobody_user_build(ret); } - } - /* if we found at least one entry, then ignore errors and indicate that we reached the end */ - if (r < 0 && iterator->n_found > 0) - return -ESRCH; + /* if we found at least one entry, then ignore errors and indicate that we reached the end */ + if (iterator->n_found > 0) + return -ESRCH; + } return r; } @@ -975,11 +975,11 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) { iterator->n_found++; return synthetic_nobody_group_build(ret); } - } - /* if we found at least one entry, then ignore errors and indicate that we reached the end */ - if (r < 0 && iterator->n_found > 0) - return -ESRCH; + /* if we found at least one entry, then ignore errors and indicate that we reached the end */ + if (iterator->n_found > 0) + return -ESRCH; + } return r; } From d4f560df4f75d8bc5816a515c000f62cb796fa9f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 30 Apr 2021 23:09:35 +0200 Subject: [PATCH 3/5] userdb: add missing 'else' --- src/shared/userdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/userdb.c b/src/shared/userdb.c index 149a8e1a0e..0f849cc879 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -910,8 +910,8 @@ int groupdb_all(UserDBFlags flags, UserDBIterator **ret) { setgrent(); iterator->nss_iterating = true; - } if (r < 0) - return r; + } else if (r < 0) + return r; *ret = TAKE_PTR(iterator); return 0; From d9f5f2a12c1c81e93d65198fd68eaa990e63e228 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 30 Apr 2021 23:10:10 +0200 Subject: [PATCH 4/5] userdb: fix typo in comment --- src/shared/userdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/userdb.c b/src/shared/userdb.c index 0f849cc879..b09452c133 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -1117,7 +1117,7 @@ int membershipdb_iterator_get( assert(iterator); for (;;) { - /* If we are iteratring through NSS acquire a new group entry if we haven't acquired one yet. */ + /* If we are iterating through NSS acquire a new group entry if we haven't acquired one yet. */ if (!iterator->members_of_group) { struct group *g; From 7c67419117f19a85cf3e7e1513c072be2b767a74 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 3 May 2021 20:06:15 +0200 Subject: [PATCH 5/5] userdb: honour USERDB_AVOID_SHADOW flag also when iterating --- src/shared/userdb.c | 48 ++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/src/shared/userdb.c b/src/shared/userdb.c index b09452c133..e4a04123c0 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -27,6 +27,7 @@ typedef enum LookupWhat { struct UserDBIterator { LookupWhat what; + UserDBFlags flags; Set *links; bool nss_covered:1; bool nss_iterating:1; @@ -92,7 +93,7 @@ UserDBIterator* userdb_iterator_free(UserDBIterator *iterator) { return mfree(iterator); } -static UserDBIterator* userdb_iterator_new(LookupWhat what) { +static UserDBIterator* userdb_iterator_new(LookupWhat what, UserDBFlags flags) { UserDBIterator *i; assert(what >= 0); @@ -104,6 +105,7 @@ static UserDBIterator* userdb_iterator_new(LookupWhat what) { *i = (UserDBIterator) { .what = what, + .flags = flags, }; return i; @@ -608,7 +610,7 @@ int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret) { if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_USER); + iterator = userdb_iterator_new(LOOKUP_USER, flags); if (!iterator) return -ENOMEM; @@ -655,7 +657,7 @@ int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret) { if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_USER); + iterator = userdb_iterator_new(LOOKUP_USER, flags); if (!iterator) return -ENOMEM; @@ -693,7 +695,7 @@ int userdb_all(UserDBFlags flags, UserDBIterator **ret) { assert(ret); - iterator = userdb_iterator_new(LOOKUP_USER); + iterator = userdb_iterator_new(LOOKUP_USER, flags); if (!iterator) return -ENOMEM; @@ -738,10 +740,15 @@ int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) { if (pw->pw_uid == UID_NOBODY) iterator->synthesize_nobody = false; - r = nss_spwd_for_passwd(pw, &spwd, &buffer); - if (r < 0) { - log_debug_errno(r, "Failed to acquire shadow entry for user %s, ignoring: %m", pw->pw_name); - incomplete = ERRNO_IS_PRIVILEGE(r); + if (!FLAGS_SET(iterator->flags, USERDB_AVOID_SHADOW)) { + r = nss_spwd_for_passwd(pw, &spwd, &buffer); + if (r < 0) { + log_debug_errno(r, "Failed to acquire shadow entry for user %s, ignoring: %m", pw->pw_name); + incomplete = ERRNO_IS_PRIVILEGE(r); + } + } else { + r = -EUCLEAN; + incomplete = true; } r = nss_passwd_to_user_record(pw, r >= 0 ? &spwd : NULL, ret); @@ -814,7 +821,7 @@ int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret) { if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_GROUP); + iterator = userdb_iterator_new(LOOKUP_GROUP, flags); if (!iterator) return -ENOMEM; @@ -858,7 +865,7 @@ int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret) { if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_GROUP); + iterator = userdb_iterator_new(LOOKUP_GROUP, flags); if (!iterator) return -ENOMEM; @@ -895,7 +902,7 @@ int groupdb_all(UserDBFlags flags, UserDBIterator **ret) { assert(ret); - iterator = userdb_iterator_new(LOOKUP_GROUP); + iterator = userdb_iterator_new(LOOKUP_GROUP, flags); if (!iterator) return -ENOMEM; @@ -938,10 +945,15 @@ int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) { if (gr->gr_gid == GID_NOBODY) iterator->synthesize_nobody = false; - r = nss_sgrp_for_group(gr, &sgrp, &buffer); - if (r < 0) { - log_debug_errno(r, "Failed to acquire shadow entry for group %s, ignoring: %m", gr->gr_name); - incomplete = ERRNO_IS_PRIVILEGE(r); + if (!FLAGS_SET(iterator->flags, USERDB_AVOID_SHADOW)) { + r = nss_sgrp_for_group(gr, &sgrp, &buffer); + if (r < 0) { + log_debug_errno(r, "Failed to acquire shadow entry for group %s, ignoring: %m", gr->gr_name); + incomplete = ERRNO_IS_PRIVILEGE(r); + } + } else { + r = -EUCLEAN; + incomplete = true; } r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret); @@ -999,7 +1011,7 @@ int membershipdb_by_user(const char *name, UserDBFlags flags, UserDBIterator **r if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP); + iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP, flags); if (!iterator) return -ENOMEM; @@ -1042,7 +1054,7 @@ int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator ** if (r < 0) return r; - iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP); + iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP, flags); if (!iterator) return -ENOMEM; @@ -1083,7 +1095,7 @@ int membershipdb_all(UserDBFlags flags, UserDBIterator **ret) { assert(ret); - iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP); + iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP, flags); if (!iterator) return -ENOMEM;