summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--map_common.c375
-rw-r--r--map_common.h17
-rw-r--r--nss_mapname.c130
-rw-r--r--nss_mapuid.c261
4 files changed, 387 insertions, 396 deletions
diff --git a/map_common.c b/map_common.c
index f7ee038..6313c88 100644
--- a/map_common.c
+++ b/map_common.c
@@ -23,128 +23,123 @@
* during the linking phase (made internal only).
*/
-
#include "map_common.h"
#include <sys/stat.h>
static const char config_file[] = "/etc/nss_mapuser.conf";
-#define DEF_MIN_UID 1001 /* fail lookups on uid's below this value */
+#define DEF_MIN_UID 1001 /* fail lookups on uid's below this value */
/* set from configuration file parsing; stripped from exported symbols
* in build, so local to the shared lib. */
-char *exclude_users; /* don't lookup these users */
+char *exclude_users; /* don't lookup these users */
char *mappeduser;
char *mapped_priv_user;
uid_t min_uid = DEF_MIN_UID;
int debug;
static int conf_parsed = 0;
-static const char *libname; /* for syslogs, set in each library */
+static const char *libname; /* for syslogs, set in each library */
/* reset all config variables when we are going to re-parse */
-static void
-reset_config(void)
+static void reset_config(void)
{
- /* reset the config variables that we use, freeing memory where needed */
- if(exclude_users) {
- (void)free(exclude_users);
- exclude_users = NULL;
- }
- if(mappeduser) {
- (void)free(mappeduser);
- mappeduser = NULL;
- }
- if(mapped_priv_user) {
- (void)free(mapped_priv_user);
- mapped_priv_user = NULL;
- }
- debug = 0;
- min_uid = DEF_MIN_UID;
+ /* reset the config variables that we use, freeing memory where needed */
+ if (exclude_users) {
+ (void)free(exclude_users);
+ exclude_users = NULL;
+ }
+ if (mappeduser) {
+ (void)free(mappeduser);
+ mappeduser = NULL;
+ }
+ if (mapped_priv_user) {
+ (void)free(mapped_priv_user);
+ mapped_priv_user = NULL;
+ }
+ debug = 0;
+ min_uid = DEF_MIN_UID;
}
/*
* return 0 on succesful parsing (at least no hard errors), 1 if
* an error, and 2 if already parsed and no change to config file
*/
-int
-nss_mapuser_config(int *errnop, const char *lname)
+int nss_mapuser_config(int *errnop, const char *lname)
{
- FILE *conf;
- char lbuf[256];
- static struct stat lastconf;
+ FILE *conf;
+ char lbuf[256];
+ static struct stat lastconf;
- if(conf_parsed) {
- struct stat st, *lst = &lastconf;
- /*
- * check to see if the config file(s) have changed since last time,
- * in case we are part of a long-lived daemon. If any changed,
- * reparse. If not, return the appropriate status (err or OK)
- */
- if (stat(config_file, &st) && st.st_ino == lst->st_ino &&
- st.st_mtime == lst->st_mtime && st.st_ctime == lst->st_ctime)
- return 2; /* nothing to reparse */
- reset_config();
- conf_parsed = 0;
- if (debug && conf_parsed)
- syslog(LOG_DEBUG, "%s: Configuration file changed, re-initializing",
- libname);
- }
+ if (conf_parsed) {
+ struct stat st, *lst = &lastconf;
+ /*
+ * check to see if the config file(s) have changed since last time,
+ * in case we are part of a long-lived daemon. If any changed,
+ * reparse. If not, return the appropriate status (err or OK)
+ */
+ if (stat(config_file, &st) && st.st_ino == lst->st_ino &&
+ st.st_mtime == lst->st_mtime
+ && st.st_ctime == lst->st_ctime)
+ return 2; /* nothing to reparse */
+ reset_config();
+ conf_parsed = 0;
+ if (debug && conf_parsed)
+ syslog(LOG_DEBUG,
+ "%s: Configuration file changed, re-initializing",
+ libname);
+ }
- libname = lname;
+ libname = lname;
- conf = fopen(config_file, "r");
- if(conf == NULL) {
- *errnop = errno;
- syslog(LOG_NOTICE, "%s: can't open config file %s: %m",
- libname, config_file);
- return 1;
- }
- if (fstat(fileno(conf), &lastconf) != 0)
- memset(&lastconf, 0, sizeof lastconf); /* avoid stale data, no warning */
+ conf = fopen(config_file, "r");
+ if (conf == NULL) {
+ *errnop = errno;
+ syslog(LOG_NOTICE, "%s: can't open config file %s: %m",
+ libname, config_file);
+ return 1;
+ }
+ if (fstat(fileno(conf), &lastconf) != 0)
+ memset(&lastconf, 0, sizeof lastconf); /* avoid stale data, no warning */
- while(fgets(lbuf, sizeof lbuf, conf)) {
- if(*lbuf == '#' || isspace(*lbuf))
- continue; /* skip comments, white space lines, etc. */
- strtok(lbuf, " \t\n\r\f"); /* terminate buffer at first whitespace */
- if(!strncmp(lbuf, "debug=", 6))
- debug = strtoul(lbuf+6, NULL, 0);
- else if(!strncmp(lbuf, "exclude_users=", 14)) {
- /*
- * Don't lookup users in this comma-separated list for both
- * robustness and performnce. Typically root and other commonly
- * used local users. If set, we also look up the uids
- * locally, and won't do remote lookup on those uids either.
- */
- exclude_users = strdup(lbuf+14);
- }
- else if(!strncmp(lbuf, "mapped_user=", 12)) {
- /* the user we are mapping to */
- mappeduser = strdup(lbuf+12);
- }
- else if(!strncmp(lbuf, "mapped_priv_user=", 17)) {
- /* the user we are mapping to */
- mapped_priv_user = strdup(lbuf+17);
- }
- else if(!strncmp(lbuf, "min_uid=", 8)) {
- /*
- * Don't lookup uids that are local, typically set to either
- * 0 or smallest always local user's uid
- */
- unsigned long uid;
- char *valid;
- uid = strtoul(lbuf+8, &valid, 0);
- if (valid > (lbuf+8))
- min_uid = (uid_t)uid;
- }
- else if(debug) /* ignore unrecognized lines, unless debug on */
- syslog(LOG_WARNING, "%s: unrecognized parameter: %s",
- libname, lbuf);
- }
- fclose(conf);
- conf_parsed = 1;
+ while (fgets(lbuf, sizeof lbuf, conf)) {
+ if (*lbuf == '#' || isspace(*lbuf))
+ continue; /* skip comments, white space lines, etc. */
+ strtok(lbuf, " \t\n\r\f"); /* terminate buffer at first whitespace */
+ if (!strncmp(lbuf, "debug=", 6))
+ debug = strtoul(lbuf + 6, NULL, 0);
+ else if (!strncmp(lbuf, "exclude_users=", 14)) {
+ /*
+ * Don't lookup users in this comma-separated list for both
+ * robustness and performnce. Typically root and other commonly
+ * used local users. If set, we also look up the uids
+ * locally, and won't do remote lookup on those uids either.
+ */
+ exclude_users = strdup(lbuf + 14);
+ } else if (!strncmp(lbuf, "mapped_user=", 12)) {
+ /* the user we are mapping to */
+ mappeduser = strdup(lbuf + 12);
+ } else if (!strncmp(lbuf, "mapped_priv_user=", 17)) {
+ /* the user we are mapping to */
+ mapped_priv_user = strdup(lbuf + 17);
+ } else if (!strncmp(lbuf, "min_uid=", 8)) {
+ /*
+ * Don't lookup uids that are local, typically set to either
+ * 0 or smallest always local user's uid
+ */
+ unsigned long uid;
+ char *valid;
+ uid = strtoul(lbuf + 8, &valid, 0);
+ if (valid > (lbuf + 8))
+ min_uid = (uid_t) uid;
+ } else if (debug) /* ignore unrecognized lines, unless debug on */
+ syslog(LOG_WARNING, "%s: unrecognized parameter: %s",
+ libname, lbuf);
+ }
+ fclose(conf);
+ conf_parsed = 1;
- return mappeduser ? 0 : 1; /* can't do anything without this */
+ return mappeduser ? 0 : 1; /* can't do anything without this */
}
/*
@@ -159,81 +154,87 @@ int
pwcopy(char *buf, size_t len, struct passwd *srcpw, struct passwd *destpw,
const char *usename)
{
- int needlen, cnt, origlen = len;
- char *shell;
+ int needlen, cnt, origlen = len;
+ char *shell;
- if(!mappeduser) {
- if(debug)
- syslog(LOG_DEBUG, "%s: empty mapped_user, failing", libname);
- return 1;
- }
- if(!usename) { /* this should never happen */
- if(debug)
- syslog(LOG_DEBUG, "%s: empty username, failing", libname);
- return 1;
- }
+ if (!mappeduser) {
+ if (debug)
+ syslog(LOG_DEBUG, "%s: empty mapped_user, failing",
+ libname);
+ return 1;
+ }
+ if (!usename) { /* this should never happen */
+ if (debug)
+ syslog(LOG_DEBUG, "%s: empty username, failing",
+ libname);
+ return 1;
+ }
- needlen = 2 * strlen(usename) + 2 + /* pw_name and pw_gecos */
- srcpw->pw_dir ? strlen(srcpw->pw_dir) + 1 : 1 +
- srcpw->pw_shell ? strlen(srcpw->pw_shell) + 1 : 1 +
- 2 + /* for 'x' in the passwd field */
- 12; /* for the "Mapped user" in the gecos field */
- if(needlen > len) {
- if(debug)
- syslog(LOG_DEBUG, "%s provided password buffer too small (%ld<%d)",
- libname, (long)len, needlen);
- return 1;
- }
+ needlen = 2 * strlen(usename) + 2 + /* pw_name and pw_gecos */
+ srcpw->pw_dir ? strlen(srcpw->pw_dir) + 1 : 1 + srcpw->pw_shell ?
+ strlen(srcpw->pw_shell) + 1 : 1 + 2 + /* for 'x' in passwd */
+ 12; /* for the "Mapped user" in gecos */
+ if (needlen > len) {
+ if (debug)
+ syslog(LOG_DEBUG,
+ "%s provided password buffer too small (%ld<%d)",
+ libname, (long)len, needlen);
+ return 1;
+ }
- destpw->pw_uid = srcpw->pw_uid;
- destpw->pw_gid = srcpw->pw_gid;
+ destpw->pw_uid = srcpw->pw_uid;
+ destpw->pw_gid = srcpw->pw_gid;
- cnt = snprintf(buf, len, "%s", usename);
- destpw->pw_name = buf;
- cnt++; /* allow for null byte also */
- buf += cnt;
- len -= cnt;
- cnt = snprintf(buf, len, "%s", "x");
- destpw->pw_passwd = buf;
- cnt++;
- buf += cnt;
- len -= cnt;
- cnt = snprintf(buf, len, "%s", srcpw->pw_shell ? srcpw->pw_shell : "");
- destpw->pw_shell = buf;
- shell = strrchr(buf, '/');
- shell = shell ? shell+1 : buf;
- cnt++;
- buf += cnt;
- len -= cnt;
- cnt = snprintf(buf, len, "%s mapped user", usename);
- destpw->pw_gecos = buf;
- cnt++;
- buf += cnt;
- len -= cnt;
- if (usename) {
- char *slash, dbuf[strlen(srcpw->pw_dir) + strlen(usename)];
- snprintf(dbuf, sizeof dbuf, "%s", srcpw->pw_dir ? srcpw->pw_dir : "");
- slash = strrchr(dbuf, '/');
- if (slash) {
- slash++;
- snprintf(slash, sizeof dbuf - (slash-dbuf), "%s", usename);
- }
- cnt = snprintf(buf, len, "%s", dbuf);
- }
- else
- cnt = snprintf(buf, len, "%s", srcpw->pw_dir ? srcpw->pw_dir : "");
- destpw->pw_dir = buf;
- cnt++;
- buf += cnt;
- len -= cnt;
- if(len < 0) {
- if(debug)
- syslog(LOG_DEBUG, "%s provided password buffer too small (%ld<%d)",
- libname, (long)origlen, origlen-(int)len);
- return 1;
- }
+ cnt = snprintf(buf, len, "%s", usename);
+ destpw->pw_name = buf;
+ cnt++; /* allow for null byte also */
+ buf += cnt;
+ len -= cnt;
+ cnt = snprintf(buf, len, "%s", "x");
+ destpw->pw_passwd = buf;
+ cnt++;
+ buf += cnt;
+ len -= cnt;
+ cnt = snprintf(buf, len, "%s", srcpw->pw_shell ? srcpw->pw_shell : "");
+ destpw->pw_shell = buf;
+ shell = strrchr(buf, '/');
+ shell = shell ? shell + 1 : buf;
+ cnt++;
+ buf += cnt;
+ len -= cnt;
+ cnt = snprintf(buf, len, "%s mapped user", usename);
+ destpw->pw_gecos = buf;
+ cnt++;
+ buf += cnt;
+ len -= cnt;
+ if (usename) {
+ char *slash, dbuf[strlen(srcpw->pw_dir) + strlen(usename)];
+ snprintf(dbuf, sizeof dbuf, "%s",
+ srcpw->pw_dir ? srcpw->pw_dir : "");
+ slash = strrchr(dbuf, '/');
+ if (slash) {
+ slash++;
+ snprintf(slash, sizeof dbuf - (slash - dbuf), "%s",
+ usename);
+ }
+ cnt = snprintf(buf, len, "%s", dbuf);
+ } else
+ cnt =
+ snprintf(buf, len, "%s",
+ srcpw->pw_dir ? srcpw->pw_dir : "");
+ destpw->pw_dir = buf;
+ cnt++;
+ buf += cnt;
+ len -= cnt;
+ if (len < 0) {
+ if (debug)
+ syslog(LOG_DEBUG,
+ "%s provided password buffer too small (%ld<%d)",
+ libname, (long)origlen, origlen - (int)len);
+ return 1;
+ }
- return 0;
+ return 0;
}
/*
@@ -242,33 +243,31 @@ pwcopy(char *buf, size_t len, struct passwd *srcpw, struct passwd *destpw,
* map file.
* returns 0 on success
*/
-int
-get_pw_mapuser(const char *name, struct pwbuf *pb)
+int get_pw_mapuser(const char *name, struct pwbuf *pb)
{
- FILE *pwfile;
- struct passwd *ent;
- int ret = 1;
-
+ FILE *pwfile;
+ struct passwd *ent;
+ int ret = 1;
- pwfile = fopen("/etc/passwd", "r");
- if(!pwfile) {
- syslog(LOG_WARNING, "%s: failed to open /etc/passwd: %m",
- libname);
- return 1;
- }
+ pwfile = fopen("/etc/passwd", "r");
+ if (!pwfile) {
+ syslog(LOG_WARNING, "%s: failed to open /etc/passwd: %m",
+ libname);
+ return 1;
+ }
- pb->pw->pw_name = NULL; /* be paranoid */
- for(ret = 1; ret && (ent = fgetpwent(pwfile)); ) {
- if(!ent->pw_name)
- continue; /* shouldn't happen */
- if(!strcmp(ent->pw_name, mappeduser)) {
- ret = pwcopy(pb->buf, pb->buflen, ent, pb->pw, name);
- break;
- }
- }
- fclose(pwfile);
- if(ret)
- *pb->errnop = ERANGE;
+ pb->pw->pw_name = NULL; /* be paranoid */
+ for (ret = 1; ret && (ent = fgetpwent(pwfile));) {
+ if (!ent->pw_name)
+ continue; /* shouldn't happen */
+ if (!strcmp(ent->pw_name, mappeduser)) {
+ ret = pwcopy(pb->buf, pb->buflen, ent, pb->pw, name);
+ break;
+ }
+ }
+ fclose(pwfile);
+ if (ret)
+ *pb->errnop = ERANGE;
- return ret;
+ return ret;
}
diff --git a/map_common.h b/map_common.h
index ff136d3..b3401ea 100644
--- a/map_common.h
+++ b/map_common.h
@@ -23,7 +23,6 @@
* stripped during the linking phase (made internal only).
*/
-
#include <string.h>
#include <syslog.h>
#include <stdlib.h>
@@ -34,17 +33,16 @@
#include <ctype.h>
#include <nss.h>
-
/*
* pwbuf is used to reduce number of arguments passed around; the strings in
* the passwd struct need to point into this buffer.
*/
struct pwbuf {
- char *name;
- char *buf;
- struct passwd *pw;
- int *errnop;
- size_t buflen;
+ char *name;
+ char *buf;
+ struct passwd *pw;
+ int *errnop;
+ size_t buflen;
};
/* configuration variables. */
@@ -55,7 +53,6 @@ extern uid_t min_uid;
extern int debug;
extern int nss_mapuser_config(int *errnop, const char *lname);
-extern int pwcopy(char *buf, size_t len, struct passwd *srcpw, struct passwd *destpw,
- const char *usename);
+extern int pwcopy(char *buf, size_t len, struct passwd *srcpw,
+ struct passwd *destpw, const char *usename);
extern int get_pw_mapuser(const char *name, struct pwbuf *pb);
-
diff --git a/nss_mapname.c b/nss_mapname.c
index f795cf5..e974b75 100644
--- a/nss_mapname.c
+++ b/nss_mapname.c
@@ -35,12 +35,10 @@
* See nss_mapuid.c for the matching getpwuid_r for UIDs.
*/
-
#include "map_common.h"
#include <stdbool.h>
-
-static const char *nssname = "nss_mapuser"; /* for syslogs */
+static const char *nssname = "nss_mapuser"; /* for syslogs */
/*
* If you aren't using glibc or a variant that supports this,
@@ -57,75 +55,75 @@ extern const char *__progname;
* Because we always have a positive reply, it's important that this
* be the last NSS module for passwd lookups.
*/
-__attribute__ ((visibility ("default")))
+__attribute__ ((visibility("default")))
enum nss_status _nss_mapname_getpwnam_r(const char *name, struct passwd *pw,
- char *buffer, size_t buflen, int *errnop)
+ char *buffer, size_t buflen,
+ int *errnop)
{
- enum nss_status status = NSS_STATUS_NOTFOUND;
- struct pwbuf pbuf;
- bool islocal = 0;
-
- /*
- * the useradd family will not add/mod/del users correctly with
- * the mapuid functionality, so return immediately if we are
- * running as part of those processes.
- */
- if (__progname && (!strcmp(__progname, "useradd") ||
- !strcmp(__progname, "usermod") ||
- !strcmp(__progname, "userdel")))
- return status;
+ enum nss_status status = NSS_STATUS_NOTFOUND;
+ struct pwbuf pbuf;
+ bool islocal = 0;
- if (nss_mapuser_config(errnop, nssname) == 1) {
- syslog(LOG_NOTICE, "%s: bad configuration", nssname);
- return status;
- }
+ /*
+ * the useradd family will not add/mod/del users correctly with
+ * the mapuid functionality, so return immediately if we are
+ * running as part of those processes.
+ */
+ if (__progname && (!strcmp(__progname, "useradd") ||
+ !strcmp(__progname, "usermod") ||
+ !strcmp(__progname, "userdel")))
+ return status;
- /*
- * Ignore any name starting with tacacs[0-9] in case a
- * tacplus client is installed. Cleaner than listing
- * all 16 in the exclude_users list or implementing
- * some form of wildcard. Also ignore our own mappeduser
- * and mapped_priv_user names if set.
- */
- if ((mappeduser && !strcmp(mappeduser, name)) ||
- (mapped_priv_user && !strcmp(mapped_priv_user, name)))
- islocal = 1;
- else if (!strncmp("tacacs", name, 6) && isdigit(name[6]))
- islocal = 1;
- else if (exclude_users) {
- char *user, *list;
- list = strdup(exclude_users);
- if (list) {
- static const char *delim = ", \t\n";
- user = strtok(list, delim);
- list = NULL;
- while (user) {
- if(!strcmp(user, name)) {
- islocal = 1;
- break;
- }
- user = strtok(NULL, delim);
- }
- free(list);
- }
- }
- if (islocal) {
- if(debug > 1)
- syslog(LOG_DEBUG, "%s: skipped excluded user: %s", nssname,
- name);
- return 2;
- }
+ if (nss_mapuser_config(errnop, nssname) == 1) {
+ syslog(LOG_NOTICE, "%s: bad configuration", nssname);
+ return status;
+ }
+ /*
+ * Ignore any name starting with tacacs[0-9] in case a
+ * tacplus client is installed. Cleaner than listing
+ * all 16 in the exclude_users list or implementing
+ * some form of wildcard. Also ignore our own mappeduser
+ * and mapped_priv_user names if set.
+ */
+ if ((mappeduser && !strcmp(mappeduser, name)) ||
+ (mapped_priv_user && !strcmp(mapped_priv_user, name)))
+ islocal = 1;
+ else if (!strncmp("tacacs", name, 6) && isdigit(name[6]))
+ islocal = 1;
+ else if (exclude_users) {
+ char *user, *list;
+ list = strdup(exclude_users);
+ if (list) {
+ static const char *delim = ", \t\n";
+ user = strtok(list, delim);
+ list = NULL;
+ while (user) {
+ if (!strcmp(user, name)) {
+ islocal = 1;
+ break;
+ }
+ user = strtok(NULL, delim);
+ }
+ free(list);
+ }
+ }
+ if (islocal) {
+ if (debug > 1)
+ syslog(LOG_DEBUG, "%s: skipped excluded user: %s",
+ nssname, name);
+ return 2;
+ }
- /* marshal the args for the lower level functions */
- pbuf.name = (char *)name;
- pbuf.pw = pw;
- pbuf.buf = buffer;
- pbuf.buflen = buflen;
- pbuf.errnop = errnop;
+ /* marshal the args for the lower level functions */
+ pbuf.name = (char *)name;
+ pbuf.pw = pw;
+ pbuf.buf = buffer;
+ pbuf.buflen = buflen;
+ pbuf.errnop = errnop;
- if(!get_pw_mapuser(name, &pbuf))
- status = NSS_STATUS_SUCCESS;
+ if (!get_pw_mapuser(name, &pbuf))
+ status = NSS_STATUS_SUCCESS;
- return status;
+ return status;
}
diff --git a/nss_mapuid.c b/nss_mapuid.c
index f97b28e..cc6c5ec 100644
--- a/nss_mapuid.c
+++ b/nss_mapuid.c
@@ -17,7 +17,6 @@
* along with this program - see the file COPYING.
*/
-
/*
* This plugin implements getpwuid_r for NSS to map a UID back to
* a mapped username account, set up via nss_mapuser.
@@ -48,8 +47,7 @@
#include <dirent.h>
#include <ctype.h>
-
-static const char *nssname = "nss_mapuid"; /* for syslogs */
+static const char *nssname = "nss_mapuid"; /* for syslogs */
static const char dbdir[] = "/run/mapuser/";
/*
@@ -66,98 +64,97 @@ extern const char *__progname;
*/
static int chk_session_file(char *sfile, uid_t uid, struct pwbuf *pb)
{
- char rbuf[256], user[64];
- FILE *mapf;
- uid_t auid = 0;
- int ret = 1;
-
- mapf = fopen(sfile, "r");
- if (!mapf) {
- if( debug)
- syslog(LOG_DEBUG, "%s: session map file %s open fails: %m",
- nssname, sfile);
- return ret;
- }
- user[0] = '\0';
- while(fgets(rbuf, sizeof rbuf, mapf)) {
- strtok(rbuf, " \t\n\r\f"); /* terminate buffer at first whitespace */
- if(!strncmp("user=", rbuf, 5)) { /* should precede auid */
- snprintf(user, sizeof user, "%s", rbuf+5);
- if (auid) /* found out of order, but now have both */
- break;
- }
- else if(!strncmp("auid=", rbuf, 5)) {
- uid_t fuid = (uid_t)strtoul(rbuf+5, NULL, 10);
- if (fuid && uid == fuid) {
- auid = fuid;
- if (user[0])
- break; /* normal ordering, else keep looking for user */
- }
- }
- }
- fclose(mapf);
-
- if (auid && user[0]) /* otherwise not a match */
- ret = get_pw_mapuser(user, pb); /* should always succeed */
-
- return ret;
+ char rbuf[256], user[64];
+ FILE *mapf;
+ uid_t auid = 0;
+ int ret = 1;
+
+ mapf = fopen(sfile, "r");
+ if (!mapf) {
+ if (debug)
+ syslog(LOG_DEBUG,
+ "%s: session map file %s open fails: %m",
+ nssname, sfile);
+ return ret;
+ }
+ user[0] = '\0';
+ while (fgets(rbuf, sizeof rbuf, mapf)) {
+ strtok(rbuf, " \t\n\r\f"); /* terminate buffer at first whitespace */
+ if (!strncmp("user=", rbuf, 5)) { /* should precede auid */
+ snprintf(user, sizeof user, "%s", rbuf + 5);
+ if (auid) /* found out of order, but now have both */
+ break;
+ } else if (!strncmp("auid=", rbuf, 5)) {
+ uid_t fuid = (uid_t) strtoul(rbuf + 5, NULL, 10);
+ if (fuid && uid == fuid) {
+ auid = fuid;
+ if (user[0])
+ break; /* normal ordering, else keep looking for user */
+ }
+ }
+ }
+ fclose(mapf);
+
+ if (auid && user[0]) /* otherwise not a match */
+ ret = get_pw_mapuser(user, pb); /* should always succeed */
+
+ return ret;
}
/* find mapping for this sessionid */
-static int
-find_mapped_name(struct pwbuf *pb, uid_t uid, uint32_t session)
+static int find_mapped_name(struct pwbuf *pb, uid_t uid, uint32_t session)
{
- char sessfile[sizeof dbdir + 11];
+ char sessfile[sizeof dbdir + 11];
- snprintf(sessfile, sizeof sessfile, "%s%u", dbdir, session);
- return chk_session_file(sessfile, uid, pb);
+ snprintf(sessfile, sizeof sessfile, "%s%u", dbdir, session);
+ return chk_session_file(sessfile, uid, pb);
}
static int find_mappingfile(struct pwbuf *pb, uid_t uid)
{
- DIR *dir;
- struct dirent *ent;
- int ret = 1;
-
- dir = opendir(dbdir);
- if (!dir) { /* can happen if no mapped users logged in */
- if (debug > 1)
- syslog(LOG_DEBUG, "%s: Unable to open mapping directory %s: %m",
- nssname, dbdir);
- return 1;
- }
-
- /* Loop through all numeric files in dbdir, check for matching uid */
- while (ret && (ent = readdir(dir))) {
- char sessfile[sizeof dbdir + 11];
- if (!isdigit(ent->d_name[0])) /* sanity check on session file */
- continue;
- snprintf(sessfile, sizeof sessfile, "%s%s", dbdir, ent->d_name);
- ret = chk_session_file(sessfile, uid, pb);
- }
- if (ret && debug)
- syslog(LOG_DEBUG, "%s: uid %u mapping not found in map files",
- nssname, uid);
- closedir(dir);
- return ret;
+ DIR *dir;
+ struct dirent *ent;
+ int ret = 1;
+
+ dir = opendir(dbdir);
+ if (!dir) { /* can happen if no mapped users logged in */
+ if (debug > 1)
+ syslog(LOG_DEBUG,
+ "%s: Unable to open mapping directory %s: %m",
+ nssname, dbdir);
+ return 1;
+ }
+
+ /* Loop through all numeric files in dbdir, check for matching uid */
+ while (ret && (ent = readdir(dir))) {
+ char sessfile[sizeof dbdir + 11];
+ if (!isdigit(ent->d_name[0])) /* sanity check on session file */
+ continue;
+ snprintf(sessfile, sizeof sessfile, "%s%s", dbdir, ent->d_name);
+ ret = chk_session_file(sessfile, uid, pb);
+ }
+ if (ret && debug)
+ syslog(LOG_DEBUG, "%s: uid %u mapping not found in map files",
+ nssname, uid);
+ closedir(dir);
+ return ret;
}
-static uint32_t
-get_sessionid(void)
+static uint32_t get_sessionid(void)
{
- int fd = -1, cnt;
- uint32_t id = 0U;
- static char buf[12];
-
- fd = open("/proc/self/sessionid", O_RDONLY);
- if(fd != -1) {
- cnt = read(fd, buf, sizeof(buf));
- close(fd);
- }
- if(fd != -1 && cnt > 0) {
- id = strtoul(buf, NULL, 0);
- }
- return id;
+ int fd = -1, cnt;
+ uint32_t id = 0U;
+ static char buf[12];
+
+ fd = open("/proc/self/sessionid", O_RDONLY);
+ if (fd != -1) {
+ cnt = read(fd, buf, sizeof(buf));
+ close(fd);
+ }
+ if (fd != -1 && cnt > 0) {
+ id = strtoul(buf, NULL, 0);
+ }
+ return id;
}
/*
@@ -184,55 +181,55 @@ get_sessionid(void)
* just get the files, ldap, etc. entry for the UID
* Returns the first match if multiple mapped users.
*/
-__attribute__ ((visibility ("default")))
+__attribute__ ((visibility("default")))
enum nss_status _nss_mapuid_getpwuid_r(uid_t uid, struct passwd *pw,
- char *buffer, size_t buflen, int *errnop)
+ char *buffer, size_t buflen, int *errnop)
{
- struct pwbuf pb;
- enum nss_status status = NSS_STATUS_NOTFOUND;
- uint32_t session;
-
- /*
- * the useradd family will not add/mod/del users correctly with
- * the mapuid functionality, so return immediately if we are
- * running as part of those processes.
- */
- if (__progname && (!strcmp(__progname, "useradd") ||
- !strcmp(__progname, "usermod") ||
- !strcmp(__progname, "userdel")))
- return status;
-
- /* this can happen for permission reasons, do don't complain except
- * at debug */
- if (nss_mapuser_config(errnop, nssname) == 1) {
- return status; /* syslog already done */
- }
-
-
- if (min_uid != ~0U && uid < min_uid) {
- if(debug > 1)
- syslog(LOG_DEBUG, "%s: uid %u < min_uid %u, don't lookup",
- nssname, uid, min_uid);
- return status;
- }
-
- /* marshal the args for the lower level functions */
- pb.pw = pw;
- pb.buf = buffer;
- pb.buflen = buflen;
- pb.errnop = errnop;
- pb.name = NULL;
-
- /* session needs to be set to lookup this user. May also be set
- * for other users.
- */
- session = get_sessionid();
- if(session && !find_mapped_name(&pb, uid, session))
- status = NSS_STATUS_SUCCESS;
- if(status != NSS_STATUS_SUCCESS) {
- /* lookup by some other user or unrelated process, try dir lookup */
- if (!find_mappingfile(&pb, uid))
- status = NSS_STATUS_SUCCESS;
- }
- return status;
+ struct pwbuf pb;
+ enum nss_status status = NSS_STATUS_NOTFOUND;
+ uint32_t session;
+
+ /*
+ * the useradd family will not add/mod/del users correctly with
+ * the mapuid functionality, so return immediately if we are
+ * running as part of those processes.
+ */
+ if (__progname && (!strcmp(__progname, "useradd") ||
+ !strcmp(__progname, "usermod") ||
+ !strcmp(__progname, "userdel")))
+ return status;
+
+ /* this can happen for permission reasons, do don't complain except
+ * at debug */
+ if (nss_mapuser_config(errnop, nssname) == 1) {
+ return status; /* syslog already done */
+ }
+
+ if (min_uid != ~0U && uid < min_uid) {
+ if (debug > 1)
+ syslog(LOG_DEBUG,
+ "%s: uid %u < min_uid %u, don't lookup", nssname,
+ uid, min_uid);
+ return status;
+ }
+
+ /* marshal the args for the lower level functions */
+ pb.pw = pw;
+ pb.buf = buffer;
+ pb.buflen = buflen;
+ pb.errnop = errnop;
+ pb.name = NULL;
+
+ /* session needs to be set to lookup this user. May also be set
+ * for other users.
+ */
+ session = get_sessionid();
+ if (session && !find_mapped_name(&pb, uid, session))
+ status = NSS_STATUS_SUCCESS;
+ if (status != NSS_STATUS_SUCCESS) {
+ /* lookup by some other user or unrelated process, try dir lookup */
+ if (!find_mappingfile(&pb, uid))
+ status = NSS_STATUS_SUCCESS;
+ }
+ return status;
}
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-31 16:05:52 +0000