Skip to content

Commit

Permalink
Fix broken up NIS groups for compat NSS module.
Browse files Browse the repository at this point in the history 
The check for the inclusion of a group in the result gave up too early
in case of broken-up NIS groups.  We now fall back automatically to
the slow mode of using getgrent_r.  As an optimization, if there is
not blacklist we need not perform the check in the first place and
therefore can just accept the results of the initgroups_dyn callback.
  • Loading branch information
Ulrich Drepper committed Jun 21, 2009
1 parent f6887a0 commit ccab6d8
Show file tree
Hide file tree
Showing 2 changed files with 146 additions and 75 deletions.
21 changes: 21 additions & 0 deletions ChangeLog
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,24 @@
2009-06-20 Ulrich Drepper <drepper@redhat.com>

[BZ #10085]
* nis/nss_compat/compat-initgroups.c (nss_setgrent): New variable.
(nss_endgrent): New variable.
(struct ent_t): Add need_endgrent and skip_initgroups_dyn
fields. Change type of files to bool and adjust all users.
(init_nss_interface): Initialize nss_setgrent and nss_endgrent.
(internal_endgrent): Call nss_endgrent if necessary.
(add_group): New function. Broken out of...
(check_and_add_group): ...here.
(getgrent_next_nss): Remove test that any callback is available.
Use skip_initgroups_dyn to determine whether to use initgroups_dyn
callback. If there is no blacklist we can trust the results returned
by the initgroups_dyn callback. In case there is a callback and we
find a group entry for the group ID but it doesn't contain the
correct member, switch to the slow mode and use getgrent_r.
(internal_getgrent_r): When we see a +: entry, determine whether
there is any callback and which we can use the initgroups_dyn
callback.

2009-06-18 Ulrich Drepper <drepper@redhat.com>

* malloc/malloc.c (_int_malloc): Add some consistency checks.
Expand Down
200 changes: 125 additions & 75 deletions nis/nss_compat/compat-initgroups.c
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 1998-2004, 2006, 2007 Free Software Foundation, Inc.
/* Copyright (C) 1998-2004, 2006, 2007, 2009 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
Expand Down Expand Up @@ -43,8 +43,10 @@ static enum nss_status (*nss_getgrnam_r) (const char *name,
static enum nss_status (*nss_getgrgid_r) (gid_t gid, struct group * grp,
char *buffer, size_t buflen,
int *errnop);
static enum nss_status (*nss_setgrent) (int stayopen);
static enum nss_status (*nss_getgrent_r) (struct group * grp, char *buffer,
size_t buflen, int *errnop);
static enum nss_status (*nss_endgrent) (void);

/* Protect global state against multiple changers. */
__libc_lock_define_initialized (static, lock)
Expand All @@ -68,7 +70,9 @@ struct blacklist_t

struct ent_t
{
bool_t files;
bool files;
bool need_endgrent;
bool skip_initgroups_dyn;
FILE *stream;
struct blacklist_t blacklist;
};
Expand Down Expand Up @@ -106,7 +110,9 @@ init_nss_interface (void)
nss_initgroups_dyn = __nss_lookup_function (ni, "initgroups_dyn");
nss_getgrnam_r = __nss_lookup_function (ni, "getgrnam_r");
nss_getgrgid_r = __nss_lookup_function (ni, "getgrgid_r");
nss_setgrent = __nss_lookup_function (ni, "setgrent");
nss_getgrent_r = __nss_lookup_function (ni, "getgrent_r");
nss_endgrent = __nss_lookup_function (ni, "endgrent");
}

__libc_lock_unlock (lock);
Expand All @@ -117,7 +123,7 @@ internal_setgrent (ent_t *ent)
{
enum nss_status status = NSS_STATUS_SUCCESS;

ent->files = TRUE;
ent->files = true;

if (ni == NULL)
init_nss_interface ();
Expand Down Expand Up @@ -195,54 +201,68 @@ internal_endgrent (ent_t *ent)
else
ent->blacklist.current = 0;

if (ent->need_endgrent && nss_endgrent != NULL)
nss_endgrent ();

return NSS_STATUS_SUCCESS;
}

/* This function checks, if the user is a member of this group and if
yes, add the group id to the list. */
/* Add new group record. */
static void
add_group (long int *start, long int *size, gid_t **groupsp, long int limit,
gid_t gid)
{
gid_t *groups = *groupsp;

/* Matches user. Insert this group. */
if (__builtin_expect (*start == *size, 0))
{
/* Need a bigger buffer. */
gid_t *newgroups;
long int newsize;

if (limit > 0 && *size == limit)
/* We reached the maximum. */
return;

if (limit <= 0)
newsize = 2 * *size;
else
newsize = MIN (limit, 2 * *size);

newgroups = realloc (groups, newsize * sizeof (*groups));
if (newgroups == NULL)
return;
*groupsp = groups = newgroups;
*size = newsize;
}

groups[*start] = gid;
*start += 1;
}

/* This function checks, if the user is a member of this group and if
yes, add the group id to the list. Return nonzero is we couldn't
handle the group because the user is not in the member list. */
static int
check_and_add_group (const char *user, gid_t group, long int *start,
long int *size, gid_t **groupsp, long int limit,
struct group *grp)
{
gid_t *groups = *groupsp;
char **member;

/* Don't add main group to list of groups. */
if (grp->gr_gid == group)
return;
return 0;

for (member = grp->gr_mem; *member != NULL; ++member)
if (strcmp (*member, user) == 0)
{
/* Matches user. Insert this group. */
if (*start == *size)
{
/* Need a bigger buffer. */
gid_t *newgroups;
long int newsize;

if (limit > 0 && *size == limit)
/* We reached the maximum. */
return;

if (limit <= 0)
newsize = 2 * *size;
else
newsize = MIN (limit, 2 * *size);

newgroups = realloc (groups, newsize * sizeof (*groups));
if (newgroups == NULL)
return;
*groupsp = groups = newgroups;
*size = newsize;
}

groups[*start] = grp->gr_gid;
*start += 1;

break;
add_group (start, size, groupsp, limit, grp->gr_gid);
return 0;
}

return 1;
}

/* Get the next group from NSS (+ entry). If the NSS module supports
Expand All @@ -255,15 +275,10 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,
enum nss_status status;
struct group grpbuf;

/* if this module does not support getgrent_r and initgroups_dyn,
abort. We cannot find the needed group entries. */
if (nss_getgrent_r == NULL && nss_initgroups_dyn == NULL)
return NSS_STATUS_UNAVAIL;

/* Try nss_initgroups_dyn if supported. We also need getgrgid_r.
If this function is not supported, step through the whole group
database with getgrent_r. */
if (nss_initgroups_dyn && nss_getgrgid_r)
if (! ent->skip_initgroups_dyn)
{
long int mystart = 0;
long int mysize = limit <= 0 ? *size : limit;
Expand All @@ -282,39 +297,56 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,
if (nss_initgroups_dyn (user, group, &mystart, &mysize, &mygroups,
limit, errnop) == NSS_STATUS_SUCCESS)
{
/* A temporary buffer. We use the normal buffer, until we find
an entry, for which this buffer is to small. In this case, we
overwrite the pointer with one to a bigger buffer. */
char *tmpbuf = buffer;
size_t tmplen = buflen;
int i;

for (i = 0; i < mystart; i++)
/* If there is no blacklist we can trust the underlying
initgroups implementation. */
if (ent->blacklist.current <= 1)
for (int i = 0; i < mystart; i++)
add_group (start, size, groupsp, limit, mygroups[i]);
else
{
while ((status = nss_getgrgid_r (mygroups[i], &grpbuf, tmpbuf,
tmplen,
errnop)) == NSS_STATUS_TRYAGAIN
&& *errnop == ERANGE)
if (tmpbuf == buffer)
{
tmplen *= 2;
tmpbuf = __alloca (tmplen);
}
else
tmpbuf = extend_alloca (tmpbuf, tmplen, 2 * tmplen);

if (__builtin_expect (status != NSS_STATUS_NOTFOUND, 1))
/* A temporary buffer. We use the normal buffer, until we find
an entry, for which this buffer is to small. In this case, we
overwrite the pointer with one to a bigger buffer. */
char *tmpbuf = buffer;
size_t tmplen = buflen;

for (int i = 0; i < mystart; i++)
{
if (__builtin_expect (status != NSS_STATUS_SUCCESS, 0))
while ((status = nss_getgrgid_r (mygroups[i], &grpbuf,
tmpbuf, tmplen, errnop))
== NSS_STATUS_TRYAGAIN
&& *errnop == ERANGE)
if (tmpbuf == buffer)
{
tmplen *= 2;
tmpbuf = __alloca (tmplen);
}
else
tmpbuf = extend_alloca (tmpbuf, tmplen, 2 * tmplen);

if (__builtin_expect (status != NSS_STATUS_NOTFOUND, 1))
{
free (mygroups);
return status;
if (__builtin_expect (status != NSS_STATUS_SUCCESS, 0))
{
free (mygroups);
return status;
}

if (!in_blacklist (grpbuf.gr_name,
strlen (grpbuf.gr_name), ent)
&& check_and_add_group (user, group, start, size,
groupsp, limit, &grpbuf))
{
if (nss_setgrent != NULL)
{
nss_setgrent (1);
ent->need_endgrent = true;
}
ent->skip_initgroups_dyn = true;

goto iter;
}
}

if (!in_blacklist (grpbuf.gr_name,
strlen (grpbuf.gr_name), ent))
check_and_add_group (user, group, start, size, groupsp,
limit, &grpbuf);
}
}

Expand All @@ -327,17 +359,21 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,
}

/* If we come here, the NSS module does not support initgroups_dyn
and we have to step through the whole list ourself. */
or we were confronted with a split group. In these cases we have
to step through the whole list ourself. */
iter:
do
{
if ((status = nss_getgrent_r (&grpbuf, buffer, buflen, errnop)) !=
NSS_STATUS_SUCCESS)
return status;
break;
}
while (in_blacklist (grpbuf.gr_name, strlen (grpbuf.gr_name), ent));

check_and_add_group (user, group, start, size, groupsp, limit, &grpbuf);
return NSS_STATUS_SUCCESS;
if (status == NSS_STATUS_SUCCESS)
check_and_add_group (user, group, start, size, groupsp, limit, &grpbuf);

return status;
}

static enum nss_status
Expand Down Expand Up @@ -435,7 +471,21 @@ internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user,
/* +:... */
if (grpbuf.gr_name[0] == '+' && grpbuf.gr_name[1] == '\0')
{
ent->files = FALSE;
/* If the selected module does not support getgrent_r or
initgroups_dyn, abort. We cannot find the needed group
entries. */
if (nss_getgrent_r == NULL && nss_initgroups_dyn == NULL)
return NSS_STATUS_UNAVAIL;

ent->files = false;

if (nss_initgroups_dyn == NULL && nss_setgrent != NULL)
{
nss_setgrent (1);
ent->need_endgrent = true;
}
ent->skip_initgroups_dyn = true;

return getgrent_next_nss (ent, buffer, buflen, user, group,
start, size, groupsp, limit, errnop);
}
Expand All @@ -455,7 +505,7 @@ _nss_compat_initgroups_dyn (const char *user, gid_t group, long int *start,
size_t buflen = sysconf (_SC_GETPW_R_SIZE_MAX);
char *tmpbuf;
enum nss_status status;
ent_t intern = { TRUE, NULL, {NULL, 0, 0} };
ent_t intern = { true, false, false, NULL, {NULL, 0, 0} };

status = internal_setgrent (&intern);
if (status != NSS_STATUS_SUCCESS)
Expand Down

0 comments on commit ccab6d8

Please sign in to comment.