src/basic/user-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <grp.h>
   6 #include <pwd.h>
   7 #include <stddef.h>
   8 #include <stdint.h>
   9 #include <stdio.h>
  10 #include <stdlib.h>
  11 #include <sys/stat.h>
  12 #include <unistd.h>
  13 #include <utmp.h>
  14
  15 #include "alloc-util.h"
  16 #include "errno-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "format-util.h"
  20 #include "macro.h"
  21 #include "parse-util.h"
  22 #include "path-util.h"
  23 #include "random-util.h"
  24 #include "string-util.h"
  25 #include "strv.h"
  26 #include "user-util.h"
  27 #include "utf8.h"
  28
  29 bool uid_is_valid(uid_t uid) {
  30
  31         /* Also see POSIX IEEE Std 1003.1-2008, 2016 Edition, 3.436. */
  32
  33         /* Some libc APIs use UID_INVALID as special placeholder */
  34         if (uid == (uid_t) UINT32_C(0xFFFFFFFF))
  35                 return false;
  36
  37         /* A long time ago UIDs where 16bit, hence explicitly avoid the 16bit -1 too */
  38         if (uid == (uid_t) UINT32_C(0xFFFF))
  39                 return false;
  40
  41         return true;
  42 }
  43
  44 int parse_uid(const char *s, uid_t *ret) {
  45         uint32_t uid = 0;
  46         int r;
  47
  48         assert(s);
  49
  50         assert_cc(sizeof(uid_t) == sizeof(uint32_t));
  51         r = safe_atou32(s, &uid);
  52         if (r < 0)
  53                 return r;
  54
  55         if (!uid_is_valid(uid))
  56                 return -ENXIO; /* we return ENXIO instead of EINVAL
  57                                 * here, to make it easy to distinguish
  58                                 * invalid numeric uids from invalid
  59                                 * strings. */
  60
  61         if (ret)
  62                 *ret = uid;
  63
  64         return 0;
  65 }
  66
  67 char* getlogname_malloc(void) {
  68         uid_t uid;
  69         struct stat st;
  70
  71         if (isatty(STDIN_FILENO) && fstat(STDIN_FILENO, &st) >= 0)
  72                 uid = st.st_uid;
  73         else
  74                 uid = getuid();
  75
  76         return uid_to_name(uid);
  77 }
  78
  79 char *getusername_malloc(void) {
  80         const char *e;
  81
  82         e = secure_getenv("USER");
  83         if (e)
  84                 return strdup(e);
  85
  86         return uid_to_name(getuid());
  87 }
  88
  89 static bool is_nologin_shell(const char *shell) {
  90
  91         return PATH_IN_SET(shell,
  92                            /* 'nologin' is the friendliest way to disable logins for a user account. It prints a nice
  93                             * message and exits. Different distributions place the binary at different places though,
  94                             * hence let's list them all. */
  95                            "/bin/nologin",
  96                            "/sbin/nologin",
  97                            "/usr/bin/nologin",
  98                            "/usr/sbin/nologin",
  99                            /* 'true' and 'false' work too for the same purpose, but are less friendly as they don't do
 100                             * any message printing. Different distributions place the binary at various places but at
 101                             * least not in the 'sbin' directory. */
 102                            "/bin/false",
 103                            "/usr/bin/false",
 104                            "/bin/true",
 105                            "/usr/bin/true");
 106 }
 107
 108 static int synthesize_user_creds(
 109                 const char **username,
 110                 uid_t *uid, gid_t *gid,
 111                 const char **home,
 112                 const char **shell,
 113                 UserCredsFlags flags) {
 114
 115         /* We enforce some special rules for uid=0 and uid=65534: in order to avoid NSS lookups for root we hardcode
 116          * their user record data. */
 117
 118         if (STR_IN_SET(*username, "root", "0")) {
 119                 *username = "root";
 120
 121                 if (uid)
 122                         *uid = 0;
 123                 if (gid)
 124                         *gid = 0;
 125
 126                 if (home)
 127                         *home = "/root";
 128
 129                 if (shell)
 130                         *shell = "/bin/sh";
 131
 132                 return 0;
 133         }
 134
 135         if (synthesize_nobody() &&
 136             STR_IN_SET(*username, NOBODY_USER_NAME, "65534")) {
 137                 *username = NOBODY_USER_NAME;
 138
 139                 if (uid)
 140                         *uid = UID_NOBODY;
 141                 if (gid)
 142                         *gid = GID_NOBODY;
 143
 144                 if (home)
 145                         *home = FLAGS_SET(flags, USER_CREDS_CLEAN) ? NULL : "/";
 146
 147                 if (shell)
 148                         *shell = FLAGS_SET(flags, USER_CREDS_CLEAN) ? NULL : NOLOGIN;
 149
 150                 return 0;
 151         }
 152
 153         return -ENOMEDIUM;
 154 }
 155
 156 int get_user_creds(
 157                 const char **username,
 158                 uid_t *uid, gid_t *gid,
 159                 const char **home,
 160                 const char **shell,
 161                 UserCredsFlags flags) {
 162
 163         uid_t u = UID_INVALID;
 164         struct passwd *p;
 165         int r;
 166
 167         assert(username);
 168         assert(*username);
 169
 170         if (!FLAGS_SET(flags, USER_CREDS_PREFER_NSS) ||
 171             (!home && !shell)) {
 172
 173                 /* So here's the deal: normally, we'll try to synthesize all records we can synthesize, and override
 174                  * the user database with that. However, if the user specifies USER_CREDS_PREFER_NSS then the
 175                  * user database will override the synthetic records instead — except if the user is only interested in
 176                  * the UID and/or GID (but not the home directory, or the shell), in which case we'll always override
 177                  * the user database (i.e. the USER_CREDS_PREFER_NSS flag has no effect in this case). Why?
 178                  * Simply because there are valid usecase where the user might change the home directory or the shell
 179                  * of the relevant users, but changing the UID/GID mappings for them is something we explicitly don't
 180                  * support. */
 181
 182                 r = synthesize_user_creds(username, uid, gid, home, shell, flags);
 183                 if (r >= 0)
 184                         return 0;
 185                 if (r != -ENOMEDIUM) /* not a username we can synthesize */
 186                         return r;
 187         }
 188
 189         if (parse_uid(*username, &u) >= 0) {
 190                 errno = 0;
 191                 p = getpwuid(u);
 192
 193                 /* If there are multiple users with the same id, make sure to leave $USER to the configured value
 194                  * instead of the first occurrence in the database. However if the uid was configured by a numeric uid,
 195                  * then let's pick the real username from /etc/passwd. */
 196                 if (p)
 197                         *username = p->pw_name;
 198                 else if (FLAGS_SET(flags, USER_CREDS_ALLOW_MISSING) && !gid && !home && !shell) {
 199
 200                         /* If the specified user is a numeric UID and it isn't in the user database, and the caller
 201                          * passed USER_CREDS_ALLOW_MISSING and was only interested in the UID, then juts return that
 202                          * and don't complain. */
 203
 204                         if (uid)
 205                                 *uid = u;
 206
 207                         return 0;
 208                 }
 209         } else {
 210                 errno = 0;
 211                 p = getpwnam(*username);
 212         }
 213         if (!p) {
 214                 r = errno_or_else(ESRCH);
 215
 216                 /* If the user requested that we only synthesize as fallback, do so now */
 217                 if (FLAGS_SET(flags, USER_CREDS_PREFER_NSS)) {
 218                         if (synthesize_user_creds(username, uid, gid, home, shell, flags) >= 0)
 219                                 return 0;
 220                 }
 221
 222                 return r;
 223         }
 224
 225         if (uid) {
 226                 if (!uid_is_valid(p->pw_uid))
 227                         return -EBADMSG;
 228
 229                 *uid = p->pw_uid;
 230         }
 231
 232         if (gid) {
 233                 if (!gid_is_valid(p->pw_gid))
 234                         return -EBADMSG;
 235
 236                 *gid = p->pw_gid;
 237         }
 238
 239         if (home) {
 240                 if (FLAGS_SET(flags, USER_CREDS_CLEAN) &&
 241                     (empty_or_root(p->pw_dir) ||
 242                      !path_is_valid(p->pw_dir) ||
 243                      !path_is_absolute(p->pw_dir)))
 244                     *home = NULL; /* Note: we don't insist on normalized paths, since there are setups that have /./ in the path */
 245                 else
 246                         *home = p->pw_dir;
 247         }
 248
 249         if (shell) {
 250                 if (FLAGS_SET(flags, USER_CREDS_CLEAN) &&
 251                     (isempty(p->pw_shell) ||
 252                      !path_is_valid(p->pw_dir) ||
 253                      !path_is_absolute(p->pw_shell) ||
 254                      is_nologin_shell(p->pw_shell)))
 255                         *shell = NULL;
 256                 else
 257                         *shell = p->pw_shell;
 258         }
 259
 260         return 0;
 261 }
 262
 263 int get_group_creds(const char **groupname, gid_t *gid, UserCredsFlags flags) {
 264         struct group *g;
 265         gid_t id;
 266
 267         assert(groupname);
 268
 269         /* We enforce some special rules for gid=0: in order to avoid NSS lookups for root we hardcode its data. */
 270
 271         if (STR_IN_SET(*groupname, "root", "0")) {
 272                 *groupname = "root";
 273
 274                 if (gid)
 275                         *gid = 0;
 276
 277                 return 0;
 278         }
 279
 280         if (synthesize_nobody() &&
 281             STR_IN_SET(*groupname, NOBODY_GROUP_NAME, "65534")) {
 282                 *groupname = NOBODY_GROUP_NAME;
 283
 284                 if (gid)
 285                         *gid = GID_NOBODY;
 286
 287                 return 0;
 288         }
 289
 290         if (parse_gid(*groupname, &id) >= 0) {
 291                 errno = 0;
 292                 g = getgrgid(id);
 293
 294                 if (g)
 295                         *groupname = g->gr_name;
 296                 else if (FLAGS_SET(flags, USER_CREDS_ALLOW_MISSING)) {
 297                         if (gid)
 298                                 *gid = id;
 299
 300                         return 0;
 301                 }
 302         } else {
 303                 errno = 0;
 304                 g = getgrnam(*groupname);
 305         }
 306
 307         if (!g)
 308                 return errno_or_else(ESRCH);
 309
 310         if (gid) {
 311                 if (!gid_is_valid(g->gr_gid))
 312                         return -EBADMSG;
 313
 314                 *gid = g->gr_gid;
 315         }
 316
 317         return 0;
 318 }
 319
 320 char* uid_to_name(uid_t uid) {
 321         char *ret;
 322         int r;
 323
 324         /* Shortcut things to avoid NSS lookups */
 325         if (uid == 0)
 326                 return strdup("root");
 327         if (synthesize_nobody() &&
 328             uid == UID_NOBODY)
 329                 return strdup(NOBODY_USER_NAME);
 330
 331         if (uid_is_valid(uid)) {
 332                 long bufsize;
 333
 334                 bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
 335                 if (bufsize <= 0)
 336                         bufsize = 4096;
 337
 338                 for (;;) {
 339                         struct passwd pwbuf, *pw = NULL;
 340                         _cleanup_free_ char *buf = NULL;
 341
 342                         buf = malloc(bufsize);
 343                         if (!buf)
 344                                 return NULL;
 345
 346                         r = getpwuid_r(uid, &pwbuf, buf, (size_t) bufsize, &pw);
 347                         if (r == 0 && pw)
 348                                 return strdup(pw->pw_name);
 349                         if (r != ERANGE)
 350                                 break;
 351
 352                         if (bufsize > LONG_MAX/2) /* overflow check */
 353                                 return NULL;
 354
 355                         bufsize *= 2;
 356                 }
 357         }
 358
 359         if (asprintf(&ret, UID_FMT, uid) < 0)
 360                 return NULL;
 361
 362         return ret;
 363 }
 364
 365 char* gid_to_name(gid_t gid) {
 366         char *ret;
 367         int r;
 368
 369         if (gid == 0)
 370                 return strdup("root");
 371         if (synthesize_nobody() &&
 372             gid == GID_NOBODY)
 373                 return strdup(NOBODY_GROUP_NAME);
 374
 375         if (gid_is_valid(gid)) {
 376                 long bufsize;
 377
 378                 bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
 379                 if (bufsize <= 0)
 380                         bufsize = 4096;
 381
 382                 for (;;) {
 383                         struct group grbuf, *gr = NULL;
 384                         _cleanup_free_ char *buf = NULL;
 385
 386                         buf = malloc(bufsize);
 387                         if (!buf)
 388                                 return NULL;
 389
 390                         r = getgrgid_r(gid, &grbuf, buf, (size_t) bufsize, &gr);
 391                         if (r == 0 && gr)
 392                                 return strdup(gr->gr_name);
 393                         if (r != ERANGE)
 394                                 break;
 395
 396                         if (bufsize > LONG_MAX/2) /* overflow check */
 397                                 return NULL;
 398
 399                         bufsize *= 2;
 400                 }
 401         }
 402
 403         if (asprintf(&ret, GID_FMT, gid) < 0)
 404                 return NULL;
 405
 406         return ret;
 407 }
 408
 409 int in_gid(gid_t gid) {
 410         _cleanup_free_ gid_t *allocated = NULL;
 411         gid_t local[16], *p = local;
 412         int ngroups = ELEMENTSOF(local);
 413         unsigned attempt = 0;
 414
 415         if (getgid() == gid)
 416                 return 1;
 417
 418         if (getegid() == gid)
 419                 return 1;
 420
 421         if (!gid_is_valid(gid))
 422                 return -EINVAL;
 423
 424         for (;;) {
 425                 ngroups = getgroups(ngroups, p);
 426                 if (ngroups >= 0)
 427                         break;
 428                 if (errno != EINVAL)
 429                         return -errno;
 430
 431                 /* Give up eventually */
 432                 if (attempt++ > 10)
 433                         return -EINVAL;
 434
 435                 /* Get actual size needed, and size the array explicitly. Note that this is potentially racy
 436                  * to use (in multi-threaded programs), hence let's call this in a loop. */
 437                 ngroups = getgroups(0, NULL);
 438                 if (ngroups < 0)
 439                         return -errno;
 440                 if (ngroups == 0)
 441                         return false;
 442
 443                 free(allocated);
 444
 445                 allocated = new(gid_t, ngroups);
 446                 if (!allocated)
 447                         return -ENOMEM;
 448
 449                 p = allocated;
 450         }
 451
 452         for (int i = 0; i < ngroups; i++)
 453                 if (p[i] == gid)
 454                         return true;
 455
 456         return false;
 457 }
 458
 459 int in_group(const char *name) {
 460         int r;
 461         gid_t gid;
 462
 463         r = get_group_creds(&name, &gid, 0);
 464         if (r < 0)
 465                 return r;
 466
 467         return in_gid(gid);
 468 }
 469
 470 int get_home_dir(char **_h) {
 471         struct passwd *p;
 472         const char *e;
 473         char *h;
 474         uid_t u;
 475
 476         assert(_h);
 477
 478         /* Take the user specified one */
 479         e = secure_getenv("HOME");
 480         if (e && path_is_valid(e) && path_is_absolute(e)) {
 481                 h = strdup(e);
 482                 if (!h)
 483                         return -ENOMEM;
 484
 485                 *_h = path_simplify(h, true);
 486                 return 0;
 487         }
 488
 489         /* Hardcode home directory for root and nobody to avoid NSS */
 490         u = getuid();
 491         if (u == 0) {
 492                 h = strdup("/root");
 493                 if (!h)
 494                         return -ENOMEM;
 495
 496                 *_h = h;
 497                 return 0;
 498         }
 499         if (synthesize_nobody() &&
 500             u == UID_NOBODY) {
 501                 h = strdup("/");
 502                 if (!h)
 503                         return -ENOMEM;
 504
 505                 *_h = h;
 506                 return 0;
 507         }
 508
 509         /* Check the database... */
 510         errno = 0;
 511         p = getpwuid(u);
 512         if (!p)
 513                 return errno_or_else(ESRCH);
 514
 515         if (!path_is_valid(p->pw_dir) ||
 516             !path_is_absolute(p->pw_dir))
 517                 return -EINVAL;
 518
 519         h = strdup(p->pw_dir);
 520         if (!h)
 521                 return -ENOMEM;
 522
 523         *_h = path_simplify(h, true);
 524         return 0;
 525 }
 526
 527 int get_shell(char **_s) {
 528         struct passwd *p;
 529         const char *e;
 530         char *s;
 531         uid_t u;
 532
 533         assert(_s);
 534
 535         /* Take the user specified one */
 536         e = secure_getenv("SHELL");
 537         if (e && path_is_valid(e) && path_is_absolute(e)) {
 538                 s = strdup(e);
 539                 if (!s)
 540                         return -ENOMEM;
 541
 542                 *_s = path_simplify(s, true);
 543                 return 0;
 544         }
 545
 546         /* Hardcode shell for root and nobody to avoid NSS */
 547         u = getuid();
 548         if (u == 0) {
 549                 s = strdup("/bin/sh");
 550                 if (!s)
 551                         return -ENOMEM;
 552
 553                 *_s = s;
 554                 return 0;
 555         }
 556         if (synthesize_nobody() &&
 557             u == UID_NOBODY) {
 558                 s = strdup(NOLOGIN);
 559                 if (!s)
 560                         return -ENOMEM;
 561
 562                 *_s = s;
 563                 return 0;
 564         }
 565
 566         /* Check the database... */
 567         errno = 0;
 568         p = getpwuid(u);
 569         if (!p)
 570                 return errno_or_else(ESRCH);
 571
 572         if (!path_is_valid(p->pw_shell) ||
 573             !path_is_absolute(p->pw_shell))
 574                 return -EINVAL;
 575
 576         s = strdup(p->pw_shell);
 577         if (!s)
 578                 return -ENOMEM;
 579
 580         *_s = path_simplify(s, true);
 581         return 0;
 582 }
 583
 584 int reset_uid_gid(void) {
 585         int r;
 586
 587         r = maybe_setgroups(0, NULL);
 588         if (r < 0)
 589                 return r;
 590
 591         if (setresgid(0, 0, 0) < 0)
 592                 return -errno;
 593
 594         if (setresuid(0, 0, 0) < 0)
 595                 return -errno;
 596
 597         return 0;
 598 }
 599
 600 int take_etc_passwd_lock(const char *root) {
 601
 602         struct flock flock = {
 603                 .l_type = F_WRLCK,
 604                 .l_whence = SEEK_SET,
 605                 .l_start = 0,
 606                 .l_len = 0,
 607         };
 608
 609         const char *path;
 610         int fd, r;
 611
 612         /* This is roughly the same as lckpwdf(), but not as awful. We
 613          * don't want to use alarm() and signals, hence we implement
 614          * our own trivial version of this.
 615          *
 616          * Note that shadow-utils also takes per-database locks in
 617          * addition to lckpwdf(). However, we don't given that they
 618          * are redundant as they invoke lckpwdf() first and keep
 619          * it during everything they do. The per-database locks are
 620          * awfully racy, and thus we just won't do them. */
 621
 622         if (root)
 623                 path = prefix_roota(root, ETC_PASSWD_LOCK_PATH);
 624         else
 625                 path = ETC_PASSWD_LOCK_PATH;
 626
 627         fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
 628         if (fd < 0)
 629                 return log_debug_errno(errno, "Cannot open %s: %m", path);
 630
 631         r = fcntl(fd, F_SETLKW, &flock);
 632         if (r < 0) {
 633                 safe_close(fd);
 634                 return log_debug_errno(errno, "Locking %s failed: %m", path);
 635         }
 636
 637         return fd;
 638 }
 639
 640 bool valid_user_group_name_full(const char *u, bool strict) {
 641         const char *i;
 642         long sz;
 643
 644         /* Checks if the specified name is a valid user/group name. Also see POSIX IEEE Std 1003.1-2008, 2016 Edition,
 645          * 3.437. We are a bit stricter here however. Specifically we deviate from POSIX rules:
 646          *
 647          * - We require that names fit into the appropriate utmp field
 648          * - We don't allow empty user names
 649          * - No dots or digits in the first character
 650          *
 651          * If strict==true, additionally:
 652          * - We don't allow any dots (this conflicts with chown syntax which permits dots as user/group name separator)
 653          *
 654          * Note that other systems are even more restrictive, and don't permit underscores or uppercase characters.
 655          */
 656
 657         if (isempty(u))
 658                 return false;
 659
 660         if (!(u[0] >= 'a' && u[0] <= 'z') &&
 661             !(u[0] >= 'A' && u[0] <= 'Z') &&
 662             u[0] != '_')
 663                 return false;
 664
 665         bool warned = false;
 666
 667         for (i = u+1; *i; i++) {
 668                 if (((*i >= 'a' && *i <= 'z') ||
 669                      (*i >= 'A' && *i <= 'Z') ||
 670                      (*i >= '0' && *i <= '9') ||
 671                      IN_SET(*i, '_', '-')))
 672                         continue;
 673
 674                 if (*i == '.' && !strict) {
 675                         if (!warned) {
 676                                 log_warning("Bad user or group name \"%s\", accepting for compatibility.", u);
 677                                 warned = true;
 678                         }
 679
 680                         continue;
 681                 }
 682
 683                 return false;
 684         }
 685
 686         sz = sysconf(_SC_LOGIN_NAME_MAX);
 687         assert_se(sz > 0);
 688
 689         if ((size_t) (i-u) > (size_t) sz)
 690                 return false;
 691
 692         if ((size_t) (i-u) > UT_NAMESIZE - 1)
 693                 return false;
 694
 695         return true;
 696 }
 697
 698 bool valid_user_group_name_or_id_full(const char *u, bool strict) {
 699
 700         /* Similar as above, but is also fine with numeric UID/GID specifications, as long as they are in the
 701          * right range, and not the invalid user ids. */
 702
 703         if (isempty(u))
 704                 return false;
 705
 706         if (valid_user_group_name_full(u, strict))
 707                 return true;
 708
 709         return parse_uid(u, NULL) >= 0;
 710 }
 711
 712 bool valid_gecos(const char *d) {
 713
 714         if (!d)
 715                 return false;
 716
 717         if (!utf8_is_valid(d))
 718                 return false;
 719
 720         if (string_has_cc(d, NULL))
 721                 return false;
 722
 723         /* Colons are used as field separators, and hence not OK */
 724         if (strchr(d, ':'))
 725                 return false;
 726
 727         return true;
 728 }
 729
 730 bool valid_home(const char *p) {
 731         /* Note that this function is also called by valid_shell(), any
 732          * changes must account for that. */
 733
 734         if (isempty(p))
 735                 return false;
 736
 737         if (!utf8_is_valid(p))
 738                 return false;
 739
 740         if (string_has_cc(p, NULL))
 741                 return false;
 742
 743         if (!path_is_absolute(p))
 744                 return false;
 745
 746         if (!path_is_normalized(p))
 747                 return false;
 748
 749         /* Colons are used as field separators, and hence not OK */
 750         if (strchr(p, ':'))
 751                 return false;
 752
 753         return true;
 754 }
 755
 756 int maybe_setgroups(size_t size, const gid_t *list) {
 757         int r;
 758
 759         /* Check if setgroups is allowed before we try to drop all the auxiliary groups */
 760         if (size == 0) { /* Dropping all aux groups? */
 761                 _cleanup_free_ char *setgroups_content = NULL;
 762                 bool can_setgroups;
 763
 764                 r = read_one_line_file("/proc/self/setgroups", &setgroups_content);
 765                 if (r == -ENOENT)
 766                         /* Old kernels don't have /proc/self/setgroups, so assume we can use setgroups */
 767                         can_setgroups = true;
 768                 else if (r < 0)
 769                         return r;
 770                 else
 771                         can_setgroups = streq(setgroups_content, "allow");
 772
 773                 if (!can_setgroups) {
 774                         log_debug("Skipping setgroups(), /proc/self/setgroups is set to 'deny'");
 775                         return 0;
 776                 }
 777         }
 778
 779         if (setgroups(size, list) < 0)
 780                 return -errno;
 781
 782         return 0;
 783 }
 784
 785 bool synthesize_nobody(void) {
 786         /* Returns true when we shall synthesize the "nobody" user (which we do by default). This can be turned off by
 787          * touching /etc/systemd/dont-synthesize-nobody in order to provide upgrade compatibility with legacy systems
 788          * that used the "nobody" user name and group name for other UIDs/GIDs than 65534.
 789          *
 790          * Note that we do not employ any kind of synchronization on the following caching variable. If the variable is
 791          * accessed in multi-threaded programs in the worst case it might happen that we initialize twice, but that
 792          * shouldn't matter as each initialization should come to the same result. */
 793         static int cache = -1;
 794
 795         if (cache < 0)
 796                 cache = access("/etc/systemd/dont-synthesize-nobody", F_OK) < 0;
 797
 798         return cache;
 799 }
 800
 801 int putpwent_sane(const struct passwd *pw, FILE *stream) {
 802         assert(pw);
 803         assert(stream);
 804
 805         errno = 0;
 806         if (putpwent(pw, stream) != 0)
 807                 return errno_or_else(EIO);
 808
 809         return 0;
 810 }
 811
 812 int putspent_sane(const struct spwd *sp, FILE *stream) {
 813         assert(sp);
 814         assert(stream);
 815
 816         errno = 0;
 817         if (putspent(sp, stream) != 0)
 818                 return errno_or_else(EIO);
 819
 820         return 0;
 821 }
 822
 823 int putgrent_sane(const struct group *gr, FILE *stream) {
 824         assert(gr);
 825         assert(stream);
 826
 827         errno = 0;
 828         if (putgrent(gr, stream) != 0)
 829                 return errno_or_else(EIO);
 830
 831         return 0;
 832 }
 833
 834 #if ENABLE_GSHADOW
 835 int putsgent_sane(const struct sgrp *sg, FILE *stream) {
 836         assert(sg);
 837         assert(stream);
 838
 839         errno = 0;
 840         if (putsgent(sg, stream) != 0)
 841                 return errno_or_else(EIO);
 842
 843         return 0;
 844 }
 845 #endif
 846
 847 int fgetpwent_sane(FILE *stream, struct passwd **pw) {
 848         struct passwd *p;
 849
 850         assert(pw);
 851         assert(stream);
 852
 853         errno = 0;
 854         p = fgetpwent(stream);
 855         if (!p && errno != ENOENT)
 856                 return errno_or_else(EIO);
 857
 858         *pw = p;
 859         return !!p;
 860 }
 861
 862 int fgetspent_sane(FILE *stream, struct spwd **sp) {
 863         struct spwd *s;
 864
 865         assert(sp);
 866         assert(stream);
 867
 868         errno = 0;
 869         s = fgetspent(stream);
 870         if (!s && errno != ENOENT)
 871                 return errno_or_else(EIO);
 872
 873         *sp = s;
 874         return !!s;
 875 }
 876
 877 int fgetgrent_sane(FILE *stream, struct group **gr) {
 878         struct group *g;
 879
 880         assert(gr);
 881         assert(stream);
 882
 883         errno = 0;
 884         g = fgetgrent(stream);
 885         if (!g && errno != ENOENT)
 886                 return errno_or_else(EIO);
 887
 888         *gr = g;
 889         return !!g;
 890 }
 891
 892 #if ENABLE_GSHADOW
 893 int fgetsgent_sane(FILE *stream, struct sgrp **sg) {
 894         struct sgrp *s;
 895
 896         assert(sg);
 897         assert(stream);
 898
 899         errno = 0;
 900         s = fgetsgent(stream);
 901         if (!s && errno != ENOENT)
 902                 return errno_or_else(EIO);
 903
 904         *sg = s;
 905         return !!s;
 906 }
 907 #endif
 908
 909 int make_salt(char **ret) {
 910         static const char table[] =
 911                 "abcdefghijklmnopqrstuvwxyz"
 912                 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 913                 "0123456789"
 914                 "./";
 915
 916         uint8_t raw[16];
 917         char *salt, *j;
 918         size_t i;
 919         int r;
 920
 921         /* This is a bit like crypt_gensalt_ra(), but doesn't require libcrypt, and doesn't do anything but
 922          * SHA512, i.e. is legacy-free and minimizes our deps. */
 923
 924         assert_cc(sizeof(table) == 64U + 1U);
 925
 926         /* Insist on the best randomness by setting RANDOM_BLOCK, this is about keeping passwords secret after all. */
 927         r = genuine_random_bytes(raw, sizeof(raw), RANDOM_BLOCK);
 928         if (r < 0)
 929                 return r;
 930
 931         salt = new(char, 3+sizeof(raw)+1+1);
 932         if (!salt)
 933                 return -ENOMEM;
 934
 935         /* We only bother with SHA512 hashed passwords, the rest is legacy, and we don't do legacy. */
 936         j = stpcpy(salt, "$6$");
 937         for (i = 0; i < sizeof(raw); i++)
 938                 j[i] = table[raw[i] & 63];
 939         j[i++] = '$';
 940         j[i] = 0;
 941
 942         *ret = salt;
 943         return 0;
 944 }