Note that the name that is resolved is the one registered with <command>systemd-machined</command>, which
may be different than the hostname configured inside of the container.</para>
- <para>The module also provides name resolution for user and group identifiers mapped to containers. All names from
- the range allocated to a given container <replaceable>container</replaceable> are exposed on the host as
- <literal>vu-<replaceable>container</replaceable>-<replaceable>uid</replaceable></literal> and
- <literal>vg-<replaceable>container</replaceable>-<replaceable>gid</replaceable></literal> (see example below). This
- functionality only applies to containers using user namespacing (see the description of
- <option>--private-users</option> in
- <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
-
- <para>To activate the NSS module, add <literal>mymachines</literal> to the lines starting with
- <literal>hosts:</literal>, <literal>passwd:</literal> and <literal>group:</literal> in
- <filename>/etc/nsswitch.conf</filename>.</para>
+ <para>To activate the NSS module, add <literal>mymachines</literal> to the line starting with
+ <literal>hosts:</literal> in <filename>/etc/nsswitch.conf</filename>.</para>
<para>It is recommended to place <literal>mymachines</literal> after the <literal>files</literal> or
- <literal>compat</literal> entry of the <filename>/etc/nsswitch.conf</filename> lines to make sure that its mappings
- are preferred over other resolvers such as DNS, but so that <filename>/etc/hosts</filename>,
- <filename>/etc/passwd</filename> and <filename>/etc/group</filename> based mappings take precedence.</para>
+ <literal>compat</literal> entry of the <filename>/etc/nsswitch.conf</filename> line to make sure that its
+ mappings are preferred over other resolvers such as DNS, but so that <filename>/etc/hosts</filename>
+ based mappings take precedence.</para>
</refsect1>
<refsect1>
<command>nss-mymachines</command> correctly:</para>
<!-- synchronize with other nss-* man pages and factory/etc/nsswitch.conf -->
- <programlisting>passwd: compat <command>mymachines</command> systemd
-group: compat <command>mymachines</command> systemd
+ <programlisting>passwd: compat systemd
+group: compat systemd
shadow: compat
hosts: <command>mymachines</command> resolve [!UNAVAIL=return] myhostname files dns
</refsect1>
<refsect1>
- <title>Mappings provided by <filename>nss-mymachines</filename></title>
+ <title>Example: Mappings provided by <filename>nss-mymachines</filename></title>
<para>The container <literal>rawhide</literal> is spawned using
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>:
MACHINE CLASS SERVICE OS VERSION ADDRESSES
rawhide container systemd-nspawn fedora 30 169.254.40.164 fe80::94aa:3aff:fe7b:d4b9
-$ getent passwd vu-rawhide-0 vu-rawhide-81
-vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin
-vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin
-
-$ getent group vg-rawhide-0 vg-rawhide-81
-vg-rawhide-0:*:20119552:
-vg-rawhide-81:*:20119633:
-
-$ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide'
-vu-rawhide-0 692 ? /usr/lib/systemd/systemd
-vu-rawhide-0 731 ? /usr/lib/systemd/systemd-journald
-vu-rawhide-192 734 ? /usr/lib/systemd/systemd-networkd
-vu-rawhide-193 738 ? /usr/lib/systemd/systemd-resolved
-vu-rawhide-0 742 ? /usr/lib/systemd/systemd-logind
-vu-rawhide-81 744 ? /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
-vu-rawhide-0 746 ? /usr/sbin/sshd -D ...
-vu-rawhide-0 752 ? /usr/lib/systemd/systemd --user
-vu-rawhide-0 753 ? (sd-pam)
-vu-rawhide-0 1628 ? login -- zbyszek
-vu-rawhide-1000 1630 ? /usr/lib/systemd/systemd --user
-vu-rawhide-1000 1631 ? (sd-pam)
-vu-rawhide-1000 1637 pts/8 -zsh
-
$ ping -c1 rawhide
PING rawhide(fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide)) 56 data bytes
64 bytes from fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide): icmp_seq=1 ttl=64 time=0.045 ms
#include "nss-util.h"
#include "signal-util.h"
#include "string-util.h"
-#include "user-util.h"
NSS_GETHOSTBYNAME_PROTOTYPES(mymachines);
NSS_GETPW_PROTOTYPES(mymachines);
NSS_GETGR_PROTOTYPES(mymachines);
-#define HOST_UID_LIMIT ((uid_t) UINT32_C(0x10000))
-#define HOST_GID_LIMIT ((gid_t) UINT32_C(0x10000))
-
static int count_addresses(sd_bus_message *m, int af, unsigned *ret) {
unsigned c = 0;
int r;
char *buffer, size_t buflen,
int *errnop) {
- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
- _cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
- _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
- const char *p, *e, *machine;
- uint32_t mapped;
- uid_t uid;
- size_t l;
- int r;
-
- PROTECT_ERRNO;
- BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
-
- assert(name);
- assert(pwd);
-
- p = startswith(name, "vu-");
- if (!p)
- return NSS_STATUS_NOTFOUND;
-
- e = strrchr(p, '-');
- if (!e || e == p)
- return NSS_STATUS_NOTFOUND;
-
- if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
- return NSS_STATUS_NOTFOUND;
-
- r = parse_uid(e + 1, &uid);
- if (r < 0)
- return NSS_STATUS_NOTFOUND;
-
- machine = strndupa(p, e - p);
- if (!machine_name_is_valid(machine))
- return NSS_STATUS_NOTFOUND;
-
- if (getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS") > 0)
- /* Make sure we can't deadlock if we are invoked by dbus-daemon. This way, it won't be able to resolve
- * these UIDs, but that should be unproblematic as containers should never be able to connect to a bus
- * running on the host. */
- return NSS_STATUS_NOTFOUND;
-
- if (avoid_deadlock()) {
- r = -EDEADLK;
- goto fail;
- }
-
- r = sd_bus_open_system(&bus);
- if (r < 0)
- goto fail;
-
- r = bus_call_method(bus, bus_machine_mgr, "MapFromMachineUser", &error, &reply, "su", machine, (uint32_t) uid);
- if (r < 0) {
- if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_USER_MAPPING))
- return NSS_STATUS_NOTFOUND;
-
- goto fail;
- }
-
- r = sd_bus_message_read(reply, "u", &mapped);
- if (r < 0)
- goto fail;
-
- /* Refuse to work if the mapped address is in the host UID range, or if there was no mapping at all. */
- if (mapped < HOST_UID_LIMIT || mapped == uid)
- return NSS_STATUS_NOTFOUND;
-
- l = strlen(name);
- if (buflen < l+1) {
- UNPROTECT_ERRNO;
- *errnop = ERANGE;
- return NSS_STATUS_TRYAGAIN;
- }
-
- memcpy(buffer, name, l+1);
-
- pwd->pw_name = buffer;
- pwd->pw_uid = mapped;
- pwd->pw_gid = GID_NOBODY;
- pwd->pw_gecos = buffer;
- pwd->pw_passwd = (char*) "*"; /* locked */
- pwd->pw_dir = (char*) "/";
- pwd->pw_shell = (char*) NOLOGIN;
-
- return NSS_STATUS_SUCCESS;
-
-fail:
- UNPROTECT_ERRNO;
- *errnop = -r;
- return NSS_STATUS_UNAVAIL;
+ return NSS_STATUS_NOTFOUND;
}
enum nss_status _nss_mymachines_getpwuid_r(
char *buffer, size_t buflen,
int *errnop) {
- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
- _cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
- _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
- const char *machine;
- uint32_t mapped;
- int r;
-
- PROTECT_ERRNO;
- BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
-
- if (!uid_is_valid(uid))
- return NSS_STATUS_NOTFOUND;
-
- /* We consider all uids < 65536 host uids */
- if (uid < HOST_UID_LIMIT)
- return NSS_STATUS_NOTFOUND;
-
- if (getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS") > 0)
- return NSS_STATUS_NOTFOUND;
-
- if (avoid_deadlock()) {
- r = -EDEADLK;
- goto fail;
- }
-
- r = sd_bus_open_system(&bus);
- if (r < 0)
- goto fail;
-
- r = bus_call_method(bus, bus_machine_mgr, "MapToMachineUser", &error, &reply, "u", (uint32_t) uid);
- if (r < 0) {
- if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_USER_MAPPING))
- return NSS_STATUS_NOTFOUND;
-
- goto fail;
- }
-
- r = sd_bus_message_read(reply, "sou", &machine, NULL, &mapped);
- if (r < 0)
- goto fail;
-
- if (mapped == uid)
- return NSS_STATUS_NOTFOUND;
-
- if (snprintf(buffer, buflen, "vu-%s-" UID_FMT, machine, (uid_t) mapped) >= (int) buflen) {
- UNPROTECT_ERRNO;
- *errnop = ERANGE;
- return NSS_STATUS_TRYAGAIN;
- }
-
- pwd->pw_name = buffer;
- pwd->pw_uid = uid;
- pwd->pw_gid = GID_NOBODY;
- pwd->pw_gecos = buffer;
- pwd->pw_passwd = (char*) "*"; /* locked */
- pwd->pw_dir = (char*) "/";
- pwd->pw_shell = (char*) NOLOGIN;
-
- return NSS_STATUS_SUCCESS;
-
-fail:
- UNPROTECT_ERRNO;
- *errnop = -r;
- return NSS_STATUS_UNAVAIL;
+ return NSS_STATUS_NOTFOUND;
}
-#pragma GCC diagnostic ignored "-Wsizeof-pointer-memaccess"
-
enum nss_status _nss_mymachines_getgrnam_r(
const char *name,
struct group *gr,
char *buffer, size_t buflen,
int *errnop) {
- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
- _cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
- _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
- const char *p, *e, *machine;
- uint32_t mapped;
- uid_t gid;
- size_t l;
- int r;
-
- PROTECT_ERRNO;
- BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
-
- assert(name);
- assert(gr);
-
- p = startswith(name, "vg-");
- if (!p)
- return NSS_STATUS_NOTFOUND;
-
- e = strrchr(p, '-');
- if (!e || e == p)
- return NSS_STATUS_NOTFOUND;
-
- if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
- return NSS_STATUS_NOTFOUND;
-
- r = parse_gid(e + 1, &gid);
- if (r < 0)
- return NSS_STATUS_NOTFOUND;
-
- machine = strndupa(p, e - p);
- if (!machine_name_is_valid(machine))
- return NSS_STATUS_NOTFOUND;
-
- if (getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS") > 0)
- return NSS_STATUS_NOTFOUND;
-
- if (avoid_deadlock()) {
- r = -EDEADLK;
- goto fail;
- }
-
- r = sd_bus_open_system(&bus);
- if (r < 0)
- goto fail;
-
- r = bus_call_method(bus, bus_machine_mgr, "MapFromMachineGroup", &error, &reply, "su", machine, (uint32_t) gid);
- if (r < 0) {
- if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_GROUP_MAPPING))
- return NSS_STATUS_NOTFOUND;
-
- goto fail;
- }
-
- r = sd_bus_message_read(reply, "u", &mapped);
- if (r < 0)
- goto fail;
-
- if (mapped < HOST_GID_LIMIT || mapped == gid)
- return NSS_STATUS_NOTFOUND;
-
- l = sizeof(char*) + strlen(name) + 1;
- if (buflen < l) {
- UNPROTECT_ERRNO;
- *errnop = ERANGE;
- return NSS_STATUS_TRYAGAIN;
- }
-
- memzero(buffer, sizeof(char*));
- strcpy(buffer + sizeof(char*), name);
-
- gr->gr_name = buffer + sizeof(char*);
- gr->gr_gid = mapped;
- gr->gr_passwd = (char*) "*"; /* locked */
- gr->gr_mem = (char**) buffer;
-
- return NSS_STATUS_SUCCESS;
-
-fail:
- UNPROTECT_ERRNO;
- *errnop = -r;
- return NSS_STATUS_UNAVAIL;
+ return NSS_STATUS_NOTFOUND;
}
enum nss_status _nss_mymachines_getgrgid_r(
char *buffer, size_t buflen,
int *errnop) {
- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
- _cleanup_(sd_bus_message_unrefp) sd_bus_message* reply = NULL;
- _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
- const char *machine;
- uint32_t mapped;
- int r;
-
- PROTECT_ERRNO;
- BLOCK_SIGNALS(NSS_SIGNALS_BLOCK);
-
- if (!gid_is_valid(gid))
- return NSS_STATUS_NOTFOUND;
-
- /* We consider all gids < 65536 host gids */
- if (gid < HOST_GID_LIMIT)
- return NSS_STATUS_NOTFOUND;
-
- if (getenv_bool_secure("SYSTEMD_NSS_BYPASS_BUS") > 0)
- return NSS_STATUS_NOTFOUND;
-
- if (avoid_deadlock()) {
- r = -EDEADLK;
- goto fail;
- }
-
- r = sd_bus_open_system(&bus);
- if (r < 0)
- goto fail;
-
- r = bus_call_method(bus, bus_machine_mgr, "MapToMachineGroup", &error, &reply, "u", (uint32_t) gid);
- if (r < 0) {
- if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_GROUP_MAPPING))
- return NSS_STATUS_NOTFOUND;
-
- goto fail;
- }
-
- r = sd_bus_message_read(reply, "sou", &machine, NULL, &mapped);
- if (r < 0)
- goto fail;
-
- if (mapped == gid)
- return NSS_STATUS_NOTFOUND;
-
- if (buflen < sizeof(char*) + 1) {
- UNPROTECT_ERRNO;
- *errnop = ERANGE;
- return NSS_STATUS_TRYAGAIN;
- }
-
- memzero(buffer, sizeof(char*));
- if (snprintf(buffer + sizeof(char*), buflen - sizeof(char*), "vg-%s-" GID_FMT, machine, (gid_t) mapped) >= (int) buflen) {
- UNPROTECT_ERRNO;
- *errnop = ERANGE;
- return NSS_STATUS_TRYAGAIN;
- }
-
- gr->gr_name = buffer + sizeof(char*);
- gr->gr_gid = gid;
- gr->gr_passwd = (char*) "*"; /* locked */
- gr->gr_mem = (char**) buffer;
-
- return NSS_STATUS_SUCCESS;
-
-fail:
- UNPROTECT_ERRNO;
- *errnop = -r;
- return NSS_STATUS_UNAVAIL;
+ return NSS_STATUS_NOTFOUND;
}
projects / thirdparty / systemd.git / commitdiff
