src/basic/user-util.h

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 #pragma once
   3
   4 #include <grp.h>
   5 #if ENABLE_GSHADOW
   6 #include <gshadow.h>
   7 #endif
   8 #include <pwd.h>
   9 #include <shadow.h>
  10 #include <stdbool.h>
  11 #include <stdint.h>
  12 #include <sys/types.h>
  13 #include <unistd.h>
  14
  15 bool uid_is_valid(uid_t uid);
  16
  17 static inline bool gid_is_valid(gid_t gid) {
  18         return uid_is_valid((uid_t) gid);
  19 }
  20
  21 int parse_uid(const char *s, uid_t* ret_uid);
  22 int parse_uid_range(const char *s, uid_t *ret_lower, uid_t *ret_upper);
  23
  24 static inline int parse_gid(const char *s, gid_t *ret_gid) {
  25         return parse_uid(s, (uid_t*) ret_gid);
  26 }
  27
  28 char* getlogname_malloc(void);
  29 char* getusername_malloc(void);
  30
  31 typedef enum UserCredsFlags {
  32         USER_CREDS_PREFER_NSS    = 1 << 0,  /* if set, only synthesize user records if database lacks them. Normally we bypass the userdb entirely for the records we can synthesize */
  33         USER_CREDS_ALLOW_MISSING = 1 << 1,  /* if a numeric UID string is resolved, be OK if there's no record for it */
  34         USER_CREDS_CLEAN         = 1 << 2,  /* try to clean up shell and home fields with invalid data */
  35 } UserCredsFlags;
  36
  37 int get_user_creds(const char **username, uid_t *uid, gid_t *gid, const char **home, const char **shell, UserCredsFlags flags);
  38 int get_group_creds(const char **groupname, gid_t *gid, UserCredsFlags flags);
  39
  40 char* uid_to_name(uid_t uid);
  41 char* gid_to_name(gid_t gid);
  42
  43 int in_gid(gid_t gid);
  44 int in_group(const char *name);
  45
  46 int merge_gid_lists(const gid_t *list1, size_t size1, const gid_t *list2, size_t size2, gid_t **result);
  47 int getgroups_alloc(gid_t** gids);
  48
  49 int get_home_dir(char **ret);
  50 int get_shell(char **_ret);
  51
  52 int reset_uid_gid(void);
  53
  54 int take_etc_passwd_lock(const char *root);
  55
  56 #define UID_INVALID ((uid_t) -1)
  57 #define GID_INVALID ((gid_t) -1)
  58
  59 #define UID_NOBODY ((uid_t) 65534U)
  60 #define GID_NOBODY ((gid_t) 65534U)
  61
  62 #define ETC_PASSWD_LOCK_PATH "/etc/.pwd.lock"
  63
  64 static inline bool uid_is_system(uid_t uid) {
  65         return uid <= SYSTEM_UID_MAX;
  66 }
  67
  68 static inline bool gid_is_system(gid_t gid) {
  69         return gid <= SYSTEM_GID_MAX;
  70 }
  71
  72 static inline bool uid_is_dynamic(uid_t uid) {
  73         return DYNAMIC_UID_MIN <= uid && uid <= DYNAMIC_UID_MAX;
  74 }
  75
  76 static inline bool gid_is_dynamic(gid_t gid) {
  77         return uid_is_dynamic((uid_t) gid);
  78 }
  79
  80 static inline bool uid_is_container(uid_t uid) {
  81         return CONTAINER_UID_BASE_MIN <= uid && uid <= CONTAINER_UID_BASE_MAX;
  82 }
  83
  84 static inline bool gid_is_container(gid_t gid) {
  85         return uid_is_container((uid_t) gid);
  86 }
  87
  88 /* The following macros add 1 when converting things, since UID 0 is a valid UID, while the pointer
  89  * NULL is special */
  90 #define PTR_TO_UID(p) ((uid_t) (((uintptr_t) (p))-1))
  91 #define UID_TO_PTR(u) ((void*) (((uintptr_t) (u))+1))
  92
  93 #define PTR_TO_GID(p) ((gid_t) (((uintptr_t) (p))-1))
  94 #define GID_TO_PTR(u) ((void*) (((uintptr_t) (u))+1))
  95
  96 static inline bool userns_supported(void) {
  97         return access("/proc/self/uid_map", F_OK) >= 0;
  98 }
  99
 100 bool valid_user_group_name_full(const char *u, bool strict);
 101 bool valid_user_group_name_or_id_full(const char *u, bool strict);
 102 static inline bool valid_user_group_name(const char *u) {
 103         return valid_user_group_name_full(u, true);
 104 }
 105 static inline bool valid_user_group_name_or_id(const char *u) {
 106         return valid_user_group_name_or_id_full(u, true);
 107 }
 108 static inline bool valid_user_group_name_compat(const char *u) {
 109         return valid_user_group_name_full(u, false);
 110 }
 111 static inline bool valid_user_group_name_or_id_compat(const char *u) {
 112         return valid_user_group_name_or_id_full(u, false);
 113 }
 114 bool valid_gecos(const char *d);
 115 bool valid_home(const char *p);
 116
 117 static inline bool valid_shell(const char *p) {
 118         /* We have the same requirements, so just piggy-back on the home check.
 119          *
 120          * Let's ignore /etc/shells because this is only applicable to real and
 121          * not system users. It is also incompatible with the idea of empty /etc.
 122          */
 123         return valid_home(p);
 124 }
 125
 126 int maybe_setgroups(size_t size, const gid_t *list);
 127
 128 bool synthesize_nobody(void);
 129
 130 int fgetpwent_sane(FILE *stream, struct passwd **pw);
 131 int fgetspent_sane(FILE *stream, struct spwd **sp);
 132 int fgetgrent_sane(FILE *stream, struct group **gr);
 133 int putpwent_sane(const struct passwd *pw, FILE *stream);
 134 int putspent_sane(const struct spwd *sp, FILE *stream);
 135 int putgrent_sane(const struct group *gr, FILE *stream);
 136 #if ENABLE_GSHADOW
 137 int fgetsgent_sane(FILE *stream, struct sgrp **sg);
 138 int putsgent_sane(const struct sgrp *sg, FILE *stream);
 139 #endif
 140
 141 bool is_nologin_shell(const char *shell);