src/shared/userdb.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/auxv.h>
   4
   5 #include "dirent-util.h"
   6 #include "errno-util.h"
   7 #include "fd-util.h"
   8 #include "group-record-nss.h"
   9 #include "missing_syscall.h"
  10 #include "parse-util.h"
  11 #include "set.h"
  12 #include "socket-util.h"
  13 #include "strv.h"
  14 #include "user-record-nss.h"
  15 #include "user-util.h"
  16 #include "userdb.h"
  17 #include "varlink.h"
  18
  19 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(link_hash_ops, void, trivial_hash_func, trivial_compare_func, Varlink, varlink_unref);
  20
  21 typedef enum LookupWhat {
  22         LOOKUP_USER,
  23         LOOKUP_GROUP,
  24         LOOKUP_MEMBERSHIP,
  25         _LOOKUP_WHAT_MAX,
  26 } LookupWhat;
  27
  28 struct UserDBIterator {
  29         LookupWhat what;
  30         Set *links;
  31         bool nss_covered:1;
  32         bool nss_iterating:1;
  33         bool synthesize_root:1;
  34         bool synthesize_nobody:1;
  35         int error;
  36         int nss_lock;
  37         unsigned n_found;
  38         sd_event *event;
  39         UserRecord *found_user;                   /* when .what == LOOKUP_USER */
  40         GroupRecord *found_group;                 /* when .what == LOOKUP_GROUP */
  41
  42         char *found_user_name, *found_group_name; /* when .what == LOOKUP_MEMBERSHIP */
  43         char **members_of_group;
  44         size_t index_members_of_group;
  45         char *filter_user_name;
  46 };
  47
  48 UserDBIterator* userdb_iterator_free(UserDBIterator *iterator) {
  49         if (!iterator)
  50                 return NULL;
  51
  52         set_free(iterator->links);
  53
  54         switch (iterator->what) {
  55
  56         case LOOKUP_USER:
  57                 user_record_unref(iterator->found_user);
  58
  59                 if (iterator->nss_iterating)
  60                         endpwent();
  61
  62                 break;
  63
  64         case LOOKUP_GROUP:
  65                 group_record_unref(iterator->found_group);
  66
  67                 if (iterator->nss_iterating)
  68                         endgrent();
  69
  70                 break;
  71
  72         case LOOKUP_MEMBERSHIP:
  73                 free(iterator->found_user_name);
  74                 free(iterator->found_group_name);
  75                 strv_free(iterator->members_of_group);
  76                 free(iterator->filter_user_name);
  77
  78                 if (iterator->nss_iterating)
  79                         endgrent();
  80
  81                 break;
  82
  83         default:
  84                 assert_not_reached("Unexpected state?");
  85         }
  86
  87         sd_event_unref(iterator->event);
  88         safe_close(iterator->nss_lock);
  89
  90         return mfree(iterator);
  91 }
  92
  93 static UserDBIterator* userdb_iterator_new(LookupWhat what) {
  94         UserDBIterator *i;
  95
  96         assert(what >= 0);
  97         assert(what < _LOOKUP_WHAT_MAX);
  98
  99         i = new(UserDBIterator, 1);
 100         if (!i)
 101                 return NULL;
 102
 103         *i = (UserDBIterator) {
 104                 .what = what,
 105                 .nss_lock = -1,
 106         };
 107
 108         return i;
 109 }
 110
 111 struct user_group_data {
 112         JsonVariant *record;
 113         bool incomplete;
 114 };
 115
 116 static void user_group_data_release(struct user_group_data *d) {
 117         json_variant_unref(d->record);
 118 }
 119
 120 static int userdb_on_query_reply(
 121                 Varlink *link,
 122                 JsonVariant *parameters,
 123                 const char *error_id,
 124                 VarlinkReplyFlags flags,
 125                 void *userdata) {
 126
 127         UserDBIterator *iterator = userdata;
 128         int r;
 129
 130         assert(iterator);
 131
 132         if (error_id) {
 133                 log_debug("Got lookup error: %s", error_id);
 134
 135                 if (STR_IN_SET(error_id,
 136                                "io.systemd.UserDatabase.NoRecordFound",
 137                                "io.systemd.UserDatabase.ConflictingRecordFound"))
 138                         r = -ESRCH;
 139                 else if (streq(error_id, "io.systemd.UserDatabase.ServiceNotAvailable"))
 140                         r = -EHOSTDOWN;
 141                 else if (streq(error_id, VARLINK_ERROR_TIMEOUT))
 142                         r = -ETIMEDOUT;
 143                 else
 144                         r = -EIO;
 145
 146                 goto finish;
 147         }
 148
 149         switch (iterator->what) {
 150
 151         case LOOKUP_USER: {
 152                 _cleanup_(user_group_data_release) struct user_group_data user_data = {};
 153
 154                 static const JsonDispatch dispatch_table[] = {
 155                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 156                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 157                         {}
 158                 };
 159                 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 160
 161                 assert_se(!iterator->found_user);
 162
 163                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &user_data);
 164                 if (r < 0)
 165                         goto finish;
 166
 167                 if (!user_data.record) {
 168                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 169                         goto finish;
 170                 }
 171
 172                 hr = user_record_new();
 173                 if (!hr) {
 174                         r = -ENOMEM;
 175                         goto finish;
 176                 }
 177
 178                 r = user_record_load(hr, user_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 179                 if (r < 0)
 180                         goto finish;
 181
 182                 if (!hr->service) {
 183                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "User record does not carry service information, refusing.");
 184                         goto finish;
 185                 }
 186
 187                 hr->incomplete = user_data.incomplete;
 188
 189                 /* We match the root user by the name since the name is our primary key. We match the nobody
 190                  * use by UID though, since the name might differ on OSes */
 191                 if (streq_ptr(hr->user_name, "root"))
 192                         iterator->synthesize_root = false;
 193                 if (hr->uid == UID_NOBODY)
 194                         iterator->synthesize_nobody = false;
 195
 196                 iterator->found_user = TAKE_PTR(hr);
 197                 iterator->n_found++;
 198
 199                 /* More stuff coming? then let's just exit cleanly here */
 200                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 201                         return 0;
 202
 203                 /* Otherwise, let's remove this link and exit cleanly then */
 204                 r = 0;
 205                 goto finish;
 206         }
 207
 208         case LOOKUP_GROUP: {
 209                 _cleanup_(user_group_data_release) struct user_group_data group_data = {};
 210
 211                 static const JsonDispatch dispatch_table[] = {
 212                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 213                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 214                         {}
 215                 };
 216                 _cleanup_(group_record_unrefp) GroupRecord *g = NULL;
 217
 218                 assert_se(!iterator->found_group);
 219
 220                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &group_data);
 221                 if (r < 0)
 222                         goto finish;
 223
 224                 if (!group_data.record) {
 225                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 226                         goto finish;
 227                 }
 228
 229                 g = group_record_new();
 230                 if (!g) {
 231                         r = -ENOMEM;
 232                         goto finish;
 233                 }
 234
 235                 r = group_record_load(g, group_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 236                 if (r < 0)
 237                         goto finish;
 238
 239                 if (!g->service) {
 240                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Group record does not carry service information, refusing.");
 241                         goto finish;
 242                 }
 243
 244                 g->incomplete = group_data.incomplete;
 245
 246                 if (streq_ptr(g->group_name, "root"))
 247                         iterator->synthesize_root = false;
 248                 if (g->gid == GID_NOBODY)
 249                         iterator->synthesize_nobody = false;
 250
 251                 iterator->found_group = TAKE_PTR(g);
 252                 iterator->n_found++;
 253
 254                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 255                         return 0;
 256
 257                 r = 0;
 258                 goto finish;
 259         }
 260
 261         case LOOKUP_MEMBERSHIP: {
 262                 struct membership_data {
 263                         const char *user_name;
 264                         const char *group_name;
 265                 } membership_data = {};
 266
 267                 static const JsonDispatch dispatch_table[] = {
 268                         { "userName",  JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, user_name),  JSON_SAFE },
 269                         { "groupName", JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, group_name), JSON_SAFE },
 270                         {}
 271                 };
 272
 273                 assert(!iterator->found_user_name);
 274                 assert(!iterator->found_group_name);
 275
 276                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &membership_data);
 277                 if (r < 0)
 278                         goto finish;
 279
 280                 iterator->found_user_name = mfree(iterator->found_user_name);
 281                 iterator->found_group_name = mfree(iterator->found_group_name);
 282
 283                 iterator->found_user_name = strdup(membership_data.user_name);
 284                 if (!iterator->found_user_name) {
 285                         r = -ENOMEM;
 286                         goto finish;
 287                 }
 288
 289                 iterator->found_group_name = strdup(membership_data.group_name);
 290                 if (!iterator->found_group_name) {
 291                         r = -ENOMEM;
 292                         goto finish;
 293                 }
 294
 295                 iterator->n_found++;
 296
 297                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 298                         return 0;
 299
 300                 r = 0;
 301                 goto finish;
 302         }
 303
 304         default:
 305                 assert_not_reached("unexpected lookup");
 306         }
 307
 308 finish:
 309         /* If we got one ESRCH, let that win. This way when we do a wild dump we won't be tripped up by bad
 310          * errors if at least one connection ended cleanly */
 311         if (r == -ESRCH || iterator->error == 0)
 312                 iterator->error = -r;
 313
 314         assert_se(set_remove(iterator->links, link) == link);
 315         link = varlink_unref(link);
 316         return 0;
 317 }
 318
 319 static int userdb_connect(
 320                 UserDBIterator *iterator,
 321                 const char *path,
 322                 const char *method,
 323                 bool more,
 324                 JsonVariant *query) {
 325
 326         _cleanup_(varlink_unrefp) Varlink *vl = NULL;
 327         int r;
 328
 329         assert(iterator);
 330         assert(path);
 331         assert(method);
 332
 333         r = varlink_connect_address(&vl, path);
 334         if (r < 0)
 335                 return log_debug_errno(r, "Unable to connect to %s: %m", path);
 336
 337         varlink_set_userdata(vl, iterator);
 338
 339         if (!iterator->event) {
 340                 r = sd_event_new(&iterator->event);
 341                 if (r < 0)
 342                         return log_debug_errno(r, "Unable to allocate event loop: %m");
 343         }
 344
 345         r = varlink_attach_event(vl, iterator->event, SD_EVENT_PRIORITY_NORMAL);
 346         if (r < 0)
 347                 return log_debug_errno(r, "Failed to attach varlink connection to event loop: %m");
 348
 349         (void) varlink_set_description(vl, path);
 350
 351         r = varlink_bind_reply(vl, userdb_on_query_reply);
 352         if (r < 0)
 353                 return log_debug_errno(r, "Failed to bind reply callback: %m");
 354
 355         if (more)
 356                 r = varlink_observe(vl, method, query);
 357         else
 358                 r = varlink_invoke(vl, method, query);
 359         if (r < 0)
 360                 return log_debug_errno(r, "Failed to invoke varlink method: %m");
 361
 362         r = set_ensure_consume(&iterator->links, &link_hash_ops, TAKE_PTR(vl));
 363         if (r < 0)
 364                 return log_debug_errno(r, "Failed to add varlink connection to set: %m");
 365         return r;
 366 }
 367
 368 static int userdb_start_query(
 369                 UserDBIterator *iterator,
 370                 const char *method,
 371                 bool more,
 372                 JsonVariant *query,
 373                 UserDBFlags flags) {
 374
 375         _cleanup_(strv_freep) char **except = NULL, **only = NULL;
 376         _cleanup_(closedirp) DIR *d = NULL;
 377         struct dirent *de;
 378         const char *e;
 379         int r, ret = 0;
 380
 381         assert(iterator);
 382         assert(method);
 383
 384         e = getenv("SYSTEMD_BYPASS_USERDB");
 385         if (e) {
 386                 r = parse_boolean(e);
 387                 if (r > 0)
 388                         return -ENOLINK;
 389                 if (r < 0) {
 390                         except = strv_split(e, ":");
 391                         if (!except)
 392                                 return -ENOMEM;
 393                 }
 394         }
 395
 396         e = getenv("SYSTEMD_ONLY_USERDB");
 397         if (e) {
 398                 only = strv_split(e, ":");
 399                 if (!only)
 400                         return -ENOMEM;
 401         }
 402
 403         /* First, let's talk to the multiplexer, if we can */
 404         if ((flags & (USERDB_AVOID_MULTIPLEXER|USERDB_AVOID_DYNAMIC_USER|USERDB_AVOID_NSS|USERDB_DONT_SYNTHESIZE)) == 0 &&
 405             !strv_contains(except, "io.systemd.Multiplexer") &&
 406             (!only || strv_contains(only, "io.systemd.Multiplexer"))) {
 407                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = json_variant_ref(query);
 408
 409                 r = json_variant_set_field_string(&patched_query, "service", "io.systemd.Multiplexer");
 410                 if (r < 0)
 411                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 412
 413                 r = userdb_connect(iterator, "/run/systemd/userdb/io.systemd.Multiplexer", method, more, patched_query);
 414                 if (r >= 0) {
 415                         iterator->nss_covered = true; /* The multiplexer does NSS */
 416                         return 0;
 417                 }
 418         }
 419
 420         d = opendir("/run/systemd/userdb/");
 421         if (!d) {
 422                 if (errno == ENOENT)
 423                         return -ESRCH;
 424
 425                 return -errno;
 426         }
 427
 428         FOREACH_DIRENT(de, d, return -errno) {
 429                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = NULL;
 430                 _cleanup_free_ char *p = NULL;
 431                 bool is_nss;
 432
 433                 if (streq(de->d_name, "io.systemd.Multiplexer")) /* We already tried this above, don't try this again */
 434                         continue;
 435
 436                 if (FLAGS_SET(flags, USERDB_AVOID_DYNAMIC_USER) &&
 437                     streq(de->d_name, "io.systemd.DynamicUser"))
 438                         continue;
 439
 440                 /* Avoid NSS is this is requested. Note that we also skip NSS when we were asked to skip the
 441                  * multiplexer, since in that case it's safer to do NSS in the client side emulation below
 442                  * (and when we run as part of systemd-userdbd.service we don't want to talk to ourselves
 443                  * anyway). */
 444                 is_nss = streq(de->d_name, "io.systemd.NameServiceSwitch");
 445                 if ((flags & (USERDB_AVOID_NSS|USERDB_AVOID_MULTIPLEXER)) && is_nss)
 446                         continue;
 447
 448                 if (strv_contains(except, de->d_name))
 449                         continue;
 450
 451                 if (only && !strv_contains(only, de->d_name))
 452                         continue;
 453
 454                 p = path_join("/run/systemd/userdb/", de->d_name);
 455                 if (!p)
 456                         return -ENOMEM;
 457
 458                 patched_query = json_variant_ref(query);
 459                 r = json_variant_set_field_string(&patched_query, "service", de->d_name);
 460                 if (r < 0)
 461                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 462
 463                 r = userdb_connect(iterator, p, method, more, patched_query);
 464                 if (is_nss && r >= 0) /* Turn off fallback NSS if we found the NSS service and could connect
 465                                        * to it */
 466                         iterator->nss_covered = true;
 467
 468                 if (ret == 0 && r < 0)
 469                         ret = r;
 470         }
 471
 472         if (set_isempty(iterator->links))
 473                 return ret; /* propagate last error we saw if we couldn't connect to anything. */
 474
 475         /* We connected to some services, in this case, ignore the ones we failed on */
 476         return 0;
 477 }
 478
 479 static int userdb_process(
 480                 UserDBIterator *iterator,
 481                 UserRecord **ret_user_record,
 482                 GroupRecord **ret_group_record,
 483                 char **ret_user_name,
 484                 char **ret_group_name) {
 485
 486         int r;
 487
 488         assert(iterator);
 489
 490         for (;;) {
 491                 if (iterator->what == LOOKUP_USER && iterator->found_user) {
 492                         if (ret_user_record)
 493                                 *ret_user_record = TAKE_PTR(iterator->found_user);
 494                         else
 495                                 iterator->found_user = user_record_unref(iterator->found_user);
 496
 497                         if (ret_group_record)
 498                                 *ret_group_record = NULL;
 499                         if (ret_user_name)
 500                                 *ret_user_name = NULL;
 501                         if (ret_group_name)
 502                                 *ret_group_name = NULL;
 503
 504                         return 0;
 505                 }
 506
 507                 if (iterator->what == LOOKUP_GROUP && iterator->found_group) {
 508                         if (ret_group_record)
 509                                 *ret_group_record = TAKE_PTR(iterator->found_group);
 510                         else
 511                                 iterator->found_group = group_record_unref(iterator->found_group);
 512
 513                         if (ret_user_record)
 514                                 *ret_user_record = NULL;
 515                         if (ret_user_name)
 516                                 *ret_user_name = NULL;
 517                         if (ret_group_name)
 518                                 *ret_group_name = NULL;
 519
 520                         return 0;
 521                 }
 522
 523                 if (iterator->what == LOOKUP_MEMBERSHIP && iterator->found_user_name && iterator->found_group_name) {
 524                         if (ret_user_name)
 525                                 *ret_user_name = TAKE_PTR(iterator->found_user_name);
 526                         else
 527                                 iterator->found_user_name = mfree(iterator->found_user_name);
 528
 529                         if (ret_group_name)
 530                                 *ret_group_name = TAKE_PTR(iterator->found_group_name);
 531                         else
 532                                 iterator->found_group_name = mfree(iterator->found_group_name);
 533
 534                         if (ret_user_record)
 535                                 *ret_user_record = NULL;
 536                         if (ret_group_record)
 537                                 *ret_group_record = NULL;
 538
 539                         return 0;
 540                 }
 541
 542                 if (set_isempty(iterator->links)) {
 543                         if (iterator->error == 0)
 544                                 return -ESRCH;
 545
 546                         return -abs(iterator->error);
 547                 }
 548
 549                 if (!iterator->event)
 550                         return -ESRCH;
 551
 552                 r = sd_event_run(iterator->event, UINT64_MAX);
 553                 if (r < 0)
 554                         return r;
 555         }
 556 }
 557
 558 static int synthetic_root_user_build(UserRecord **ret) {
 559         return user_record_build(
 560                         ret,
 561                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING("root")),
 562                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(0)),
 563                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 564                                           JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING("/root")),
 565                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 566 }
 567
 568 static int synthetic_nobody_user_build(UserRecord **ret) {
 569         return user_record_build(
 570                         ret,
 571                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(NOBODY_USER_NAME)),
 572                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(UID_NOBODY)),
 573                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 574                                           JSON_BUILD_PAIR("shell", JSON_BUILD_STRING(NOLOGIN)),
 575                                           JSON_BUILD_PAIR("locked", JSON_BUILD_BOOLEAN(true)),
 576                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 577 }
 578
 579 int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret) {
 580         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 581         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 582         int r;
 583
 584         if (!valid_user_group_name(name, VALID_USER_RELAX))
 585                 return -EINVAL;
 586
 587         r = json_build(&query, JSON_BUILD_OBJECT(
 588                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
 589         if (r < 0)
 590                 return r;
 591
 592         iterator = userdb_iterator_new(LOOKUP_USER);
 593         if (!iterator)
 594                 return -ENOMEM;
 595
 596         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 597         if (r >= 0) {
 598                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 599                 if (r >= 0)
 600                         return r;
 601         }
 602
 603         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 604                 /* Make sure the NSS lookup doesn't recurse back to us. (EBUSY is fine here, it just means we
 605                  * already took the lock from our thread, which is totally OK.) */
 606                 r = userdb_nss_compat_disable();
 607                 if (r >= 0 || r == -EBUSY) {
 608                         iterator->nss_lock = r;
 609
 610                         /* Client-side NSS fallback */
 611                         r = nss_user_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 612                         if (r >= 0)
 613                                 return r;
 614                 }
 615         }
 616
 617         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 618                 if (streq(name, "root"))
 619                         return synthetic_root_user_build(ret);
 620
 621                 if (streq(name, NOBODY_USER_NAME) && synthesize_nobody())
 622                         return synthetic_nobody_user_build(ret);
 623         }
 624
 625         return r;
 626 }
 627
 628 int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret) {
 629         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 630         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 631         int r;
 632
 633         if (!uid_is_valid(uid))
 634                 return -EINVAL;
 635
 636         r = json_build(&query, JSON_BUILD_OBJECT(
 637                                        JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid))));
 638         if (r < 0)
 639                 return r;
 640
 641         iterator = userdb_iterator_new(LOOKUP_USER);
 642         if (!iterator)
 643                 return -ENOMEM;
 644
 645         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 646         if (r >= 0) {
 647                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 648                 if (r >= 0)
 649                         return r;
 650         }
 651
 652         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 653                 r = userdb_nss_compat_disable();
 654                 if (r >= 0 || r == -EBUSY) {
 655                         iterator->nss_lock = r;
 656
 657                         /* Client-side NSS fallback */
 658                         r = nss_user_record_by_uid(uid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 659                         if (r >= 0)
 660                                 return r;
 661                 }
 662         }
 663
 664         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 665                 if (uid == 0)
 666                         return synthetic_root_user_build(ret);
 667
 668                 if (uid == UID_NOBODY && synthesize_nobody())
 669                         return synthetic_nobody_user_build(ret);
 670         }
 671
 672         return r;
 673 }
 674
 675 int userdb_all(UserDBFlags flags, UserDBIterator **ret) {
 676         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 677         int r;
 678
 679         assert(ret);
 680
 681         iterator = userdb_iterator_new(LOOKUP_USER);
 682         if (!iterator)
 683                 return -ENOMEM;
 684
 685         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 686
 687         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", true, NULL, flags);
 688
 689         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 690                 iterator->nss_lock = userdb_nss_compat_disable();
 691                 if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
 692                         return iterator->nss_lock;
 693
 694                 setpwent();
 695                 iterator->nss_iterating = true;
 696         } else if (r < 0)
 697                 return r;
 698
 699         *ret = TAKE_PTR(iterator);
 700         return 0;
 701 }
 702
 703 int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) {
 704         int r;
 705
 706         assert(iterator);
 707         assert(iterator->what == LOOKUP_USER);
 708
 709         if (iterator->nss_iterating) {
 710                 struct passwd *pw;
 711
 712                 /* If NSS isn't covered elsewhere, let's iterate through it first, since it probably contains
 713                  * the more traditional sources, which are probably good to show first. */
 714
 715                 pw = getpwent();
 716                 if (pw) {
 717                         _cleanup_free_ char *buffer = NULL;
 718                         bool incomplete = false;
 719                         struct spwd spwd;
 720
 721                         if (streq_ptr(pw->pw_name, "root"))
 722                                 iterator->synthesize_root = false;
 723                         if (pw->pw_uid == UID_NOBODY)
 724                                 iterator->synthesize_nobody = false;
 725
 726                         r = nss_spwd_for_passwd(pw, &spwd, &buffer);
 727                         if (r < 0) {
 728                                 log_debug_errno(r, "Failed to acquire shadow entry for user %s, ignoring: %m", pw->pw_name);
 729                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 730                         }
 731
 732                         r = nss_passwd_to_user_record(pw, r >= 0 ? &spwd : NULL, ret);
 733                         if (r < 0)
 734                                 return r;
 735
 736                         if (ret)
 737                                 (*ret)->incomplete = incomplete;
 738                         return r;
 739                 }
 740
 741                 if (errno != 0)
 742                         log_debug_errno(errno, "Failure to iterate NSS user database, ignoring: %m");
 743
 744                 iterator->nss_iterating = false;
 745                 endpwent();
 746         }
 747
 748         r = userdb_process(iterator, ret, NULL, NULL, NULL);
 749
 750         if (r < 0) {
 751                 if (iterator->synthesize_root) {
 752                         iterator->synthesize_root = false;
 753                         iterator->n_found++;
 754                         return synthetic_root_user_build(ret);
 755                 }
 756
 757                 if (iterator->synthesize_nobody) {
 758                         iterator->synthesize_nobody = false;
 759                         iterator->n_found++;
 760                         return synthetic_nobody_user_build(ret);
 761                 }
 762         }
 763
 764         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 765         if (r < 0 && iterator->n_found > 0)
 766                 return -ESRCH;
 767
 768         return r;
 769 }
 770
 771 static int synthetic_root_group_build(GroupRecord **ret) {
 772         return group_record_build(
 773                         ret,
 774                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING("root")),
 775                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 776                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 777 }
 778
 779 static int synthetic_nobody_group_build(GroupRecord **ret) {
 780         return group_record_build(
 781                         ret,
 782                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(NOBODY_GROUP_NAME)),
 783                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 784                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 785 }
 786
 787 int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret) {
 788         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 789         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 790         int r;
 791
 792         if (!valid_user_group_name(name, VALID_USER_RELAX))
 793                 return -EINVAL;
 794
 795         r = json_build(&query, JSON_BUILD_OBJECT(
 796                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
 797         if (r < 0)
 798                 return r;
 799
 800         iterator = userdb_iterator_new(LOOKUP_GROUP);
 801         if (!iterator)
 802                 return -ENOMEM;
 803
 804         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 805         if (r >= 0) {
 806                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 807                 if (r >= 0)
 808                         return r;
 809         }
 810
 811         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 812                 r = userdb_nss_compat_disable();
 813                 if (r >= 0 || r == -EBUSY) {
 814                         iterator->nss_lock = r;
 815
 816                         r = nss_group_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 817                         if (r >= 0)
 818                                 return r;
 819                 }
 820         }
 821
 822         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 823                 if (streq(name, "root"))
 824                         return synthetic_root_group_build(ret);
 825
 826                 if (streq(name, NOBODY_GROUP_NAME) && synthesize_nobody())
 827                         return synthetic_nobody_group_build(ret);
 828         }
 829
 830         return r;
 831 }
 832
 833 int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret) {
 834         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 835         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 836         int r;
 837
 838         if (!gid_is_valid(gid))
 839                 return -EINVAL;
 840
 841         r = json_build(&query, JSON_BUILD_OBJECT(
 842                                        JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid))));
 843         if (r < 0)
 844                 return r;
 845
 846         iterator = userdb_iterator_new(LOOKUP_GROUP);
 847         if (!iterator)
 848                 return -ENOMEM;
 849
 850         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 851         if (r >= 0) {
 852                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 853                 if (r >= 0)
 854                         return r;
 855         }
 856
 857         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 858                 r = userdb_nss_compat_disable();
 859                 if (r >= 0 || r == -EBUSY) {
 860                         iterator->nss_lock = r;
 861
 862                         r = nss_group_record_by_gid(gid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 863                         if (r >= 0)
 864                                 return r;
 865                 }
 866         }
 867
 868         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 869                 if (gid == 0)
 870                         return synthetic_root_group_build(ret);
 871
 872                 if (gid == GID_NOBODY && synthesize_nobody())
 873                         return synthetic_nobody_group_build(ret);
 874         }
 875
 876         return r;
 877 }
 878
 879 int groupdb_all(UserDBFlags flags, UserDBIterator **ret) {
 880         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 881         int r;
 882
 883         assert(ret);
 884
 885         iterator = userdb_iterator_new(LOOKUP_GROUP);
 886         if (!iterator)
 887                 return -ENOMEM;
 888
 889         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 890
 891         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", true, NULL, flags);
 892
 893         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 894                 iterator->nss_lock = userdb_nss_compat_disable();
 895                 if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
 896                         return iterator->nss_lock;
 897
 898                 setgrent();
 899                 iterator->nss_iterating = true;
 900         } if (r < 0)
 901                   return r;
 902
 903         *ret = TAKE_PTR(iterator);
 904         return 0;
 905 }
 906
 907 int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
 908         int r;
 909
 910         assert(iterator);
 911         assert(iterator->what == LOOKUP_GROUP);
 912
 913         if (iterator->nss_iterating) {
 914                 struct group *gr;
 915
 916                 errno = 0;
 917                 gr = getgrent();
 918                 if (gr) {
 919                         _cleanup_free_ char *buffer = NULL;
 920                         bool incomplete = false;
 921                         struct sgrp sgrp;
 922
 923                         if (streq_ptr(gr->gr_name, "root"))
 924                                 iterator->synthesize_root = false;
 925                         if (gr->gr_gid == GID_NOBODY)
 926                                 iterator->synthesize_nobody = false;
 927
 928                         r = nss_sgrp_for_group(gr, &sgrp, &buffer);
 929                         if (r < 0) {
 930                                 log_debug_errno(r, "Failed to acquire shadow entry for group %s, ignoring: %m", gr->gr_name);
 931                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 932                         }
 933
 934                         r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret);
 935                         if (r < 0)
 936                                 return r;
 937
 938                         if (ret)
 939                                 (*ret)->incomplete = incomplete;
 940                         return r;
 941                 }
 942
 943                 if (errno != 0)
 944                         log_debug_errno(errno, "Failure to iterate NSS group database, ignoring: %m");
 945
 946                 iterator->nss_iterating = false;
 947                 endgrent();
 948         }
 949
 950         r = userdb_process(iterator, NULL, ret, NULL, NULL);
 951         if (r < 0) {
 952                 if (iterator->synthesize_root) {
 953                         iterator->synthesize_root = false;
 954                         iterator->n_found++;
 955                         return synthetic_root_group_build(ret);
 956                 }
 957
 958                 if (iterator->synthesize_nobody) {
 959                         iterator->synthesize_nobody = false;
 960                         iterator->n_found++;
 961                         return synthetic_nobody_group_build(ret);
 962                 }
 963         }
 964
 965         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 966         if (r < 0 && iterator->n_found > 0)
 967                 return -ESRCH;
 968
 969         return r;
 970 }
 971
 972 int membershipdb_by_user(const char *name, UserDBFlags flags, UserDBIterator **ret) {
 973         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 974         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 975         int r;
 976
 977         assert(ret);
 978
 979         if (!valid_user_group_name(name, VALID_USER_RELAX))
 980                 return -EINVAL;
 981
 982         r = json_build(&query, JSON_BUILD_OBJECT(
 983                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
 984         if (r < 0)
 985                 return r;
 986
 987         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
 988         if (!iterator)
 989                 return -ENOMEM;
 990
 991         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
 992         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
 993                 goto finish;
 994
 995         iterator->nss_lock = userdb_nss_compat_disable();
 996         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
 997                 return iterator->nss_lock;
 998
 999         iterator->filter_user_name = strdup(name);
1000         if (!iterator->filter_user_name)
1001                 return -ENOMEM;
1002
1003         setgrent();
1004         iterator->nss_iterating = true;
1005
1006         r = 0;
1007
1008 finish:
1009         if (r >= 0)
1010                 *ret = TAKE_PTR(iterator);
1011         return r;
1012 }
1013
1014 int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator **ret) {
1015         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1016         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
1017         _cleanup_(group_record_unrefp) GroupRecord *gr = NULL;
1018         int r;
1019
1020         assert(ret);
1021
1022         if (!valid_user_group_name(name, VALID_USER_RELAX))
1023                 return -EINVAL;
1024
1025         r = json_build(&query, JSON_BUILD_OBJECT(
1026                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
1027         if (r < 0)
1028                 return r;
1029
1030         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1031         if (!iterator)
1032                 return -ENOMEM;
1033
1034         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
1035         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1036                 goto finish;
1037
1038         iterator->nss_lock = userdb_nss_compat_disable();
1039         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
1040                 return iterator->nss_lock;
1041
1042         /* We ignore all errors here, since the group might be defined by a userdb native service, and we queried them already above. */
1043         (void) nss_group_record_by_name(name, false, &gr);
1044         if (gr) {
1045                 iterator->members_of_group = strv_copy(gr->members);
1046                 if (!iterator->members_of_group)
1047                         return -ENOMEM;
1048
1049                 iterator->index_members_of_group = 0;
1050
1051                 iterator->found_group_name = strdup(name);
1052                 if (!iterator->found_group_name)
1053                         return -ENOMEM;
1054         }
1055
1056         r = 0;
1057
1058 finish:
1059         if (r >= 0)
1060                 *ret = TAKE_PTR(iterator);
1061
1062         return r;
1063 }
1064
1065 int membershipdb_all(UserDBFlags flags, UserDBIterator **ret) {
1066         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1067         int r;
1068
1069         assert(ret);
1070
1071         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1072         if (!iterator)
1073                 return -ENOMEM;
1074
1075         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, NULL, flags);
1076         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1077                 goto finish;
1078
1079         iterator->nss_lock = userdb_nss_compat_disable();
1080         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
1081                 return iterator->nss_lock;
1082
1083         setgrent();
1084         iterator->nss_iterating = true;
1085
1086         r = 0;
1087
1088 finish:
1089         if (r >= 0)
1090                 *ret = TAKE_PTR(iterator);
1091
1092         return r;
1093 }
1094
1095 int membershipdb_iterator_get(
1096                 UserDBIterator *iterator,
1097                 char **ret_user,
1098                 char **ret_group) {
1099
1100         int r;
1101
1102         assert(iterator);
1103
1104         for (;;) {
1105                 /* If we are iteratring through NSS acquire a new group entry if we haven't acquired one yet. */
1106                 if (!iterator->members_of_group) {
1107                         struct group *g;
1108
1109                         if (!iterator->nss_iterating)
1110                                 break;
1111
1112                         assert(!iterator->found_user_name);
1113                         do {
1114                                 errno = 0;
1115                                 g = getgrent();
1116                                 if (!g) {
1117                                         if (errno != 0)
1118                                                 log_debug_errno(errno, "Failure during NSS group iteration, ignoring: %m");
1119                                         break;
1120                                 }
1121
1122                         } while (iterator->filter_user_name ? !strv_contains(g->gr_mem, iterator->filter_user_name) :
1123                                                               strv_isempty(g->gr_mem));
1124
1125                         if (g) {
1126                                 r = free_and_strdup(&iterator->found_group_name, g->gr_name);
1127                                 if (r < 0)
1128                                         return r;
1129
1130                                 if (iterator->filter_user_name)
1131                                         iterator->members_of_group = strv_new(iterator->filter_user_name);
1132                                 else
1133                                         iterator->members_of_group = strv_copy(g->gr_mem);
1134                                 if (!iterator->members_of_group)
1135                                         return -ENOMEM;
1136
1137                                 iterator->index_members_of_group = 0;
1138                         } else {
1139                                 iterator->nss_iterating = false;
1140                                 endgrent();
1141                                 break;
1142                         }
1143                 }
1144
1145                 assert(iterator->found_group_name);
1146                 assert(iterator->members_of_group);
1147                 assert(!iterator->found_user_name);
1148
1149                 if (iterator->members_of_group[iterator->index_members_of_group]) {
1150                         _cleanup_free_ char *cu = NULL, *cg = NULL;
1151
1152                         if (ret_user) {
1153                                 cu = strdup(iterator->members_of_group[iterator->index_members_of_group]);
1154                                 if (!cu)
1155                                         return -ENOMEM;
1156                         }
1157
1158                         if (ret_group) {
1159                                 cg = strdup(iterator->found_group_name);
1160                                 if (!cg)
1161                                         return -ENOMEM;
1162                         }
1163
1164                         if (ret_user)
1165                                 *ret_user = TAKE_PTR(cu);
1166
1167                         if (ret_group)
1168                                 *ret_group = TAKE_PTR(cg);
1169
1170                         iterator->index_members_of_group++;
1171                         return 0;
1172                 }
1173
1174                 iterator->members_of_group = strv_free(iterator->members_of_group);
1175                 iterator->found_group_name = mfree(iterator->found_group_name);
1176         }
1177
1178         r = userdb_process(iterator, NULL, NULL, ret_user, ret_group);
1179         if (r < 0 && iterator->n_found > 0)
1180                 return -ESRCH;
1181
1182         return r;
1183 }
1184
1185 int membershipdb_by_group_strv(const char *name, UserDBFlags flags, char ***ret) {
1186         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1187         _cleanup_strv_free_ char **members = NULL;
1188         int r;
1189
1190         assert(name);
1191         assert(ret);
1192
1193         r = membershipdb_by_group(name, flags, &iterator);
1194         if (r < 0)
1195                 return r;
1196
1197         for (;;) {
1198                 _cleanup_free_ char *user_name = NULL;
1199
1200                 r = membershipdb_iterator_get(iterator, &user_name, NULL);
1201                 if (r == -ESRCH)
1202                         break;
1203                 if (r < 0)
1204                         return r;
1205
1206                 r = strv_consume(&members, TAKE_PTR(user_name));
1207                 if (r < 0)
1208                         return r;
1209         }
1210
1211         strv_sort(members);
1212         strv_uniq(members);
1213
1214         *ret = TAKE_PTR(members);
1215         return 0;
1216 }
1217
1218 static int userdb_thread_sockaddr(struct sockaddr_un *ret_sa, socklen_t *ret_salen) {
1219         static const uint8_t
1220                 k1[16] = { 0x35, 0xc1, 0x1f, 0x41, 0x59, 0xc6, 0xa0, 0xf9, 0x33, 0x4b, 0x17, 0x3d, 0xb9, 0xf6, 0x14, 0xd9 },
1221                 k2[16] = { 0x6a, 0x11, 0x4c, 0x37, 0xe5, 0xa3, 0x8c, 0xa6, 0x93, 0x55, 0x64, 0x8c, 0x93, 0xee, 0xa1, 0x7b };
1222
1223         struct siphash sh;
1224         uint64_t x, y;
1225         pid_t tid;
1226         void *p;
1227
1228         assert(ret_sa);
1229         assert(ret_salen);
1230
1231         /* This calculates an AF_UNIX socket address in the abstract namespace whose existence works as an
1232          * indicator whether to emulate NSS records for complex user records that are also available via the
1233          * varlink protocol. The name of the socket is picked in a way so that:
1234          *
1235          *     → it is per-thread (by hashing from the TID)
1236          *
1237          *     → is not guessable for foreign processes (by hashing from the — hopefully secret — AT_RANDOM
1238          *       value every process gets passed from the kernel
1239          *
1240          * By using a socket the NSS emulation can be nicely turned off for limited amounts of time only,
1241          * simply controlled by the lifetime of the fd itself. By using an AF_UNIX socket in the abstract
1242          * namespace the lock is automatically cleaned up when the process dies abnormally.
1243          *
1244          */
1245
1246         p = ULONG_TO_PTR(getauxval(AT_RANDOM));
1247         if (!p)
1248                 return -EIO;
1249
1250         tid = gettid();
1251
1252         siphash24_init(&sh, k1);
1253         siphash24_compress(p, 16, &sh);
1254         siphash24_compress(&tid, sizeof(tid), &sh);
1255         x = siphash24_finalize(&sh);
1256
1257         siphash24_init(&sh, k2);
1258         siphash24_compress(p, 16, &sh);
1259         siphash24_compress(&tid, sizeof(tid), &sh);
1260         y = siphash24_finalize(&sh);
1261
1262         *ret_sa = (struct sockaddr_un) {
1263                 .sun_family = AF_UNIX,
1264         };
1265
1266         sprintf(ret_sa->sun_path + 1, "userdb-%016" PRIx64 "%016" PRIx64, x, y);
1267         *ret_salen = offsetof(struct sockaddr_un, sun_path) + 1 + 7 + 32;
1268
1269         return 0;
1270 }
1271
1272 int userdb_nss_compat_is_enabled(void) {
1273         _cleanup_close_ int fd = -1;
1274         union sockaddr_union sa;
1275         socklen_t salen;
1276         int r;
1277
1278         /* Tests whether the NSS compatibility logic is currently turned on for the invoking thread. Returns
1279          * true if NSS compatibility is turned on, i.e. whether NSS records shall be synthesized from complex
1280          * user records. */
1281
1282         r = userdb_thread_sockaddr(&sa.un, &salen);
1283         if (r < 0)
1284                 return r;
1285
1286         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
1287         if (fd < 0)
1288                 return -errno;
1289
1290         /* Try to connect(). This doesn't do anything really, except that it checks whether the socket
1291          * address is bound at all. */
1292         if (connect(fd, &sa.sa, salen) < 0) {
1293                 if (errno == ECONNREFUSED) /* the socket is not bound, hence NSS emulation shall be done */
1294                         return true;
1295
1296                 return -errno;
1297         }
1298
1299         return false;
1300 }
1301
1302 int userdb_nss_compat_disable(void) {
1303         _cleanup_close_ int fd = -1;
1304         union sockaddr_union sa;
1305         socklen_t salen;
1306         int r;
1307
1308         /* Turn off the NSS compatibility logic for the invoking thread. By default NSS records are
1309          * synthesized for all complex user records looked up via NSS. If this call is invoked this is
1310          * disabled for the invoking thread, but only for it. A caller that natively supports the varlink
1311          * user record protocol may use that to turn off the compatibility for NSS lookups. */
1312
1313         r = userdb_thread_sockaddr(&sa.un, &salen);
1314         if (r < 0)
1315                 return r;
1316
1317         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
1318         if (fd < 0)
1319                 return -errno;
1320
1321         if (bind(fd, &sa.sa, salen) < 0) {
1322                 if (errno == EADDRINUSE) /* lock already taken, convert this into a recognizable error */
1323                         return -EBUSY;
1324
1325                 return -errno;
1326         }
1327
1328         return TAKE_FD(fd);
1329 }