src/shared/userdb.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/auxv.h>
   4
   5 #include "dirent-util.h"
   6 #include "errno-util.h"
   7 #include "fd-util.h"
   8 #include "group-record-nss.h"
   9 #include "missing_syscall.h"
  10 #include "parse-util.h"
  11 #include "set.h"
  12 #include "socket-util.h"
  13 #include "strv.h"
  14 #include "user-record-nss.h"
  15 #include "user-util.h"
  16 #include "userdb.h"
  17 #include "varlink.h"
  18
  19 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(link_hash_ops, void, trivial_hash_func, trivial_compare_func, Varlink, varlink_unref);
  20
  21 typedef enum LookupWhat {
  22         LOOKUP_USER,
  23         LOOKUP_GROUP,
  24         LOOKUP_MEMBERSHIP,
  25         _LOOKUP_WHAT_MAX,
  26 } LookupWhat;
  27
  28 struct UserDBIterator {
  29         LookupWhat what;
  30         Set *links;
  31         bool nss_covered:1;
  32         bool nss_iterating:1;
  33         bool synthesize_root:1;
  34         bool synthesize_nobody:1;
  35         int error;
  36         int nss_lock;
  37         unsigned n_found;
  38         sd_event *event;
  39         UserRecord *found_user;                   /* when .what == LOOKUP_USER */
  40         GroupRecord *found_group;                 /* when .what == LOOKUP_GROUP */
  41
  42         char *found_user_name, *found_group_name; /* when .what == LOOKUP_MEMBERSHIP */
  43         char **members_of_group;
  44         size_t index_members_of_group;
  45         char *filter_user_name;
  46 };
  47
  48 UserDBIterator* userdb_iterator_free(UserDBIterator *iterator) {
  49         if (!iterator)
  50                 return NULL;
  51
  52         set_free(iterator->links);
  53
  54         switch (iterator->what) {
  55
  56         case LOOKUP_USER:
  57                 user_record_unref(iterator->found_user);
  58
  59                 if (iterator->nss_iterating)
  60                         endpwent();
  61
  62                 break;
  63
  64         case LOOKUP_GROUP:
  65                 group_record_unref(iterator->found_group);
  66
  67                 if (iterator->nss_iterating)
  68                         endgrent();
  69
  70                 break;
  71
  72         case LOOKUP_MEMBERSHIP:
  73                 free(iterator->found_user_name);
  74                 free(iterator->found_group_name);
  75                 strv_free(iterator->members_of_group);
  76                 free(iterator->filter_user_name);
  77
  78                 if (iterator->nss_iterating)
  79                         endgrent();
  80
  81                 break;
  82
  83         default:
  84                 assert_not_reached("Unexpected state?");
  85         }
  86
  87         sd_event_unref(iterator->event);
  88         safe_close(iterator->nss_lock);
  89
  90         return mfree(iterator);
  91 }
  92
  93 static UserDBIterator* userdb_iterator_new(LookupWhat what) {
  94         UserDBIterator *i;
  95
  96         assert(what >= 0);
  97         assert(what < _LOOKUP_WHAT_MAX);
  98
  99         i = new(UserDBIterator, 1);
 100         if (!i)
 101                 return NULL;
 102
 103         *i = (UserDBIterator) {
 104                 .what = what,
 105                 .nss_lock = -1,
 106         };
 107
 108         return i;
 109 }
 110
 111 struct user_group_data {
 112         JsonVariant *record;
 113         bool incomplete;
 114 };
 115
 116 static void user_group_data_release(struct user_group_data *d) {
 117         json_variant_unref(d->record);
 118 }
 119
 120 static int userdb_on_query_reply(
 121                 Varlink *link,
 122                 JsonVariant *parameters,
 123                 const char *error_id,
 124                 VarlinkReplyFlags flags,
 125                 void *userdata) {
 126
 127         UserDBIterator *iterator = userdata;
 128         int r;
 129
 130         assert(iterator);
 131
 132         if (error_id) {
 133                 log_debug("Got lookup error: %s", error_id);
 134
 135                 if (STR_IN_SET(error_id,
 136                                "io.systemd.UserDatabase.NoRecordFound",
 137                                "io.systemd.UserDatabase.ConflictingRecordFound"))
 138                         r = -ESRCH;
 139                 else if (streq(error_id, "io.systemd.UserDatabase.ServiceNotAvailable"))
 140                         r = -EHOSTDOWN;
 141                 else if (streq(error_id, VARLINK_ERROR_TIMEOUT))
 142                         r = -ETIMEDOUT;
 143                 else
 144                         r = -EIO;
 145
 146                 goto finish;
 147         }
 148
 149         switch (iterator->what) {
 150
 151         case LOOKUP_USER: {
 152                 _cleanup_(user_group_data_release) struct user_group_data user_data = {};
 153
 154                 static const JsonDispatch dispatch_table[] = {
 155                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 156                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 157                         {}
 158                 };
 159                 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 160
 161                 assert_se(!iterator->found_user);
 162
 163                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &user_data);
 164                 if (r < 0)
 165                         goto finish;
 166
 167                 if (!user_data.record) {
 168                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 169                         goto finish;
 170                 }
 171
 172                 hr = user_record_new();
 173                 if (!hr) {
 174                         r = -ENOMEM;
 175                         goto finish;
 176                 }
 177
 178                 r = user_record_load(hr, user_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 179                 if (r < 0)
 180                         goto finish;
 181
 182                 if (!hr->service) {
 183                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "User record does not carry service information, refusing.");
 184                         goto finish;
 185                 }
 186
 187                 hr->incomplete = user_data.incomplete;
 188
 189                 /* We match the root user by the name since the name is our primary key. We match the nobody
 190                  * use by UID though, since the name might differ on OSes */
 191                 if (streq_ptr(hr->user_name, "root"))
 192                         iterator->synthesize_root = false;
 193                 if (hr->uid == UID_NOBODY)
 194                         iterator->synthesize_nobody = false;
 195
 196                 iterator->found_user = TAKE_PTR(hr);
 197                 iterator->n_found++;
 198
 199                 /* More stuff coming? then let's just exit cleanly here */
 200                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 201                         return 0;
 202
 203                 /* Otherwise, let's remove this link and exit cleanly then */
 204                 r = 0;
 205                 goto finish;
 206         }
 207
 208         case LOOKUP_GROUP: {
 209                 _cleanup_(user_group_data_release) struct user_group_data group_data = {};
 210
 211                 static const JsonDispatch dispatch_table[] = {
 212                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 213                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 214                         {}
 215                 };
 216                 _cleanup_(group_record_unrefp) GroupRecord *g = NULL;
 217
 218                 assert_se(!iterator->found_group);
 219
 220                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &group_data);
 221                 if (r < 0)
 222                         goto finish;
 223
 224                 if (!group_data.record) {
 225                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 226                         goto finish;
 227                 }
 228
 229                 g = group_record_new();
 230                 if (!g) {
 231                         r = -ENOMEM;
 232                         goto finish;
 233                 }
 234
 235                 r = group_record_load(g, group_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 236                 if (r < 0)
 237                         goto finish;
 238
 239                 if (!g->service) {
 240                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Group record does not carry service information, refusing.");
 241                         goto finish;
 242                 }
 243
 244                 g->incomplete = group_data.incomplete;
 245
 246                 if (streq_ptr(g->group_name, "root"))
 247                         iterator->synthesize_root = false;
 248                 if (g->gid == GID_NOBODY)
 249                         iterator->synthesize_nobody = false;
 250
 251                 iterator->found_group = TAKE_PTR(g);
 252                 iterator->n_found++;
 253
 254                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 255                         return 0;
 256
 257                 r = 0;
 258                 goto finish;
 259         }
 260
 261         case LOOKUP_MEMBERSHIP: {
 262                 struct membership_data {
 263                         const char *user_name;
 264                         const char *group_name;
 265                 } membership_data = {};
 266
 267                 static const JsonDispatch dispatch_table[] = {
 268                         { "userName",  JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, user_name),  JSON_SAFE },
 269                         { "groupName", JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, group_name), JSON_SAFE },
 270                         {}
 271                 };
 272
 273                 assert(!iterator->found_user_name);
 274                 assert(!iterator->found_group_name);
 275
 276                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &membership_data);
 277                 if (r < 0)
 278                         goto finish;
 279
 280                 iterator->found_user_name = mfree(iterator->found_user_name);
 281                 iterator->found_group_name = mfree(iterator->found_group_name);
 282
 283                 iterator->found_user_name = strdup(membership_data.user_name);
 284                 if (!iterator->found_user_name) {
 285                         r = -ENOMEM;
 286                         goto finish;
 287                 }
 288
 289                 iterator->found_group_name = strdup(membership_data.group_name);
 290                 if (!iterator->found_group_name) {
 291                         r = -ENOMEM;
 292                         goto finish;
 293                 }
 294
 295                 iterator->n_found++;
 296
 297                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 298                         return 0;
 299
 300                 r = 0;
 301                 goto finish;
 302         }
 303
 304         default:
 305                 assert_not_reached("unexpected lookup");
 306         }
 307
 308 finish:
 309         /* If we got one ESRCH, let that win. This way when we do a wild dump we won't be tripped up by bad
 310          * errors if at least one connection ended cleanly */
 311         if (r == -ESRCH || iterator->error == 0)
 312                 iterator->error = -r;
 313
 314         assert_se(set_remove(iterator->links, link) == link);
 315         link = varlink_unref(link);
 316         return 0;
 317 }
 318
 319 static int userdb_connect(
 320                 UserDBIterator *iterator,
 321                 const char *path,
 322                 const char *method,
 323                 bool more,
 324                 JsonVariant *query) {
 325
 326         _cleanup_(varlink_unrefp) Varlink *vl = NULL;
 327         int r;
 328
 329         assert(iterator);
 330         assert(path);
 331         assert(method);
 332
 333         r = varlink_connect_address(&vl, path);
 334         if (r < 0)
 335                 return log_debug_errno(r, "Unable to connect to %s: %m", path);
 336
 337         varlink_set_userdata(vl, iterator);
 338
 339         if (!iterator->event) {
 340                 r = sd_event_new(&iterator->event);
 341                 if (r < 0)
 342                         return log_debug_errno(r, "Unable to allocate event loop: %m");
 343         }
 344
 345         r = varlink_attach_event(vl, iterator->event, SD_EVENT_PRIORITY_NORMAL);
 346         if (r < 0)
 347                 return log_debug_errno(r, "Failed to attach varlink connection to event loop: %m");
 348
 349         (void) varlink_set_description(vl, path);
 350
 351         r = varlink_bind_reply(vl, userdb_on_query_reply);
 352         if (r < 0)
 353                 return log_debug_errno(r, "Failed to bind reply callback: %m");
 354
 355         if (more)
 356                 r = varlink_observe(vl, method, query);
 357         else
 358                 r = varlink_invoke(vl, method, query);
 359         if (r < 0)
 360                 return log_debug_errno(r, "Failed to invoke varlink method: %m");
 361
 362         r = set_ensure_allocated(&iterator->links, &link_hash_ops);
 363         if (r < 0)
 364                 return log_debug_errno(r, "Failed to allocate set: %m");
 365
 366         r = set_put(iterator->links, vl);
 367         if (r < 0)
 368                 return log_debug_errno(r, "Failed to add varlink connection to set: %m");
 369
 370         TAKE_PTR(vl);
 371         return r;
 372 }
 373
 374 static int userdb_start_query(
 375                 UserDBIterator *iterator,
 376                 const char *method,
 377                 bool more,
 378                 JsonVariant *query,
 379                 UserDBFlags flags) {
 380
 381         _cleanup_(strv_freep) char **except = NULL, **only = NULL;
 382         _cleanup_(closedirp) DIR *d = NULL;
 383         struct dirent *de;
 384         const char *e;
 385         int r, ret = 0;
 386
 387         assert(iterator);
 388         assert(method);
 389
 390         e = getenv("SYSTEMD_BYPASS_USERDB");
 391         if (e) {
 392                 r = parse_boolean(e);
 393                 if (r > 0)
 394                         return -ENOLINK;
 395                 if (r < 0) {
 396                         except = strv_split(e, ":");
 397                         if (!except)
 398                                 return -ENOMEM;
 399                 }
 400         }
 401
 402         e = getenv("SYSTEMD_ONLY_USERDB");
 403         if (e) {
 404                 only = strv_split(e, ":");
 405                 if (!only)
 406                         return -ENOMEM;
 407         }
 408
 409         /* First, let's talk to the multiplexer, if we can */
 410         if ((flags & (USERDB_AVOID_MULTIPLEXER|USERDB_AVOID_DYNAMIC_USER|USERDB_AVOID_NSS|USERDB_DONT_SYNTHESIZE)) == 0 &&
 411             !strv_contains(except, "io.systemd.Multiplexer") &&
 412             (!only || strv_contains(only, "io.systemd.Multiplexer"))) {
 413                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = json_variant_ref(query);
 414
 415                 r = json_variant_set_field_string(&patched_query, "service", "io.systemd.Multiplexer");
 416                 if (r < 0)
 417                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 418
 419                 r = userdb_connect(iterator, "/run/systemd/userdb/io.systemd.Multiplexer", method, more, patched_query);
 420                 if (r >= 0) {
 421                         iterator->nss_covered = true; /* The multiplexer does NSS */
 422                         return 0;
 423                 }
 424         }
 425
 426         d = opendir("/run/systemd/userdb/");
 427         if (!d) {
 428                 if (errno == ENOENT)
 429                         return -ESRCH;
 430
 431                 return -errno;
 432         }
 433
 434         FOREACH_DIRENT(de, d, return -errno) {
 435                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = NULL;
 436                 _cleanup_free_ char *p = NULL;
 437                 bool is_nss;
 438
 439                 if (streq(de->d_name, "io.systemd.Multiplexer")) /* We already tried this above, don't try this again */
 440                         continue;
 441
 442                 if (FLAGS_SET(flags, USERDB_AVOID_DYNAMIC_USER) &&
 443                     streq(de->d_name, "io.systemd.DynamicUser"))
 444                         continue;
 445
 446                 /* Avoid NSS is this is requested. Note that we also skip NSS when we were asked to skip the
 447                  * multiplexer, since in that case it's safer to do NSS in the client side emulation below
 448                  * (and when we run as part of systemd-userdbd.service we don't want to talk to ourselves
 449                  * anyway). */
 450                 is_nss = streq(de->d_name, "io.systemd.NameServiceSwitch");
 451                 if ((flags & (USERDB_AVOID_NSS|USERDB_AVOID_MULTIPLEXER)) && is_nss)
 452                         continue;
 453
 454                 if (strv_contains(except, de->d_name))
 455                         continue;
 456
 457                 if (only && !strv_contains(only, de->d_name))
 458                         continue;
 459
 460                 p = path_join("/run/systemd/userdb/", de->d_name);
 461                 if (!p)
 462                         return -ENOMEM;
 463
 464                 patched_query = json_variant_ref(query);
 465                 r = json_variant_set_field_string(&patched_query, "service", de->d_name);
 466                 if (r < 0)
 467                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 468
 469                 r = userdb_connect(iterator, p, method, more, patched_query);
 470                 if (is_nss && r >= 0) /* Turn off fallback NSS if we found the NSS service and could connect
 471                                        * to it */
 472                         iterator->nss_covered = true;
 473
 474                 if (ret == 0 && r < 0)
 475                         ret = r;
 476         }
 477
 478         if (set_isempty(iterator->links))
 479                 return ret; /* propagate last error we saw if we couldn't connect to anything. */
 480
 481         /* We connected to some services, in this case, ignore the ones we failed on */
 482         return 0;
 483 }
 484
 485 static int userdb_process(
 486                 UserDBIterator *iterator,
 487                 UserRecord **ret_user_record,
 488                 GroupRecord **ret_group_record,
 489                 char **ret_user_name,
 490                 char **ret_group_name) {
 491
 492         int r;
 493
 494         assert(iterator);
 495
 496         for (;;) {
 497                 if (iterator->what == LOOKUP_USER && iterator->found_user) {
 498                         if (ret_user_record)
 499                                 *ret_user_record = TAKE_PTR(iterator->found_user);
 500                         else
 501                                 iterator->found_user = user_record_unref(iterator->found_user);
 502
 503                         if (ret_group_record)
 504                                 *ret_group_record = NULL;
 505                         if (ret_user_name)
 506                                 *ret_user_name = NULL;
 507                         if (ret_group_name)
 508                                 *ret_group_name = NULL;
 509
 510                         return 0;
 511                 }
 512
 513                 if (iterator->what == LOOKUP_GROUP && iterator->found_group) {
 514                         if (ret_group_record)
 515                                 *ret_group_record = TAKE_PTR(iterator->found_group);
 516                         else
 517                                 iterator->found_group = group_record_unref(iterator->found_group);
 518
 519                         if (ret_user_record)
 520                                 *ret_user_record = NULL;
 521                         if (ret_user_name)
 522                                 *ret_user_name = NULL;
 523                         if (ret_group_name)
 524                                 *ret_group_name = NULL;
 525
 526                         return 0;
 527                 }
 528
 529                 if (iterator->what == LOOKUP_MEMBERSHIP && iterator->found_user_name && iterator->found_group_name) {
 530                         if (ret_user_name)
 531                                 *ret_user_name = TAKE_PTR(iterator->found_user_name);
 532                         else
 533                                 iterator->found_user_name = mfree(iterator->found_user_name);
 534
 535                         if (ret_group_name)
 536                                 *ret_group_name = TAKE_PTR(iterator->found_group_name);
 537                         else
 538                                 iterator->found_group_name = mfree(iterator->found_group_name);
 539
 540                         if (ret_user_record)
 541                                 *ret_user_record = NULL;
 542                         if (ret_group_record)
 543                                 *ret_group_record = NULL;
 544
 545                         return 0;
 546                 }
 547
 548                 if (set_isempty(iterator->links)) {
 549                         if (iterator->error == 0)
 550                                 return -ESRCH;
 551
 552                         return -abs(iterator->error);
 553                 }
 554
 555                 if (!iterator->event)
 556                         return -ESRCH;
 557
 558                 r = sd_event_run(iterator->event, UINT64_MAX);
 559                 if (r < 0)
 560                         return r;
 561         }
 562 }
 563
 564 static int synthetic_root_user_build(UserRecord **ret) {
 565         return user_record_build(
 566                         ret,
 567                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING("root")),
 568                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(0)),
 569                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 570                                           JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING("/root")),
 571                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 572 }
 573
 574 static int synthetic_nobody_user_build(UserRecord **ret) {
 575         return user_record_build(
 576                         ret,
 577                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(NOBODY_USER_NAME)),
 578                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(UID_NOBODY)),
 579                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 580                                           JSON_BUILD_PAIR("shell", JSON_BUILD_STRING(NOLOGIN)),
 581                                           JSON_BUILD_PAIR("locked", JSON_BUILD_BOOLEAN(true)),
 582                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 583 }
 584
 585 int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret) {
 586         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 587         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 588         int r;
 589
 590         if (!valid_user_group_name(name))
 591                 return -EINVAL;
 592
 593         r = json_build(&query, JSON_BUILD_OBJECT(
 594                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
 595         if (r < 0)
 596                 return r;
 597
 598         iterator = userdb_iterator_new(LOOKUP_USER);
 599         if (!iterator)
 600                 return -ENOMEM;
 601
 602         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 603         if (r >= 0) {
 604                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 605                 if (r >= 0)
 606                         return r;
 607         }
 608
 609         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 610                 /* Make sure the NSS lookup doesn't recurse back to us. (EBUSY is fine here, it just means we
 611                  * already took the lock from our thread, which is totally OK.) */
 612                 r = userdb_nss_compat_disable();
 613                 if (r >= 0 || r == -EBUSY) {
 614                         iterator->nss_lock = r;
 615
 616                         /* Client-side NSS fallback */
 617                         r = nss_user_record_by_name(name, ret);
 618                         if (r >= 0)
 619                                 return r;
 620                 }
 621         }
 622
 623         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 624                 if (streq(name, "root"))
 625                         return synthetic_root_user_build(ret);
 626
 627                 if (streq(name, NOBODY_USER_NAME) && synthesize_nobody())
 628                         return synthetic_nobody_user_build(ret);
 629         }
 630
 631         return r;
 632 }
 633
 634 int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret) {
 635         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 636         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 637         int r;
 638
 639         if (!uid_is_valid(uid))
 640                 return -EINVAL;
 641
 642         r = json_build(&query, JSON_BUILD_OBJECT(
 643                                        JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid))));
 644         if (r < 0)
 645                 return r;
 646
 647         iterator = userdb_iterator_new(LOOKUP_USER);
 648         if (!iterator)
 649                 return -ENOMEM;
 650
 651         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 652         if (r >= 0) {
 653                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 654                 if (r >= 0)
 655                         return r;
 656         }
 657
 658         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 659                 r = userdb_nss_compat_disable();
 660                 if (r >= 0 || r == -EBUSY) {
 661                         iterator->nss_lock = r;
 662
 663                         /* Client-side NSS fallback */
 664                         r = nss_user_record_by_uid(uid, ret);
 665                         if (r >= 0)
 666                                 return r;
 667                 }
 668         }
 669
 670         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 671                 if (uid == 0)
 672                         return synthetic_root_user_build(ret);
 673
 674                 if (uid == UID_NOBODY && synthesize_nobody())
 675                         return synthetic_nobody_user_build(ret);
 676         }
 677
 678         return r;
 679 }
 680
 681 int userdb_all(UserDBFlags flags, UserDBIterator **ret) {
 682         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 683         int r;
 684
 685         assert(ret);
 686
 687         iterator = userdb_iterator_new(LOOKUP_USER);
 688         if (!iterator)
 689                 return -ENOMEM;
 690
 691         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 692
 693         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", true, NULL, flags);
 694
 695         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 696                 iterator->nss_lock = userdb_nss_compat_disable();
 697                 if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
 698                         return iterator->nss_lock;
 699
 700                 setpwent();
 701                 iterator->nss_iterating = true;
 702                 goto finish;
 703         }
 704
 705         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE))
 706                 goto finish;
 707
 708         return r;
 709
 710 finish:
 711         *ret = TAKE_PTR(iterator);
 712         return 0;
 713 }
 714
 715 int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) {
 716         int r;
 717
 718         assert(iterator);
 719         assert(iterator->what == LOOKUP_USER);
 720
 721         if (iterator->nss_iterating) {
 722                 struct passwd *pw;
 723
 724                 /* If NSS isn't covered elsewhere, let's iterate through it first, since it probably contains
 725                  * the more traditional sources, which are probably good to show first. */
 726
 727                 pw = getpwent();
 728                 if (pw) {
 729                         _cleanup_free_ char *buffer = NULL;
 730                         bool incomplete = false;
 731                         struct spwd spwd;
 732
 733                         if (streq_ptr(pw->pw_name, "root"))
 734                                 iterator->synthesize_root = false;
 735                         if (pw->pw_uid == UID_NOBODY)
 736                                 iterator->synthesize_nobody = false;
 737
 738                         r = nss_spwd_for_passwd(pw, &spwd, &buffer);
 739                         if (r < 0) {
 740                                 log_debug_errno(r, "Failed to acquire shadow entry for user %s, ignoring: %m", pw->pw_name);
 741                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 742                         }
 743
 744                         r = nss_passwd_to_user_record(pw, r >= 0 ? &spwd : NULL, ret);
 745                         if (r < 0)
 746                                 return r;
 747
 748                         if (ret)
 749                                 (*ret)->incomplete = incomplete;
 750                         return r;
 751                 }
 752
 753                 if (errno != 0)
 754                         log_debug_errno(errno, "Failure to iterate NSS user database, ignoring: %m");
 755
 756                 iterator->nss_iterating = false;
 757                 endpwent();
 758         }
 759
 760         r = userdb_process(iterator, ret, NULL, NULL, NULL);
 761
 762         if (r < 0) {
 763                 if (iterator->synthesize_root) {
 764                         iterator->synthesize_root = false;
 765                         iterator->n_found++;
 766                         return synthetic_root_user_build(ret);
 767                 }
 768
 769                 if (iterator->synthesize_nobody) {
 770                         iterator->synthesize_nobody = false;
 771                         iterator->n_found++;
 772                         return synthetic_nobody_user_build(ret);
 773                 }
 774         }
 775
 776         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 777         if (r < 0 && iterator->n_found > 0)
 778                 return -ESRCH;
 779
 780         return r;
 781 }
 782
 783 static int synthetic_root_group_build(GroupRecord **ret) {
 784         return group_record_build(
 785                         ret,
 786                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING("root")),
 787                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 788                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 789 }
 790
 791 static int synthetic_nobody_group_build(GroupRecord **ret) {
 792         return group_record_build(
 793                         ret,
 794                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(NOBODY_GROUP_NAME)),
 795                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 796                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 797 }
 798
 799 int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret) {
 800         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 801         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 802         int r;
 803
 804         if (!valid_user_group_name(name))
 805                 return -EINVAL;
 806
 807         r = json_build(&query, JSON_BUILD_OBJECT(
 808                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
 809         if (r < 0)
 810                 return r;
 811
 812         iterator = userdb_iterator_new(LOOKUP_GROUP);
 813         if (!iterator)
 814                 return -ENOMEM;
 815
 816         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 817         if (r >= 0) {
 818                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 819                 if (r >= 0)
 820                         return r;
 821         }
 822
 823         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 824                 r = userdb_nss_compat_disable();
 825                 if (r >= 0 || r == -EBUSY) {
 826                         iterator->nss_lock = r;
 827
 828                         r = nss_group_record_by_name(name, ret);
 829                         if (r >= 0)
 830                                 return r;
 831                 }
 832         }
 833
 834         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 835                 if (streq(name, "root"))
 836                         return synthetic_root_group_build(ret);
 837
 838                 if (streq(name, NOBODY_GROUP_NAME) && synthesize_nobody())
 839                         return synthetic_nobody_group_build(ret);
 840         }
 841
 842         return r;
 843 }
 844
 845 int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret) {
 846         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 847         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 848         int r;
 849
 850         if (!gid_is_valid(gid))
 851                 return -EINVAL;
 852
 853         r = json_build(&query, JSON_BUILD_OBJECT(
 854                                        JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid))));
 855         if (r < 0)
 856                 return r;
 857
 858         iterator = userdb_iterator_new(LOOKUP_GROUP);
 859         if (!iterator)
 860                 return -ENOMEM;
 861
 862         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 863         if (r >= 0) {
 864                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 865                 if (r >= 0)
 866                         return r;
 867         }
 868
 869         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 870                 r = userdb_nss_compat_disable();
 871                 if (r >= 0 || r == -EBUSY) {
 872                         iterator->nss_lock = r;
 873
 874                         r = nss_group_record_by_gid(gid, ret);
 875                         if (r >= 0)
 876                                 return r;
 877                 }
 878         }
 879
 880         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 881                 if (gid == 0)
 882                         return synthetic_root_group_build(ret);
 883
 884                 if (gid == GID_NOBODY && synthesize_nobody())
 885                         return synthetic_nobody_group_build(ret);
 886         }
 887
 888         return r;
 889 }
 890
 891 int groupdb_all(UserDBFlags flags, UserDBIterator **ret) {
 892         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 893         int r;
 894
 895         assert(ret);
 896
 897         iterator = userdb_iterator_new(LOOKUP_GROUP);
 898         if (!iterator)
 899                 return -ENOMEM;
 900
 901         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 902
 903         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", true, NULL, flags);
 904
 905         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 906                 iterator->nss_lock = userdb_nss_compat_disable();
 907                 if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
 908                         return iterator->nss_lock;
 909
 910                 setgrent();
 911                 iterator->nss_iterating = true;
 912                 goto finish;
 913         }
 914
 915         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE))
 916                 goto finish;
 917
 918         return r;
 919
 920 finish:
 921         *ret = TAKE_PTR(iterator);
 922         return 0;
 923 }
 924
 925 int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
 926         int r;
 927
 928         assert(iterator);
 929         assert(iterator->what == LOOKUP_GROUP);
 930
 931         if (iterator->nss_iterating) {
 932                 struct group *gr;
 933
 934                 errno = 0;
 935                 gr = getgrent();
 936                 if (gr) {
 937                         _cleanup_free_ char *buffer = NULL;
 938                         bool incomplete = false;
 939                         struct sgrp sgrp;
 940
 941                         if (streq_ptr(gr->gr_name, "root"))
 942                                 iterator->synthesize_root = false;
 943                         if (gr->gr_gid == GID_NOBODY)
 944                                 iterator->synthesize_nobody = false;
 945
 946                         r = nss_sgrp_for_group(gr, &sgrp, &buffer);
 947                         if (r < 0) {
 948                                 log_debug_errno(r, "Failed to acquire shadow entry for group %s, ignoring: %m", gr->gr_name);
 949                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 950                         }
 951
 952                         r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret);
 953                         if (r < 0)
 954                                 return r;
 955
 956                         if (ret)
 957                                 (*ret)->incomplete = incomplete;
 958                         return r;
 959                 }
 960
 961                 if (errno != 0)
 962                         log_debug_errno(errno, "Failure to iterate NSS group database, ignoring: %m");
 963
 964                 iterator->nss_iterating = false;
 965                 endgrent();
 966         }
 967
 968         r = userdb_process(iterator, NULL, ret, NULL, NULL);
 969         if (r < 0) {
 970                 if (iterator->synthesize_root) {
 971                         iterator->synthesize_root = false;
 972                         iterator->n_found++;
 973                         return synthetic_root_group_build(ret);
 974                 }
 975
 976                 if (iterator->synthesize_nobody) {
 977                         iterator->synthesize_nobody = false;
 978                         iterator->n_found++;
 979                         return synthetic_nobody_group_build(ret);
 980                 }
 981         }
 982
 983         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 984         if (r < 0 && iterator->n_found > 0)
 985                 return -ESRCH;
 986
 987         return r;
 988 }
 989
 990 int membershipdb_by_user(const char *name, UserDBFlags flags, UserDBIterator **ret) {
 991         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 992         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 993         int r;
 994
 995         assert(ret);
 996
 997         if (!valid_user_group_name(name))
 998                 return -EINVAL;
 999
1000         r = json_build(&query, JSON_BUILD_OBJECT(
1001                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
1002         if (r < 0)
1003                 return r;
1004
1005         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1006         if (!iterator)
1007                 return -ENOMEM;
1008
1009         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
1010         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1011                 goto finish;
1012
1013         iterator->nss_lock = userdb_nss_compat_disable();
1014         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
1015                 return iterator->nss_lock;
1016
1017         iterator->filter_user_name = strdup(name);
1018         if (!iterator->filter_user_name)
1019                 return -ENOMEM;
1020
1021         setgrent();
1022         iterator->nss_iterating = true;
1023
1024         r = 0;
1025
1026 finish:
1027         if (r >= 0)
1028                 *ret = TAKE_PTR(iterator);
1029         return r;
1030 }
1031
1032 int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator **ret) {
1033         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1034         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
1035         _cleanup_(group_record_unrefp) GroupRecord *gr = NULL;
1036         int r;
1037
1038         assert(ret);
1039
1040         if (!valid_user_group_name(name))
1041                 return -EINVAL;
1042
1043         r = json_build(&query, JSON_BUILD_OBJECT(
1044                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
1045         if (r < 0)
1046                 return r;
1047
1048         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1049         if (!iterator)
1050                 return -ENOMEM;
1051
1052         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
1053         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1054                 goto finish;
1055
1056         iterator->nss_lock = userdb_nss_compat_disable();
1057         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
1058                 return iterator->nss_lock;
1059
1060         /* We ignore all errors here, since the group might be defined by a userdb native service, and we queried them already above. */
1061         (void) nss_group_record_by_name(name, &gr);
1062         if (gr) {
1063                 iterator->members_of_group = strv_copy(gr->members);
1064                 if (!iterator->members_of_group)
1065                         return -ENOMEM;
1066
1067                 iterator->index_members_of_group = 0;
1068
1069                 iterator->found_group_name = strdup(name);
1070                 if (!iterator->found_group_name)
1071                         return -ENOMEM;
1072         }
1073
1074         r = 0;
1075
1076 finish:
1077         if (r >= 0)
1078                 *ret = TAKE_PTR(iterator);
1079
1080         return r;
1081 }
1082
1083 int membershipdb_all(UserDBFlags flags, UserDBIterator **ret) {
1084         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1085         int r;
1086
1087         assert(ret);
1088
1089         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1090         if (!iterator)
1091                 return -ENOMEM;
1092
1093         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, NULL, flags);
1094         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1095                 goto finish;
1096
1097         iterator->nss_lock = userdb_nss_compat_disable();
1098         if (iterator->nss_lock < 0 && iterator->nss_lock != -EBUSY)
1099                 return iterator->nss_lock;
1100
1101         setgrent();
1102         iterator->nss_iterating = true;
1103
1104         r = 0;
1105
1106 finish:
1107         if (r >= 0)
1108                 *ret = TAKE_PTR(iterator);
1109
1110         return r;
1111 }
1112
1113 int membershipdb_iterator_get(
1114                 UserDBIterator *iterator,
1115                 char **ret_user,
1116                 char **ret_group) {
1117
1118         int r;
1119
1120         assert(iterator);
1121
1122         for (;;) {
1123                 /* If we are iteratring through NSS acquire a new group entry if we haven't acquired one yet. */
1124                 if (!iterator->members_of_group) {
1125                         struct group *g;
1126
1127                         if (!iterator->nss_iterating)
1128                                 break;
1129
1130                         assert(!iterator->found_user_name);
1131                         do {
1132                                 errno = 0;
1133                                 g = getgrent();
1134                                 if (!g) {
1135                                         if (errno != 0)
1136                                                 log_debug_errno(errno, "Failure during NSS group iteration, ignoring: %m");
1137                                         break;
1138                                 }
1139
1140                         } while (iterator->filter_user_name ? !strv_contains(g->gr_mem, iterator->filter_user_name) :
1141                                                               strv_isempty(g->gr_mem));
1142
1143                         if (g) {
1144                                 r = free_and_strdup(&iterator->found_group_name, g->gr_name);
1145                                 if (r < 0)
1146                                         return r;
1147
1148                                 if (iterator->filter_user_name)
1149                                         iterator->members_of_group = strv_new(iterator->filter_user_name);
1150                                 else
1151                                         iterator->members_of_group = strv_copy(g->gr_mem);
1152                                 if (!iterator->members_of_group)
1153                                         return -ENOMEM;
1154
1155                                 iterator->index_members_of_group = 0;
1156                         } else {
1157                                 iterator->nss_iterating = false;
1158                                 endgrent();
1159                                 break;
1160                         }
1161                 }
1162
1163                 assert(iterator->found_group_name);
1164                 assert(iterator->members_of_group);
1165                 assert(!iterator->found_user_name);
1166
1167                 if (iterator->members_of_group[iterator->index_members_of_group]) {
1168                         _cleanup_free_ char *cu = NULL, *cg = NULL;
1169
1170                         if (ret_user) {
1171                                 cu = strdup(iterator->members_of_group[iterator->index_members_of_group]);
1172                                 if (!cu)
1173                                         return -ENOMEM;
1174                         }
1175
1176                         if (ret_group) {
1177                                 cg = strdup(iterator->found_group_name);
1178                                 if (!cg)
1179                                         return -ENOMEM;
1180                         }
1181
1182                         if (ret_user)
1183                                 *ret_user = TAKE_PTR(cu);
1184
1185                         if (ret_group)
1186                                 *ret_group = TAKE_PTR(cg);
1187
1188                         iterator->index_members_of_group++;
1189                         return 0;
1190                 }
1191
1192                 iterator->members_of_group = strv_free(iterator->members_of_group);
1193                 iterator->found_group_name = mfree(iterator->found_group_name);
1194         }
1195
1196         r = userdb_process(iterator, NULL, NULL, ret_user, ret_group);
1197         if (r < 0 && iterator->n_found > 0)
1198                 return -ESRCH;
1199
1200         return r;
1201 }
1202
1203 int membershipdb_by_group_strv(const char *name, UserDBFlags flags, char ***ret) {
1204         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1205         _cleanup_strv_free_ char **members = NULL;
1206         int r;
1207
1208         assert(name);
1209         assert(ret);
1210
1211         r = membershipdb_by_group(name, flags, &iterator);
1212         if (r < 0)
1213                 return r;
1214
1215         for (;;) {
1216                 _cleanup_free_ char *user_name = NULL;
1217
1218                 r = membershipdb_iterator_get(iterator, &user_name, NULL);
1219                 if (r == -ESRCH)
1220                         break;
1221                 if (r < 0)
1222                         return r;
1223
1224                 r = strv_consume(&members, TAKE_PTR(user_name));
1225                 if (r < 0)
1226                         return r;
1227         }
1228
1229         strv_sort(members);
1230         strv_uniq(members);
1231
1232         *ret = TAKE_PTR(members);
1233         return 0;
1234 }
1235
1236 static int userdb_thread_sockaddr(struct sockaddr_un *ret_sa, socklen_t *ret_salen) {
1237         static const uint8_t
1238                 k1[16] = { 0x35, 0xc1, 0x1f, 0x41, 0x59, 0xc6, 0xa0, 0xf9, 0x33, 0x4b, 0x17, 0x3d, 0xb9, 0xf6, 0x14, 0xd9 },
1239                 k2[16] = { 0x6a, 0x11, 0x4c, 0x37, 0xe5, 0xa3, 0x8c, 0xa6, 0x93, 0x55, 0x64, 0x8c, 0x93, 0xee, 0xa1, 0x7b };
1240
1241         struct siphash sh;
1242         uint64_t x, y;
1243         pid_t tid;
1244         void *p;
1245
1246         assert(ret_sa);
1247         assert(ret_salen);
1248
1249         /* This calculates an AF_UNIX socket address in the abstract namespace whose existence works as an
1250          * indicator whether to emulate NSS records for complex user records that are also available via the
1251          * varlink protocol. The name of the socket is picked in a way so that:
1252          *
1253          *     → it is per-thread (by hashing from the TID)
1254          *
1255          *     → is not guessable for foreign processes (by hashing from the — hopefully secret — AT_RANDOM
1256          *       value every process gets passed from the kernel
1257          *
1258          * By using a socket the NSS emulation can be nicely turned off for limited amounts of time only,
1259          * simply controlled by the lifetime of the fd itself. By using an AF_UNIX socket in the abstract
1260          * namespace the lock is automatically cleaned up when the process dies abnormally.
1261          *
1262          */
1263
1264         p = ULONG_TO_PTR(getauxval(AT_RANDOM));
1265         if (!p)
1266                 return -EIO;
1267
1268         tid = gettid();
1269
1270         siphash24_init(&sh, k1);
1271         siphash24_compress(p, 16, &sh);
1272         siphash24_compress(&tid, sizeof(tid), &sh);
1273         x = siphash24_finalize(&sh);
1274
1275         siphash24_init(&sh, k2);
1276         siphash24_compress(p, 16, &sh);
1277         siphash24_compress(&tid, sizeof(tid), &sh);
1278         y = siphash24_finalize(&sh);
1279
1280         *ret_sa = (struct sockaddr_un) {
1281                 .sun_family = AF_UNIX,
1282         };
1283
1284         sprintf(ret_sa->sun_path + 1, "userdb-%016" PRIx64 "%016" PRIx64, x, y);
1285         *ret_salen = offsetof(struct sockaddr_un, sun_path) + 1 + 7 + 32;
1286
1287         return 0;
1288 }
1289
1290 int userdb_nss_compat_is_enabled(void) {
1291         _cleanup_close_ int fd = -1;
1292         union sockaddr_union sa;
1293         socklen_t salen;
1294         int r;
1295
1296         /* Tests whether the NSS compatibility logic is currently turned on for the invoking thread. Returns
1297          * true if NSS compatibility is turned on, i.e. whether NSS records shall be synthesized from complex
1298          * user records. */
1299
1300         r = userdb_thread_sockaddr(&sa.un, &salen);
1301         if (r < 0)
1302                 return r;
1303
1304         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
1305         if (fd < 0)
1306                 return -errno;
1307
1308         /* Try to connect(). This doesn't do anything really, except that it checks whether the socket
1309          * address is bound at all. */
1310         if (connect(fd, &sa.sa, salen) < 0) {
1311                 if (errno == ECONNREFUSED) /* the socket is not bound, hence NSS emulation shall be done */
1312                         return true;
1313
1314                 return -errno;
1315         }
1316
1317         return false;
1318 }
1319
1320 int userdb_nss_compat_disable(void) {
1321         _cleanup_close_ int fd = -1;
1322         union sockaddr_union sa;
1323         socklen_t salen;
1324         int r;
1325
1326         /* Turn off the NSS compatibility logic for the invoking thread. By default NSS records are
1327          * synthesized for all complex user records looked up via NSS. If this call is invoked this is
1328          * disabled for the invoking thread, but only for it. A caller that natively supports the varlink
1329          * user record protocol may use that to turn off the compatibility for NSS lookups. */
1330
1331         r = userdb_thread_sockaddr(&sa.un, &salen);
1332         if (r < 0)
1333                 return r;
1334
1335         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
1336         if (fd < 0)
1337                 return -errno;
1338
1339         if (bind(fd, &sa.sa, salen) < 0) {
1340                 if (errno == EADDRINUSE) /* lock already taken, convert this into a recognizable error */
1341                         return -EBUSY;
1342
1343                 return -errno;
1344         }
1345
1346         return TAKE_FD(fd);
1347 }