src/shared/userdb.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/auxv.h>
   4
   5 #include "dirent-util.h"
   6 #include "dlfcn-util.h"
   7 #include "errno-util.h"
   8 #include "fd-util.h"
   9 #include "group-record-nss.h"
  10 #include "missing_syscall.h"
  11 #include "parse-util.h"
  12 #include "set.h"
  13 #include "socket-util.h"
  14 #include "strv.h"
  15 #include "user-record-nss.h"
  16 #include "user-util.h"
  17 #include "userdb.h"
  18 #include "varlink.h"
  19
  20 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(link_hash_ops, void, trivial_hash_func, trivial_compare_func, Varlink, varlink_unref);
  21
  22 typedef enum LookupWhat {
  23         LOOKUP_USER,
  24         LOOKUP_GROUP,
  25         LOOKUP_MEMBERSHIP,
  26         _LOOKUP_WHAT_MAX,
  27 } LookupWhat;
  28
  29 struct UserDBIterator {
  30         LookupWhat what;
  31         Set *links;
  32         bool nss_covered:1;
  33         bool nss_iterating:1;
  34         bool synthesize_root:1;
  35         bool synthesize_nobody:1;
  36         bool nss_systemd_blocked:1;
  37         int error;
  38         unsigned n_found;
  39         sd_event *event;
  40         UserRecord *found_user;                   /* when .what == LOOKUP_USER */
  41         GroupRecord *found_group;                 /* when .what == LOOKUP_GROUP */
  42
  43         char *found_user_name, *found_group_name; /* when .what == LOOKUP_MEMBERSHIP */
  44         char **members_of_group;
  45         size_t index_members_of_group;
  46         char *filter_user_name;
  47 };
  48
  49 UserDBIterator* userdb_iterator_free(UserDBIterator *iterator) {
  50         if (!iterator)
  51                 return NULL;
  52
  53         set_free(iterator->links);
  54
  55         switch (iterator->what) {
  56
  57         case LOOKUP_USER:
  58                 user_record_unref(iterator->found_user);
  59
  60                 if (iterator->nss_iterating)
  61                         endpwent();
  62
  63                 break;
  64
  65         case LOOKUP_GROUP:
  66                 group_record_unref(iterator->found_group);
  67
  68                 if (iterator->nss_iterating)
  69                         endgrent();
  70
  71                 break;
  72
  73         case LOOKUP_MEMBERSHIP:
  74                 free(iterator->found_user_name);
  75                 free(iterator->found_group_name);
  76                 strv_free(iterator->members_of_group);
  77                 free(iterator->filter_user_name);
  78
  79                 if (iterator->nss_iterating)
  80                         endgrent();
  81
  82                 break;
  83
  84         default:
  85                 assert_not_reached("Unexpected state?");
  86         }
  87
  88         sd_event_unref(iterator->event);
  89
  90         if (iterator->nss_systemd_blocked)
  91                 assert_se(userdb_block_nss_systemd(false) >= 0);
  92
  93         return mfree(iterator);
  94 }
  95
  96 static UserDBIterator* userdb_iterator_new(LookupWhat what) {
  97         UserDBIterator *i;
  98
  99         assert(what >= 0);
 100         assert(what < _LOOKUP_WHAT_MAX);
 101
 102         i = new(UserDBIterator, 1);
 103         if (!i)
 104                 return NULL;
 105
 106         *i = (UserDBIterator) {
 107                 .what = what,
 108         };
 109
 110         return i;
 111 }
 112
 113 static int userdb_iterator_block_nss_systemd(UserDBIterator *iterator) {
 114         int r;
 115
 116         assert(iterator);
 117
 118         if (iterator->nss_systemd_blocked)
 119                 return 0;
 120
 121         r = userdb_block_nss_systemd(true);
 122         if (r < 0)
 123                 return r;
 124
 125         iterator->nss_systemd_blocked = true;
 126         return 1;
 127 }
 128
 129 struct user_group_data {
 130         JsonVariant *record;
 131         bool incomplete;
 132 };
 133
 134 static void user_group_data_release(struct user_group_data *d) {
 135         json_variant_unref(d->record);
 136 }
 137
 138 static int userdb_on_query_reply(
 139                 Varlink *link,
 140                 JsonVariant *parameters,
 141                 const char *error_id,
 142                 VarlinkReplyFlags flags,
 143                 void *userdata) {
 144
 145         UserDBIterator *iterator = userdata;
 146         int r;
 147
 148         assert(iterator);
 149
 150         if (error_id) {
 151                 log_debug("Got lookup error: %s", error_id);
 152
 153                 if (STR_IN_SET(error_id,
 154                                "io.systemd.UserDatabase.NoRecordFound",
 155                                "io.systemd.UserDatabase.ConflictingRecordFound"))
 156                         r = -ESRCH;
 157                 else if (streq(error_id, "io.systemd.UserDatabase.ServiceNotAvailable"))
 158                         r = -EHOSTDOWN;
 159                 else if (streq(error_id, VARLINK_ERROR_TIMEOUT))
 160                         r = -ETIMEDOUT;
 161                 else
 162                         r = -EIO;
 163
 164                 goto finish;
 165         }
 166
 167         switch (iterator->what) {
 168
 169         case LOOKUP_USER: {
 170                 _cleanup_(user_group_data_release) struct user_group_data user_data = {};
 171
 172                 static const JsonDispatch dispatch_table[] = {
 173                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 174                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 175                         {}
 176                 };
 177                 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 178
 179                 assert_se(!iterator->found_user);
 180
 181                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &user_data);
 182                 if (r < 0)
 183                         goto finish;
 184
 185                 if (!user_data.record) {
 186                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 187                         goto finish;
 188                 }
 189
 190                 hr = user_record_new();
 191                 if (!hr) {
 192                         r = -ENOMEM;
 193                         goto finish;
 194                 }
 195
 196                 r = user_record_load(hr, user_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 197                 if (r < 0)
 198                         goto finish;
 199
 200                 if (!hr->service) {
 201                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "User record does not carry service information, refusing.");
 202                         goto finish;
 203                 }
 204
 205                 hr->incomplete = user_data.incomplete;
 206
 207                 /* We match the root user by the name since the name is our primary key. We match the nobody
 208                  * use by UID though, since the name might differ on OSes */
 209                 if (streq_ptr(hr->user_name, "root"))
 210                         iterator->synthesize_root = false;
 211                 if (hr->uid == UID_NOBODY)
 212                         iterator->synthesize_nobody = false;
 213
 214                 iterator->found_user = TAKE_PTR(hr);
 215                 iterator->n_found++;
 216
 217                 /* More stuff coming? then let's just exit cleanly here */
 218                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 219                         return 0;
 220
 221                 /* Otherwise, let's remove this link and exit cleanly then */
 222                 r = 0;
 223                 goto finish;
 224         }
 225
 226         case LOOKUP_GROUP: {
 227                 _cleanup_(user_group_data_release) struct user_group_data group_data = {};
 228
 229                 static const JsonDispatch dispatch_table[] = {
 230                         { "record",     _JSON_VARIANT_TYPE_INVALID, json_dispatch_variant, offsetof(struct user_group_data, record),     0 },
 231                         { "incomplete", JSON_VARIANT_BOOLEAN,       json_dispatch_boolean, offsetof(struct user_group_data, incomplete), 0 },
 232                         {}
 233                 };
 234                 _cleanup_(group_record_unrefp) GroupRecord *g = NULL;
 235
 236                 assert_se(!iterator->found_group);
 237
 238                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &group_data);
 239                 if (r < 0)
 240                         goto finish;
 241
 242                 if (!group_data.record) {
 243                         r = log_debug_errno(SYNTHETIC_ERRNO(EIO), "Reply is missing record key");
 244                         goto finish;
 245                 }
 246
 247                 g = group_record_new();
 248                 if (!g) {
 249                         r = -ENOMEM;
 250                         goto finish;
 251                 }
 252
 253                 r = group_record_load(g, group_data.record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 254                 if (r < 0)
 255                         goto finish;
 256
 257                 if (!g->service) {
 258                         r = log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Group record does not carry service information, refusing.");
 259                         goto finish;
 260                 }
 261
 262                 g->incomplete = group_data.incomplete;
 263
 264                 if (streq_ptr(g->group_name, "root"))
 265                         iterator->synthesize_root = false;
 266                 if (g->gid == GID_NOBODY)
 267                         iterator->synthesize_nobody = false;
 268
 269                 iterator->found_group = TAKE_PTR(g);
 270                 iterator->n_found++;
 271
 272                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 273                         return 0;
 274
 275                 r = 0;
 276                 goto finish;
 277         }
 278
 279         case LOOKUP_MEMBERSHIP: {
 280                 struct membership_data {
 281                         const char *user_name;
 282                         const char *group_name;
 283                 } membership_data = {};
 284
 285                 static const JsonDispatch dispatch_table[] = {
 286                         { "userName",  JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, user_name),  JSON_SAFE },
 287                         { "groupName", JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(struct membership_data, group_name), JSON_SAFE },
 288                         {}
 289                 };
 290
 291                 assert(!iterator->found_user_name);
 292                 assert(!iterator->found_group_name);
 293
 294                 r = json_dispatch(parameters, dispatch_table, NULL, 0, &membership_data);
 295                 if (r < 0)
 296                         goto finish;
 297
 298                 iterator->found_user_name = mfree(iterator->found_user_name);
 299                 iterator->found_group_name = mfree(iterator->found_group_name);
 300
 301                 iterator->found_user_name = strdup(membership_data.user_name);
 302                 if (!iterator->found_user_name) {
 303                         r = -ENOMEM;
 304                         goto finish;
 305                 }
 306
 307                 iterator->found_group_name = strdup(membership_data.group_name);
 308                 if (!iterator->found_group_name) {
 309                         r = -ENOMEM;
 310                         goto finish;
 311                 }
 312
 313                 iterator->n_found++;
 314
 315                 if (FLAGS_SET(flags, VARLINK_REPLY_CONTINUES))
 316                         return 0;
 317
 318                 r = 0;
 319                 goto finish;
 320         }
 321
 322         default:
 323                 assert_not_reached("unexpected lookup");
 324         }
 325
 326 finish:
 327         /* If we got one ESRCH, let that win. This way when we do a wild dump we won't be tripped up by bad
 328          * errors if at least one connection ended cleanly */
 329         if (r == -ESRCH || iterator->error == 0)
 330                 iterator->error = -r;
 331
 332         assert_se(set_remove(iterator->links, link) == link);
 333         link = varlink_unref(link);
 334         return 0;
 335 }
 336
 337 static int userdb_connect(
 338                 UserDBIterator *iterator,
 339                 const char *path,
 340                 const char *method,
 341                 bool more,
 342                 JsonVariant *query) {
 343
 344         _cleanup_(varlink_unrefp) Varlink *vl = NULL;
 345         int r;
 346
 347         assert(iterator);
 348         assert(path);
 349         assert(method);
 350
 351         r = varlink_connect_address(&vl, path);
 352         if (r < 0)
 353                 return log_debug_errno(r, "Unable to connect to %s: %m", path);
 354
 355         varlink_set_userdata(vl, iterator);
 356
 357         if (!iterator->event) {
 358                 r = sd_event_new(&iterator->event);
 359                 if (r < 0)
 360                         return log_debug_errno(r, "Unable to allocate event loop: %m");
 361         }
 362
 363         r = varlink_attach_event(vl, iterator->event, SD_EVENT_PRIORITY_NORMAL);
 364         if (r < 0)
 365                 return log_debug_errno(r, "Failed to attach varlink connection to event loop: %m");
 366
 367         (void) varlink_set_description(vl, path);
 368
 369         r = varlink_bind_reply(vl, userdb_on_query_reply);
 370         if (r < 0)
 371                 return log_debug_errno(r, "Failed to bind reply callback: %m");
 372
 373         if (more)
 374                 r = varlink_observe(vl, method, query);
 375         else
 376                 r = varlink_invoke(vl, method, query);
 377         if (r < 0)
 378                 return log_debug_errno(r, "Failed to invoke varlink method: %m");
 379
 380         r = set_ensure_consume(&iterator->links, &link_hash_ops, TAKE_PTR(vl));
 381         if (r < 0)
 382                 return log_debug_errno(r, "Failed to add varlink connection to set: %m");
 383         return r;
 384 }
 385
 386 static int userdb_start_query(
 387                 UserDBIterator *iterator,
 388                 const char *method,
 389                 bool more,
 390                 JsonVariant *query,
 391                 UserDBFlags flags) {
 392
 393         _cleanup_(strv_freep) char **except = NULL, **only = NULL;
 394         _cleanup_(closedirp) DIR *d = NULL;
 395         struct dirent *de;
 396         const char *e;
 397         int r, ret = 0;
 398
 399         assert(iterator);
 400         assert(method);
 401
 402         e = getenv("SYSTEMD_BYPASS_USERDB");
 403         if (e) {
 404                 r = parse_boolean(e);
 405                 if (r > 0)
 406                         return -ENOLINK;
 407                 if (r < 0) {
 408                         except = strv_split(e, ":");
 409                         if (!except)
 410                                 return -ENOMEM;
 411                 }
 412         }
 413
 414         e = getenv("SYSTEMD_ONLY_USERDB");
 415         if (e) {
 416                 only = strv_split(e, ":");
 417                 if (!only)
 418                         return -ENOMEM;
 419         }
 420
 421         /* First, let's talk to the multiplexer, if we can */
 422         if ((flags & (USERDB_AVOID_MULTIPLEXER|USERDB_AVOID_DYNAMIC_USER|USERDB_AVOID_NSS|USERDB_DONT_SYNTHESIZE)) == 0 &&
 423             !strv_contains(except, "io.systemd.Multiplexer") &&
 424             (!only || strv_contains(only, "io.systemd.Multiplexer"))) {
 425                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = json_variant_ref(query);
 426
 427                 r = json_variant_set_field_string(&patched_query, "service", "io.systemd.Multiplexer");
 428                 if (r < 0)
 429                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 430
 431                 r = userdb_connect(iterator, "/run/systemd/userdb/io.systemd.Multiplexer", method, more, patched_query);
 432                 if (r >= 0) {
 433                         iterator->nss_covered = true; /* The multiplexer does NSS */
 434                         return 0;
 435                 }
 436         }
 437
 438         d = opendir("/run/systemd/userdb/");
 439         if (!d) {
 440                 if (errno == ENOENT)
 441                         return -ESRCH;
 442
 443                 return -errno;
 444         }
 445
 446         FOREACH_DIRENT(de, d, return -errno) {
 447                 _cleanup_(json_variant_unrefp) JsonVariant *patched_query = NULL;
 448                 _cleanup_free_ char *p = NULL;
 449                 bool is_nss;
 450
 451                 if (streq(de->d_name, "io.systemd.Multiplexer")) /* We already tried this above, don't try this again */
 452                         continue;
 453
 454                 if (FLAGS_SET(flags, USERDB_AVOID_DYNAMIC_USER) &&
 455                     streq(de->d_name, "io.systemd.DynamicUser"))
 456                         continue;
 457
 458                 /* Avoid NSS is this is requested. Note that we also skip NSS when we were asked to skip the
 459                  * multiplexer, since in that case it's safer to do NSS in the client side emulation below
 460                  * (and when we run as part of systemd-userdbd.service we don't want to talk to ourselves
 461                  * anyway). */
 462                 is_nss = streq(de->d_name, "io.systemd.NameServiceSwitch");
 463                 if ((flags & (USERDB_AVOID_NSS|USERDB_AVOID_MULTIPLEXER)) && is_nss)
 464                         continue;
 465
 466                 if (strv_contains(except, de->d_name))
 467                         continue;
 468
 469                 if (only && !strv_contains(only, de->d_name))
 470                         continue;
 471
 472                 p = path_join("/run/systemd/userdb/", de->d_name);
 473                 if (!p)
 474                         return -ENOMEM;
 475
 476                 patched_query = json_variant_ref(query);
 477                 r = json_variant_set_field_string(&patched_query, "service", de->d_name);
 478                 if (r < 0)
 479                         return log_debug_errno(r, "Unable to set service JSON field: %m");
 480
 481                 r = userdb_connect(iterator, p, method, more, patched_query);
 482                 if (is_nss && r >= 0) /* Turn off fallback NSS if we found the NSS service and could connect
 483                                        * to it */
 484                         iterator->nss_covered = true;
 485
 486                 if (ret == 0 && r < 0)
 487                         ret = r;
 488         }
 489
 490         if (set_isempty(iterator->links))
 491                 return ret; /* propagate last error we saw if we couldn't connect to anything. */
 492
 493         /* We connected to some services, in this case, ignore the ones we failed on */
 494         return 0;
 495 }
 496
 497 static int userdb_process(
 498                 UserDBIterator *iterator,
 499                 UserRecord **ret_user_record,
 500                 GroupRecord **ret_group_record,
 501                 char **ret_user_name,
 502                 char **ret_group_name) {
 503
 504         int r;
 505
 506         assert(iterator);
 507
 508         for (;;) {
 509                 if (iterator->what == LOOKUP_USER && iterator->found_user) {
 510                         if (ret_user_record)
 511                                 *ret_user_record = TAKE_PTR(iterator->found_user);
 512                         else
 513                                 iterator->found_user = user_record_unref(iterator->found_user);
 514
 515                         if (ret_group_record)
 516                                 *ret_group_record = NULL;
 517                         if (ret_user_name)
 518                                 *ret_user_name = NULL;
 519                         if (ret_group_name)
 520                                 *ret_group_name = NULL;
 521
 522                         return 0;
 523                 }
 524
 525                 if (iterator->what == LOOKUP_GROUP && iterator->found_group) {
 526                         if (ret_group_record)
 527                                 *ret_group_record = TAKE_PTR(iterator->found_group);
 528                         else
 529                                 iterator->found_group = group_record_unref(iterator->found_group);
 530
 531                         if (ret_user_record)
 532                                 *ret_user_record = NULL;
 533                         if (ret_user_name)
 534                                 *ret_user_name = NULL;
 535                         if (ret_group_name)
 536                                 *ret_group_name = NULL;
 537
 538                         return 0;
 539                 }
 540
 541                 if (iterator->what == LOOKUP_MEMBERSHIP && iterator->found_user_name && iterator->found_group_name) {
 542                         if (ret_user_name)
 543                                 *ret_user_name = TAKE_PTR(iterator->found_user_name);
 544                         else
 545                                 iterator->found_user_name = mfree(iterator->found_user_name);
 546
 547                         if (ret_group_name)
 548                                 *ret_group_name = TAKE_PTR(iterator->found_group_name);
 549                         else
 550                                 iterator->found_group_name = mfree(iterator->found_group_name);
 551
 552                         if (ret_user_record)
 553                                 *ret_user_record = NULL;
 554                         if (ret_group_record)
 555                                 *ret_group_record = NULL;
 556
 557                         return 0;
 558                 }
 559
 560                 if (set_isempty(iterator->links)) {
 561                         if (iterator->error == 0)
 562                                 return -ESRCH;
 563
 564                         return -abs(iterator->error);
 565                 }
 566
 567                 if (!iterator->event)
 568                         return -ESRCH;
 569
 570                 r = sd_event_run(iterator->event, UINT64_MAX);
 571                 if (r < 0)
 572                         return r;
 573         }
 574 }
 575
 576 static int synthetic_root_user_build(UserRecord **ret) {
 577         return user_record_build(
 578                         ret,
 579                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING("root")),
 580                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(0)),
 581                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 582                                           JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING("/root")),
 583                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 584 }
 585
 586 static int synthetic_nobody_user_build(UserRecord **ret) {
 587         return user_record_build(
 588                         ret,
 589                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(NOBODY_USER_NAME)),
 590                                           JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(UID_NOBODY)),
 591                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 592                                           JSON_BUILD_PAIR("shell", JSON_BUILD_STRING(NOLOGIN)),
 593                                           JSON_BUILD_PAIR("locked", JSON_BUILD_BOOLEAN(true)),
 594                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 595 }
 596
 597 int userdb_by_name(const char *name, UserDBFlags flags, UserRecord **ret) {
 598         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 599         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 600         int r;
 601
 602         if (!valid_user_group_name(name, VALID_USER_RELAX))
 603                 return -EINVAL;
 604
 605         r = json_build(&query, JSON_BUILD_OBJECT(
 606                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
 607         if (r < 0)
 608                 return r;
 609
 610         iterator = userdb_iterator_new(LOOKUP_USER);
 611         if (!iterator)
 612                 return -ENOMEM;
 613
 614         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 615         if (r >= 0) {
 616                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 617                 if (r >= 0)
 618                         return r;
 619         }
 620
 621         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !iterator->nss_covered) {
 622                 /* Make sure the NSS lookup doesn't recurse back to us. */
 623
 624                 r = userdb_iterator_block_nss_systemd(iterator);
 625                 if (r >= 0) {
 626                         /* Client-side NSS fallback */
 627                         r = nss_user_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 628                         if (r >= 0)
 629                                 return r;
 630                 }
 631         }
 632
 633         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 634                 if (streq(name, "root"))
 635                         return synthetic_root_user_build(ret);
 636
 637                 if (streq(name, NOBODY_USER_NAME) && synthesize_nobody())
 638                         return synthetic_nobody_user_build(ret);
 639         }
 640
 641         return r;
 642 }
 643
 644 int userdb_by_uid(uid_t uid, UserDBFlags flags, UserRecord **ret) {
 645         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 646         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 647         int r;
 648
 649         if (!uid_is_valid(uid))
 650                 return -EINVAL;
 651
 652         r = json_build(&query, JSON_BUILD_OBJECT(
 653                                        JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid))));
 654         if (r < 0)
 655                 return r;
 656
 657         iterator = userdb_iterator_new(LOOKUP_USER);
 658         if (!iterator)
 659                 return -ENOMEM;
 660
 661         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", false, query, flags);
 662         if (r >= 0) {
 663                 r = userdb_process(iterator, ret, NULL, NULL, NULL);
 664                 if (r >= 0)
 665                         return r;
 666         }
 667
 668         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !iterator->nss_covered) {
 669                 r = userdb_iterator_block_nss_systemd(iterator);
 670                 if (r >= 0) {
 671                         /* Client-side NSS fallback */
 672                         r = nss_user_record_by_uid(uid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 673                         if (r >= 0)
 674                                 return r;
 675                 }
 676         }
 677
 678         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 679                 if (uid == 0)
 680                         return synthetic_root_user_build(ret);
 681
 682                 if (uid == UID_NOBODY && synthesize_nobody())
 683                         return synthetic_nobody_user_build(ret);
 684         }
 685
 686         return r;
 687 }
 688
 689 int userdb_all(UserDBFlags flags, UserDBIterator **ret) {
 690         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 691         int r;
 692
 693         assert(ret);
 694
 695         iterator = userdb_iterator_new(LOOKUP_USER);
 696         if (!iterator)
 697                 return -ENOMEM;
 698
 699         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 700
 701         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetUserRecord", true, NULL, flags);
 702
 703         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 704                 r = userdb_iterator_block_nss_systemd(iterator);
 705                 if (r < 0)
 706                         return r;
 707
 708                 setpwent();
 709                 iterator->nss_iterating = true;
 710         } else if (r < 0)
 711                 return r;
 712
 713         *ret = TAKE_PTR(iterator);
 714         return 0;
 715 }
 716
 717 int userdb_iterator_get(UserDBIterator *iterator, UserRecord **ret) {
 718         int r;
 719
 720         assert(iterator);
 721         assert(iterator->what == LOOKUP_USER);
 722
 723         if (iterator->nss_iterating) {
 724                 struct passwd *pw;
 725
 726                 /* If NSS isn't covered elsewhere, let's iterate through it first, since it probably contains
 727                  * the more traditional sources, which are probably good to show first. */
 728
 729                 pw = getpwent();
 730                 if (pw) {
 731                         _cleanup_free_ char *buffer = NULL;
 732                         bool incomplete = false;
 733                         struct spwd spwd;
 734
 735                         if (streq_ptr(pw->pw_name, "root"))
 736                                 iterator->synthesize_root = false;
 737                         if (pw->pw_uid == UID_NOBODY)
 738                                 iterator->synthesize_nobody = false;
 739
 740                         r = nss_spwd_for_passwd(pw, &spwd, &buffer);
 741                         if (r < 0) {
 742                                 log_debug_errno(r, "Failed to acquire shadow entry for user %s, ignoring: %m", pw->pw_name);
 743                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 744                         }
 745
 746                         r = nss_passwd_to_user_record(pw, r >= 0 ? &spwd : NULL, ret);
 747                         if (r < 0)
 748                                 return r;
 749
 750                         if (ret)
 751                                 (*ret)->incomplete = incomplete;
 752                         return r;
 753                 }
 754
 755                 if (errno != 0)
 756                         log_debug_errno(errno, "Failure to iterate NSS user database, ignoring: %m");
 757
 758                 iterator->nss_iterating = false;
 759                 endpwent();
 760         }
 761
 762         r = userdb_process(iterator, ret, NULL, NULL, NULL);
 763
 764         if (r < 0) {
 765                 if (iterator->synthesize_root) {
 766                         iterator->synthesize_root = false;
 767                         iterator->n_found++;
 768                         return synthetic_root_user_build(ret);
 769                 }
 770
 771                 if (iterator->synthesize_nobody) {
 772                         iterator->synthesize_nobody = false;
 773                         iterator->n_found++;
 774                         return synthetic_nobody_user_build(ret);
 775                 }
 776         }
 777
 778         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 779         if (r < 0 && iterator->n_found > 0)
 780                 return -ESRCH;
 781
 782         return r;
 783 }
 784
 785 static int synthetic_root_group_build(GroupRecord **ret) {
 786         return group_record_build(
 787                         ret,
 788                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING("root")),
 789                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(0)),
 790                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 791 }
 792
 793 static int synthetic_nobody_group_build(GroupRecord **ret) {
 794         return group_record_build(
 795                         ret,
 796                         JSON_BUILD_OBJECT(JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(NOBODY_GROUP_NAME)),
 797                                           JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(GID_NOBODY)),
 798                                           JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("intrinsic"))));
 799 }
 800
 801 int groupdb_by_name(const char *name, UserDBFlags flags, GroupRecord **ret) {
 802         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 803         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 804         int r;
 805
 806         if (!valid_user_group_name(name, VALID_USER_RELAX))
 807                 return -EINVAL;
 808
 809         r = json_build(&query, JSON_BUILD_OBJECT(
 810                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
 811         if (r < 0)
 812                 return r;
 813
 814         iterator = userdb_iterator_new(LOOKUP_GROUP);
 815         if (!iterator)
 816                 return -ENOMEM;
 817
 818         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 819         if (r >= 0) {
 820                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 821                 if (r >= 0)
 822                         return r;
 823         }
 824
 825         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 826                 r = userdb_iterator_block_nss_systemd(iterator);
 827                 if (r >= 0) {
 828                         r = nss_group_record_by_name(name, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 829                         if (r >= 0)
 830                                 return r;
 831                 }
 832         }
 833
 834         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 835                 if (streq(name, "root"))
 836                         return synthetic_root_group_build(ret);
 837
 838                 if (streq(name, NOBODY_GROUP_NAME) && synthesize_nobody())
 839                         return synthetic_nobody_group_build(ret);
 840         }
 841
 842         return r;
 843 }
 844
 845 int groupdb_by_gid(gid_t gid, UserDBFlags flags, GroupRecord **ret) {
 846         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 847         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 848         int r;
 849
 850         if (!gid_is_valid(gid))
 851                 return -EINVAL;
 852
 853         r = json_build(&query, JSON_BUILD_OBJECT(
 854                                        JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid))));
 855         if (r < 0)
 856                 return r;
 857
 858         iterator = userdb_iterator_new(LOOKUP_GROUP);
 859         if (!iterator)
 860                 return -ENOMEM;
 861
 862         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", false, query, flags);
 863         if (r >= 0) {
 864                 r = userdb_process(iterator, NULL, ret, NULL, NULL);
 865                 if (r >= 0)
 866                         return r;
 867         }
 868
 869         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && !(iterator && iterator->nss_covered)) {
 870                 r = userdb_iterator_block_nss_systemd(iterator);
 871                 if (r >= 0) {
 872                         r = nss_group_record_by_gid(gid, !FLAGS_SET(flags, USERDB_AVOID_SHADOW), ret);
 873                         if (r >= 0)
 874                                 return r;
 875                 }
 876         }
 877
 878         if (!FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE)) {
 879                 if (gid == 0)
 880                         return synthetic_root_group_build(ret);
 881
 882                 if (gid == GID_NOBODY && synthesize_nobody())
 883                         return synthetic_nobody_group_build(ret);
 884         }
 885
 886         return r;
 887 }
 888
 889 int groupdb_all(UserDBFlags flags, UserDBIterator **ret) {
 890         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 891         int r;
 892
 893         assert(ret);
 894
 895         iterator = userdb_iterator_new(LOOKUP_GROUP);
 896         if (!iterator)
 897                 return -ENOMEM;
 898
 899         iterator->synthesize_root = iterator->synthesize_nobody = !FLAGS_SET(flags, USERDB_DONT_SYNTHESIZE);
 900
 901         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetGroupRecord", true, NULL, flags);
 902
 903         if (!FLAGS_SET(flags, USERDB_AVOID_NSS) && (r < 0 || !iterator->nss_covered)) {
 904                 r = userdb_iterator_block_nss_systemd(iterator);
 905                 if (r < 0)
 906                         return r;
 907
 908                 setgrent();
 909                 iterator->nss_iterating = true;
 910         } if (r < 0)
 911                   return r;
 912
 913         *ret = TAKE_PTR(iterator);
 914         return 0;
 915 }
 916
 917 int groupdb_iterator_get(UserDBIterator *iterator, GroupRecord **ret) {
 918         int r;
 919
 920         assert(iterator);
 921         assert(iterator->what == LOOKUP_GROUP);
 922
 923         if (iterator->nss_iterating) {
 924                 struct group *gr;
 925
 926                 errno = 0;
 927                 gr = getgrent();
 928                 if (gr) {
 929                         _cleanup_free_ char *buffer = NULL;
 930                         bool incomplete = false;
 931                         struct sgrp sgrp;
 932
 933                         if (streq_ptr(gr->gr_name, "root"))
 934                                 iterator->synthesize_root = false;
 935                         if (gr->gr_gid == GID_NOBODY)
 936                                 iterator->synthesize_nobody = false;
 937
 938                         r = nss_sgrp_for_group(gr, &sgrp, &buffer);
 939                         if (r < 0) {
 940                                 log_debug_errno(r, "Failed to acquire shadow entry for group %s, ignoring: %m", gr->gr_name);
 941                                 incomplete = ERRNO_IS_PRIVILEGE(r);
 942                         }
 943
 944                         r = nss_group_to_group_record(gr, r >= 0 ? &sgrp : NULL, ret);
 945                         if (r < 0)
 946                                 return r;
 947
 948                         if (ret)
 949                                 (*ret)->incomplete = incomplete;
 950                         return r;
 951                 }
 952
 953                 if (errno != 0)
 954                         log_debug_errno(errno, "Failure to iterate NSS group database, ignoring: %m");
 955
 956                 iterator->nss_iterating = false;
 957                 endgrent();
 958         }
 959
 960         r = userdb_process(iterator, NULL, ret, NULL, NULL);
 961         if (r < 0) {
 962                 if (iterator->synthesize_root) {
 963                         iterator->synthesize_root = false;
 964                         iterator->n_found++;
 965                         return synthetic_root_group_build(ret);
 966                 }
 967
 968                 if (iterator->synthesize_nobody) {
 969                         iterator->synthesize_nobody = false;
 970                         iterator->n_found++;
 971                         return synthetic_nobody_group_build(ret);
 972                 }
 973         }
 974
 975         /* if we found at least one entry, then ignore errors and indicate that we reached the end */
 976         if (r < 0 && iterator->n_found > 0)
 977                 return -ESRCH;
 978
 979         return r;
 980 }
 981
 982 int membershipdb_by_user(const char *name, UserDBFlags flags, UserDBIterator **ret) {
 983         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
 984         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
 985         int r;
 986
 987         assert(ret);
 988
 989         if (!valid_user_group_name(name, VALID_USER_RELAX))
 990                 return -EINVAL;
 991
 992         r = json_build(&query, JSON_BUILD_OBJECT(
 993                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(name))));
 994         if (r < 0)
 995                 return r;
 996
 997         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
 998         if (!iterator)
 999                 return -ENOMEM;
1000
1001         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
1002         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1003                 goto finish;
1004
1005         r = userdb_iterator_block_nss_systemd(iterator);
1006         if (r < 0)
1007                 return r;
1008
1009         iterator->filter_user_name = strdup(name);
1010         if (!iterator->filter_user_name)
1011                 return -ENOMEM;
1012
1013         setgrent();
1014         iterator->nss_iterating = true;
1015
1016         r = 0;
1017
1018 finish:
1019         if (r >= 0)
1020                 *ret = TAKE_PTR(iterator);
1021         return r;
1022 }
1023
1024 int membershipdb_by_group(const char *name, UserDBFlags flags, UserDBIterator **ret) {
1025         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1026         _cleanup_(json_variant_unrefp) JsonVariant *query = NULL;
1027         _cleanup_(group_record_unrefp) GroupRecord *gr = NULL;
1028         int r;
1029
1030         assert(ret);
1031
1032         if (!valid_user_group_name(name, VALID_USER_RELAX))
1033                 return -EINVAL;
1034
1035         r = json_build(&query, JSON_BUILD_OBJECT(
1036                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(name))));
1037         if (r < 0)
1038                 return r;
1039
1040         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1041         if (!iterator)
1042                 return -ENOMEM;
1043
1044         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, query, flags);
1045         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1046                 goto finish;
1047
1048         r = userdb_iterator_block_nss_systemd(iterator);
1049         if (r < 0)
1050                 return r;
1051
1052         /* We ignore all errors here, since the group might be defined by a userdb native service, and we queried them already above. */
1053         (void) nss_group_record_by_name(name, false, &gr);
1054         if (gr) {
1055                 iterator->members_of_group = strv_copy(gr->members);
1056                 if (!iterator->members_of_group)
1057                         return -ENOMEM;
1058
1059                 iterator->index_members_of_group = 0;
1060
1061                 iterator->found_group_name = strdup(name);
1062                 if (!iterator->found_group_name)
1063                         return -ENOMEM;
1064         }
1065
1066         r = 0;
1067
1068 finish:
1069         if (r >= 0)
1070                 *ret = TAKE_PTR(iterator);
1071
1072         return r;
1073 }
1074
1075 int membershipdb_all(UserDBFlags flags, UserDBIterator **ret) {
1076         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1077         int r;
1078
1079         assert(ret);
1080
1081         iterator = userdb_iterator_new(LOOKUP_MEMBERSHIP);
1082         if (!iterator)
1083                 return -ENOMEM;
1084
1085         r = userdb_start_query(iterator, "io.systemd.UserDatabase.GetMemberships", true, NULL, flags);
1086         if ((r >= 0 && iterator->nss_covered) || FLAGS_SET(flags, USERDB_AVOID_NSS))
1087                 goto finish;
1088
1089         r = userdb_iterator_block_nss_systemd(iterator);
1090         if (r < 0)
1091                 return r;
1092
1093         setgrent();
1094         iterator->nss_iterating = true;
1095
1096         r = 0;
1097
1098 finish:
1099         if (r >= 0)
1100                 *ret = TAKE_PTR(iterator);
1101
1102         return r;
1103 }
1104
1105 int membershipdb_iterator_get(
1106                 UserDBIterator *iterator,
1107                 char **ret_user,
1108                 char **ret_group) {
1109
1110         int r;
1111
1112         assert(iterator);
1113
1114         for (;;) {
1115                 /* If we are iteratring through NSS acquire a new group entry if we haven't acquired one yet. */
1116                 if (!iterator->members_of_group) {
1117                         struct group *g;
1118
1119                         if (!iterator->nss_iterating)
1120                                 break;
1121
1122                         assert(!iterator->found_user_name);
1123                         do {
1124                                 errno = 0;
1125                                 g = getgrent();
1126                                 if (!g) {
1127                                         if (errno != 0)
1128                                                 log_debug_errno(errno, "Failure during NSS group iteration, ignoring: %m");
1129                                         break;
1130                                 }
1131
1132                         } while (iterator->filter_user_name ? !strv_contains(g->gr_mem, iterator->filter_user_name) :
1133                                                               strv_isempty(g->gr_mem));
1134
1135                         if (g) {
1136                                 r = free_and_strdup(&iterator->found_group_name, g->gr_name);
1137                                 if (r < 0)
1138                                         return r;
1139
1140                                 if (iterator->filter_user_name)
1141                                         iterator->members_of_group = strv_new(iterator->filter_user_name);
1142                                 else
1143                                         iterator->members_of_group = strv_copy(g->gr_mem);
1144                                 if (!iterator->members_of_group)
1145                                         return -ENOMEM;
1146
1147                                 iterator->index_members_of_group = 0;
1148                         } else {
1149                                 iterator->nss_iterating = false;
1150                                 endgrent();
1151                                 break;
1152                         }
1153                 }
1154
1155                 assert(iterator->found_group_name);
1156                 assert(iterator->members_of_group);
1157                 assert(!iterator->found_user_name);
1158
1159                 if (iterator->members_of_group[iterator->index_members_of_group]) {
1160                         _cleanup_free_ char *cu = NULL, *cg = NULL;
1161
1162                         if (ret_user) {
1163                                 cu = strdup(iterator->members_of_group[iterator->index_members_of_group]);
1164                                 if (!cu)
1165                                         return -ENOMEM;
1166                         }
1167
1168                         if (ret_group) {
1169                                 cg = strdup(iterator->found_group_name);
1170                                 if (!cg)
1171                                         return -ENOMEM;
1172                         }
1173
1174                         if (ret_user)
1175                                 *ret_user = TAKE_PTR(cu);
1176
1177                         if (ret_group)
1178                                 *ret_group = TAKE_PTR(cg);
1179
1180                         iterator->index_members_of_group++;
1181                         return 0;
1182                 }
1183
1184                 iterator->members_of_group = strv_free(iterator->members_of_group);
1185                 iterator->found_group_name = mfree(iterator->found_group_name);
1186         }
1187
1188         r = userdb_process(iterator, NULL, NULL, ret_user, ret_group);
1189         if (r < 0 && iterator->n_found > 0)
1190                 return -ESRCH;
1191
1192         return r;
1193 }
1194
1195 int membershipdb_by_group_strv(const char *name, UserDBFlags flags, char ***ret) {
1196         _cleanup_(userdb_iterator_freep) UserDBIterator *iterator = NULL;
1197         _cleanup_strv_free_ char **members = NULL;
1198         int r;
1199
1200         assert(name);
1201         assert(ret);
1202
1203         r = membershipdb_by_group(name, flags, &iterator);
1204         if (r < 0)
1205                 return r;
1206
1207         for (;;) {
1208                 _cleanup_free_ char *user_name = NULL;
1209
1210                 r = membershipdb_iterator_get(iterator, &user_name, NULL);
1211                 if (r == -ESRCH)
1212                         break;
1213                 if (r < 0)
1214                         return r;
1215
1216                 r = strv_consume(&members, TAKE_PTR(user_name));
1217                 if (r < 0)
1218                         return r;
1219         }
1220
1221         strv_sort(members);
1222         strv_uniq(members);
1223
1224         *ret = TAKE_PTR(members);
1225         return 0;
1226 }
1227
1228 int userdb_block_nss_systemd(int b) {
1229         _cleanup_(dlclosep) void *dl = NULL;
1230         int (*call)(bool b);
1231
1232         /* Note that we might be called from libnss_systemd.so.2 itself, but that should be fine, really. */
1233
1234         dl = dlopen(ROOTLIBDIR "libnss_systemd.so.2", RTLD_LAZY|RTLD_NODELETE);
1235         if (!dl) {
1236                 /* If the file isn't installed, don't complain loudly */
1237                 log_debug("Failed to dlopen(libnss_systemd.so.2), ignoring: %s", dlerror());
1238                 return 0;
1239         }
1240
1241         call = (int (*)(bool b)) dlsym(dl, "_nss_systemd_block");
1242         if (!call)
1243                 /* If the file is is installed but lacks the symbol we expect, things are weird, let's complain */
1244                 return log_debug_errno(SYNTHETIC_ERRNO(ELIBBAD),
1245                                        "Unable to find symbol _nss_systemd_block in libnss_systemd.so.2: %s", dlerror());
1246
1247         return call(b);
1248 }