From: dongshengyuan <545258830@qq.com>
Date: Tue, 4 Aug 2026 01:58:17 +0000 (+0800)
Subject: userdb: apply UUID filters to group records
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fsystemd.git

userdb: apply UUID filters to group records

group_record_match() handled the other filters, but ignored match->uuid,
so userdbctl group --uuid=... could still return non-matching groups.

Add the same UUID check used by user_record_match().

Reproduced locally:
build/userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa \
  --output=json group root

Before result:
The command succeeded and printed the root group record.

Follow-up for: 466562c69b75cec197176f556b940a43bb8350f2
---

diff --git a/src/shared/group-record.c b/src/shared/group-record.c
index 361030f5a27..1c431adf16b 100644
--- a/src/shared/group-record.c
+++ b/src/shared/group-record.c
@@ -372,6 +372,9 @@ bool group_record_match(GroupRecord *h, const UserDBMatch *match) {
         if (!BIT_SET(match->disposition_mask, group_record_disposition(h)))
                 return false;
 
+        if (!sd_id128_is_null(match->uuid) && !sd_id128_equal(match->uuid, h->uuid))
+                return false;
+
         if (!strv_isempty(match->fuzzy_names)) {
                 const char* names[] = {
                         h->group_name,
diff --git a/src/shared/userdb.c b/src/shared/userdb.c
index 7dd9ac7496f..e3487fbb628 100644
--- a/src/shared/userdb.c
+++ b/src/shared/userdb.c
@@ -203,6 +203,7 @@ static int userdb_maybe_restart_query(
         static const char *const fields[] = {
                 "fuzzyNames",
                 "dispositionMask",
+                "uuid",
                 "uidMin",
                 "uidMax",
                 "gidMin",
diff --git a/src/shared/varlink-io.systemd.UserDatabase.c b/src/shared/varlink-io.systemd.UserDatabase.c
index bdcba2be8a9..c20d3068589 100644
--- a/src/shared/varlink-io.systemd.UserDatabase.c
+++ b/src/shared/varlink-io.systemd.UserDatabase.c
@@ -18,6 +18,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL(
                 SD_VARLINK_DEFINE_INPUT(uidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("Maximum UID to restrict search too."),
                 SD_VARLINK_DEFINE_INPUT(uidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."),
+                SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."),
                 SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0),
                 SD_VARLINK_FIELD_COMMENT("The retrieved user record."),
@@ -41,6 +43,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL(
                 SD_VARLINK_DEFINE_INPUT(gidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("Maximum GID to restrict search too."),
                 SD_VARLINK_DEFINE_INPUT(gidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."),
+                SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."),
                 SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0),
                 SD_VARLINK_FIELD_COMMENT("The retrieved group record."),
diff --git a/test/units/TEST-74-AUX-UTILS.userdbctl.sh b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
index dd57c6fee56..c1746903d0d 100755
--- a/test/units/TEST-74-AUX-UTILS.userdbctl.sh
+++ b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
@@ -55,6 +55,9 @@ assert_eq "$(userdbctl user 2147352576 -j | jq -r .userName)" foreign-0
 assert_eq "$(userdbctl user 2147352577 -j | jq -r .userName)" foreign-1
 assert_eq "$(userdbctl user 2147418110 -j | jq -r .userName)" foreign-65534
 
+(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa user root)
+(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa group root)
+
 # Make sure that -F shows same data as if we'd ask directly
 userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root)
 userdbctl user test-74-userdbctl -j | userdbctl -F- user | cmp - <(userdbctl user test-74-userdbctl)