grp/initgroups.c

   1 /* Copyright (C) 1989, 1991-2017 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3
   4    The GNU C Library is free software; you can redistribute it and/or
   5    modify it under the terms of the GNU Lesser General Public
   6    License as published by the Free Software Foundation; either
   7    version 2.1 of the License, or (at your option) any later version.
   8
   9    The GNU C Library is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12    Lesser General Public License for more details.
  13
  14    You should have received a copy of the GNU Lesser General Public
  15    License along with the GNU C Library; if not, see
  16    <http://www.gnu.org/licenses/>.  */
  17
  18 #include <assert.h>
  19 #include <errno.h>
  20 #include <grp.h>
  21 #include <limits.h>
  22 #include <stdlib.h>
  23 #include <string.h>
  24 #include <unistd.h>
  25 #include <sys/param.h>
  26 #include <sys/types.h>
  27 #include <nsswitch.h>
  28 #include <scratch_buffer.h>
  29
  30 #include "../nscd/nscd-client.h"
  31 #include "../nscd/nscd_proto.h"
  32
  33
  34 /* Type of the lookup function.  */
  35 typedef enum nss_status (*initgroups_dyn_function) (const char *, gid_t,
  36                                                     long int *, long int *,
  37                                                     gid_t **, long int, int *);
  38
  39 /* The lookup function for the first entry of this service.  */
  40 extern int __nss_group_lookup (service_user **nip, const char *name,
  41                                    void **fctp);
  42 extern void *__nss_lookup_function (service_user *ni, const char *fct_name);
  43
  44 extern service_user *__nss_group_database attribute_hidden;
  45 service_user *__nss_initgroups_database;
  46 static bool use_initgroups_entry;
  47
  48
  49 #include "compat-initgroups.c"
  50
  51
  52 static int
  53 internal_getgrouplist (const char *user, gid_t group, long int *size,
  54                        gid_t **groupsp, long int limit)
  55 {
  56 #ifdef USE_NSCD
  57   if (__nss_not_use_nscd_group > 0
  58       && ++__nss_not_use_nscd_group > NSS_NSCD_RETRY)
  59     __nss_not_use_nscd_group = 0;
  60   if (!__nss_not_use_nscd_group
  61       && !__nss_database_custom[NSS_DBSIDX_group])
  62     {
  63       int n = __nscd_getgrouplist (user, group, size, groupsp, limit);
  64       if (n >= 0)
  65         return n;
  66
  67       /* nscd is not usable.  */
  68       __nss_not_use_nscd_group = 1;
  69     }
  70 #endif
  71
  72   enum nss_status status = NSS_STATUS_UNAVAIL;
  73   int no_more = 0;
  74
  75   /* Never store more than the starting *SIZE number of elements.  */
  76   assert (*size > 0);
  77   (*groupsp)[0] = group;
  78   /* Start is one, because we have the first group as parameter.  */
  79   long int start = 1;
  80
  81   if (__nss_initgroups_database == NULL)
  82     {
  83       if (__nss_database_lookup ("initgroups", NULL, "",
  84                                  &__nss_initgroups_database) < 0)
  85         {
  86           if (__nss_group_database == NULL)
  87             no_more = __nss_database_lookup ("group", NULL, "compat files",
  88                                              &__nss_group_database);
  89
  90           __nss_initgroups_database = __nss_group_database;
  91         }
  92       else
  93         use_initgroups_entry = true;
  94     }
  95   else
  96     /* __nss_initgroups_database might have been set through
  97        __nss_configure_lookup in which case use_initgroups_entry was
  98        not set here.  */
  99     use_initgroups_entry = __nss_initgroups_database != __nss_group_database;
 100
 101   service_user *nip = __nss_initgroups_database;
 102   while (! no_more)
 103     {
 104       long int prev_start = start;
 105
 106       initgroups_dyn_function fct = __nss_lookup_function (nip,
 107                                                            "initgroups_dyn");
 108       if (fct == NULL)
 109         status = compat_call (nip, user, group, &start, size, groupsp,
 110                               limit, &errno);
 111       else
 112         status = DL_CALL_FCT (fct, (user, group, &start, size, groupsp,
 113                                     limit, &errno));
 114
 115       /* Remove duplicates.  */
 116       long int cnt = prev_start;
 117       while (cnt < start)
 118         {
 119           long int inner;
 120           for (inner = 0; inner < prev_start; ++inner)
 121             if ((*groupsp)[inner] == (*groupsp)[cnt])
 122               break;
 123
 124           if (inner < prev_start)
 125             (*groupsp)[cnt] = (*groupsp)[--start];
 126           else
 127             ++cnt;
 128         }
 129
 130       /* This is really only for debugging.  */
 131       if (NSS_STATUS_TRYAGAIN > status || status > NSS_STATUS_RETURN)
 132         __libc_fatal ("illegal status in internal_getgrouplist");
 133
 134       /* For compatibility reason we will continue to look for more
 135          entries using the next service even though data has already
 136          been found if the nsswitch.conf file contained only a 'groups'
 137          line and no 'initgroups' line.  If the latter is available
 138          we always respect the status.  This means that the default
 139          for successful lookups is to return.  */
 140       if ((use_initgroups_entry || status != NSS_STATUS_SUCCESS)
 141           && nss_next_action (nip, status) == NSS_ACTION_RETURN)
 142          break;
 143
 144       if (nip->next == NULL)
 145         no_more = -1;
 146       else
 147         nip = nip->next;
 148     }
 149
 150   return start;
 151 }
 152
 153 /* Store at most *NGROUPS members of the group set for USER into
 154    *GROUPS.  Also include GROUP.  The actual number of groups found is
 155    returned in *NGROUPS.  Return -1 if the if *NGROUPS is too small.  */
 156 int
 157 getgrouplist (const char *user, gid_t group, gid_t *groups, int *ngroups)
 158 {
 159   long int size = MAX (1, *ngroups);
 160
 161   gid_t *newgroups = (gid_t *) malloc (size * sizeof (gid_t));
 162   if (__glibc_unlikely (newgroups == NULL))
 163     /* No more memory.  */
 164     // XXX This is wrong.  The user provided memory, we have to use
 165     // XXX it.  The internal functions must be called with the user
 166     // XXX provided buffer and not try to increase the size if it is
 167     // XXX too small.  For initgroups a flag could say: increase size.
 168     return -1;
 169
 170   int total = internal_getgrouplist (user, group, &size, &newgroups, -1);
 171
 172   memcpy (groups, newgroups, MIN (*ngroups, total) * sizeof (gid_t));
 173
 174   free (newgroups);
 175
 176   int retval = total > *ngroups ? -1 : total;
 177   *ngroups = total;
 178
 179   return retval;
 180 }
 181
 182 nss_interface_function (getgrouplist)
 183
 184 /* Initialize the group set for the current user
 185    by reading the group database and using all groups
 186    of which USER is a member.  Also include GROUP.  */
 187 int
 188 initgroups (const char *user, gid_t group)
 189 {
 190 #if defined NGROUPS_MAX && NGROUPS_MAX == 0
 191
 192   /* No extra groups allowed.  */
 193   return 0;
 194
 195 #else
 196
 197   long int size;
 198   gid_t *groups;
 199   int ngroups;
 200   int result;
 201
 202  /* We always use sysconf even if NGROUPS_MAX is defined.  That way, the
 203      limit can be raised in the kernel configuration without having to
 204      recompile libc.  */
 205   long int limit = __sysconf (_SC_NGROUPS_MAX);
 206
 207   if (limit > 0)
 208     /* We limit the size of the intially allocated array.  */
 209     size = MIN (limit, 64);
 210   else
 211     /* No fixed limit on groups.  Pick a starting buffer size.  */
 212     size = 16;
 213
 214   groups = (gid_t *) malloc (size * sizeof (gid_t));
 215   if (__glibc_unlikely (groups == NULL))
 216     /* No more memory.  */
 217     return -1;
 218
 219   ngroups = internal_getgrouplist (user, group, &size, &groups, limit);
 220
 221   /* Try to set the maximum number of groups the kernel can handle.  */
 222   do
 223     result = setgroups (ngroups, groups);
 224   while (result == -1 && errno == EINVAL && --ngroups > 0);
 225
 226   free (groups);
 227
 228   return result;
 229 #endif
 230 }
 231
 232 nss_interface_function (initgroups)