From b2c8372d32ab2ddf6fd28b62fb528c06bd1a279e Mon Sep 17 00:00:00 2001 From: Reilly Brogan Date: Fri, 9 Oct 2026 22:38:03 -0500 Subject: [PATCH] nss-systemd: copy PASSWORD_SEE_SHADOW into the group record buffer nss_pack_group_record() left gr_passwd pointing at PASSWORD_SEE_SHADOW, which is part of the module's read-only .rodata. That breaks callers that modify the returned group before freeing it, in particular pam_modutil_cleanup_group(), which zeroes gr_passwd when the PAM handle is torn down and then segfaults on read-only memory. Copy the placeholder into the caller-provided buffer, as nss_pack_user_record() already does. (cherry picked from commit c7a8e871de3427cf654d9a608dc58663874197bb) --- src/nss-systemd/userdb-glue.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/nss-systemd/userdb-glue.c b/src/nss-systemd/userdb-glue.c index 5bc89d5f9b..dbe2c40d4d 100644 --- a/src/nss-systemd/userdb-glue.c +++ b/src/nss-systemd/userdb-glue.c @@ -229,6 +229,8 @@ int nss_pack_group_record( assert(g->group_name); required = strlen(g->group_name) + 1; + required += strlen(PASSWORD_SEE_SHADOW) + 1; + STRV_FOREACH(m, g->members) { required += sizeof(char*); /* space for ptr array entry */ required += strlen(*m) + 1; @@ -267,12 +269,14 @@ int nss_pack_group_record( array[n] = NULL; *gr = (struct group) { - .gr_name = strcpy(p, g->group_name), + .gr_name = p, .gr_gid = g->gid, - .gr_passwd = (char*) PASSWORD_SEE_SHADOW, .gr_mem = array, }; + gr->gr_passwd = stpcpy(gr->gr_name, g->group_name) + 1; + strcpy(gr->gr_passwd, PASSWORD_SEE_SHADOW); + return 0; }