Lennart Poettering
bfc0cc1a25
We want user records to be extensible, hence we shouldn't complain about fields we can't parse. In particular we want them to be extensible for our own future extensions. Some code already turned the permissive flag when parsing the JSON data, but most did not. Fix that. A few select cases remain where the bit is not set: where we just gnerated the JSON data ourselves, and thus can be reasonably sure that if we can't parse it it's our immediate programming error and not just us processing a user record from some other tool or a newer version of ourselves.
305 lines
10 KiB
C
305 lines
10 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include "errno-util.h"
|
|
#include "fd-util.h"
|
|
#include "fileio.h"
|
|
#include "format-util.h"
|
|
#include "path-util.h"
|
|
#include "stdio-util.h"
|
|
#include "user-util.h"
|
|
#include "userdb-dropin.h"
|
|
|
|
static int load_user(
|
|
FILE *f,
|
|
const char *path,
|
|
const char *name,
|
|
uid_t uid,
|
|
UserDBFlags flags,
|
|
UserRecord **ret) {
|
|
|
|
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
|
|
_cleanup_(user_record_unrefp) UserRecord *u = NULL;
|
|
bool have_privileged;
|
|
int r;
|
|
|
|
assert(f);
|
|
|
|
r = json_parse_file(f, path, 0, &v, NULL, NULL);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (FLAGS_SET(flags, USERDB_SUPPRESS_SHADOW) || !path || !(name || uid_is_valid(uid)))
|
|
have_privileged = false;
|
|
else {
|
|
_cleanup_(json_variant_unrefp) JsonVariant *privileged_v = NULL;
|
|
_cleanup_free_ char *d = NULL, *j = NULL;
|
|
|
|
/* Let's load the "privileged" section from a companion file. But only if USERDB_AVOID_SHADOW
|
|
* is not set. After all, the privileged section kinda takes the role of the data from the
|
|
* shadow file, hence it makes sense to use the same flag here.
|
|
*
|
|
* The general assumption is that whoever provides these records makes the .user file
|
|
* world-readable, but the .privilege file readable to root and the assigned UID only. But we
|
|
* won't verify that here, as it would be too late. */
|
|
|
|
r = path_extract_directory(path, &d);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (name) {
|
|
j = strjoin(d, "/", name, ".user-privileged");
|
|
if (!j)
|
|
return -ENOMEM;
|
|
} else {
|
|
assert(uid_is_valid(uid));
|
|
if (asprintf(&j, "%s/" UID_FMT ".user-privileged", d, uid) < 0)
|
|
return -ENOMEM;
|
|
}
|
|
|
|
r = json_parse_file(NULL, j, JSON_PARSE_SENSITIVE, &privileged_v, NULL, NULL);
|
|
if (ERRNO_IS_PRIVILEGE(r))
|
|
have_privileged = false;
|
|
else if (r == -ENOENT)
|
|
have_privileged = true; /* if the privileged file doesn't exist, we are complete */
|
|
else if (r < 0)
|
|
return r;
|
|
else {
|
|
r = json_variant_merge(&v, privileged_v);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
have_privileged = true;
|
|
}
|
|
}
|
|
|
|
u = user_record_new();
|
|
if (!u)
|
|
return -ENOMEM;
|
|
|
|
r = user_record_load(
|
|
u, v,
|
|
USER_RECORD_REQUIRE_REGULAR|
|
|
USER_RECORD_ALLOW_PER_MACHINE|
|
|
USER_RECORD_ALLOW_BINDING|
|
|
USER_RECORD_ALLOW_SIGNATURE|
|
|
(have_privileged ? USER_RECORD_ALLOW_PRIVILEGED : 0)|
|
|
USER_RECORD_PERMISSIVE);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (name && !streq_ptr(name, u->user_name))
|
|
return -EINVAL;
|
|
|
|
if (uid_is_valid(uid) && uid != u->uid)
|
|
return -EINVAL;
|
|
|
|
u->incomplete = !have_privileged;
|
|
|
|
if (ret)
|
|
*ret = TAKE_PTR(u);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int dropin_user_record_by_name(const char *name, const char *path, UserDBFlags flags, UserRecord **ret) {
|
|
_cleanup_free_ char *found_path = NULL;
|
|
_cleanup_fclose_ FILE *f = NULL;
|
|
int r;
|
|
|
|
assert(name);
|
|
|
|
if (path) {
|
|
f = fopen(path, "re");
|
|
if (!f)
|
|
return errno == ENOENT ? -ESRCH : -errno; /* We generally want ESRCH to indicate no such user */
|
|
} else {
|
|
const char *j;
|
|
|
|
j = strjoina(name, ".user");
|
|
if (!filename_is_valid(j)) /* Doesn't qualify as valid filename? Then it's definitely not provided as a drop-in */
|
|
return -ESRCH;
|
|
|
|
r = search_and_fopen_nulstr(j, "re", NULL, USERDB_DROPIN_DIR_NULSTR("userdb"), &f, &found_path);
|
|
if (r == -ENOENT)
|
|
return -ESRCH;
|
|
if (r < 0)
|
|
return r;
|
|
|
|
path = found_path;
|
|
}
|
|
|
|
return load_user(f, path, name, UID_INVALID, flags, ret);
|
|
}
|
|
|
|
int dropin_user_record_by_uid(uid_t uid, const char *path, UserDBFlags flags, UserRecord **ret) {
|
|
_cleanup_free_ char *found_path = NULL;
|
|
_cleanup_fclose_ FILE *f = NULL;
|
|
int r;
|
|
|
|
assert(uid_is_valid(uid));
|
|
|
|
if (path) {
|
|
f = fopen(path, "re");
|
|
if (!f)
|
|
return errno == ENOENT ? -ESRCH : -errno;
|
|
} else {
|
|
char buf[DECIMAL_STR_MAX(uid_t) + STRLEN(".user") + 1];
|
|
|
|
xsprintf(buf, UID_FMT ".user", uid);
|
|
/* Note that we don't bother to validate this as a filename, as this is generated from a decimal
|
|
* integer, i.e. is definitely OK as a filename */
|
|
|
|
r = search_and_fopen_nulstr(buf, "re", NULL, USERDB_DROPIN_DIR_NULSTR("userdb"), &f, &found_path);
|
|
if (r == -ENOENT)
|
|
return -ESRCH;
|
|
if (r < 0)
|
|
return r;
|
|
|
|
path = found_path;
|
|
}
|
|
|
|
return load_user(f, path, NULL, uid, flags, ret);
|
|
}
|
|
|
|
static int load_group(
|
|
FILE *f,
|
|
const char *path,
|
|
const char *name,
|
|
gid_t gid,
|
|
UserDBFlags flags,
|
|
GroupRecord **ret) {
|
|
|
|
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
|
|
_cleanup_(group_record_unrefp) GroupRecord *g = NULL;
|
|
bool have_privileged;
|
|
int r;
|
|
|
|
assert(f);
|
|
|
|
r = json_parse_file(f, path, 0, &v, NULL, NULL);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (FLAGS_SET(flags, USERDB_SUPPRESS_SHADOW) || !path || !(name || gid_is_valid(gid)))
|
|
have_privileged = false;
|
|
else {
|
|
_cleanup_(json_variant_unrefp) JsonVariant *privileged_v = NULL;
|
|
_cleanup_free_ char *d = NULL, *j = NULL;
|
|
|
|
r = path_extract_directory(path, &d);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (name) {
|
|
j = strjoin(d, "/", name, ".group-privileged");
|
|
if (!j)
|
|
return -ENOMEM;
|
|
} else {
|
|
assert(gid_is_valid(gid));
|
|
if (asprintf(&j, "%s/" GID_FMT ".group-privileged", d, gid) < 0)
|
|
return -ENOMEM;
|
|
}
|
|
|
|
r = json_parse_file(NULL, j, JSON_PARSE_SENSITIVE, &privileged_v, NULL, NULL);
|
|
if (ERRNO_IS_PRIVILEGE(r))
|
|
have_privileged = false;
|
|
else if (r == -ENOENT)
|
|
have_privileged = true; /* if the privileged file doesn't exist, we are complete */
|
|
else if (r < 0)
|
|
return r;
|
|
else {
|
|
r = json_variant_merge(&v, privileged_v);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
have_privileged = true;
|
|
}
|
|
}
|
|
|
|
g = group_record_new();
|
|
if (!g)
|
|
return -ENOMEM;
|
|
|
|
r = group_record_load(
|
|
g, v,
|
|
USER_RECORD_REQUIRE_REGULAR|
|
|
USER_RECORD_ALLOW_PER_MACHINE|
|
|
USER_RECORD_ALLOW_BINDING|
|
|
USER_RECORD_ALLOW_SIGNATURE|
|
|
(have_privileged ? USER_RECORD_ALLOW_PRIVILEGED : 0)|
|
|
USER_RECORD_PERMISSIVE);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (name && !streq_ptr(name, g->group_name))
|
|
return -EINVAL;
|
|
|
|
if (gid_is_valid(gid) && gid != g->gid)
|
|
return -EINVAL;
|
|
|
|
g->incomplete = !have_privileged;
|
|
|
|
if (ret)
|
|
*ret = TAKE_PTR(g);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int dropin_group_record_by_name(const char *name, const char *path, UserDBFlags flags, GroupRecord **ret) {
|
|
_cleanup_free_ char *found_path = NULL;
|
|
_cleanup_fclose_ FILE *f = NULL;
|
|
int r;
|
|
|
|
assert(name);
|
|
|
|
if (path) {
|
|
f = fopen(path, "re");
|
|
if (!f)
|
|
return errno == ENOENT ? -ESRCH : -errno;
|
|
} else {
|
|
const char *j;
|
|
|
|
j = strjoina(name, ".group");
|
|
if (!filename_is_valid(j)) /* Doesn't qualify as valid filename? Then it's definitely not provided as a drop-in */
|
|
return -ESRCH;
|
|
|
|
r = search_and_fopen_nulstr(j, "re", NULL, USERDB_DROPIN_DIR_NULSTR("userdb"), &f, &found_path);
|
|
if (r == -ENOENT)
|
|
return -ESRCH;
|
|
if (r < 0)
|
|
return r;
|
|
|
|
path = found_path;
|
|
}
|
|
|
|
return load_group(f, path, name, GID_INVALID, flags, ret);
|
|
}
|
|
|
|
int dropin_group_record_by_gid(gid_t gid, const char *path, UserDBFlags flags, GroupRecord **ret) {
|
|
_cleanup_free_ char *found_path = NULL;
|
|
_cleanup_fclose_ FILE *f = NULL;
|
|
int r;
|
|
|
|
assert(gid_is_valid(gid));
|
|
|
|
if (path) {
|
|
f = fopen(path, "re");
|
|
if (!f)
|
|
return errno == ENOENT ? -ESRCH : -errno;
|
|
} else {
|
|
char buf[DECIMAL_STR_MAX(gid_t) + STRLEN(".group") + 1];
|
|
|
|
xsprintf(buf, GID_FMT ".group", gid);
|
|
|
|
r = search_and_fopen_nulstr(buf, "re", NULL, USERDB_DROPIN_DIR_NULSTR("userdb"), &f, &found_path);
|
|
if (r == -ENOENT)
|
|
return -ESRCH;
|
|
if (r < 0)
|
|
return r;
|
|
|
|
path = found_path;
|
|
}
|
|
|
|
return load_group(f, path, NULL, gid, flags, ret);
|
|
}
|