Commit Graph

2616 Commits

Author SHA1 Message Date
Serge Hallyn
8492dee663 subids: support nsswitch
Closes #154

When starting any operation to do with subuid delegation, check
nsswitch for a module to use.  If none is specified, then use
the traditional /etc/subuid and /etc/subgid files.

Currently only one module is supported, and there is no fallback
to the files on errors.  Several possibilities could be considered:

1. in case of connection error, fall back to files
2. in case of unknown user, also fall back to files

etc...

When non-files nss module is used, functions to edit the range
are not supported.  It may make sense to support it, but it also
may make sense to require another tool to be used.

libsubordinateio also uses the nss_ helpers.  This is how for instance
lxc could easily be converted to supporting nsswitch.

Add a set of test cases, including a dummy libsubid_zzz module.  This
hardcodes values such that:

'ubuntu' gets 200000 - 300000
'user1' gets 100000 - 165536
'error' emulates an nss module error
'unknown' emulates a user unknown to the nss module
'conn' emulates a connection error ot the nss module

Changes to libsubid:

Change the list_owner_ranges api: return a count instead of making the array
null terminated.

This is a breaking change, so bump the libsubid abi major number.

Rename free_subuid_range and free_subgid_range to ungrant_subuid_range,
because otherwise it's confusing with free_subid_ranges which frees
    memory.

Run libsubid tests in jenkins

Switch argument order in find_subid_owners

Move the db locking into subordinateio.c

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:02:37 -05:00
Serge Hallyn
514c1328b6 try again to fix libmisc sharing problem
Issue #297 reported seeing

*** Warning: Linking the shared library libsubid.la against the
*** static library ../libmisc/libmisc.a is not portable!

which commit b5fb1b38ee was supposed
to fix.  But a few commits later it's back.  So try to fix it
in the way the bug reporter suggested.  This broke builds some
other ways, namely a few missing library specifications, so add
those.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-11 17:42:04 -05:00
Serge Hallyn
7cfe134090
Merge pull request #314 from sevan/patch-1
passwd(5): Note the use of an ampersand in the comment field
2021-03-30 10:21:17 -05:00
Iker Pedrosa
df6ec1d169
man: include lastlog file caveat (#313)
man/lastlog.8.xml: add another point to the caveats section regarding
the handling of the lastlog file by external tools.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=951564
2021-03-28 22:26:28 -05:00
Haelwenn Monnier
b865e14f25
login & su: Treat an empty passwd field as invalid (#315)
* login & su: Treat an empty passwd field as invalid

Otherwise it's treated like the “require no password” clause while it probably
should be treated like a normal su that can't validate anyway.

A similar change should be done for USE_PAM.

* su & login: Introduce PREVENT_NO_AUTH
2021-03-28 22:16:03 -05:00
Serge Hallyn
697901a328
Merge pull request #303 from breard-r/yescrypt
Add yescrypt support
2021-03-28 22:13:56 -05:00
Sevan Janiyan
9f1a43996c
Note the use of an ampersand in the comment field 2021-03-12 23:56:38 +00:00
Serge Hallyn
7273c25cc2
Merge pull request #308 from martijndegouw/relaxgidcheck
newuidmap,newgidmap: Relax gid checking to allow running under alternative group ID
2021-03-02 12:42:25 -06:00
Serge Hallyn
c0818ab01d
Merge pull request #310 from ikerexxe/upstream_man_clarifications
Man clarifications
2021-03-01 10:02:44 -06:00
Serge Hallyn
f4cbf38ad7
Merge pull request #311 from ikerexxe/upstream_userdel_clarification
userdel: clarify "-f" usage
2021-03-01 09:59:14 -06:00
ikerexxe
0409c91a7f userdel: clarify "-f" usage
src/userdel.c: clarify the examples for "-f" option
2021-02-23 12:21:42 +01:00
ikerexxe
4faf42b31b man: usermod clarification
man/usermod.8.xml: specify what happens when the current home directory
doesn't exist if using -d and -m options. Moreover, specify what happens
when the group ownership is changed and the uid's don't match in -u and
-g options.
2021-02-18 16:08:27 +01:00
ikerexxe
786e44f6dd man: useradd clarification
man/useradd.8.xml: specify the SELinux requirements for -m option.
2021-02-18 16:08:27 +01:00
ikerexxe
bc22009031 man: shadow clarification
man/shadow.5.xml: indicate the exact time and timezone for the dates.
Moreover, clarify that when the password expires the user won't be able
to login.
2021-02-18 16:08:27 +01:00
ikerexxe
4ea269d23e man: groupadd and groupmod clarification
man/groupadd.8.xml: clarify the exit values meaning.
man/groupmod.8.xml: clarify the E_GID_IN_USE value meaning.
2021-02-18 16:07:03 +01:00
Serge Hallyn
f28660f5dd
Merge pull request #307 from glysbaysb/usermod-shell-path
usermod: check if shell is know
2021-02-08 10:03:11 -06:00
Martijn de Gouw
246d5c1c25 Add tests for group checking in newuidmap/newgidmap 2021-02-08 13:32:18 +01:00
Martijn de Gouw
c464ec5570 newuidmap,newgidmap: Relax gid checking to allow running under alternative group ID
Signed-off-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
2021-02-08 13:32:18 +01:00
Geert Ijewski
b628850a09 usermod expects a path
Closes #307
2021-02-07 19:31:49 +01:00
Geert Ijewski
fe159b7668 usermod: check if shell exists & is executable 2021-02-07 19:26:55 +01:00
ikerexxe
325bf584ce man: chage clarification
man/chage.1.xml: Indicate that -d option with a value of 0 forces the
user to change his password. Besides, set an example on how to use -E
option. Finally, add a general note to clarify that chage only takes
charge of local users and another note to indicate that it doesn't check
inconsistencies between shadow and passwd files.
2021-02-02 11:35:34 +01:00
Rodolphe Bréard
5cd04d03f9 Add yescrypt support 2021-02-01 22:11:10 +01:00
Serge Hallyn
ae169c4046
Merge pull request #306 from hallyn/2021-01-01/nosubids
useradd: don't try to create 0 subuids
2021-01-01 13:10:53 -06:00
Serge Hallyn
0dffc7c612 useradd: don't try to create 0 subuids
Closes #289

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-01-01 13:10:12 -06:00
Serge Hallyn
5d53e0bf07
Merge pull request #305 from hallyn/2021-01-01/static-dynamic
libsubid: move libmisc.a to last LIBADD entry
2021-01-01 13:05:33 -06:00
Serge Hallyn
b5fb1b38ee libsubid: move libmisc.a to last LIBADD entry
Closes #297

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-01-01 13:01:54 -06:00
Serge Hallyn
c917ed7b76
Merge pull request #302 from whzhe51/br_master
useradd.c:fix memleaks of grp
2020-12-27 00:37:46 -06:00
Serge Hallyn
08f5577018
Merge pull request #301 from whzhe51/br_whzhe
useradd.c:fix memleak in get_groups
2020-12-27 00:31:30 -06:00
Serge Hallyn
1021195bfe
Merge pull request #299 from lnussel/master
useradd: use built-in settings by default
2020-12-27 00:26:47 -06:00
Serge Hallyn
a8361e7410
Merge pull request #296 from ikerexxe/log_exit_code
useradd: log exit code when failing
2020-12-27 00:18:12 -06:00
Serge Hallyn
7384865775
Merge pull request #295 from ikerexxe/newusers_clarification
newusers: doesn't create parent home directories
2020-12-27 00:16:18 -06:00
whzhe
fd9d79a1a3 useradd.c:fix memleak in get_groups
Signed-off-by: whzhe <wanghongzhe@huawei.com>
2020-12-20 22:05:03 -05:00
whzhe51
c44b71cec2 useradd.c:fix memleaks of grp
Signed-off-by: whzhe51 <wanghongzhe@huawei.com>
2020-12-20 20:14:49 -05:00
Ludwig Nussel
bbf4b79bc4 useradd: use built-in settings by default
Avoids installing inconsistent settings. The correct ones would be
written as soon as an admin uses useradd -D to modify the defaults.
2020-12-04 09:20:18 +01:00
ikerexxe
abb5c99114 useradd: log exit code when failing
src/useradd.c: log exit code when failing
2020-11-17 16:58:40 +01:00
ikerexxe
88128000c9 newusers: doesn't create parent home directories
man/newusers.8.xml: clarify that newusers doesn't create parent
directories of the new user's home directory.
2020-11-17 16:46:10 +01:00
Serge Hallyn
599cc003da
Merge pull request #293 from ikerexxe/sync_file_write
commonio: force lock file sync
2020-11-08 16:36:36 -06:00
Serge Hallyn
e7938d5a30
Merge pull request #291 from ikerexxe/covscan_issues
Two covscan issues
2020-11-08 16:33:55 -06:00
Serge Hallyn
bd32c1c8fc
Merge pull request #290 from jamincollins/master
add parsing support for advertised force long opt
2020-11-08 16:29:29 -06:00
ikerexxe
fb0f702cbf commonio: force lock file sync
lib/commonio.c: after writing to the lock file, force a file sync to
the storage system.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1862056
2020-11-05 17:15:56 +01:00
Jamin W. Collins
a04287cf24 update groupdel man page for the --force option
Signed-off-by: Jamin W. Collins <jamin.collins@gmail.com>
2020-11-01 21:22:54 -07:00
ikerexxe
569bd1d54f useradd: free grp to avoid leak
covscan issue:
Error: RESOURCE_LEAK (CWE-772): [#def39] [important]
src/useradd.c:728: alloc_fn: Storage is returned from allocation function "get_local_group".
src/useradd.c:728: var_assign: Assigning: "grp" = storage returned from "get_local_group(list)".
src/useradd.c:728: overwrite_var: Overwriting "grp" in "grp = get_local_group(list)" leaks the storage that "grp" points to.
726|   		 * GID values, otherwise the string is looked up as is.
727|   		 */
728|-> 		grp = get_local_group (list);
729|
730|   		/*
2020-10-27 11:42:34 +01:00
ikerexxe
2df8c0728d newgrp: delete dead code
covscan issue:
Error: CLANG_WARNING: [#def31]
src/newgrp.c:448:2: warning: Value stored to 'gid' is never read [deadcode.DeadStores]
	gid = getgid ();
2020-10-27 11:42:08 +01:00
Jamin W. Collins
bd4dc81a82 add parsing support for advertised force long opt
Existing help output advertises --force as a long opt.

  -f, --force                   delete group even if it is the primary group of a user

But errors when the long opt is used.

groupdel: unrecognized option '--force'

Signed-off-by: Jamin W. Collins <jamin.collins@gmail.com>
2020-10-17 09:18:30 -07:00
Serge Hallyn
f8642a1986
Merge pull request #288 from whzhe51/br_whzhe
xfree: move xfree() function to xmalloc.c
2020-10-16 09:59:34 -05:00
w00475903
e24700fd5d xfree: move xfree() function to xmalloc.c
Signed-off-by: whzhe <wanghongzhe@huawei.com>
2020-10-15 21:52:06 -04:00
Serge Hallyn
18c5c6139d
Merge pull request #286 from karelzak/defs
getdefs: add foreign (non-shadow-utils) items
2020-10-12 08:40:50 -05:00
Serge Hallyn
af0f55a625
Merge pull request #285 from masmullin2000/master
Fix the undefined xfree issue
2020-10-12 08:36:33 -05:00
Karel Zak
3f09f7b6fb getdefs: add foreign (non-shadow-utils) items
The login.defs is shared between more upstream projects (util-linux,
etc.). We need to improve compatibility between the projects do not
report valid, but foreign items.

Addresses: https://github.com/shadow-maint/shadow/issues/276
Signed-off-by: Karel Zak <kzak@redhat.com>
2020-10-08 12:30:53 +02:00
Michael Mullin
dfd19fc35b Use {} to kep more in line with code style 2020-10-03 14:23:06 -04:00