emo
/
shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

Compare commits

base: emo:v4.13
Branches Tags
emo:master
emo:v4.13
...
compare: emo:master
Branches Tags
emo:master
emo:v4.13

260 Commits
v4.13 ... master

Author SHA1 Message Date
pepe 1f0ac29e17 :( 2023-05-28 03:50:23 +00:00
Samanta Navarro dcc90658fd xgetXXbyYY: Avoid duplicated error handling block 
The error handling is performed after the loop. By just calling break it
is possible to reuse the error handling if status is not ERANGE.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-26 16:03:27 -05:00
Samanta Navarro e73a2194b3 xgetXXbyYY: Handle DUP_FUNCTION failure 
A failure of DUP_FUNCTION is already handled for non-reentrant
function wrapper. Perform the check for reentrant version as well.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-26 16:03:27 -05:00
Serge Hallyn a80b792afc sub_[ug]id_{add,remove}: fix return values 
On failure, these are meant to return 0 with errno set.  But if
an nss module is loaded, they were returning -ERRNO instead.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-26 15:16:29 -05:00
Martin Kletzander 8665fe1957 usermod: Small optimization using memmove for password unlock 
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
 2023-05-26 15:14:02 -05:00
Alejandro Colomar e3b7058110 Reorder logic to improve comprehensibility 
-  Don't else after return or fail_exit().
-  Prefer == over != (negated logic is more complex to think about it).
-  Reduce nesting when reasonable.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-05-25 21:22:08 -05:00
Alejandro Colomar 5b117d5526 newusers: Fail early 
There's no reason to report all errors.  Bail out at the first one,
which is simpler.

Suggested-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-05-25 21:22:08 -05:00
Alejandro Colomar 1957c8c881 newusers: Add missing error handling 
Some errors were being reported in stderr, but then they weren't really
being treated as errors.

If mkdir(2) for EEXIST, it's possible that the sysadmin pre-created the
user dir; don't fail.  However, let's keep a log line, for having some
notice that it happened.

Also, run chmod(2) if mkdir(2) failed for EEXIST (so transform the
'else if' into an 'if').

Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-05-25 21:22:08 -05:00
Samanta Navarro 6491fef1e0 libmisc: Use safer chroot/chdir sequence 
OpenSSH and coreutils' chroot call chroot first and then chdir. Doing it
this way is a bit safer because otherwise something could happen between
chdir and chroot to the specified path (like exchange of links) so the
working directory would not end up within the chroot environment.

This is a purely defensive measure.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-25 08:25:42 -05:00
Samanta Navarro a116e20c76 su: Prevent stack overflow in check_perms 
This is no real world security fix.

The overflow could occur if too many layered subsystems are encountered
because the function check_perms calls itself recursively.

It would already take a misconfigured system for this to achieve it.

Use an iterative approach by calling the do_check_perms in a loop
instead of calling itself recursively.

As a side note: At least GCC 13 optimized this code and already uses
a jmp in its assembler code. I could only see the stack overflow by
activating address sanitizer which prevented the optimization.

Co-developed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-25 08:25:42 -05:00
Samanta Navarro 4ad359ccc6 subsystem: Prevent endless loop 
If a user has home directory "/" and login shell "*" then login and su
enter an endless loop by constantly switching to the next subsystem.

This could also be achieved with a layered approach so just checking
for "/" as home directory is not enough to protect against such a
misconfiguration.

Just break the loop if it progressed too far. I doubt that this has
negative impact on any real setup.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-25 08:25:42 -05:00
Serge Hallyn 419cf1f1c4 def_load: avoid NULL deref 
If econf_getStringValue() fails, it will return an error and
set value to NULL.  Look for the error and avoid dereferencing
value in that case.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-22 10:23:12 +02:00
Serge Hallyn 9e854f525d def_load: split the econf from non-econf definition 
The function is completely different based on USE_CONF.  Either copy
will be easier to read if we just keep them completely separate.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-22 10:23:12 +02:00
Tobias Stoeckmann 8175b1532e Plug econf memory leaks 
You can see the memory leaks with address sanitizer if shadow is
compiled with `--enable-vendordir=/usr/etc`.

How to reproduce:

1. Prepare a custom shell file as root
```
mkdir -p /etc/shells.d
echo /bin/myshell > /etc/shells.d/custom
```

2. Run chsh as regular user
```
chsh
```

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
 2023-05-19 08:02:24 -05:00
Samanta Navarro 7321ceaf69 chsh: Verify that login shell path is absolute 
The getusershell implementation of musl returns every line within the
/etc/shells file, which even includes comments. Only consider absolute
paths for login shells.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-18 16:03:41 +02:00
Samanta Navarro 812f934e77 process_prefix_flag: Drop privileges 
Using --prefix in a setuid binary is quite dangerous. An unprivileged
user could prepare a custom shadow file in home directory. During a data
race the user could exchange directories with links which could lead to
exchange of shadow file in system's /etc directory.

This could be used for local privilege escalation.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-18 15:36:59 +02:00
bubu 1132b89236 Update French translations 
Please find attached the french updated translation of shadow-man-page,
proofread by the debian-l10n-french mailing list contributors.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-05-15 08:42:40 -05:00
Samanta Navarro 4ef4477535 get_pid.c: Use tighter validation checks 
Neither a pid_t below 1 nor a negative fd could be valid in this context.

Proof of Concept:

$ newuidmap -1 1 1 1
newuidmap: Could not open proc directory for target 4294967295

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-15 09:21:16 +02:00
Markus Hiereth a022d39d2a replace inadequate German translation of login error message 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-11 17:01:43 -05:00
Markus Hiereth bd6db6f226 Update German translations 
find the attached German message catalogue proofread by the German
language team.

Best regards
Markus

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-11 11:05:59 -05:00
Samanta Navarro 666468cc36 Remove some static char arrays 
Some strings are first written into static char arrays before passed to
functions which expect a const char pointer anyway.

It is easier to pass these strings directly as arguments.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-11 11:05:29 -05:00
Samanta Navarro 72290ede0e commonio: Use do_lock_file again 
This avoids regressions introduced with do_fcntl_lock.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-11 10:59:21 -05:00
Serge Hallyn 4abcbb056e Fix broken docbook translations 
its by default does not support xml tags inside translatable
units.  Use custom its rules from

https://www.w3.org/TR/xml-i18n-bp/#relating-docbook-plus-its

to enable the tags which are in use by docbook.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-05-10 09:15:53 +02:00
ed neville 0bce9c9808 open with O_CREAT when lock path does not exist 
Reported in #686, by wyj611 when trying to lock a file that is not
present

Lock method should be F_SETLKW rather than open file descriptor
 2023-05-08 08:16:11 -05:00
Samanta Navarro 627631bf9a commonio_open: Remove fcntl call 
The fcntl call to set FD_CLOEXEC can be performed directly with the
previously performed open call by using the O_CLOEXEC flag.

O_CLOEXEC is required by POSIX.1-2008.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-05 16:15:46 +02:00
Samanta Navarro e899e3d745 commonio_lock_nowait: Remove deprecated code 
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-05 16:15:46 +02:00
Samanta Navarro 7109b7c066 login_prompt: Simplify login_prompt API 
The only user of login_prompt is the login tool. This implies that the
first argument is always the same.

It is much easier to verify printf's format string and its argument if
both are next to each other.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-03 07:54:28 -05:00
Samanta Navarro 3010ec11ae login_prompt: Use _exit in signal handler 
Calling exit is not signal safe.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-03 07:54:28 -05:00
Samanta Navarro 8fc8de382a login_prompt: Do not parse environment variables 
Parsing optional environment variables after a login name is a feature
which is neither documented nor available in util-linux or busybox
login which are other wide spread login utilities used in Linux
distributions as reference.

Removing this feature resolves two issues:

- A memory leak exists if variables without an equal sign are used,
  because set_env creates copies on its own. This could lead to OOM
  situations in privileged part of login or may lead to heap spraying.
- Environment variables are not reset between login attempts. This
  could lead to additional environment variables set for a user who
  never intended to do so.

Proof of Concept on a system with shadow login without PAM and
util-linux agetty:

1. Provoke an invalid login, e.g. user `noone` and password `invalid`.
   This starts shadow login and subsequent inputs are passed through
   the function login_prompt.
2. Provoke an invalid login with environment variables, e.g.
   user `noone HISTFILE=/tmp/owo` and password `invalid`.
3. Log in correctly with user `root`.

Now you can see with `echo $HISTFILE` that `/tmp/owo` has been set for
the root user.

This requires a malicious failed login attempt and a successful login
within the configured login timeout (default 60 seconds).

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-05-03 07:54:28 -05:00
Samanta Navarro c0fc4d2122 libmisc/yesno.c: Fix regression 
The getline function does not return a pointer but the amount of read
characters. The error return value to check for is -1.

Set buf to NULL to avoid dereference of an uninitialized stack value.

The getline function returns -1 if size argument is NULL. Always use
a valid pointer even if size is unimportant.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-04-28 11:22:48 -05:00
Alejandro Colomar 0c4fa6ee0a libmisc, man: Drop old check and advice for complex character sets in passwords 
Add the relevant XKCD to the passwd(1) manual page.  It already explains
most of the rationale behind this patch.

Add also reference to makepasswd(1), which is a good way to generate
strong passwords.  Personally, I commonly run `makepasswd --chars 64` to
create my passwords, or 32 for passwords I need to type interactively
often.

The strength of a password is an exponential formula, where the base is
the size of the character set, and the exponent is the length of the
password.  That already shows why long passwords of just lowercase
letters are better than short Pa$sw0rdZ3.  But an even more important
point is that humans, when forced to use symbols in a password, are more
likely to do trivial substitutions on simple passwords, which doesn't
increase strength, and can instead give a false sense of strength, which
is dangerous.

Closes: <https://github.com/shadow-maint/shadow/issues/688>
Link: <https://xkcd.com/936/>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-04-27 09:16:08 +02:00
Christian Göttsche 7078ed1e0b semanage: disconnect to free libsemanage internals 
Destroying the handle does not actually disconnect, see [1].
Also free the key on user removal.

[1]: e9072e7d45/libsemanage/src/direct_api.c (L330)

Example adduser leak:

    Direct leak of 1008 byte(s) in 14 object(s) allocated from:
        #0 0x5638f2e782ae in __interceptor_malloc (./src/useradd+0xee2ae)
        #1 0x7fb5cfffad09 in dbase_file_init src/database_file.c:170:45

    Direct leak of 392 byte(s) in 7 object(s) allocated from:
        #0 0x5638f2e782ae in __interceptor_malloc (./src/useradd+0xee2ae)
        #1 0x7fb5cfffc929 in dbase_policydb_init src/database_policydb.c:187:27

    Direct leak of 144 byte(s) in 2 object(s) allocated from:
        #0 0x5638f2e782ae in __interceptor_malloc (./src/useradd+0xee2ae)
        #1 0x7fb5cfffb519 in dbase_join_init src/database_join.c:249:28

    [...]
 2023-04-26 17:52:54 -05:00
Christian Göttsche a8dd8ce6c9 commonio: free removed database entries 
Free the actual struct of the removed entry.

Example userdel report:

    Direct leak of 40 byte(s) in 1 object(s) allocated from:
        #0 0x55b230efe857 in reallocarray (./src/userdel+0xda857)
        #1 0x55b230f6041f in mallocarray ./lib/./alloc.h:97:9
        #2 0x55b230f6041f in commonio_open ./lib/commonio.c:563:7
        #3 0x55b230f39098 in open_files ./src/userdel.c:555:6
        #4 0x55b230f39098 in main ./src/userdel.c:1189:2
        #5 0x7f9b48c64189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
 2023-04-26 17:52:54 -05:00
ed neville 4e1f674c41 run_parts for groupadd and groupdel 
run_parts currently exists in useradd and userdel, this commit mirrors
the functionality with groupadd and groupdel

Hook for group{add,del} to include killing processes that have group
membership that would no longer exist to avoid membership ID reuse.
 2023-04-26 17:38:24 -05:00
lilinjie 15a64f9e7f fix typos 
Signed-off-by: lilinjie <lilinjie@uniontech.com>
 2023-04-26 17:35:58 -05:00
Alejandro Colomar e28deeb8e9 libmisc/yesno.c: Use getline(3) and rpmatch(3) 
getline(3) is much more readable than manually looping.  It has some
overhead due to the allocation of a buffer, but that shouldn't be a
problem here.  If that was a problem, we could reuse the buffer (thus
making the function non-reentrant), but I don't think that's worth the
extra complexity.

Using rpmatch(3) instead of a simple y/n test provides i18n to the
response checking.  We have a fall-back minimalistic implementation for
systems that lack this function (e.g., musl libc).

While we're at it, apply some other minor improvements to this file:

-  Remove comment saying which files use this function.  That's likely
   to get outdated.  And anyway, it's just a grep(1) away, so it doesn't
   really add any value.

-  Remove unnecessary casts to (void) that were used to verbosely ignore
   errors from stdio calls.  They add clutter without really adding much
   value to the code (or I don't see it).

-  Remove comments from the function body.  They make the function less
   readable.  Instead, centralize the description of the function into a
   man-page-like comment before the function definition.  This keeps the
   function body short and sweet.

-  Add '#include <stdbool.h>', which was missing.

-  Minor whitespace style changes (it doesn't hurt the diff at this
   point, since most of the affected lines were already touched by other
   changes, so I applied my preferred style :).

Acked-by: Samanta Navarro <ferivoz@riseup.net>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-04-26 17:32:47 -05:00
Samanta Navarro 7b686d8bd6 newgrp/useradd: always set SIGCHLD to default 
The tools newgrp and useradd expect waitpid to behave as described in
its manual page. But the notes indicate that if SIGCHLD is ignored,
waitpid behaves differently.

A user could set SIGCHLD to ignore before starting newgrp through exec.
Children of newgrp would not become zombies and their PIDs could be
reassigned before newgrp could call kill with the child pid and SIGCONT.

The useradd tool is not installed setuid, but I have added the default
there as well (copied from vipw).

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-04-26 08:27:45 -05:00
Serge Hallyn 7ed1df2e80 Update AUTHORS to add Marek Michałkiewicz 
Closes #708

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-04-24 09:01:22 +02:00
Samanta Navarro 0c83b98105 Read whole line in yes_or_no 
Do not stop after 79 characters. Read the complete line to avoid
arbitrary limitations.

Proof of Concept:

```
cat > passwd-poc << EOF
root❌0:0:root:/root:/bin/bash
root❌0:0:root:/root:/bin/bash
root❌0:0:root:/root:/bin/bash
EOF
python -c "print(80*'y')" | pwck passwd-poc
```

Two lines should still be within the file because we agreed only once
to remove a duplicated line.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
Reviewed-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
 2023-04-21 18:12:56 -05:00
Christian Göttsche c80788a3ac useradd/usermod: add --selinux-range argument 
Add a command line argument to useradd(8) and usermod(8) to specify the
MLS range for a SELinux user mapping.

Improves: #676
 2023-04-19 09:19:19 +02:00
Alejandro Colomar 97f79e3b27 CI: Make build logs more readable 
If make fails in a multi-process invocation, the log is pretty much
unreadable.  To make it readable, build as much as can be built without
failing.  Then run a single-process make again.  If we succeeded
previously, this should be a no-op.  If not, this run will stop at the
first error, which should be more readable, and will only print the few
lines we're interested in.

This has some side effects:  Now we build as much as we can, instead of
failing as early as possible; this may make CI a bit slower.  However,
it also has the benefit that you see _all_ the error messages that could
be given, instead of needing to fix the first error to see the next and
so on.

Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-04-18 09:21:09 +02:00
Iker Pedrosa 075ed522be ci: remove explicit fedora dependencies 
libbsd-devel libeconf-devel have already been added to the spec file and
they should be installed by the `dnf builddep` command.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-13 13:05:32 +02:00
Iker Pedrosa e047a3acc6 README: add reference to contribution guidelines 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa 981bb8f9d1 doc: add contributions introduction 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa f6f14a2a83 doc: add license 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa 29df94eb4a doc: add releases 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa 6ceddd9205 doc: add Continuous Integration 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa 77c6cc9857 doc: add tests 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa d40c58dc3b doc: add coding style 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Iker Pedrosa 1f15ea5955 doc: add build & install 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-04-03 10:42:22 -05:00
Serge Hallyn 30f3ea4bd3 trivial: vipw.8: fix grammar 
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
 2023-04-03 13:06:14 +02:00
Christian Göttsche 2eee4c67f5 sssd: skip flushing if executable does not exist 
Avoid unnecessary syslog output, like:

    Apr 01 13:35:09 dlaptop userdel[45872]: userdel: sss_cache exited with status 1
    Apr 01 13:35:09 dlaptop userdel[45872]: userdel: Failed to flush the sssd cache.
 2023-04-03 13:05:30 +02:00
Christian Göttsche 2eaea70111 Overhaul valid_field() 
e5905c4b ("Added control character check") introduced checking for
control characters but had the logic inverted, so it rejects all
characters that are not control ones.

Cast the character to `unsigned char` before passing to the character
checking functions to avoid UB.

Use strpbrk(3) for the illegal character test and return early.
 2023-03-31 09:53:40 -05:00
Martin Kletzander a5f9ef8b7f semanage: Do not set default SELinux range 
Both semanage and libsemanage actually set the user's mls range to the
default of the seuser, which makes more sense and removes a bit of code
for usermod and useradd.  More fine-grained details must always be set
with some other tool
(semanage) anyway.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
 2023-03-31 16:13:02 +02:00
Michael Vetter b44d7f78e0 Fix typo in groupadd usage 2023-03-31 16:04:42 +02:00
Christian Göttsche 189a01f7a7 ci: update Differential ShellCheck 
Run on pushes and drop unnecessary write access.

Should avoid pull-requests comments like
https://github.com/shadow-maint/shadow/pull/695#issuecomment-1491876950
 2023-03-31 15:54:39 +02:00
tomspiderlabs e5905c4b84 Added control character check 
Added control character check, returning -1 (to "err") if control characters are present.
 2023-03-30 19:23:00 -05:00
Mike Gilbert bd2d0079c9 usermod: respect --prefix for --gid option 
The --gid option accepts a group name or id. When a name is provided, it
is resolved to an id by looking up the name in the group database
(/etc/group).

The --prefix option overides the location of the passwd and group
databases. I suspect the --gid option was overlooked when wiring up the
--prefix option.

useradd --gid already respects --prefix; this change makes usermod
behave the same way.

Fixes: b6b2c756c9
Signed-off-by: Mike Gilbert <floppym@gentoo.org>
 2023-03-29 09:05:23 +02:00
Alejandro Colomar 4c210a29bc Fix su(1) silent truncation 
*  src/su.c (check_perms): Do not silently truncate user name.

Reported-by: Paul Eggert <eggert@cs.ucla.edu>
Co-developed-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Alejandro Colomar 1d7d94ed7d Simplify is_my_tty() 
This commit will serve to document why we shouldn't worry about the
truncation in the call to strlcpy(3).  Since we have one more byte in
tmptty than in full_tty, truncation will produce a string that is at
least one byte longer than full_tty.  Such a string could never compare
equal, so we're actually handling the truncation in a clever way.  Maybe
too clever, but that's why I'm documenting it here.

Now, about the simplification itself:

Since we made sure that both full_tty and tmptty are null-terminated, we
can call strcmp(3) instead of strncmp(3).  We can also simplify the
return logic avoiding one branch.

Cc: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Alejandro Colomar e27ca53091 Fix is_my_tty() buffer overrun 
*  libmisc/utmp.c (is_my_tty): Declare the parameter as a char array,
   not char *, as it is not necessarily null-terminated.
   Avoid a read overrun when reading 'tty', which comes from
   'ut_utname'.

Reported-by: Paul Eggert <eggert@cs.ucla.edu>
Co-developed-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Alejandro Colomar 664d361fa5 Add STRLEN(): a constexpr strlen(3) for string literals 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Alejandro Colomar 03af2940f7 Fix crash with large timestamps 
*  libmisc/date_to_str.c (date_to_str): Do not crash if gmtime(3)
   returns NULL because the timestamp is far in the future.

Reported-by: Paul Eggert <eggert@cs.ucla.edu>
Co-developed-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Paul Eggert ea3d49506f Prefer strcpy(3) to strlcpy(3) when either works 
* lib/gshadow.c (sgetsgent): Use strcpy(3) not strlcpy(3),
since the string is known to fit.

Signed-off-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Paul Eggert a926a26f0c Fix change_field() buffer underrun 
* lib/fields.c (change_field): Don't point
before array start; that has undefined behavior.

Signed-off-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Paul Eggert 690ca8c238 Omit unneeded test in change_field() 
* fields.c (change_field): Omit unnecessary test.

Signed-off-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
Paul Eggert 5686d9162e Simplify change_field() by using strcpy 
* lib/fields.c (change_field): Since we know the string fits,
use strcpy(3) rather than strlcpy(3).

Signed-off-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-28 13:00:38 +02:00
skyler-ferrante c089196e15 Fix null dereference in basename 
On older kernels (<=linux-5.17), argv[0] can be null. Basename would
call strrchr with null if argc==0. Fixes issue #680
 2023-03-27 10:10:37 -05:00
Iker Pedrosa 300d6ef45c CI: script for local container build 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-26 12:45:34 -05:00
Iker Pedrosa d4f31a5b3e CI: build project in containers 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-26 12:45:34 -05:00
Iker Pedrosa 411a66476d container: add fedora 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-26 12:45:34 -05:00
Iker Pedrosa 3efab2039f container: add debian 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-26 12:45:34 -05:00
Iker Pedrosa baff19767d container: add alpine 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-26 12:45:34 -05:00
Iker Pedrosa 53a4bda9ba SECURITY.md: add Iker Pedrosa 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-03-20 10:54:45 -05:00
Christian Göttsche f2c4949707 selinux: use type safe function pointer assignment 2023-03-20 08:47:52 +01:00
Christian Göttsche 37bf59067f Use strict prototype in definition 
gettime.c:25:30: warning: a function declaration without a prototype is deprecated in all versions of C [-Wstrict-prototypes]
    /*@observer@*/time_t gettime ()
                                 ^
                                  void
 2023-03-20 08:47:52 +01:00
Vinícius dos Santos Oliveira e638841f5a Add .editorconfig 2023-03-02 16:33:06 -06:00
Serge Hallyn 61ca915ac5 run_some: fix shellcheck warning 
shellcheck warns against using echo with flags, as posix sh won't
support it.  It suggests using printf, so let's do that.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-27 21:38:45 -06:00
Serge Hallyn 6d03bbea96 fail on any run_some test failure 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-27 21:38:45 -06:00
Serge Hallyn add4ab4bf0 ignore first test in run_some 
bc github...

For some reason, the first test - ONLY on github - seems to not
give the '$ ' prompt expected when you spawn 'su testsuite'.
So just run the first test twice, and ignore the first failure.
 2023-02-27 21:38:45 -06:00
Serge Hallyn 4da831c02f swap first two tests - does the first one still fail? 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-27 21:38:45 -06:00
Serge Hallyn 421c6cf951 tests: remove some github runner PATH tweaking 
It messes with the expected results.

We can do better than this in the expect scripts, but let's
get things running for now.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-27 21:38:45 -06:00
Alejandro Colomar a72065a108 tests: Support git-worktree(1) 
git-worktree(1) uses a regular file for <.git>, instead of a directory.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-27 14:16:50 -06:00
Serge Hallyn 4445cee19d tests: newuidmap and newgidmap: update expected fail message 
The failure message got changed, but the tests looking for it did
not.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 21:46:29 -06:00
Serge Hallyn aa15bc445e libsubid: include alloc.h 
Fixes: efbbcade43: Use safer allocation macros
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 21:27:02 -06:00
Serge Hallyn 9a9e163e71 run_some: log stderr 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 20:11:14 -06:00
Vinícius dos Santos Oliveira 05e2adf509 Validate fds created by the user 
write_mapping() will do the following:

openat(proc_dir_fd, map_file, O_WRONLY);

An attacker could create a directory containing a symlink named
"uid_map" pointing to any file owned by root, and thus allow him to
overwrite any root-owned file.
 2023-02-24 16:20:57 -06:00
Serge Hallyn 7ff33fae6f get_pidfd_from_fd: return -1 on error, not 0 
Fixes: 6974df39a: newuidmap and newgidmap: support passing pid as fd
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 13:54:54 -06:00
Serge Hallyn 17efd59252 g-h-a workflow: workaround 
Skip updating grub packages that are currently breaking
apt-get dist-upgrade.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 13:27:57 -06:00
Serge Hallyn e4e3212122 Fix regression in some translation strings 
Fixes: d80df2c8a: Update translation
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 12:56:05 -06:00
Iker Pedrosa 3b3d3e5cd4 lib: bit_ceil_wrapul(): stop recursion 
It should call bit_ceilul() instead of itself.

Fixes: 0712b236c3 ("Add bit manipulation functions")
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-02-24 12:44:14 -06:00
Iker Pedrosa 21d88b4525 lib: define ULONG_WIDTH if non-existent 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2023-02-24 12:44:14 -06:00
maqi d80df2c8a0 Update translation 2023-02-24 12:41:50 -06:00
Serge Hallyn 6974df39a7 newuidmap and newgidmap: support passing pid as fd 
Closes #635

newuidmap and newgidmap currently take an integner pid as
the first argument, determining the process id on which to
act.  Accept also "fd:N", where N must be an open file
descriptor to the /proc/pid directory for the process to
act upon.  This way, if you

exec 10</proc/99
newuidmap fd:10 100000 0 65536

and pid 99 dies and a new process happens to take pid 99 before
newuidmap happens to do its work, then since newuidmap will use
openat() using fd 10, it won't change the mapping for the new
process.

Example:

// terminal 1:
serge@jerom ~/src/nsexec$ ./nsexec -W -s 0 -S 0 -U
about to unshare with 10000000
Press any key to exec (I am 129176)

// terminal 2:
serge@jerom ~/src/shadow$ exec 10</proc/129176
serge@jerom ~/src/shadow$ sudo chown root src/newuidmap src/newgidmap
serge@jerom ~/src/shadow$ sudo chmod u+s src/newuidmap
serge@jerom ~/src/shadow$ sudo chmod u+s src/newgidmap
serge@jerom ~/src/shadow$ ./src/newuidmap fd:10 0 100000 10
serge@jerom ~/src/shadow$ ./src/newgidmap fd:10 0 100000 10

// Terminal 1:
uid=0(root) gid=0(root) groups=0(root)

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-24 12:35:49 -06:00
Alejandro Colomar 7668f77439 Fix use-after-free of pointer after realloc(3) 
We can't use a pointer that was input to realloc(3), nor any pointers
that point to reallocated memory, without making sure that the memory
wasn't moved.  If we do, the Behavior is Undefined.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar efbbcade43 Use safer allocation macros 
Use of these macros, apart from the benefits mentioned in the commit
that adds the macros, has some other good side effects:

-  Consistency in getting the size of the object from sizeof(type),
   instead of a mix of sizeof(type) sometimes and sizeof(*p) other
   times.

-  More readable code: no casts, and no sizeof(), so also shorter lines
   that we don't need to cut.

-  Consistency in using array allocation calls for allocations of arrays
   of objects, even when the object size is 1.

Cc: Valentin V. Bartenev <vbartenev@gmail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 6e58c12752 libmisc: Add safer allocation macros 
This macros have several benefits over the standard functions:

-  The type of the allocated object (not the pointer) is specified as an
   argument, which improves readability:
   -  It is directly obvious what is the type of the object just by
      reading the macro call.
   -  It allows grepping for all allocations of a given type.

   This is admittedly similar to using sizeof() to get the size of the
   object, but we'll see why this is better.

-  In the case of reallocation macros, an extra check is performed to
   make sure that the previous pointer was compatible with the allocated
   type, which can avoid some mistakes.

-  The cast is performed automatically, with a pointer type derived from
   the type of the object.  This is the best point of this macro, since
   it does an automatic cast, where there's no chance of typos.

   Usually, programmers have to decide whether to cast or not the result
   of malloc(3).  Casts usually hide warnings, so are to be avoided.
   However, these functions already return a void *, so a cast doesn't
   really add much danger.  Moreover, a cast can even add warnings in
   this exceptional case, if the type of the cast is different than the
   type of the assigned pointer.  Performing a manual cast is still not
   perfect, since there are chances that a mistake will be done, and
   even ignoring accidents, they clutter code, hurting readability.
   And now we have a cast that is synced with sizeof.

-  Whenever the type of the object changes, since we perform an explicit
   cast to the old type, there will be a warning due to type mismatch in
   the assignment, so we'll be able to see all lines that are affected
   by such a change.  This is especially important, since changing the
   type of a variable and missing to update an allocation call far away
   from the declaration is easy, and the consequences can be quite bad.

Cc: Valentin V. Bartenev <vbartenev@gmail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar f332379ea0 Use xreallocarray() instead of its pattern 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 190a702225 Use reallocarrayf() instead of its pattern 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 191f04f7dc Use *array() allocation functions where appropriate 
This prevents overflow from multiplication.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 727275a027 Use xcalloc(3) instead of its pattern 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar d81506de1e libmisc: Add safer allocation functions 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 881c1d63a1 libmisc: Move xmalloc.c to alloc.c 
We'll expand the contents in a following commit, so let's move the file
to a more generic name, have a dedicated header, and update includes.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

Use the new header for xstrdup()

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar a578617cc0 Use calloc(3) instead of its pattern 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 1aa22c1467 Use reallocarray(3) instead of its pattern 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 45c0003e53 Use reallocf(3) instead of its pattern 
In addition, don't set local variables just before return.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 56e4842db0 malloc(3) already sets errno to ENOMEM 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 0e1d017993 Rely on realloc(NULL, ...) being equivalent to malloc(...) 
This is guaranteed by ISO C.  Now that we require ISO C (and even POSIX)
to compile, we can simplify this code.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-23 20:28:43 -06:00
Alejandro Colomar 5c5dc75641 libmisc: agetpass(): Fix bug detecting truncation 
On 2/19/23 18:09, David Mudrich wrote:
> I am working on a RAM based Linux OS from source, and try to use
> latest versions of all software.  I found shadow needs libbsd's
> readpassphrase(3) as superior alternative to getpass(3).  While
> considering if I a) include libbsd, or include libbsd's code of
> readpassphrase(3) into shadow, found, that libbsd's readpassphrase(3)
> never returns \n or \r
> <https://cgit.freedesktop.org/libbsd/tree/src/readpassphrase.c>
> line 122, while agetpass() uses a check for \n in agetpass.c line 108.
> I assume it always fails.

Indeed, it always failed.  I made a mistake when writing agetpass(),
assuming that readpassphrase(3) would keep newlines.

>
> I propose a check of len == PASS_MAX - 1, with false positive error for
> exactly PASS_MAX - 1 long passwords.

Instead, I added an extra byte to the allocation to allow a maximum
password length of PASS_MAX (which is the maximum for getpass(3), which
we're replacing.

While doing that, I notice that my previous implementation also had
another bug (minor): The maximum password length was PASS_MAX - 1
instead of PASS_MAX.  That's also fixed in this commit.

Reported-by: David Mudrich <dmudrich@gmx.de>
Fixes: 155c9421b9 ("libmisc: agetpass(), erase_pass(): Add functions for getting passwords safely")
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-20 12:16:01 +01:00
Martin Kletzander baae5b4a06 find_new_[gu]id(): Skip over IDs that are reserved for legacy reasons 
Some programs don't support `(uint16_t) -1` or `(uint32_t) -1` as user
or group IDs.  This is because `-1` is used as an error code or as an
unspecified ID, e.g. in `chown(2)` parameters, and in the past, `gid_t`
and `uid_t` have changed width.  For legacy reasons, those values have
been kept reserved in programs today (for example systemd does this; see
the documentation in the link below).

This should not be confused with catching overflow in the ID values,
since that is already caught by our ERANGE checks.  This is about not
using reserved values that have been reserved for legacy reasons.

Link: <https://systemd.io/UIDS-GIDS/>
Reviewed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
 2023-02-20 12:10:02 +01:00
Samanta Navarro 0dfeb9e674 Fix comments 
These comments should indicate which functions they really wrap.
An alternative would be to remove the line completely to avoid
future copy&paste mistakes.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-16 13:23:08 -06:00
Samanta Navarro c53b36fe85 Fix grammar 
Use proper grammar (third-person singular).

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-16 13:23:08 -06:00
Samanta Navarro b8ea76ba72 Fix typo 
It should be "if" not "is".

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-16 13:23:08 -06:00
Samanta Navarro d5d1932370 Fix typos 
It is a user, not an user.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-16 13:23:08 -06:00
Alejandro Colomar 5956cea1d1 Use stpecpy() where appropriate 
This function simplifies the calculation of the bounds of the buffer for
catenating strings.  It would also reduce error checking, but we don't
care about truncation in this specific code. :)

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar 709e6b4497 Add stpecpy() 
strncat(3), strlcpy(3), and many other functions are often misused for
catenating strings, when they should never be used for that.  strlcat(3)
is good.  However, there's no equivalent to strlcat(3) similar to
snprintf(3).  Let's add stpecpy(), which is similar to strlcat(3), but
it is also the only function compatible with stpeprintf(), which makes
it more useful than strlcat(3).

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar e0e9e57a72 Add mempcpy(3) 
We'll use it for implementing stpecpy(), and may be interesting to have
it around.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar 8a9285aacb Remove unnecessary NUL terminators 
All the string-copying functions called above do terminate the strings
they create with a NUL byte.  Writing it again at the end of the buffer
is unnecessary paranoid code.  Let's remove it.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar 46610792e9 Use stpeprintf() where appropriate 
This function allows reducing error checking (since errors are
propagated across chained calls), and also simplifies the calculation of
the start and end of the buffer where the string should be written.

Moreover, the new code is more optimized, since many calls to strlen(3)
have been removed.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar 7e213cfb50 Add stpeprintf() 
[v]stpeprintf() are similar to [v]snprintf(3), but they allow chaining.
[v]snprintf(3) are very dangerous for catenating strings, since the
obvious ways to do it invoke Undefined Behavior, and the ways that avoid
UB are very error-prone.

Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Alejandro Colomar a187ad8e9e agetpass.c: Use SPDX tags 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-16 11:29:33 +01:00
Martin Kletzander ca9e309d30 Fix VPATH build 
When trying to build shadow in a different directory I stumbled upon few
issues, this commit aims to fix all of them:

- The `subid.h` file is generated and hence in the build directory and
	not in the source directory, so use `$(builddir)` instead of
	`$(srcdir)`.

- Using `$<` instead of filenames utilises autotools to locate the files
  in either the source or build directory automatically.

- `xsltproc` needs to access the files in login.defs.d in either the
  source directory or the symlink in a language subdirectory, but it
	does not interpret the `--path` as prefix of the entity path, but
	rather a path under which to locate the basename of the entity
	from the XML file.  So specify the whole path to login.defs.d.

- The above point could be used to make the symlinks of login.defs.d
  and entity path specifications in the XMLs obsolete, but I trying
	not to propose possibly disrupting patches, so for the sake of
	simplicity just specify `$(srcdir)` when creating the symlink.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
 2023-02-13 10:01:17 +01:00
Alejandro Colomar 5da8388fc6 ttytype(): Fix race 
The intention of the code is just to not report an error message when
'typefile' doesn't exist.  If we call access(2) and then fopen(2),
there's a race.  It's not a huge problem, and the worst thing that can
happen is reporting an error when the file has been removed after
access(2).  It's not a problem, but we can fix the race and at the same
time clarify the intention of not warning about ENOENT and also remove
one syscall.  Seems like a win-win.

Suggested-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-09 10:03:03 -06:00
Alejandro Colomar bddcd9b095 Remove superfluous casts 
-  Every non-const pointer converts automatically to void *.
-  Every pointer converts automatically to void *.
-  void * converts to any other pointer.
-  const void * converts to any other const pointer.
-  Integer variables convert to each other.

I changed the declaration of a few variables in order to allow removing
a cast.

However, I didn't attempt to edit casts inside comparisons, since they
are very delicate.  I also kept casts in variadic functions, since they
are necessary, and in allocation functions, because I have other plans
for them.

I also changed a few casts to int that are better as ptrdiff_t.

This change has triggered some warnings about const correctness issues,
which have also been fixed in this patch (see for example src/login.c).

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-09 10:03:03 -06:00
Serge Hallyn 66daa74232 run on github runner 2023-02-09 09:55:04 -06:00
Serge Hallyn 8728bd87ed tests: print default timeout message to stderr 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-09 09:55:04 -06:00
Serge Hallyn 6a51e6893e use self-hosted runner for testsuite 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-09 09:55:04 -06:00
Alejandro Colomar 416707b087 Use the noreturn attribute, rather than comments 
This will allow the compiler to understand these functions better.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-08 22:01:01 -06:00
Alejandro Colomar b34387745a lib/defines.h: Add NORETURN attribute macro 
We could use the standard (C11) _Noreturn qualifier, but it will be
deprecated in C23, and replaced by C++'s [[noreturn]], which is
compatible with the GCC attribute, so let's directly use the attribute,
and in the future we'll be able to switch to [[]].

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-08 22:01:01 -06:00
Alejandro Colomar e762ab8b54 Assume getutent(3) exists (remove dead code) 
Recently, we removed support for 'struct utmpx'.  We did it because utmp
and utmpx are identical, and while POSIX specifies utmpx (and not utmp),
GNU/Linux documentation seems to favor utmp.  Also, this project
defaulted to utmp, so changing to utmpx would be more dangerous than
keeping old defaults, even if it's supposed to be the same.

Now, I just found more code that didn't make much sense: lib/utent.c
provides definitions for getutent(3) and friends in case the system
doesn't provide them, but we don't provide prototypes for those
definitions, so code using the functions would have never compiled.

Let's just remove these definitions as dead code.

Fixes: 3be7b9d75a ("Remove traces of utmpx")
Fixes: 170b76cdd1 ("Disable utmpx permanently")
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-08 17:21:34 +01:00
Alejandro Colomar f301a4ca19 Handle reallocf(3) errors 
Reported-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-03 22:03:38 -06:00
Alejandro Colomar 0ec157d579 Fix memory leaks by replacing realloc(3) with reallocf(3) 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-03 22:03:38 -06:00
Alejandro Colomar 82480995b4 Remove unused function: gr_append_member() 
Reported-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-03 22:03:38 -06:00
Serge Hallyn 1058872a0b Improve TTYGROUP description in login.defs manpage 
Closes #457

The existing prose was confusing, or simply wrong.  Make it clear
that only the group ownership of the tty is affected, and how.
Also move the paragraph about defaults after the discussion of
acceptable TTYGROUPs, as this seems more natural.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-02-02 22:03:45 -06:00
Alejandro Colomar 1f6f1669cf Remove superfluous casts to 'void*' 
Every non-const pointer converts automatically to it.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-02 22:03:26 -06:00
Alejandro Colomar 62172f6fb5 Call NULL by its name 
In variadic functions we still do the cast.  In POSIX, it's not
necessary, since NULL is required to be of type 'void *', and 'void *'
is guaranteed to have the same alignment and representation as 'char *'.
However, since ISO C still doesn't mandate that, and moreover they're
doing dubious stuff by adding nullptr, let's be on the cautious side.
Also, C++ requires that NULL is _not_ 'void *', but either plain 0 or
some magic stuff.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-02 13:08:30 -06:00
Alejandro Colomar 1482224c54 Use freezero(3) where suitable 
It originated in OpenBSD, and is available in libbsd.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-02 12:04:28 +01:00
Samanta Navarro 8e0ad48c21 Prevent out of boundary access 
If lines start with '\0' then it is possible to trigger out of
boundary accesses.

Check if indices are valid before accessing them.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-01 15:47:35 -06:00
Samanta Navarro ffc480c2e9 Explicitly override only newlines 
Override only newlines with '\0' to avoid undesired truncation of
actual line content.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-01 15:47:35 -06:00
Samanta Navarro 37ae232080 Correctly handle illegal system file in tz 
If the file referenced by ENV_TZ has a zero length string, then an out
of boundary write occurs. Also the result can be wrong because it is
assumed that the file will always end with a newline.

Only override a newline character with '\0' to avoid these cases.

This cannot be considered to be security relevant because login.defs
and its contained references to system files should be trusted to begin
with.

Proof of Concept:

1. Compile shadow's su with address sanitizer and --without-libpam

2. Setup your /etc/login.defs to contain ENV_TZ=/etc/tzname

3. Prepare /etc/tzname to contain a '\0' byte at the beginning

`python -c "print('\x00')" > /etc/tzname`

4. Use su

`su -l`

You can see the following output:

`tz.c:45:8: runtime error: index 18446744073709551615 out of bounds for type 'char [8192]'`

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-02-01 15:47:35 -06:00
Alejandro Colomar 03bbe6c418 leading_zerosul(): Fix bug 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-02-01 09:10:34 +01:00
Alejandro Colomar 2a61122b5e Unoptimize the higher part of the domain of csrand_uniform() 
__int128, which is needed for optimizing that part of the range, is not
always available.  We need the unoptimized version for portability
reasons.

Closes: <https://github.com/shadow-maint/shadow/issues/634>
Fixes: 1a0e13f94e ("Optimize csrand_uniform()")
Reported-by: Adam Sampson <ats@offog.org>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-30 18:24:15 +01:00
Alejandro Colomar 0712b236c3 Add bit manipulation functions 
We do need the unoptimized version of csrand_uniform() for high values
of `n`, since the optimized version depends on having __int128, and it's
not available on several platforms, including ARMv7, IA32, and MK68k.

This reverts commit 848f53c1d3c1362c86d3baab6906e1e4419d2634; however,
I applied some tweaks to the reverted commit.

Reported-by: Adam Sampson <ats@offog.org>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-30 18:24:15 +01:00
Alejandro Colomar 848f53c1d3 Revert "Add bit manipulation functions" 
Now that we optimized csrand_uniform(), we don't need these functions.

This reverts commit 7c8fe291b1260e127c10562bfd7616961013730f.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 1a0e13f94e Optimize csrand_uniform() 
Use a different algorithm to minimize rejection.  This is essentially
the same algorithm implemented in the Linux kernel for
__get_random_u32_below(), but written in a more readable way, and
avoiding microopimizations that make it less readable.

Which (the Linux kernel implementation) is itself based on Daniel
Lemire's algorithm from "Fast Random Integer Generation in an Interval",
linked below.  However, I couldn't really understand that paper very
much, so I had to reconstruct the proofs from scratch, just from what I
could understand from the Linux kernel implementation source code.

I constructed some graphical explanation of how it works, and why it
is optimal, because I needed to visualize it to understand it.  It is
published in the GitHub pull request linked below.

Here goes a wordy explanation of why this algorithm based on
multiplication is better optimized than my original implementation based
on masking.

masking:

	It discards the extra bits of entropy that are not necessary for
	this operation.  This works as if dividing the entire space of
	possible csrand() values into smaller spaces of a size that is
	a smaller power of 2.  Each of those smaller spaces has a
	rejection band, so we get as many rejection bands as spaces
	there are.  For smaller values of 'n', the size of each
	rejection band is smaller, but having more rejection bands
	compensates for this, and results in the same inefficiency as
	for large values of 'n'.

multiplication:

	It divides the entire space of possible random numbers in
	chunks of size exactly 'n', so that there is only one rejection
	band that is the remainder of `2^64 % n`.  The worst case is
	still similar to the masking algorithm, a rejection band that is
	almost half the entire space (n = 2^63 + 1), but for lower
	values of 'n', by only having one small rejection band, it is
	much faster than the masking algorithm.

	This algorithm, however, has one caveat: the implementation
	is harder to read, since it relies on several bitwise tricky
	operations to perform operations like `2^64 % n`, `mult % 2^64`,
	and `mult / 2^64`.  And those operations are different depending
	on the number of bits of the maximum possible random number
	generated by the function.  This means that while this algorithm
	could also be applied to get uniform random numbers in the range
	[0, n-1] quickly from a function like rand(3), which only
	produces 31 bits of (non-CS) random numbers, it would need to be
	implemented differently.  However, that's not a concern for us,
	it's just a note so that nobody picks this code and expects it
	to just work with rand(3) (which BTW I tried for testing it, and
	got a bit confused until I realized this).

Finally, here's some light testing of this implementation, just to know
that I didn't goof it.  I pasted this function into a standalone
program, and run it many times to find if it has any bias (I tested also
to see how many iterations it performs, and it's also almost always 1,
but that test is big enough to not paste it here).

int main(int argc, char *argv[])
{
	printf("%lu\n", csrand_uniform(atoi(argv[1])));
}

$ seq 1 1000 | while read _; do ./a.out 3; done | grep 1 | wc -l
341
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 1 | wc -l
339
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 1 | wc -l
338
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 2 | wc -l
336
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 2 | wc -l
328
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 2 | wc -l
335
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 0 | wc -l
332
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 0 | wc -l
331
$ seq 1 1000 | while read _; do ./a.out 3; done | grep 0 | wc -l
327

This isn't a complete test for a cryptographically-secure random number
generator, of course, but I leave that for interested parties.

Link: <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9a688bcb19348862afe30d7c85bc37c4c293471>
Link: <https://github.com/shadow-maint/shadow/pull/624#discussion_r1059574358>
Link: <https://arxiv.org/abs/1805.10941>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Cristian Rodríguez <crrodriguez@opensuse.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Björn Esser <besser82@fedoraproject.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Joseph Myers <joseph@codesourcery.com>
Cc: Sam James <sam@gentoo.org>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
[Daniel Lemire: Added link to research paper in source code]
Cc: Daniel Lemire <daniel@lemire.me>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 217b054cf5 Use WIDTHOF() instead of its expansion 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 3f90eff494 Add WIDTHOF() to get the width in bits 
It is common to use the expression 'sizeof(x) * CHAR_BIT' to mean the
width in bits of a type or object.  Now that there are _WIDTH macros for
some types, indicating the number of bits that they use, it makes sense
to wrap this calculation in a macro of a similar name.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 1db190cb66 Rewrite csrand_interval() as a wrapper around csrand_uniform() 
The old code didn't produce very good random numbers.  It had a bias.
And that was from performing some unnecessary floating-point
calculations that overcomplicate the problem.

Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Cristian Rodríguez <crrodriguez@opensuse.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Björn Esser <besser82@fedoraproject.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Joseph Myers <joseph@codesourcery.com>
Cc: Sam James <sam@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 31375d48ca Add csrand_uniform() 
This API is similar to arc4random_uniform(3).  However, for an input of
0, this function is equivalent to csrand(), while arc4random_uniform(0)
returns 0.

This function will be used to reimplement csrand_interval() as a wrapper
around this one.

The current implementation of csrand_interval() doesn't produce very good
random numbers.  It has a bias.  And that comes from performing some
unnecessary floating-point calculations that overcomplicate the problem.

Looping until the random number hits within bounds is unbiased, and
truncating unwanted bits makes the overhead of the loop very small.

We could reduce loop overhead even more, by keeping unused bits of the
random number, if the width of the mask is not greater than
ULONG_WIDTH/2, however, that complicates the code considerably, and I
prefer to be a bit slower but have simple code.

BTW, Björn really deserves the copyright for csrand() (previously known
as read_random_bytes()), since he rewrote it almost from scratch last
year, and I kept most of its contents.  Since he didn't put himself in
the copyright back then, and BSD-3-Clause doesn't allow me to attribute
derived works, I won't add his name, but if he asks, he should be put in
the copyright too.

Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Cristian Rodríguez <crrodriguez@opensuse.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Björn Esser <besser82@fedoraproject.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Joseph Myers <joseph@codesourcery.com>
Cc: Sam James <sam@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 4a56f2baab Add bit manipulation functions 
These functions implement bit manipulation APIs, which will be added to
C23, so that in the far future, we will be able to replace our functions
by the standard ones, just by adding the stdc_ prefix, and including
<stdbit.h>.

However, we need to avoid UB for an input of 0, so slightly deviate from
C23, and use a different name (with _wrap) for distunguishing our API
from the standard one.

Cc: Joseph Myers <joseph@codesourcery.com>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar be1f4f7972 Move csrand() to a new file csrand.c 
A set of APIs similar to arc4random(3) is complex enough to deserve its
own file.

Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Cristian Rodríguez <crrodriguez@opensuse.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Björn Esser <besser82@fedoraproject.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Joseph Myers <joseph@codesourcery.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 986ef4e69c Use naming consistent with other common functions 
arc4random(3) returns a number.
arc4random_buf(3) fills a buffer.
arc4random_uniform(3) returns a number less than a bound.

and I'd add a hypothetical one which we use:

*_interval() should return a number within the interval [min, max].

In reality, the function being called csrand() in this patch is not
really cryptographically secure, since it had a bias, but a subsequent
patch will fix that.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 6d2337d9e8 Fix types of the csrand_interval() API 
We were always casting the result to u_long.  Better just use that type
in the function.  Since we're returning u_long, it makes sense to also
specify the input as u_long.  In fact, that'll help for doing bitwise
operations inside this function.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Alejandro Colomar 8f441c9f7a Use a more precise name for a CSPRNG API with an interval 
I have plans to split this function in smaller functions that implement
bits of this functionallity, to simplify the implementation.  So, let's
use names that distinguish them.

This one produces a number within an interval, so make that clear.  Also
make clear that the function produces cryptographically-secure numbers.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-27 21:48:37 -06:00
Stefan Schubert a27d5c51f1 Supporting vendor given -shells- configuration file 2023-01-26 22:45:32 -06:00
Samanta Navarro b2d202cb5d libmisc: fix grammar 
Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-01-26 22:44:39 -06:00
Samanta Navarro b312bc0b4d Fix typos 
Typos found with codespell.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
 2023-01-26 22:44:39 -06:00
Christian Göttsche 194014678e Declare constant data structure const 
./lib/pam_defs.h:18:24: warning: ‘conv’ defined but not used [-Wunused-variable]
       18 | static struct pam_conv conv = {
          |                        ^~~~
 2023-01-25 12:31:17 +01:00
Christian Göttsche 89be7c0465 Provide strlcpy declaration 
strlcpy(3) might not be visible since it is declared in <bsd/string.h>.
This can lead to warnings, like:

    fields.c: In function 'change_field':
    fields.c:103:17: warning: implicit declaration of function 'strlcpy'; did you mean 'strncpy'? [-Wimplicit-function-declaration]
      103 |                 strlcpy (buf, cp, maxsize);
          |                 ^~~~~~~
          |                 strncpy

    ../lib/fields.c:103:17: warning: type of 'strlcpy' does not match original declaration [-Wlto-type-mismatch]
      103 |                 strlcpy (buf, cp, maxsize);
          |                 ^
    /usr/include/bsd/string.h:44:8: note: return value type mismatch
       44 | size_t strlcpy(char *dst, const char *src, size_t siz);
          |        ^
    /usr/include/bsd/string.h:44:8: note: type 'size_t' should match type 'int'
    /usr/include/bsd/string.h:44:8: note: 'strlcpy' was previously declared here
    /usr/include/bsd/string.h:44:8: note: code may be misoptimized unless '-fno-strict-aliasing' is used
 2023-01-25 12:31:17 +01:00
Christian Göttsche c99d8d0a08 Avoid comparisons of different signs 
Comparisons if different signedness can result in unexpected results.
Add casts to ensure operants are of the same type.

    gettime.c: In function 'gettime':
    gettime.c:58:26: warning: comparison of integer expressions of different signedness: 'long long unsigned int' and 'time_t' {aka 'long int'} [-Wsign-compare]
       58 |         } else if (epoch > fallback) {
          |                          ^

Cast to time_t, since epoch is less than ULONG_MAX at this point.

    idmapping.c: In function 'write_mapping':
    idmapping.c:202:48: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare]
      202 |                 if ((written <= 0) || (written >= (bufsize - (pos - buf)))) {
          |                                                ^~

    newgidmap.c: In function ‘main’:
    newgidmap.c:178:40: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare]
      178 |         if ((written <= 0) || (written >= sizeof(proc_dir_name))) {
          |                                        ^~
    newuidmap.c: In function ‘main’:
    newuidmap.c:107:40: warning: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Wsign-compare]
      107 |         if ((written <= 0) || (written >= sizeof(proc_dir_name))) {
          |                                        ^~
 2023-01-25 12:31:17 +01:00
Christian Göttsche 43508ac476 Drop redundant declaration 
environ is exported in <unistd.h>.

    env.c:29:15: warning: redundant redeclaration of 'environ' [-Wredundant-decls]
       29 | extern char **environ;
          |               ^~~~~~~
    login.c:92:15: warning: redundant redeclaration of ‘environ’ [-Wredundant-decls]
       92 | extern char **environ;
          |               ^~~~~~~
    sulogin.c:40:15: warning: redundant redeclaration of ‘environ’ [-Wredundant-decls]
       40 | extern char **environ;
          |               ^~~~~~~
    newgrp.c:32:15: warning: redundant redeclaration of ‘environ’ [-Wredundant-decls]
       32 | extern char **environ;
          |               ^~~~~~~
 2023-01-25 12:31:17 +01:00
Christian Göttsche 46d3058341 copydir: fix impl usage 
copydir.c: In function 'copy_dir':
    copydir.c:517:32: warning: passing argument 1 of 'copy_tree' from incompatible pointer type [-Wincompatible-pointer-types]
      517 |             return (copy_tree (src, dst, false, reset_selinux,
          |                                ^~~
          |                                |
          |                                const struct path_info *
    In file included from copydir.c:20:
    ../lib/prototypes.h:108:35: note: expected 'const char *' but argument is of type 'const struct path_info *'
      108 | extern int copy_tree (const char *src_root, const char *dst_root,
          |                       ~~~~~~~~~~~~^~~~~~~~
    copydir.c:517:37: warning: passing argument 2 of 'copy_tree' from incompatible pointer type [-Wincompatible-pointer-types]
      517 |             return (copy_tree (src, dst, false, reset_selinux,
          |                                     ^~~
          |                                     |
          |                                     const struct path_info *
    ../lib/prototypes.h:108:57: note: expected 'const char *' but argument is of type 'const struct path_info *'
      108 | extern int copy_tree (const char *src_root, const char *dst_root,
          |                                             ~~~~~~~~~~~~^~~~~~~~

Fixes: 74c17c71 ("Add support for skeleton files from /usr/etc/skel")
 2023-01-25 12:31:17 +01:00
Christian Göttsche e0d79ee032 Modernize manual memzero implementation 
Instead of using volatile pointers to prevent the compiler from
optimizing the call away, use a memory barrier.
This requires support for embedded assembly, which should be fine after
the recent requirement bumps.
 2023-01-25 11:07:25 +01:00
Christian Göttsche 90ead3cfb8 Replace flawed memset_s usage 
memset_s() has a different signature than memset(3) or explicit_bzero(),
thus the current code would not compile.  Also memset_s()
implementations are quite rare.
Use the C23 standardized version memset_explicit(3).

Fixes: 7a799ebb ("Ensure memory cleaning")
 2023-01-25 11:07:25 +01:00
Alejandro Colomar b2bed465e8 Use getnameinfo(3) instead of our own equivalent 
I didn't know getnameinfo(3) existed, so I implemented it, or something
similar to it called inet_sockaddr2str().  Let's use the standard API.

Link: <https://inbox.sourceware.org/libc-alpha/0f25d60f-f183-b518-b6c1-6d46aa63ee57@gmail.com/T/>
Link: <https://stackoverflow.com/a/42190913/6872717>
Link: <https://github.com/shadow-maint/shadow/pull/617>
Link: <https://software.codidact.com/posts/287748>
Cc: Zack Weinberg <zack@owlfolio.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-20 10:23:03 -06:00
Alejandro Colomar ac8b81c2b7 Prefer getrandom(3)/getentropy(3) over arc4random(3bsd) 
arc4random(3) without kernel support is unsafe, as it can't know when to
drop the buffer.  Since we depend on libbsd since recently, we have
arc4random(3) functions always available, and thus, this code would have
always called arc4random_buf(3bsd), which is unsafe.  Put it after some
better alternatives, at least until in a decade or so all systems have a
recent enough glibc.

glibc implements arc4random(3) safely, since it's just a wrapper around
getrandom(2).

Link: <https://inbox.sourceware.org/libc-alpha/20220722122137.3270666-1-adhemerval.zanella@linaro.org/>
Link: <https://inbox.sourceware.org/libc-alpha/5c29df04-6283-9eee-6648-215b52cfa26b@cs.ucla.edu/T/>
Cc: Cristian Rodríguez <crrodriguez@opensuse.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Guillem Jover <guillem@hadrons.org>
Cc: Björn Esser <besser82@fedoraproject.org>
Reviewed-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-16 10:12:31 +01:00
Serge Hallyn 39ecca84d4 workflow: update checkout acton v2 to v3 
Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2023-01-13 09:51:05 +01:00
SoumyaWind 670cae8348 shadow: Fix can not print full login timeout message 
Login timed out message prints only first few bytes when write is immediately followed by exit.
Calling exit from new handler provides enough time to display full message.
 2023-01-12 18:30:32 -06:00
lilinjie abeb5f3794 fix typo 
Signed-off-by: lilinjie <lilinjie@uniontech.com>
 2023-01-12 12:10:57 +01:00
Christian Göttsche 1d936c968a Warn if failed to read existing /etc/nsswitch.conf 
Commit 90424e7c ("Don't warn when failed to open /etc/nsswitch.conf")
removed the logging for failing to read /etc/nsswitch.conf to reduce the
noise in the case the file does not exists (e.g. musl based systems).

Reintroduce a warning if /etc/nsswitch.conf exists but we failed to read
it (e.g. permission denied).

Improves: 90424e7c ("Don't warn when failed to open /etc/nsswitch.conf")
 2023-01-04 14:21:43 -06:00
Alejandro Colomar 609c641323 Call inet_sockaddr2str() instead of inet_ntop(3) 
To simplify.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-02 08:20:43 +01:00
Alejandro Colomar bb3a89577c Add inet_sockaddr2str() to wrap inet_ntop(3) 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-02 08:20:43 +01:00
Alejandro Colomar eec5f9fccc Replace gethostbyname(3) by getaddrinfo(3) 
gethostbyname(3) was removed in POSIX.1-2008.  It has been obsoleted,
and replaced by getaddrinfo(3), which is superior in several ways:

-  gethostbyname(3) is not reentrant.  There's a GNU extension,
   gethostbyname_r(3) which is reentrant, but it's not likely to be
   standardized for the following reason.  And we don't care too much
   about this point either.

-  gethostbyname(3) only supports IPv4, but getaddrinfo(3) supports both
   IPv4 and IPv6 (and may support other address families in the future).

We don't care about reentrancy, so for keeping the code simple (i.e.,
not touch call site to add code to free(3) an allocated buffer), I added
a static buffer for inet_ntop(3).  We could address that in the future,
but I don't think it's worth it.

BTW, we also replace inet_ntoa(3) by inet_ntop(3), as a consequence of
using getaddrinfo(3).  inet_ntoa(3) is also marked as deprecated, but
that deprecation seems to have been documented only in the manual page,
and POSIX doesn't mark it as deprecated.  The deprecation notice goes
back to when the inet_ntop(3) manual page was added by Sam Varshavchik
to the Linux man-pages in version 1.30 (year 2000).

So, this, apart from updating the code to POSIX.1-2008, is also adding
support for IPv6 :)  Although, probably many other parts of the code are
written for IPv4 only, so I wouldn't yet claim support for it.

A few notes:

-  I didn't check the return value of inet_ntop(3), since it can't fail
   for the given input:

   -  EAFNOSUPPORT:  We only call it with AF_INET and AF_INET6.
   -  ENOSPC:  We calculate the size of the buffer to be wide enough:
               MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN) so it always fits.

Cc: Dave Hagewood <admin@arrowweb.com>
Cc: Sam Varshavchik
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2023-01-02 08:20:43 +01:00
ed neville 65470e5c7d changing lock mechanism 
Systems can suffer power interruptions whilst .lock files are in /etc,
preventing scripts and other automation tools from updating shadow's
files which persist across boots.

This commit replaces that mechanism with file locking to avoid problems
of power interruption/crashing.

Minor tweak to groupmems man page, requested by 'xx' on IRC.

Signed-off-by: ed neville <ed@s5h.net>
 2022-12-29 13:58:49 -06:00
Serge Hallyn bc18c184e5 chfn: new_fields: fix wrong fields printed 
When the caller may not change the room number, work phone, or
home number, then rather than prompting for the new one it will
print the existing one.  But due to a typo it printed the full name
in place of each of those.

Fix the fields being printed.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
 2022-12-23 09:04:02 +01:00
Alejandro Colomar eb164165f6 Add NITEMS(arr) to get the number of elements of an array 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 18:20:02 -06:00
Alejandro Colomar 220b352b70 Use strlcpy(3) instead of its pattern 
-  Since strncpy(3) is not designed to write strings, but rather
   (null-padded) character sequences (a.k.a. unterminated strings), we
   had to manually append a '\0'.  strlcpy(3) creates strings, so they
   are always terminated.  This removes dependencies between lines, and
   also removes chances of accidents.

-  Repurposing strncpy(3) to create strings requires calculating the
   location of the terminating null byte, which involves a '-1'
   calculation.  This is a source of off-by-one bugs.  The new code has
   no '-1' calculations, so there's almost-zero chance of these bugs.

-  strlcpy(3) doesn't padd with null bytes.  Padding is relevant when
   writing fixed-width buffers to binary files, when interfacing certain
   APIs (I believe utmpx requires null padding at lease in some
   systems), or when sending them to other processes or through the
   network.  This is not the case, so padding is effectively ignored.

-  strlcpy(3) requires that the input string is really a string;
   otherwise it crashes (SIGSEGV).  Let's check if the input strings are
   really strings:

   -  lib/fields.c:
      -  'cp' was assigned from 'newft', and 'newft' comes from fgets(3).

   -  lib/gshadow.c:
      -  strlen(string) is calculated a few lines above.

   -  libmisc/console.c:
      -  'cons' comes from getdef_str, which is a bit cryptic, but seems
         to generate strings, I guess.1

   -  libmisc/date_to_str.c:
      -  It receives a string literal.  :)

   -  libmisc/utmp.c:
      -  'tname' comes from ttyname(3), which returns a string.

   -  src/su.c:
      -  'tmp_name' has been passed to strcmp(3) a few lines above.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 18:03:39 -06:00
Iker Pedrosa a48d77bdef strtoday.c: remove unused defines.h inclusion 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2022-12-22 10:39:45 -06:00
Iker Pedrosa bb0c89d944 strtoday.c: remove USE_GETDATE as it was always used 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2022-12-22 10:39:45 -06:00
Iker Pedrosa e4441489bc strtoday.c: remove POSIX 1995 conditional dependency 
Since the project is supposed to be POSIX.1-2001 compliant it doesn't
make sense to have that added conditionally.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2022-12-22 10:39:45 -06:00
Alejandro Colomar 647d46507d Assume struct tm is defined in <time.h> 
It has been a requirement since at least C90, according to tm(3type).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 09:49:02 -06:00
Alejandro Colomar d96bb2868d Assume struct stat has st_atim and st_mtim fields 
That's required by POSIX.1-2008.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 09:49:02 -06:00
Alejandro Colomar 5d7a3b80e9 Remove USE_SYSLOG preprocessor conditional, which was always defined 
Reported-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 11:44:36 +01:00
Alejandro Colomar 350b1e8683 Remove dead code 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 11:44:36 +01:00
Alejandro Colomar e2df287aad Don't redefine errno(3) 
It is Undefined Behavior to declare errno (see NOTES in its manual page).
Instead of using the errno dummy declaration, use one that doesn't need
a comment.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 11:43:29 +01:00
Alejandro Colomar ed69feaaff Fix typos in length calculations 
Link: <https://github.com/shadow-maint/shadow/pull/607>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:34:04 +01:00
Alejandro Colomar 06c30450ce Use 'uintmax_t' to print 'gid_t' 
This is shorter to write than 'unsigned long int', so we can collapse
some lines.  It is guaranteed by C99.

Link: <https://github.com/shadow-maint/shadow/pull/607>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:34:04 +01:00
Alejandro Colomar 587ce83e3f Fix off-by-one mistakes 
The buffers have a size of 512 (see xmalloc() above), which is what
snprintf(3) expects.

Link: <https://github.com/shadow-maint/shadow/pull/607>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:34:04 +01:00
Alejandro Colomar b990b167d4 Cosmetic fixes 
Previous commits, to keep readability of the diffs, left the code that
was previously wrapped by preprocessor coditionals untouched.  Apply
some minor cosmetic changes to merge it in the surrounding code.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:31:43 +01:00
Alejandro Colomar 3be7b9d75a Remove traces of utmpx 
-  USER_NAME_MAX_LENGTH was being calculated in terms of utmpx.  Do it
   in terms of utmp.
-  Remove utmpx support from the whishlist.
-  Remove unused tests about utmpx members.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:31:43 +01:00
Alejandro Colomar 170b76cdd1 Disable utmpx permanently 
On Linux, utmpx and utmp are identical.  However, documentation (manual
pages) covers utmp, and just says about utmpx that it's identical to
utmp.  It seems that it's preferred to use utmp, at least by reading the
manual pages.

Moreover, we were defaulting to utmp (utmpx had to be explicitly enabled
at configuration time).  So, it seems safer to just make it permanent,
which should not affect default builds.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:31:43 +01:00
Alejandro Colomar 2da7607ea6 Assume <utmpx.h> always exists 
We already made that assumption in commit b47aa1e9aa.  While the
header is not required by POSIX (it is an XSI extension), it is defined
in systems that are of interest to this project (GNU/Linux).

Fixes: b47aa1e9aa ("Assume <utmpx.h> exists")
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-22 10:31:43 +01:00
Alejandro Colomar 5fae37271e Remove pwdauth.c 
We don't know what it was for.  If anyone cares, it's in git history.
In my distro, there seem to be no traces of it:

alx@debian:~$ apt-file find pwdauth
alx@debian:~$

Link: <https://codesearch.debian.net/search?q=pwdauth&literal=1>
Link: <https://github.com/shadow-maint/shadow/pull/612>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-21 08:22:22 -06:00
Michael Vetter 74c17c7167 Add support for skeleton files from /usr/etc/skel 
This patch is used by openSUSE to make useradd look for
skeleton files in /usr/etc/skel additionally to /etc/skel
in accordance with
https://uapi-group.org/specifications/specs/base_directory_specification/
 2022-12-19 09:43:03 -06:00
Michael Vetter 37412f505e Fix useradd audit event logging of ID field 
When useradd sends its ADD_USER event, it is filling in the id field. This is not yet written to disk. When auditd sees the event and the log format is enriched, auditd tries to lookup the user name but it does not exist. This causes the event to never be resolvable since ausearch relies on the lookup information attached by auditd.

The fix is to not send the id information for any event until after close_files() is called. Just the acct field is all that is

Patch by Steve Grubb (afaik).

Reported at https://bugzilla.redhat.com/show_bug.cgi?id=1713432
 2022-12-15 16:29:42 -06:00
Alejandro Colomar 6b6e005ce1 Remove comments that survived the Helicoprion 
The OSes that are referred to by these comments, are extinct, but
their comments survived, fossilized in amber.

Reported-by: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 428a2078b6 Ping? :) 
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 54847a76da Remove preprocessor conditionals that are always true 
In a previous commit, we made USE_TERMIOS unconditionally defined.
Let's just remove it, and remove the condition everywhere.

Reported-by: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar f2ae6a42a4 Remove code conditional on USE_TERMIO 
The definition for this macro was removed in a previous commit.

Reported-by: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 5669b34891 Assume socket(2) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 3d32dd05bb Assume inet_ntoa(3) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 0e0c55aeca Assume F_* and SEEK_* macros are defined 
They are required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 9dfa71f71c Remove code conditional on S_SPLINT_S 
I don't know for sure what that is, but it's redefining setlocale(3)
and LC_ALL, which is are defined by C99, so it's supect of being some
variety of an extinct dynosaur.  Maybe related to the Dodo.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 143e346dd5 Assume strdup(3) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 56e989ccf7 Assume strcasecmp(3) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 06f4acee99 Assume rmdir(2) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar dfc93b35cc Assume mkdir(2) exists 
It is required by POSIX.1-2001.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 61299d69ad Assume B[0-9]* macros are defined 
All of the macros we're using are required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar f51c6838ac Assume SIGTTOU is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 307502d8b5 Assume SIGTSTP is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 74c8015730 Assume RLIMIT_STACK is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar c916715a6c Assume RLIMIT_NOFILE is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 5ebf28c999 Assume RLIMIT_FSIZE is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 91adf3b8bb Assume RLIMIT_DATA is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 891d8dbedd Assume RLIMIT_CPU is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 7a4906fc75 Assume RLIMIT_AS is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar e1a39e1dfc Assume RLIMIT_CORE is defined 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar cbc363f671 Assume getgrgid_r(3) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 88eb38f4ab Assume getgrnam_r(3) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar e5e5df1966 Assume getpwuid_r(3) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar e788001977 Assume getpwnam_r(3) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar a082a3975f Assume fsync(2) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar e71c23586a Assume fchown(2) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 9c86e07067 Assume fchmod(2) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 55c62b663f Assume l64a(3) exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 48391fb862 Assume <netdb.h> exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar b76d9b540a Remove preprocessor conditionals that are always true 
Since the last commit, LIMITS is always defined.  Remove the dummy
macro, and all conditionals on it.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 9d695340b4 Assume <sys/resource.h> exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar cdaa04e460 Remove uses of ulimit(3) 
The function is obsolete.  It is recommended to use getrlimit(2) instead
(see the manual page for ulimit(3) or the POSIX manual for it).  Since
getrlimit(2) is required by POSIX.1-2001, we can rely on it.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 0527fa677b Add indentation to heavy use of preprocessor conditionals 
This clarifies which code is under which conditions,
for further clenaup.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 7b1fc83e9b Remove unused check for <utime.h> 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar eecd021c04 Remove unused check for <syslog.h> 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 5777e583cd Assume <termios.h> exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar b47aa1e9aa Assume <utmpx.h> exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 85d2688d62 Remove unused check for <sys/time.h> 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 578f286215 Assume <unistd.h> exists 
It is required by POSIX.1-2001.

Cc: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar 28e565aa83 Remove unused check for <fcntl.h> 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-15 16:22:05 -06:00
Alejandro Colomar d7baafb2eb Assume strstr(3) exists 
ISO C99 requires strstr(3).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 0793782d31 Assume snprintf(3) exists 
ISO C99 requires snprintf(3).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 7d3213741e Assume rename(2) exists 
ISO C99 requires rename(2).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 9d8c3df93c Assume NULL exists 
ISO C99 requires NULL.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 3a32f5278d Assume strerror(3) exists 
ISO C99 requires strerror(3).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 5e8df2b2b5 Assume fputs(3) exists 
ISO C99 requires fputs(3).

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar c26b682381 Assume <locale.h> exists 
ISO C99 requires <locale.h>.

Other files in the project already include <locale.h> unconditionally,
so it's reasonable to assume that it is always available.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar d34c834ea8 Remove unused check for <limits.h> 
Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar 1eaa30756e Assume <errno.h> exists 
ISO C99 requires <errno.h>.

Many files in the project already include <errno.h> unconditionally,
so it's reasonable to assume that it is always available.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
Alejandro Colomar c4d9dcacc9 Assume <stdbool.h> exists 
ISO C99 requires <stdbool.h>.

Many files in the project already include <stdbool.h> unconditionally,
so it's reasonable to assume that it is always available.

Link: <https://github.com/shadow-maint/shadow/pull/600>
Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-12 09:16:43 +01:00
James Addison ed6c505312 Add '62_usermod_remove_supplementary_groups' test case to test runner scripts (run_some) 2022-12-11 10:58:37 -06:00
James Addison f2bcb7a1b8 Add '62_usermod_remove_supplementary_groups' test case to test runner scripts (run_all, run_all.coverage) 2022-12-11 10:58:37 -06:00
James Addison 20f8ead9ec Add regression test for 'usermod -rG' -- it should not add users to groups they did not previously belong to 2022-12-11 10:58:37 -06:00
James Addison 899f7a43b1 Preparation / clarity: rename existing usermod test from 'remove_supplemental_groups' to 'clear_supplemental_groups' 2022-12-11 10:58:37 -06:00
Guillem Jover 2a5b8810bb agetpass: Hook into build-system 
Signed-off-by: Guillem Jover <guillem@hadrons.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-05 10:47:19 +01:00
Alejandro Colomar ab91ec10b4 Hide [[gnu::malloc(deallocator)]] in a macro 
Clang doesn't implement this attribute and reports an error.  Work
around it by hiding it in a macro that will be empty in clang.

Reported-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-05 10:47:19 +01:00
Alejandro Colomar 554f86bafa Replace the deprecated getpass(3) by our agetpass() 
getpass(3) is broken in all implementations; in some, more than
others, but somewhat broken in all of them.  Check the immediate
previous commit, which added the functions, for more details.
Check also the Linux man-pages commit that marked it as
deprecated, for more details:
7ca189099d73bde954eed2d7fc21732bcc8ddc6b.

Link: <https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/commit?id=7ca189099d73bde954eed2d7fc21732bcc8ddc6b>
Reported-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-05 10:47:19 +01:00
Alex Colomar 155c9421b9 libmisc: agetpass(), erase_pass(): Add functions for getting passwords safely 
There are several issues with getpass(3).

Many implementations of it share the same issues that the infamous
gets(3).  In glibc it's not so terrible, since it's a wrapper
around getline(3).  But it still has an important bug:

If the password is long enough, getline(3) will realloc(3) memory,
and prefixes of the password will be laying around in some
deallocated memory.

See the getpass(3) manual page for more details, and especially
the commit that marked it as deprecated, which links to a long
discussion in the linux-man@ mailing list.

So, readpassphrase(3bsd) is preferrable, which is provided by
libbsd on GNU systems.  However, using readpassphrase(3) directly
is a bit verbose, so we can write our own wrapper with a simpler
interface similar to that of getpass(3).

One of the benefits of writing our own interface around
readpassphrase(3) is that we can hide there any checks that should
be done always and which would be error-prone to repeat every
time.  For example, check that there was no truncation in the
password.

Also, use malloc(3) to get the buffer, instead of using a global
buffer.  We're not using a multithreaded program (and it wouldn't
make sense to do so), but it's nice to know that the visibility of
our passwords is as limited as possible.

erase_pass() is a clean-up function that handles all clean-up
correctly, including zeroing the entire buffer, and then
free(3)ing the memory.  By using [[gnu::malloc(erase_pass)]], we
make sure that we don't leak the buffers in any case, since the
compiler will be able to enforce clean up.

Link: <https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/commit?id=7ca189099d73bde954eed2d7fc21732bcc8ddc6b>
Reported-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-05 10:47:19 +01:00
Alex Colomar 8cce4557e0 Don't 'else' after a 'noreturn' call 
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-12-05 10:47:19 +01:00
Iker Pedrosa 99ce21a313 CI: add libbsd and pkg-config dependencies 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Co-developed-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
 2022-11-28 09:07:41 -06:00
Florian Weimer a281f241b5 Fix HAVE_SHADOWGRP configure check 
The missing #include <gshadow.h> causes the configure check to fail
spuriously, resulting in HAVE_SHADOWGRP not being defined even
on systems that actually have sgetsgent (such as current glibc).
 2022-11-21 08:06:14 -06:00
Andy Zaugg e8d2bc8d8b Allow supplementary groups to be added via config file 
Allow supplementary groups to be set via the /etc/default/useradd config
file. Allowing an administrator to set additonal groups via the GROUPS
configurable and control the default behaviour of useradd.
 2022-11-18 15:10:56 -06:00
Iker Pedrosa e0524e813a useradd: check if subid range exists for user 
Check if a user already has a subid range before assigning one.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2012929

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
 2022-11-18 09:04:42 -06:00
449 changed files with 8603 additions and 10388 deletions
Show Stats Expand all files Collapse all files

2
.builds/alpine-edge.yml
View File

@ -9,9 +9,11 @@ packages:
- gettext
- gettext-dev
- gettext-lang
- libbsd-dev
- libcap-dev
- libtool
- linux-pam-dev
- pkgconf
- sed
sources:
- https://github.com/shadow-maint/shadow

2
.builds/fedora.yml
View File

@ -8,10 +8,12 @@ packages:
- gettext
- gettext-devel
- git
- libbsd-devel
- libselinux-devel
- libsemanage-devel
- libtool
- libxslt
- pkgconf
sources:
- https://github.com/shadow-maint/shadow
tasks:

2
.builds/ubuntu-focal.yml
View File

@ -3,11 +3,13 @@ packages:
- automake
- autopoint
- xsltproc
- libbsd-dev
- libselinux1-dev
- gettext
- expect
- byacc
- libtool
- pkgconf
sources:
- https://github.com/shadow-maint/shadow
tasks:

2
.builds/ubuntu-jammy.yml
View File

@ -3,11 +3,13 @@ packages:
- automake
- autopoint
- xsltproc
- libbsd-dev
- libselinux1-dev
- gettext
- expect
- byacc
- libtool
- pkgconf
sources:
- https://github.com/shadow-maint/shadow
tasks:

4
.editorconfig Normal file
View File

@ -0,0 +1,4 @@
root = true
[*.{c,h}]
indent_style = tab

2
.github/actions/install-dependencies/action.yml vendored
View File

@ -6,7 +6,7 @@ runs:
- shell: bash
run: |
sudo apt-get update -y
sudo apt-get install -y ubuntu-dev-tools
sudo apt-get install -y ubuntu-dev-tools libbsd-dev
sudo sed -Ei 's/^# deb-src /deb-src /' /etc/apt/sources.list
sudo apt-get update -y
sudo apt-get -y build-dep shadow

76
.github/workflows/runner.yml vendored Normal file
View File

@ -0,0 +1,76 @@
name: CI
on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: debug
run: |
id
which bash
whoami
env
ps -ef
pwd
cat /proc/self/uid_map
cat /proc/self/status
systemd-detect-virt
- name: Install dependencies
run: |
sudo cat /etc/apt/sources.list
sudo sed -i '/deb-src/d' /etc/apt/sources.list
sudo sed -i '/^deb /p;s/ /-src /' /etc/apt/sources.list
export DEBIAN_PRIORITY=critical
export DEBIAN_FRONTEND=noninteractive
# let's try to work around upgrade breakage in a pkg we don't care about
sudo apt-mark hold grub-efi-amd64-bin grub-efi-amd64-signed
sudo apt-get update
sudo apt-get -y dist-upgrade
sudo apt-get -y install ubuntu-dev-tools automake autopoint xsltproc gettext expect byacc libtool libbsd-dev pkgconf
sudo apt-get -y build-dep shadow
- name: configure
run: |
autoreconf -v -f --install
./autogen.sh --without-selinux --disable-man --with-yescrypt
- run: make
- run: make install DESTDIR=${HOME}/rootfs
- run: sudo make install
- name: run tests in shell with tty
shell: 'script -q -e -c "bash {0}"'
run: |
set -e
cd tests
sudo ./run_some
cat testsuite.log
container-build:
runs-on: ubuntu-latest
strategy:
matrix:
os: [alpine, debian, fedora]
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Build container
run: |
docker buildx build -f ./share/containers/${{ matrix.os }}.dockerfile . --output build-out
- name: Store artifacts
uses: actions/upload-artifact@v3
with:
name: ${{ matrix.os }}-build
path: |
./build-out/config.log
./build-out/config.h
if-no-files-found: ignore

9
.github/workflows/static-code-analysis.yml vendored
View File

@ -14,7 +14,7 @@ jobs:
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Install dependencies
id: dependencies
@ -32,19 +32,20 @@ jobs:
- name: Build shadow-utils
run: |
PROCESSORS=$(/usr/bin/getconf _NPROCESSORS_ONLN)
make -j$PROCESSORS
make -kj$PROCESSORS || true
- name: Check build errors
run: make
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
differential-shellcheck:
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
pull-requests: write
steps:
- name: Checkout repository

2
.travis.yml
View File

@ -36,7 +36,7 @@ addons:
notification_email: christian.brauner@ubuntu.com,serge@hallyn.com
build_command_prepend: "./autogen.sh --without-selinux --disable-man"
build_command: "make -j4"
build_command: "make -kj4 || make"
branch_pattern: master
script:

1
AUTHORS.md
View File

@ -3,6 +3,7 @@ reports and various comments. This list may be incomplete, I received
a lot of mail...
# Maintainers
* Marek Michałkiewicz <marekm72@gmail.com> (1995-2000)
* Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
* Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
* Serge E. Hallyn <serge@hallyn.com> (2014-now)

14
ChangeLog
View File

@ -9558,7 +9558,7 @@
* NEWS: release date corrected.
* NEWS, src/su.c:
fixed set enviroment too early when using PAM, so move it to !USE_PAM
fixed set environment too early when using PAM, so move it to !USE_PAM
(patch submitted by Mike Frysinger <vapier@gentoo.org>).
2006-07-30 Tomasz Kłoczko <kloczek@pld.org.pl>
@ -10245,7 +10245,7 @@
* NEWS: cleanups.
* autogen.sh:
by default in development enviroment use CFLAGS="-O2 -Wall".
by default in development environment use CFLAGS="-O2 -Wall".
* src/chgpasswd.c (main): remove two unused variables (newgr and now).
@ -11654,7 +11654,7 @@
in OPTIONS section). Describe -a and -k options.
* NEWS, src/su.c:
fixed twice copy enviroment which causes auth problems (bug was introduced in 4.0.12;
fixed twice copy environment which causes auth problems (bug was introduced in 4.0.12;
fix by Nicolas François <nicolas.francois@centraliens.net>).
* src/passwd.c, po/ja.po, po/ko.po, po/nb.po, po/nl.po, po/nn.po, po/pl.po, po/pt.po, po/pt_BR.po, po/ro.po, po/ru.po, po/sk.po, po/sq.po, po/sv.po, po/tl.po, po/tr.po, po/uk.po, po/vi.po, po/zh_CN.po, po/zh_TW.po, po/bs.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po, po/es.po, po/eu.po, po/fi.po, po/fr.po, po/he.po, po/id.po, po/it.po:
@ -12584,7 +12584,7 @@
http://bugs.debian.org/48002
* src/login.c, NEWS:
fixed loggin of username on succesful login (was using the normal username,
fixed loggin of username on successful login (was using the normal username,
when it should have used pam_user) http://bugs.debian.org/47819
2005-06-02 Tomasz Kłoczko <kloczek@pld.org.pl>
@ -13029,7 +13029,7 @@
* man/pl/usermod.8: finish sync with english version.
* man/hu/login.1, man/pl/login.1, NEWS, man/Attic/login.1, man/de/login.1:
removed fragment about abilities pass enviroment variables in login prompt.
removed fragment about abilities pass environment variables in login prompt.
* man/Attic/gpasswd.1, man/Attic/newgrp.1:
fixes by Nicolas Nicolas François <nicolas.francois@centraliens.net> (not all
@ -13508,7 +13508,7 @@
removed not used translations.
* NEWS, src/su.c:
fix adding of pam_env env variables to enviroment (Martin Schlemmer <azarah@nosferatu.za.org>).
fix adding of pam_env env variables to environment (Martin Schlemmer <azarah@nosferatu.za.org>).
* NEWS, configure.in:
fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables which was allways
@ -13605,7 +13605,7 @@
* NEWS, src/su.c:
add pam_open_session() support. If builded without PAM support
propagate $DISPLAY and $XAUTHORITY enviroment variables.
propagate $DISPLAY and $XAUTHORITY environment variables.
Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
2004-10-23 Tomasz Kłoczko <kloczek@pld.org.pl>

14
NEWS
View File

@ -696,7 +696,7 @@ shadow-4.0.18 -> shadow-4.0.18.1 03-08-2006
shadow-4.0.17 -> shadow-4.0.18 01-08-2006
*** general:
- su: fixed set enviroment too early when using PAM, so move it to !USE_PAM
- su: fixed set environment too early when using PAM, so move it to !USE_PAM
(patch submitted by Mike Frysinger <vapier@gentoo.org>),
- groupadd, groupmod, useradd, usermod: fixed UID/GID overflow (fixed
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198920)
@ -855,7 +855,7 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
- su: move exit() outside libmisc/shell.c::shell() for handle shell() errors
on higher level (now is better visable where some programs exit with 126
and 127 exit codes); added new shell() parameter (char *const envp[])
which allow fix preserving enviroment in su on using -p, (patch by
which allow fix preserving environment in su on using -p, (patch by
Alexander Gattin <xrgtn@yandex.ru>),
- su: added handle -c,--command option for GNU su compliance (merge
437_su_-c_option Debian patch),
@ -966,7 +966,7 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
to example described in ident(1) man page (modern compilers like latest GCC
removes not used functions by global optimization).
So "ident /usr/bin/passwd" will show again some useable informations
- su: fixed twice copy enviroment which causes auth problems
- su: fixed twice copy environment which causes auth problems
(bug was introduced in 4.0.12; fix by Nicolas François <nicolas.francois@centraliens.net>),
- chage: differentiate the different failure causes by the exit value
This will permit to adduser Debian script to detect if chage failed because the
@ -1133,7 +1133,7 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
http://bugs.debian.org/53702
- login: check for hushed login and pass PAM_SILENT if true,
http://bugs.debian.org/48002
- login: fixed username on succesful login (was using the normal username,
- login: fixed username on successful login (was using the normal username,
when it should have used pam_user) http://bugs.debian.org/47819
- remove using SHADOWPWD #define so now shadow is always built with shadow
password support,
@ -1212,7 +1212,7 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
(without gshadow) doesn't permit to use newgrp,
- newgrp(1): newgrp uses /bin/sh (not bash),
- faillog(8): updated after rewritten faillog command for use getopt_long(),
- login(1): removed fragment about abilities pass enviroment variables in login prompt,
- login(1): removed fragment about abilities pass environment variables in login prompt,
- gshadow(5): new file (by Nicolas Nicolas François <nicolas.francois@centraliens.net>),
- usermod(8): fixed #302388 Debian bug: added separated -o option description,
@ -1242,7 +1242,7 @@ shadow-4.0.6 -> shadow-4.0.7 26-01-2005
shadow-4.0.5 -> shadow-4.0.6 08-11-2004
- su: fixed adding of pam_env env variables to enviroment
- su: fixed adding of pam_env env variables to environment
(Martin Schlemmer <azarah@nosferatu.za.org>),
- autoconf: fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables
which was always empty (Gregorio Guidi <g.guidi@sns.it>),
@ -1275,7 +1275,7 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
including symlinks placed into /etc/skel/public_html for example.
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=66819
- su: add pam_open_session() support. If built without PAM support
propagate $DISPLAY and $XAUTHORITY enviroment variables.
propagate $DISPLAY and $XAUTHORITY environment variables.
Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
- applied 036_pam_access_with_preauth.patch Debian patch submited by Bjorn
Torkelsson <Bjorn.Torkelsson@hpc2n.umu.se>: add support for PAM account

5
README.md
View File

@ -31,6 +31,11 @@ There are several ways to contact us:
https://alioth-lists-archive.debian.net/pipermail/pkg-shadow-commits/),
only used for historical purposes
## Contributions
Contributions are welcome. Follow the
[guidelines](doc/contributions/introduction.md) before posting any patches.
## Authors and maintainers
Authors and maintainers are listed in [AUTHORS.md](
https://github.com/shadow-maint/shadow/blob/master/AUTHORS.md).

1
SECURITY.md
View File

@ -9,3 +9,4 @@ At the moment only the latest release is supported.
Security vulnerabilities may be reported to
* Serge Hallyn <serge@hallyn.com> (B175CFA98F192AF2)
* Christian Brauner <christian@brauner.io> (4880B8C9BD0E5106FC070F4F7B3C391EFEA93624)
* Iker Pedrosa <ipedrosa@redhat.com> (4E80EF49C7987B6DE2F81F5005079C6C3A653E57)

86
configure.ac
View File

@ -36,31 +36,25 @@ LT_INIT
dnl Checks for libraries.
dnl Checks for header files.
AC_HEADER_STDBOOL
AC_CHECK_HEADERS(crypt.h errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
utime.h ulimit.h sys/capability.h sys/random.h sys/resource.h \
gshadow.h lastlog.h locale.h rpc/key_prot.h netdb.h acl/libacl.h \
AC_CHECK_HEADERS(crypt.h utmp.h \
termio.h sgtty.h sys/ioctl.h paths.h \
sys/capability.h sys/random.h \
gshadow.h lastlog.h rpc/key_prot.h acl/libacl.h \
attr/libattr.h attr/error_context.h)
dnl shadow now uses the libc's shadow implementation
AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
AC_CHECK_FUNCS(arc4random_buf l64a fchmod fchown fsync futimes \
AC_CHECK_FUNCS(arc4random_buf futimes \
getentropy getrandom getspnam getusershell \
getutent initgroups lckpwdf lutimes \
setgroups updwtmp updwtmpx innetgr getpwnam_r \
getpwuid_r getgrnam_r getgrgid_r getspnam_r \
memset_s explicit_bzero)
initgroups lckpwdf lutimes mempcpy \
setgroups updwtmp updwtmpx innetgr \
getspnam_r \
rpmatch \
memset_explicit explicit_bzero stpecpy stpeprintf)
AC_SYS_LARGEFILE
dnl Checks for typedefs, structures, and compiler characteristics.
AC_CHECK_MEMBERS([struct stat.st_atim])
AC_CHECK_MEMBERS([struct stat.st_atimensec])
AC_CHECK_MEMBERS([struct stat.st_mtim])
AC_CHECK_MEMBERS([struct stat.st_mtimensec])
AC_STRUCT_TM
AC_CHECK_MEMBERS([struct utmp.ut_type,
struct utmp.ut_id,
@ -74,14 +68,6 @@ AC_CHECK_MEMBERS([struct utmp.ut_type,
struct utmp.ut_xtime,
struct utmp.ut_tv],,,[[#include <utmp.h>]])
AC_CHECK_MEMBERS([struct utmpx.ut_name,
struct utmpx.ut_host,
struct utmpx.ut_syslen,
struct utmpx.ut_addr,
struct utmpx.ut_addr_v6,
struct utmpx.ut_time,
struct utmpx.ut_xtime],,,[[#include <utmpx.h>]])
if test "$ac_cv_header_lastlog_h" = "yes"; then
AC_CACHE_CHECK(for ll_host in struct lastlog,
ac_cv_struct_lastlog_ll_host,
@ -102,9 +88,8 @@ fi
dnl Checks for library functions.
AC_TYPE_GETGROUPS
AC_FUNC_UTIME_NULL
AC_REPLACE_FUNCS(mkdir putgrent putpwent putspent rename rmdir)
AC_REPLACE_FUNCS(putgrent putpwent putspent)
AC_REPLACE_FUNCS(sgetgrent sgetpwent sgetspent)
AC_REPLACE_FUNCS(snprintf strcasecmp strdup strerror strstr)
AC_CHECK_FUNC(setpgrp)
AC_CHECK_FUNC(secure_getenv, [AC_DEFINE(HAS_SECURE_GETENV,
@ -116,6 +101,10 @@ if test "$ac_cv_header_shadow_h" = "yes"; then
ac_cv_libc_shadowgrp,
AC_RUN_IFELSE([AC_LANG_SOURCE([
#include <shadow.h>
#ifdef HAVE_GSHADOW_H
#include <gshadow.h>
#endif
int
main()
{
struct sgrp *sg = sgetsgent("test:x::");
@ -191,7 +180,7 @@ AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$shadow_cv_passwd_dir/passwd",
[Path to passwd program.])
dnl XXX - quick hack, should disappear before anyone notices :).
AC_DEFINE(USE_SYSLOG, 1, [Define to use syslog().])
dnl XXX - I just read the above message :).
if test "$ac_cv_func_ruserok" = "yes"; then
AC_DEFINE(RLOGIN, 1, [Define if login should support the -r flag for rlogind.])
AC_DEFINE(RUSEROK, 0, [Define to the ruserok() "success" return value (0 or 1).])
@ -226,17 +215,6 @@ AC_ARG_ENABLE(account-tools-setuid,
[enable_acct_tools_setuid="no"]
)
AC_ARG_ENABLE(utmpx,
[AS_HELP_STRING([--enable-utmpx],
[enable loggin in utmpx / wtmpx @<:@default=no@:>@])],
[case "${enableval}" in
yes) enable_utmpx="yes" ;;
no) enable_utmpx="no" ;;
*) AC_MSG_ERROR(bad value ${enableval} for --enable-utmpx) ;;
esac],
[enable_utmpx="no"]
)
AC_ARG_ENABLE(subordinate-ids,
[AS_HELP_STRING([--enable-subordinate-ids],
[support subordinate ids @<:@default=yes@:>@])],
@ -336,12 +314,12 @@ dnl Check for some functions in libc first, only if not found check for
dnl other libraries. This should prevent linking libnsl if not really
dnl needed (Linux glibc, Irix), but still link it if needed (Solaris).
AC_SEARCH_LIBS(inet_ntoa, inet)
AC_SEARCH_LIBS(socket, socket)
AC_SEARCH_LIBS(gethostbyname, nsl)
AC_CHECK_LIB([econf],[econf_readDirs],[LIBECONF="-leconf"],[LIBECONF=""])
if test -n "$LIBECONF"; then
AC_DEFINE_UNQUOTED([VENDORDIR], ["$enable_vendordir"],
[Directory for distribution provided configuration files])
ECONF_CPPFLAGS="-DUSE_ECONF=1"
AC_ARG_ENABLE([vendordir],
AS_HELP_STRING([--enable-vendordir=DIR], [Directory for distribution provided configuration files]),,[])
@ -349,6 +327,9 @@ fi
AC_SUBST(ECONF_CPPFLAGS)
AC_SUBST(LIBECONF)
AC_SUBST([VENDORDIR], [$enable_vendordir])
if test "x$enable_vendordir" != x; then
AC_DEFINE(HAVE_VENDORDIR, 1, [Define to support vendor settings.])
fi
AM_CONDITIONAL([HAVE_VENDORDIR], [test "x$enable_vendordir" != x])
if test "$enable_shadowgrp" = "yes"; then
@ -401,6 +382,21 @@ AC_SUBST(LIYESCRYPT)
AC_CHECK_LIB(crypt, crypt, [LIYESCRYPT=-lcrypt],
[AC_MSG_ERROR([crypt() not found])])
AC_SEARCH_LIBS([readpassphrase], [bsd], [], [
AC_MSG_ERROR([readpassphrase() is missing, either from libc or libbsd])
])
AS_IF([test "$ac_cv_search_readpassphrase" = "-lbsd"], [
PKG_CHECK_MODULES([LIBBSD], [libbsd-overlay])
])
dnl Make sure either the libc or libbsd provide the header.
save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $LIBBSD_CFLAGS"
AC_CHECK_HEADERS([readpassphrase.h])
AS_IF([test "$ac_cv_header_readpassphrase_h" != "yes"], [
AC_MSG_ERROR([readpassphrase.h is missing])
])
CFLAGS="$save_CFLAGS"
AC_SUBST(LIBACL)
if test "$with_acl" != "no"; then
AC_CHECK_HEADERS(acl/libacl.h attr/error_context.h, [acl_header="yes"], [acl_header="no"])
@ -682,15 +678,6 @@ if test "$with_skey" = "yes"; then
]])],[AC_DEFINE(SKEY_BSD_STYLE, 1, [Define to support newer BSD S/Key API])],[])
fi
if test "$enable_utmpx" = "yes"; then
if test "$ac_cv_header_utmpx_h" != "yes"; then
AC_MSG_ERROR([The utmpx.h header file is required for utmpx support.])
fi
AC_DEFINE(USE_UTMPX,
1,
[Define if utmpx should be used])
fi
AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
AM_GNU_GETTEXT_VERSION([0.19])
@ -759,4 +746,5 @@ echo " sssd support: $with_sssd"
echo " subordinate IDs support: $enable_subids"
echo " use file caps: $with_fcaps"
echo " install su: $with_su"
echo " enabled vendor dir: $enable_vendordir"
echo

2
contrib/Makefile.am
View File

@ -2,5 +2,5 @@
# and also cooperate to make a distribution for `make dist'
EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
atudel groupmems.shar shadow-anonftp.patch \
udbachk.tgz

4
contrib/adduser.c
View File

@ -60,7 +60,7 @@
** Added in the password date field, which should always reflect the last
** date the password was changed, for expiry purposes. "passwd" always
** updates this field, so the adduser program should set it up right
** initially (or a user could keep thier initial password forever ;)
** initially (or a user could keep their initial password forever ;)
** The number is in days since Jan 1st, 1970.
**
** Have fun with it, and someone please make
@ -489,7 +489,7 @@ safeget (char *buf, int maxlen)
while ((c = getc (stdin)) != EOF && (c != '\n') && (++i < maxlen))
{
bad = (!isalnum (c) && (c != '_') && (c != ' '));
*(buf++) = (char) c;
*(buf++) = c;
}
*buf = '\0';

308
contrib/pwdauth.c
View File

@ -1,308 +0,0 @@
/*
* pwdauth.c - program to verify a given username/password pair.
*
* Run it with username in argv[1] (may be omitted - default is the
* current user), and send it the password over a pipe on stdin.
* Exit status: 0 - correct password, 1 - wrong password, >1 - other
* errors. For use with shadow passwords, this program should be
* installed setuid root.
*
* This can be used, for example, by xlock - you don't have to install
* this large and complex (== possibly insecure) program setuid root,
* just modify it to run this simple program to do the authentication.
*
* Recent versions (xlockmore-3.9) are cleaner, and drop privileges as
* soon as possible after getting the user's encrypted password.
* Using this program probably doesn't make it more secure, and has one
* disadvantage: since we don't get the encrypted user's password at
* startup (but at the time the user is authenticated), it is not clear
* how we should handle errors (like getpwnam() returning NULL).
* - fail the authentication? Problem: no way to unlock (other than kill
* the process from somewhere else) if the NIS server stops responding.
* - succeed and unlock? Problem: it's too easy to unlock by unplugging
* the box from the network and waiting until NIS times out...
*
* This program is Copyright (C) 1996 Marek Michalkiewicz
* <marekm@i17linuxb.ists.pwr.wroc.pl>.
*
* It may be used and distributed freely for any purposes. There is no
* warranty - use at your own risk. I am not liable for any damages etc.
* If you improve it, please send me your changes.
*/
static char rcsid[] = "$Id$";
/*
* Define USE_SYSLOG to use syslog() to log successful and failed
* authentication. This should be safe even if your system has
* the infamous syslog buffer overrun security problem...
*/
#define USE_SYSLOG
/*
* Define HAVE_GETSPNAM to get shadow passwords using getspnam().
* Some systems don't have getspnam(), but getpwnam() returns
* encrypted passwords only if running as root.
*
* According to the xlock source (not tested, except Linux) -
* define: Linux, Solaris 2.x, SVR4, ...
* undef: HP-UX with Secured Passwords, FreeBSD, NetBSD, QNX.
* Known not supported (yet): Ultrix, OSF/1, SCO.
*/
#define HAVE_GETSPNAM
/*
* Define HAVE_PW_ENCRYPT to use pw_encrypt() instead of crypt().
* pw_encrypt() is like the standard crypt(), except that it may
* support better password hashing algorithms.
*
* Define if linking with libshadow.a from the shadow password
* suite (Linux, SunOS 4.x?).
*/
#undef HAVE_PW_ENCRYPT
/*
* Define HAVE_AUTH_METHODS to support the shadow suite specific
* extension: the encrypted password field contains a list of
* administrator defined authentication methods, separated by
* semicolons. This program only supports the standard password
* authentication method (a string that doesn't start with '@').
*/
#undef HAVE_AUTH_METHODS
/*
* FAIL_DELAY - number of seconds to sleep before exiting if the
* password was wrong, to slow down password guessing attempts.
*/
#define FAIL_DELAY 2
/* No user-serviceable parts below :-). */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <pwd.h>
#ifdef USE_SYSLOG
#include <syslog.h>
#ifndef LOG_AUTHPRIV
#define LOG_AUTHPRIV LOG_AUTH
#endif
#endif
#ifdef HAVE_GETSPNAM
#include <shadow.h>
#endif
#ifdef HAVE_PW_ENCRYPT
extern char *pw_encrypt();
#define crypt pw_encrypt
#endif
/*
* Read the password (one line) from fp. We don't turn off echo
* because we expect input from a pipe.
*/
static char *
get_line(fp)
FILE *fp;
{
static char buf[128];
char *cp;
int ch;
cp = buf;
while ((ch = getc(fp)) != EOF && ch != '\0' && ch != '\n') {
if (cp >= buf + sizeof buf - 1)
break;
*cp++ = ch;
}
*cp = '\0';
return buf;
}
/*
* Get the password file entry for the current user. If the name
* returned by getlogin() is correct (matches the current real uid),
* return the entry for that user. Otherwise, return the entry (if
* any) matching the current real uid. Return NULL on failure.
*/
static struct passwd *
get_my_pwent()
{
uid_t uid = getuid();
char *name = getlogin();
if (name && *name) {
struct passwd *pw = getpwnam(name);
if (pw && pw->pw_uid == uid)
return pw;
}
return getpwuid(uid);
}
/*
* Verify the password. The system-dependent shadow support is here.
*/
static int
password_auth_ok(pw, pass)
const struct passwd *pw;
const char *pass;
{
int result;
char *cp;
#ifdef HAVE_AUTH_METHODS
char *buf;
#endif
#ifdef HAVE_GETSPNAM
struct spwd *sp;
#endif
if (pw) {
#ifdef HAVE_GETSPNAM
sp = getspnam(pw->pw_name);
if (sp)
cp = sp->sp_pwdp;
else
#endif
cp = pw->pw_passwd;
} else
cp = "xx";
#ifdef HAVE_AUTH_METHODS
buf = strdup(cp); /* will be modified by strtok() */
if (!buf) {
fprintf(stderr, "Out of memory.\n");
exit(13);
}
cp = strtok(buf, ";");
while (cp && *cp == '@')
cp = strtok(NULL, ";");
/* fail if no password authentication for this user */
if (!cp)
cp = "xx";
#endif
if (*pass || *cp)
result = (strcmp(crypt(pass, cp), cp) == 0);
else
result = 1; /* user with no password */
#ifdef HAVE_AUTH_METHODS
free(buf);
#endif
return result;
}
/*
* Main program.
*/
int
main(argc, argv)
int argc;
char **argv;
{
struct passwd *pw;
char *pass, *name;
char myname[32];
#ifdef USE_SYSLOG
openlog("pwdauth", LOG_PID | LOG_CONS, LOG_AUTHPRIV);
#endif
pw = get_my_pwent();
if (!pw) {
#ifdef USE_SYSLOG
syslog(LOG_ERR, "can't get login name for uid %d.\n",
(int) getuid());
#endif
fprintf(stderr, "Who are you?\n");
exit(2);
}
strncpy(myname, pw->pw_name, sizeof myname - 1);
myname[sizeof myname - 1] = '\0';
name = myname;
if (argc > 1) {
name = argv[1];
pw = getpwnam(name);
}
pass = get_line(stdin);
if (password_auth_ok(pw, pass)) {
#ifdef USE_SYSLOG
syslog(pw->pw_uid ? LOG_INFO : LOG_NOTICE,
"user `%s' entered correct password for `%.32s'.\n",
myname, name);
#endif
exit(0);
}
#ifdef USE_SYSLOG
/* be careful not to overrun the syslog buffer */
syslog((!pw || pw->pw_uid) ? LOG_NOTICE : LOG_WARNING,
"user `%s' entered incorrect password for `%.32s'.\n",
myname, name);
#endif
#ifdef FAIL_DELAY
sleep(FAIL_DELAY);
#endif
fprintf(stderr, "Wrong password.\n");
exit(1);
}
#if 0
/*
* You can use code similar to the following to run this program.
* Return values: >=0 - program exit status (use the <sys/wait.h>
* macros to get the exit code, it is shifted left by 8 bits),
* -1 - check errno.
*/
int
verify_password(const char *username, const char *password)
{
int pipe_fd[2];
int pid, wpid, status;
if (pipe(pipe_fd))
return -1;
if ((pid = fork()) == 0) {
char *arg[3];
char *env[1];
/* child */
close(pipe_fd[1]);
if (pipe_fd[0] != 0) {
if (dup2(pipe_fd[0], 0) != 0)
_exit(127);
close(pipe_fd[0]);
}
arg[0] = "/usr/bin/pwdauth";
arg[1] = username;
arg[2] = NULL;
env[0] = NULL;
execve(arg[0], arg, env);
_exit(127);
} else if (pid == -1) {
/* error */
close(pipe_fd[0]);
close(pipe_fd[1]);
return -1;
}
/* parent */
close(pipe_fd[0]);
write(pipe_fd[1], password, strlen(password));
write(pipe_fd[1], "\n", 1);
close(pipe_fd[1]);
while ((wpid = wait(&status)) != pid) {
if (wpid == -1)
return -1;
}
return status;
}
#endif

1
doc/WISHLIST
View File

@ -26,7 +26,6 @@ New ideas to add to this list are welcome, too. --marekm
- vipw: check password files for errors after editing
- add "maximum time users allowed to stay logged in" limit option to logoutd
- handle quotes in /etc/environment like the shell does (but sshd doesn't...)
- better utmpx support (logoutd, ...)
- better OPIE support (report number of logins left, etc.)
- new option for /etc/suauth: don't load user's environment (force "su -")
suggested by Ulisses Alonso Camaro

68
doc/contributions/build_install.md Normal file
View File

@ -0,0 +1,68 @@
# Build & install
The following page explains how to build and install the shadow project.
Additional information on how to do this in a container environment is provided
at the end of the page.
## Local
### Dependency installation
This projects depends on other software packages that need to be installed
before building it. We recommend using the dependency installation commands
provided by the distributions to install them. Some examples below.
Debian:
```
apt-get build-dep shadow
```
Fedora:
```
dnf builddep shadow-utils
```
### Configure
The first step is to configure it. You can use the
`autogen.sh` script provided by the project. Example:
```
./autogen.sh --without-selinux --enable-man --with-yescrypt
```
### Build
The next step is to build the project:
```
make -j4
```
### Install
The last step is to install it. We recommend avoiding this step and using a
disposable system like a VM or a container instead.
```
make install
```
## Containers
Alternatively, you can use any of the preconfigured container images builders
to build and install shadow.
You can either generate a single image by running the following command from
the root folder of the project (i.e. Alpine):
```
docker build -f share/containers/alpine.dockerfile . --output build-out/alpine
```
Or generate all of the images with the `container-build.sh` script, as if you
were running some of the CI checks locally:
```
share/container-build.sh
```

25
doc/contributions/ci.md Normal file
View File

@ -0,0 +1,25 @@
# Continuous Integration (CI)
Shadow runs a CI workflow every time a pull-request (PR) is updated. This
workflow contains several checks to assure the quality of the project, and
only pull-requests with green results are merged.
## Build & install
The project is built & installed on Ubuntu, Alpine, Debian and Fedora. The last
three distributions are built & installed on containers, and the workflow can
be triggered locally by following the instructions specified in the
[Build & install](build_install.md#containers) page.
## System tests
The project is tested on Ubuntu. For that purpose it is built & installed in
this distribution in a VM. You can run this step locally by following the
instructions provided in the [Tests](tests.md#system-tests) page.
## Static code analysis
C and shell static code analysis is also executed. For that purpose
[CodeQL](https://codeql.github.com/) and
[Differential ShellCheck](https://github.com/marketplace/actions/differential-shellcheck)
are used.

12
doc/contributions/coding_style.md Normal file
View File

@ -0,0 +1,12 @@
# Coding style
* For a general guidance refer to the
[Linux kernel coding style](https://www.kernel.org/doc/html/latest/process/coding-style.html)
* Patches that change the existing coding style are not welcome, as they make
downstream porting harder for the distributions
## Indentation
Tabs are preferred over spaces for indentation. Loading the `.editorconfig`
file in your preferred IDE may help you configure it.

77
doc/contributions/introduction.md Normal file
View File

@ -0,0 +1,77 @@
# Introduction
## Git and Github
We recommend you to get familiar with the
[git](https://guides.github.com/introduction/git-handbook) and
[Github](https://guides.github.com) workflows before posting any changes.
### Set up in a nut shell
The following steps describe the process in a nut shell to provide you a basic
template:
* Create an account on [GitHub](https://github.com)
* Fork the [shadow repository](https://github.com/shadow-maint/shadow)
* Clone the shadow repository
```
git clone https://github.com/shadow-maint/shadow.git
```
* Add your fork as an extra remote
```
git remote add $ghusername git@github.com:$ghusername/shadow.git
```
* Setup your name contact e-mail that you want to use for the development
```
git config user.name "John Smith"
git config user.email "john.smith@home.com"
```
**Note**: this will setup the user information only for this repository. You
can also add `--global` switch to the `git config` command to setup these
options globally and thus making them available in every git repository.
* Create a working branch
```
git checkout -b my-changes
```
* Commit changes
```
vim change-what-you-need
git commit -s
```
Check
[the kernel patches guide](https://www.kernel.org/doc/html/v4.14/process/submitting-patches.html#describe-your-changes)
to get an idea on how to write a good commit message.
* Push your changes to your GitHub repository
```
git push $ghusername my-changes --force
```
* Open a Pull Request against shadow project by clicking on the link provided
in the output of the previous step
* Make sure that all Continuous Integration checks are green and wait review
## Internal guidelines
Additionally, you should also check the following internal guidelines to
understand the project's development model:
* [Build & install](build_install.md)
* [Coding style](coding_style.md)
* [Tests](tests.md)
* [Continuous Integration](CI.md)
* [Releases](releases.md)
* [License](license.md)

10
doc/contributions/license.md Normal file
View File

@ -0,0 +1,10 @@
# License
All new source code committed to the shadow project is assumed to be made
available under the [BSD-3-Clause](../../COPYING) license unless the submitter
specifies another license at that time. The shadow maintainers reserve the
right to refuse a submission if the license is deemed incompatible with the
goals of the project.
**Note**: old code may be made available under another license, check the
license tag for each file to get additional information.

7
doc/contributions/releases.md Normal file
View File

@ -0,0 +1,7 @@
# Releases
The shadow project doesn't follow any specific timeline to release new software
versions. Usually, they are released when a major milestone is finished.
Released source code, alongside the release notes, are provided in the
[release Github page](https://github.com/shadow-maint/shadow/releases).

18
doc/contributions/tests.md Normal file
View File

@ -0,0 +1,18 @@
# Tests
Currently, shadow only provides system tests.
## System tests
These type of tests are written in shell. Unfortunately, the testing framework
is tightly coupled to the Ubuntu distribution and it can only be run in this
distribution. Besides, if anything fails during the execution the system can
be left in an unstable state. Taking that into account you shouldn't run this
workflow in your host machine, we recommend to use a disposable system like a
VM or a container instead.
You can execute system tests by running:
```
cd tests && ./run_all`.
```

7
etc/login.defs
View File

@ -127,7 +127,7 @@ SU_NAME su
# Directory where mailboxes reside, _or_ name of file, relative to the
# home directory. If you _do_ define both, MAIL_DIR takes precedence.
#
MAIL_DIR /var/spool/mail
MAIL_DIR /var/mail
#MAIL_FILE .mail
#
@ -159,7 +159,7 @@ ENV_HZ HZ=100
#
# (they are minimal, add the rest in the shell startup files)
ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin
ENV_PATH PATH=/bin:/usr/bin
ENV_PATH PATH=/usr/bin:/usr/local/bin
#
# Terminal permissions
@ -335,6 +335,7 @@ CHFN_RESTRICT rwh
# the PAM modules configuration.
#
#ENCRYPT_METHOD DES
ENCRYPT_METHOD SHA512
#
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
@ -351,7 +352,9 @@ CHFN_RESTRICT rwh
# If MIN > MAX, the highest value will be used.
#
#SHA_CRYPT_MIN_ROUNDS 5000
SHA_CRYPT_MIN_ROUNDS 500000
#SHA_CRYPT_MAX_ROUNDS 5000
SHA_CRYPT_MAX_ROUNDS 500000
#
# Only works if ENCRYPT_METHOD is set to BCRYPT.

26
etc/shadow-maint/groupdel-pre.d/01-kill_group_procs.sh Normal file
View File

@ -0,0 +1,26 @@
#!/bin/sh
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
GROUPID=`awk -F: '$1 == "'"${SUBJECT}"'" { print $3 }' /etc/group`
if [ "${GROUPID}" = "" ]; then
exit 0
fi
for status in /proc/*/status; do
# either this isn't a process or its already dead since expanding the list
[ -f "$status" ] || continue
tbuf=${status%/status}
pid=${tbuf#/proc/}
case "$pid" in
"$$") continue;;
[0-9]*) :;;
*) continue
esac
grep -q '^Groups:.*\b'"${GROUPID}"'\b.*' "/proc/$pid/status" || continue
kill -9 "$pid" || echo "cannot kill $pid" 1>&2
done

4
lib/Makefile.am
View File

@ -11,6 +11,7 @@ libshadow_la_CPPFLAGS += -DVENDORDIR=\"$(VENDORDIR)\"
endif
libshadow_la_CPPFLAGS += -I$(top_srcdir)
libshadow_la_CFLAGS = $(LIBBSD_CFLAGS)
libshadow_la_SOURCES = \
commonio.c \
@ -65,8 +66,7 @@ libshadow_la_SOURCES = \
shadowio.c \
shadowio.h \
shadowmem.c \
spawn.c \
utent.c
spawn.c
if WITH_TCB
libshadow_la_SOURCES += tcbfuncs.c tcbfuncs.h

122
lib/alloc.h Normal file
View File

@ -0,0 +1,122 @@
/*
* SPDX-FileCopyrightText: 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SHADOW_INCLUDE_LIB_MALLOC_H_
#define SHADOW_INCLUDE_LIB_MALLOC_H_
#include <config.h>
#include <assert.h>
#include <errno.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include "defines.h"
#define ALLOCARRAY(n, type) ((type *) alloca(sizeof(type) * (n)))
#define CALLOC(n, type) ((type *) calloc(n, sizeof(type)))
#define XCALLOC(n, type) ((type *) xcalloc(n, sizeof(type)))
#define MALLOCARRAY(n, type) ((type *) mallocarray(n, sizeof(type)))
#define XMALLOCARRAY(n, type) ((type *) xmallocarray(n, sizeof(type)))
#define ALLOCA(type) ALLOCARRAY(1, type)
#define MALLOC(type) MALLOCARRAY(1, type)
#define XMALLOC(type) XMALLOCARRAY(1, type)
#define REALLOC(ptr, type) REALLOCARRAY(ptr, 1, type)
#define REALLOCF(ptr, type) REALLOCARRAYF(ptr, 1, type)
#define REALLOCARRAY(ptr, n, type) \
({ \
__auto_type p_ = (ptr); \
\
static_assert(__builtin_types_compatible_p(typeof(p_), type *), ""); \
\
(type *) reallocarray(p_, n, sizeof(type)); \
})
#define REALLOCARRAYF(ptr, n, type) \
({ \
__auto_type p_ = (ptr); \
\
static_assert(__builtin_types_compatible_p(typeof(p_), type *), ""); \
\
(type *) reallocarrayf(p_, n, sizeof(type)); \
})
#define XREALLOCARRAY(ptr, n, type) \
({ \
__auto_type p_ = (ptr); \
\
static_assert(__builtin_types_compatible_p(typeof(p_), type *), ""); \
\
(type *) xreallocarray(p_, n, sizeof(type)); \
})
ATTR_MALLOC(free)
inline void *xmalloc(size_t size);
ATTR_MALLOC(free)
inline void *xmallocarray(size_t nmemb, size_t size);
ATTR_MALLOC(free)
inline void *mallocarray(size_t nmemb, size_t size);
ATTR_MALLOC(free)
inline void *reallocarrayf(void *p, size_t nmemb, size_t size);
ATTR_MALLOC(free)
inline char *xstrdup(const char *str);
ATTR_MALLOC(free)
void *xcalloc(size_t nmemb, size_t size);
ATTR_MALLOC(free)
void *xreallocarray(void *p, size_t nmemb, size_t size);
inline void *
xmalloc(size_t size)
{
return xmallocarray(1, size);
}
inline void *
xmallocarray(size_t nmemb, size_t size)
{
return xreallocarray(NULL, nmemb, size);
}
inline void *
mallocarray(size_t nmemb, size_t size)
{
return reallocarray(NULL, nmemb, size);
}
inline void *
reallocarrayf(void *p, size_t nmemb, size_t size)
{
void *q;
q = reallocarray(p, nmemb, size);
/* realloc(p, 0) is equivalent to free(p); avoid double free. */
if (q == NULL && nmemb != 0 && size != 0)
free(p);
return q;
}
inline char *
xstrdup(const char *str)
{
return strcpy(XMALLOCARRAY(strlen(str) + 1, char), str);
}
#endif // include guard

53
lib/bit.h Normal file
View File

@ -0,0 +1,53 @@
/*
* SPDX-FileCopyrightText: 2022 - 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SHADOW_INCLUDE_LIB_BIT_H_
#define SHADOW_INCLUDE_LIB_BIT_H_
#include <config.h>
#include <limits.h>
#ifndef ULONG_WIDTH
#define ULONG_WIDTH (sizeof(unsigned long) * CHAR_BIT)
#endif
inline unsigned long bit_ceilul(unsigned long x);
inline unsigned long bit_ceil_wrapul(unsigned long x);
inline int leading_zerosul(unsigned long x);
/* stdc_bit_ceilul(3) */
inline unsigned long
bit_ceilul(unsigned long x)
{
return 1 + (ULONG_MAX >> leading_zerosul(x));
}
/* stdc_bit_ceilul(3), but wrap instead of having Undefined Behavior */
inline unsigned long
bit_ceil_wrapul(unsigned long x)
{
if (x == 0)
return 0;
return bit_ceilul(x);
}
/* stdc_leading_zerosul(3) */
inline int
leading_zerosul(unsigned long x)
{
return (x == 0) ? ULONG_WIDTH : __builtin_clzl(x);
}
#endif // include guard

47
lib/commonio.c
View File

@ -21,6 +21,8 @@
#include <errno.h>
#include <stdio.h>
#include <signal.h>
#include "alloc.h"
#include "nscd.h"
#include "sssd.h"
#ifdef WITH_TCB
@ -251,25 +253,13 @@ static /*@null@*/ /*@dependent@*/FILE *fopen_set_perms (
return NULL;
}
#ifdef HAVE_FCHOWN
if (fchown (fileno (fp), sb->st_uid, sb->st_gid) != 0) {
goto fail;
}
#else /* !HAVE_FCHOWN */
if (chown (name, sb->st_mode) != 0) {
goto fail;
}
#endif /* !HAVE_FCHOWN */
#ifdef HAVE_FCHMOD
if (fchmod (fileno (fp), sb->st_mode & 0664) != 0) {
goto fail;
}
#else /* !HAVE_FCHMOD */
if (chmod (name, sb->st_mode & 0664) != 0) {
goto fail;
}
#endif /* !HAVE_FCHMOD */
return fp;
fail:
@ -374,11 +364,11 @@ int commonio_lock_nowait (struct commonio_db *db, bool log)
}
file_len = strlen(db->filename) + 11;/* %lu max size */
lock_file_len = strlen(db->filename) + 6; /* sizeof ".lock" */
file = (char*)malloc(file_len);
file = MALLOCARRAY(file_len, char);
if (file == NULL) {
goto cleanup_ENOMEM;
}
lock = (char*)malloc(lock_file_len);
lock = MALLOCARRAY(lock_file_len, char);
if (lock == NULL) {
goto cleanup_ENOMEM;
}
@ -618,7 +608,7 @@ int commonio_open (struct commonio_db *db, int mode)
fd = open (db->filename,
(db->readonly ? O_RDONLY : O_RDWR)
| O_NOCTTY | O_NONBLOCK | O_NOFOLLOW);
| O_NOCTTY | O_NONBLOCK | O_NOFOLLOW | O_CLOEXEC);
saved_errno = errno;
db->fp = NULL;
if (fd >= 0) {
@ -649,22 +639,19 @@ int commonio_open (struct commonio_db *db, int mode)
return 0;
}
/* Do not inherit fd in spawned processes (e.g. nscd) */
fcntl (fileno (db->fp), F_SETFD, FD_CLOEXEC);
buflen = BUFLEN;
buf = (char *) malloc (buflen);
buf = MALLOCARRAY (buflen, char);
if (NULL == buf) {
goto cleanup_ENOMEM;
}
while (db->ops->fgets (buf, (int) buflen, db->fp) == buf) {
while (db->ops->fgets (buf, buflen, db->fp) == buf) {
while ( ((cp = strrchr (buf, '\n')) == NULL)
&& (feof (db->fp) == 0)) {
size_t len;
buflen += BUFLEN;
cp = (char *) realloc (buf, buflen);
cp = REALLOCARRAY (buf, buflen, char);
if (NULL == cp) {
goto cleanup_buf;
}
@ -698,7 +685,7 @@ int commonio_open (struct commonio_db *db, int mode)
}
}
p = (struct commonio_entry *) malloc (sizeof *p);
p = MALLOC (struct commonio_entry);
if (NULL == p) {
goto cleanup_entry;
}
@ -775,7 +762,7 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))
return 0;
}
entries = malloc (n * sizeof (struct commonio_entry *));
entries = MALLOCARRAY (n, struct commonio_entry *);
if (entries == NULL) {
return -1;
}
@ -998,13 +985,11 @@ int commonio_close (struct commonio_db *db)
if (fflush (db->fp) != 0) {
errors++;
}
#ifdef HAVE_FSYNC
if (fsync (fileno (db->fp)) != 0) {
errors++;
}
#else /* !HAVE_FSYNC */
sync ();
#endif /* !HAVE_FSYNC */
if (fclose (db->fp) != 0) {
errors++;
}
@ -1096,7 +1081,7 @@ int commonio_update (struct commonio_db *db, const void *eptr)
return 1;
}
/* not found, new entry */
p = (struct commonio_entry *) malloc (sizeof *p);
p = MALLOC (struct commonio_entry);
if (NULL == p) {
db->ops->free (nentry);
errno = ENOMEM;
@ -1133,7 +1118,7 @@ int commonio_append (struct commonio_db *db, const void *eptr)
return 0;
}
/* new entry */
p = (struct commonio_entry *) malloc (sizeof *p);
p = MALLOC (struct commonio_entry);
if (NULL == p) {
db->ops->free (nentry);
errno = ENOMEM;
@ -1200,6 +1185,8 @@ int commonio_remove (struct commonio_db *db, const char *name)
db->ops->free (p->eptr);
}
free(p);
return 1;
}

1
lib/commonio.h
View File

@ -123,6 +123,7 @@ extern int commonio_setname (struct commonio_db *, const char *);
extern bool commonio_present (const struct commonio_db *db);
extern int commonio_lock (struct commonio_db *);
extern int commonio_lock_nowait (struct commonio_db *, bool log);
extern int do_fcntl_lock (const char *file, bool log, short type);
extern int commonio_open (struct commonio_db *, int);
extern /*@observer@*/ /*@null@*/const void *commonio_locate (struct commonio_db *, const char *);
extern int commonio_update (struct commonio_db *, const void *);

139
lib/defines.h
View File

@ -6,41 +6,8 @@
#include "config.h"
#if HAVE_STDBOOL_H
# include <stdbool.h>
#else
# if ! HAVE__BOOL
# ifdef __cplusplus
typedef bool _Bool;
# else
typedef unsigned char _Bool;
# endif
# endif
# define bool _Bool
# define false (0)
# define true (1)
# define __bool_true_false_are_defined 1
#endif
/* Take care of NLS matters. */
#ifdef S_SPLINT_S
extern char *setlocale(int categories, const char *locale);
# define LC_ALL (6)
extern char * bindtextdomain (const char * domainname, const char * dirname);
extern char * textdomain (const char * domainname);
# define _(Text) Text
# define ngettext(Msgid1, Msgid2, N) \
((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
#else
#ifdef HAVE_LOCALE_H
# include <locale.h>
#else
# undef setlocale
# define setlocale(category, locale) (NULL)
# ifndef LC_ALL
# define LC_ALL 6
# endif
#endif
#include <stdbool.h>
#include <locale.h>
#define gettext_noop(String) (String)
/* #define gettext_def(String) "#define String" */
@ -57,22 +24,17 @@ extern char * textdomain (const char * domainname);
# define ngettext(Msgid1, Msgid2, N) \
((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
#endif
#endif
#include <stdlib.h>
#include <string.h>
#if HAVE_ERRNO_H
# include <errno.h>
#endif
#include <errno.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#if HAVE_UNISTD_H
# include <unistd.h>
#endif
#include <unistd.h>
/*
* crypt(3), crypt_gensalt(3), and their
@ -85,17 +47,15 @@ extern char * textdomain (const char * domainname);
#include <sys/time.h>
#include <time.h>
#ifdef HAVE_MEMSET_S
# define memzero(ptr, size) memset_s((ptr), 0, (size))
#ifdef HAVE_MEMSET_EXPLICIT
# define memzero(ptr, size) memset_explicit((ptr), 0, (size))
#elif defined HAVE_EXPLICIT_BZERO /* !HAVE_MEMSET_S */
# define memzero(ptr, size) explicit_bzero((ptr), (size))
#else /* !HAVE_MEMSET_S && HAVE_EXPLICIT_BZERO */
static inline void memzero(void *ptr, size_t size)
{
volatile unsigned char * volatile p = ptr;
while (size--) {
*p++ = '\0';
}
ptr = memset(ptr, '\0', size);
__asm__ __volatile__ ("" : : "r"(ptr) : "memory");
}
#endif /* !HAVE_MEMSET_S && !HAVE_EXPLICIT_BZERO */
@ -123,7 +83,6 @@ static inline void memzero(void *ptr, size_t size)
#endif
#endif
#ifdef USE_SYSLOG
#include <syslog.h>
#ifndef LOG_WARN
@ -170,14 +129,6 @@ static inline void memzero(void *ptr, size_t size)
#define SYSLOG(x) syslog x
#endif /* !ENABLE_NLS */
#else /* !USE_SYSLOG */
#define SYSLOG(x) /* empty */
#define openlog(a,b,c) /* empty */
#define closelog() /* empty */
#endif /* !USE_SYSLOG */
/* The default syslog settings can now be changed here,
in just one place. */
@ -192,33 +143,10 @@ static inline void memzero(void *ptr, size_t size)
#define OPENLOG(progname) openlog(progname, SYSLOG_OPTIONS, SYSLOG_FACILITY)
#ifndef F_OK
# define F_OK 0
# define X_OK 1
# define W_OK 2
# define R_OK 4
#endif
#ifndef SEEK_SET
# define SEEK_SET 0
# define SEEK_CUR 1
# define SEEK_END 2
#endif
#if HAVE_TERMIOS_H
# include <termios.h>
# define STTY(fd, termio) tcsetattr(fd, TCSANOW, termio)
# define GTTY(fd, termio) tcgetattr(fd, termio)
# define TERMIO struct termios
# define USE_TERMIOS
#else /* assumed HAVE_TERMIO_H */
# include <sys/ioctl.h>
# include <termio.h>
# define STTY(fd, termio) ioctl(fd, TCSETA, termio)
# define GTTY(fd, termio) ioctl(fd, TCGETA, termio)
# define TEMRIO struct termio
# define USE_TERMIO
#endif
#include <termios.h>
#define STTY(fd, termio) tcsetattr(fd, TCSANOW, termio)
#define GTTY(fd, termio) tcgetattr(fd, termio)
#define TERMIO struct termios
/*
* Password aging constants
@ -241,6 +169,10 @@ static inline void memzero(void *ptr, size_t size)
#define SCALE DAY
#endif
#define WIDTHOF(x) (sizeof(x) * CHAR_BIT)
#define NITEMS(arr) (sizeof((arr)) / sizeof((arr)[0]))
#define STRLEN(s) (NITEMS(s) - 1)
/* Copy string pointed by B to array A with size checking. It was originally
in lmain.c but is _very_ useful elsewhere. Some setuid root programs with
very sloppy coding used to assume that BUFSIZ will always be enough... */
@ -267,18 +199,6 @@ static inline void memzero(void *ptr, size_t size)
#endif
#endif
#ifndef NULL
#define NULL ((void *) 0)
#endif
#ifdef sun /* hacks for compiling on SunOS */
# ifndef SOLARIS
extern int fputs ();
extern char *strdup ();
extern char *strerror ();
# endif
#endif
/*
* string to use for the pw_passwd field in /etc/passwd when using
* shadow passwords - most systems use "x" but there are a few
@ -303,33 +223,28 @@ extern char *strerror ();
/* To be used for verified unused parameters */
#if defined(__GNUC__) && !defined(__STRICT_ANSI__)
# define unused __attribute__((unused))
# define unused __attribute__((unused))
# define NORETURN __attribute__((__noreturn__))
# define format_attr(type, index, check) __attribute__((format (type, index, check)))
#else
# define unused
# define NORETURN
# define format_attr(type, index, check)
#endif
/* Maximum length of usernames */
#ifdef HAVE_UTMPX_H
# include <utmpx.h>
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmpx *)NULL)->ut_user))
#else
# include <utmp.h>
# ifdef HAVE_STRUCT_UTMP_UT_USER
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmp *)NULL)->ut_user))
# else
# ifdef HAVE_STRUCT_UTMP_UT_NAME
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmp *)NULL)->ut_name))
# else
# define USER_NAME_MAX_LENGTH 32
# endif
# endif
#endif
#include <utmp.h>
#define USER_NAME_MAX_LENGTH (sizeof (((struct utmp *)NULL)->ut_user))
/* Maximum length of passwd entry */
#define PASSWD_ENTRY_MAX_LENGTH 32768
#if (__GNUC__ >= 11) && !defined(__clang__)
# define ATTR_MALLOC(deallocator) [[gnu::malloc(deallocator)]]
#else
# define ATTR_MALLOC(deallocator)
#endif
#ifdef HAVE_SECURE_GETENV
# define shadow_getenv(name) secure_getenv(name)
# else

42
lib/fields.c
View File

@ -21,9 +21,9 @@
*
* The supplied field is scanned for non-printable and other illegal
* characters.
* + -1 is returned if an illegal character is present.
* + 1 is returned if no illegal characters are present, but the field
* contains a non-printable character.
* + -1 is returned if an illegal or control character is present.
* + 1 is returned if no illegal or control characters are present,
* but the field contains a non-printable character.
* + 0 is returned otherwise.
*/
int valid_field (const char *field, const char *illegal)
@ -37,20 +37,19 @@ int valid_field (const char *field, const char *illegal)
/* For each character of field, search if it appears in the list
* of illegal characters. */
for (cp = field; '\0' != *cp; cp++) {
if (strchr (illegal, *cp) != NULL) {
err = -1;
break;
}
if (illegal && NULL != strpbrk (field, illegal)) {
return -1;
}
if (0 == err) {
/* Search if there are some non-printable characters */
for (cp = field; '\0' != *cp; cp++) {
if (!isprint (*cp)) {
err = 1;
break;
}
/* Search if there are non-printable or control characters */
for (cp = field; '\0' != *cp; cp++) {
unsigned char c = *cp;
if (!isprint (c)) {
err = 1;
}
if (iscntrl (c)) {
err = -1;
break;
}
}
@ -74,7 +73,7 @@ void change_field (char *buf, size_t maxsize, const char *prompt)
printf ("\t%s [%s]: ", prompt, buf);
(void) fflush (stdout);
if (fgets (newf, (int) maxsize, stdin) != newf) {
if (fgets (newf, maxsize, stdin) != newf) {
return;
}
@ -91,17 +90,16 @@ void change_field (char *buf, size_t maxsize, const char *prompt)
* entering a space. --marekm
*/
while (--cp >= newf && isspace (*cp));
cp++;
while (newf < cp && isspace (cp[-1])) {
cp--;
}
*cp = '\0';
cp = newf;
while (('\0' != *cp) && isspace (*cp)) {
while (isspace (*cp)) {
cp++;
}
strncpy (buf, cp, maxsize - 1);
buf[maxsize - 1] = '\0';
strcpy (buf, cp);
}
}

2
lib/get_gid.c
View File

@ -25,7 +25,7 @@ int get_gid (const char *gidstr, gid_t *gid)
return 0;
}
*gid = (gid_t)val;
*gid = val;
return 1;
}

73
lib/get_pid.c
View File

@ -10,6 +10,9 @@
#include "prototypes.h"
#include "defines.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
int get_pid (const char *pidstr, pid_t *pid)
{
@ -21,11 +24,79 @@ int get_pid (const char *pidstr, pid_t *pid)
if ( ('\0' == *pidstr)
|| ('\0' != *endptr)
|| (ERANGE == errno)
|| (val < 1)
|| (/*@+longintegral@*/val != (pid_t)val)/*@=longintegral@*/) {
return 0;
}
*pid = (pid_t)val;
*pid = val;
return 1;
}
/*
* If use passed in fd:4 as an argument, then return the
* value '4', the fd to use.
* On error, return -1.
*/
int get_pidfd_from_fd(const char *pidfdstr)
{
long long int val;
char *endptr;
struct stat st;
dev_t proc_st_dev, proc_st_rdev;
errno = 0;
val = strtoll (pidfdstr, &endptr, 10);
if ( ('\0' == *pidfdstr)
|| ('\0' != *endptr)
|| (ERANGE == errno)
|| (val < 0)
|| (/*@+longintegral@*/val != (int)val)/*@=longintegral@*/) {
return -1;
}
if (stat("/proc/self/uid_map", &st) < 0) {
return -1;
}
proc_st_dev = st.st_dev;
proc_st_rdev = st.st_rdev;
if (fstat(val, &st) < 0) {
return -1;
}
if (st.st_dev != proc_st_dev || st.st_rdev != proc_st_rdev) {
return -1;
}
return (int)val;
}
int open_pidfd(const char *pidstr)
{
int proc_dir_fd;
int written;
char proc_dir_name[32];
pid_t target;
if (get_pid(pidstr, &target) == 0)
return -ENOENT;
/* max string length is 6 + 10 + 1 + 1 = 18, allocate 32 bytes */
written = snprintf(proc_dir_name, sizeof(proc_dir_name), "/proc/%u/",
target);
if ((written <= 0) || ((size_t)written >= sizeof(proc_dir_name))) {
fprintf(stderr, "snprintf of proc path failed for %u: %s\n",
target, strerror(errno));
return -EINVAL;
}
proc_dir_fd = open(proc_dir_name, O_DIRECTORY);
if (proc_dir_fd < 0) {
fprintf(stderr, _("Could not open proc directory for target %u: %s\n"),
target, strerror(errno));
return -EINVAL;
}
return proc_dir_fd;
}

2
lib/get_uid.c
View File

@ -25,7 +25,7 @@ int get_uid (const char *uidstr, uid_t *uid)
return 0;
}
*uid = (uid_t)val;
*uid = val;
return 1;
}

57
lib/getdef.c
View File

@ -13,6 +13,7 @@
#include "prototypes.h"
#include "defines.h"
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
@ -20,8 +21,11 @@
#ifdef USE_ECONF
#include <libeconf.h>
#endif
#include "alloc.h"
#include "getdef.h"
#include "shadowlog_internal.h"
/*
* A configuration item definition.
*/
@ -132,10 +136,8 @@ static struct itemdef def_table[] = {
#ifndef USE_PAM
PAMDEFS
#endif
#ifdef USE_SYSLOG
{"SYSLOG_SG_ENAB", NULL},
{"SYSLOG_SU_ENAB", NULL},
#endif
#ifdef WITH_TCB
{"TCB_AUTH_GROUP", NULL},
{"TCB_SYMLINKS", NULL},
@ -193,7 +195,7 @@ static void def_load (void);
}
d = def_find (item);
return ((NULL == d)? (const char *) NULL : d->value);
return (NULL == d) ? NULL : d->value;
}
@ -251,7 +253,7 @@ int getdef_num (const char *item, int dflt)
return dflt;
}
return (int) val;
return val;
}
@ -286,7 +288,7 @@ unsigned int getdef_unum (const char *item, unsigned int dflt)
return dflt;
}
return (unsigned int) val;
return val;
}
@ -430,7 +432,7 @@ static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
SYSLOG ((LOG_CRIT, "unknown configuration item `%s'", name));
out:
return (struct itemdef *) NULL;
return NULL;
}
/*
@ -446,14 +448,14 @@ void setdef_config_file (const char* file)
char* cp;
len = strlen(file) + strlen(sysconfdir) + 2;
cp = malloc(len);
cp = MALLOCARRAY(len, char);
if (cp == NULL)
exit (13);
snprintf(cp, len, "%s/%s", file, sysconfdir);
sysconfdir = cp;
#ifdef VENDORDIR
len = strlen(file) + strlen(vendordir) + 2;
cp = malloc(len);
cp = MALLOCARRAY(len, char);
if (cp == NULL)
exit (13);
snprintf(cp, len, "%s/%s", file, vendordir);
@ -470,18 +472,13 @@ void setdef_config_file (const char* file)
* Loads the user-configured options from the default configuration file
*/
#ifdef USE_ECONF
static void def_load (void)
{
#ifdef USE_ECONF
econf_file *defs_file = NULL;
econf_err error;
char **keys;
size_t key_number;
#else
int i;
FILE *fp;
char buf[1024], *name, *value, *s;
#endif
/*
* Set the initialized flag.
@ -489,8 +486,6 @@ static void def_load (void)
*/
def_loaded = true;
#ifdef USE_ECONF
error = econf_readDirs (&defs_file, vendordir, sysconfdir, "login", "defs", " \t", "#");
if (error) {
if (error == ECONF_NOFILE)
@ -510,7 +505,12 @@ static void def_load (void)
for (size_t i = 0; i < key_number; i++) {
char *value;
econf_getStringValue(defs_file, NULL, keys[i], &value);
error = econf_getStringValue(defs_file, NULL, keys[i], &value);
if (error) {
SYSLOG ((LOG_CRIT, "failed reading key %zu from econf [%s]",
i, econf_errString(error)));
exit (EXIT_FAILURE);
}
/*
* Store the value in def_table.
@ -520,11 +520,26 @@ static void def_load (void)
* syslog. The tools will just use their default values.
*/
(void)putdef_str (keys[i], value);
free(value);
}
econf_free (keys);
econf_free (defs_file);
#else
}
#else /* USE_ECONF */
static void def_load (void)
{
int i;
FILE *fp;
char buf[1024], *name, *value, *s;
/*
* Set the initialized flag.
* (do it early to prevent recursion in putdef_str())
*/
def_loaded = true;
/*
* Open the configuration definitions file.
*/
@ -542,12 +557,12 @@ static void def_load (void)
/*
* Go through all of the lines in the file.
*/
while (fgets (buf, (int) sizeof (buf), fp) != NULL) {
while (fgets (buf, sizeof (buf), fp) != NULL) {
/*
* Trim trailing whitespace.
*/
for (i = (int) strlen (buf) - 1; i >= 0; --i) {
for (i = (ptrdiff_t) strlen (buf) - 1; i >= 0; --i) {
if (!isspace (buf[i])) {
break;
}
@ -588,8 +603,8 @@ static void def_load (void)
}
(void) fclose (fp);
#endif
}
#endif /* USE_ECONF */
#ifdef CKDEFS

26
lib/groupio.c
View File

@ -15,6 +15,7 @@
#include <assert.h>
#include <stdio.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include "commonio.h"
@ -50,7 +51,7 @@ static const char *group_getname (const void *ent)
static void *group_parse (const char *line)
{
return (void *) sgetgrent (line);
return sgetgrent (line);
}
static int group_put (const void *ent, FILE * file)
@ -159,7 +160,7 @@ int gr_open (int mode)
int gr_update (const struct group *gr)
{
return commonio_update (&group_db, (const void *) gr);
return commonio_update (&group_db, gr);
}
int gr_remove (const char *name)
@ -247,8 +248,8 @@ static int group_open_hook (void)
for (gr1 = group_db.head; NULL != gr1; gr1 = gr1->next) {
for (gr2 = gr1->next; NULL != gr2; gr2 = gr2->next) {
struct group *g1 = (struct group *)gr1->eptr;
struct group *g2 = (struct group *)gr2->eptr;
struct group *g1 = gr1->eptr;
struct group *g2 = gr2->eptr;
if (NULL != g1 &&
NULL != g2 &&
0 == strcmp (g1->gr_name, g2->gr_name) &&
@ -302,8 +303,8 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
return NULL;
}
gptr1 = (struct group *)gr1->eptr;
gptr2 = (struct group *)gr2->eptr;
gptr1 = gr1->eptr;
gptr2 = gr2->eptr;
if (NULL == gptr2 || NULL == gptr1) {
errno = EINVAL;
return NULL;
@ -311,9 +312,8 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
/* Concatenate the 2 lines */
new_line_len = strlen (gr1->line) + strlen (gr2->line) +1;
new_line = (char *)malloc (new_line_len + 1);
new_line = MALLOCARRAY (new_line_len + 1, char);
if (NULL == new_line) {
errno = ENOMEM;
return NULL;
}
snprintf(new_line, new_line_len + 1, "%s\n%s", gr1->line, gr2->line);
@ -333,10 +333,9 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
members++;
}
}
new_members = (char **)calloc ( (members+1), sizeof(char*) );
new_members = CALLOC (members + 1, char *);
if (NULL == new_members) {
free (new_line);
errno = ENOMEM;
return NULL;
}
for (i=0; NULL != gptr1->gr_mem[i]; i++) {
@ -377,7 +376,7 @@ static int split_groups (unsigned int max_members)
struct commonio_entry *gr;
for (gr = group_db.head; NULL != gr; gr = gr->next) {
struct group *gptr = (struct group *)gr->eptr;
struct group *gptr = gr->eptr;
struct commonio_entry *new;
struct group *new_gptr;
unsigned int members = 0;
@ -395,9 +394,8 @@ static int split_groups (unsigned int max_members)
continue;
}
new = (struct commonio_entry *) malloc (sizeof *new);
new = MALLOC (struct commonio_entry);
if (NULL == new) {
errno = ENOMEM;
return 0;
}
new->eptr = group_dup(gr->eptr);
@ -406,7 +404,7 @@ static int split_groups (unsigned int max_members)
errno = ENOMEM;
return 0;
}
new_gptr = (struct group *)new->eptr;
new_gptr = new->eptr;
new->line = NULL;
new->changed = true;

35
lib/groupmem.c
View File

@ -12,6 +12,7 @@
#ident "$Id$"
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include "groupio.h"
@ -21,7 +22,7 @@
struct group *gr;
int i;
gr = (struct group *) malloc (sizeof *gr);
gr = MALLOC (struct group);
if (NULL == gr) {
return NULL;
}
@ -46,7 +47,7 @@
for (i = 0; grent->gr_mem[i]; i++);
/*@-mustfreeonly@*/
gr->gr_mem = (char **) malloc ((i + 1) * sizeof (char *));
gr->gr_mem = MALLOCARRAY (i + 1, char *);
/*@=mustfreeonly@*/
if (NULL == gr->gr_mem) {
gr_free(gr);
@ -86,33 +87,3 @@ void gr_free (/*@out@*/ /*@only@*/struct group *grent)
gr_free_members(grent);
free (grent);
}
bool gr_append_member(struct group *grp, char *member)
{
int i;
if (NULL == grp->gr_mem || grp->gr_mem[0] == NULL) {
grp->gr_mem = (char **)malloc(2 * sizeof(char *));
if (!grp->gr_mem) {
return false;
}
grp->gr_mem[0] = strdup(member);
if (!grp->gr_mem[0]) {
return false;
}
grp->gr_mem[1] = NULL;
return true;
}
for (i = 0; grp->gr_mem[i]; i++) ;
grp->gr_mem = realloc(grp->gr_mem, (i + 2) * sizeof(char *));
if (NULL == grp->gr_mem) {
return false;
}
grp->gr_mem[i] = strdup(member);
if (NULL == grp->gr_mem[i]) {
return false;
}
grp->gr_mem[i + 1] = NULL;
return true;
}

29
lib/gshadow.c
View File

@ -15,8 +15,12 @@
#ident "$Id$"
#include <stdio.h>
#include <string.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
static /*@null@*/FILE *shadow;
static /*@null@*//*@only@*/char **members = NULL;
static size_t nmembers = 0;
@ -62,7 +66,7 @@ static /*@null@*/char **build_list (char *s, char **list[], size_t * nlist)
while (s != NULL && *s != '\0') {
size = (nelem + 1) * sizeof (ptr);
ptr = realloc (*list, size);
ptr = REALLOCARRAY (*list, size, char *);
if (NULL != ptr) {
ptr[nelem] = s;
nelem++;
@ -76,7 +80,7 @@ static /*@null@*/char **build_list (char *s, char **list[], size_t * nlist)
}
}
size = (nelem + 1) * sizeof (ptr);
ptr = realloc (*list, size);
ptr = REALLOCARRAY (*list, size, char *);
if (NULL != ptr) {
ptr[nelem] = NULL;
*list = ptr;
@ -102,7 +106,7 @@ void endsgent (void)
(void) fclose (shadow);
}
shadow = (FILE *) 0;
shadow = NULL;
}
/*@observer@*//*@null@*/struct sgrp *sgetsgent (const char *string)
@ -116,7 +120,7 @@ void endsgent (void)
size_t len = strlen (string) + 1;
if (len > sgrbuflen) {
char *buf = (char *) realloc (sgrbuf, sizeof (char) * len);
char *buf = REALLOCARRAY (sgrbuf, len, char);
if (NULL == buf) {
return NULL;
}
@ -124,8 +128,7 @@ void endsgent (void)
sgrbuflen = len;
}
strncpy (sgrbuf, string, len);
sgrbuf[len-1] = '\0';
strcpy (sgrbuf, string);
cp = strrchr (sgrbuf, '\n');
if (NULL != cp) {
@ -195,7 +198,7 @@ void endsgent (void)
char *cp;
if (0 == buflen) {
buf = (char *) malloc (BUFSIZ);
buf = MALLOCARRAY (BUFSIZ, char);
if (NULL == buf) {
return NULL;
}
@ -207,16 +210,16 @@ void endsgent (void)
}
#ifdef USE_NIS
while (fgetsx (buf, (int) buflen, fp) == buf)
while (fgetsx (buf, buflen, fp) == buf)
#else
if (fgetsx (buf, (int) buflen, fp) == buf)
if (fgetsx (buf, buflen, fp) == buf)
#endif
{
while ( ((cp = strrchr (buf, '\n')) == NULL)
&& (feof (fp) == 0)) {
size_t len;
cp = (char *) realloc (buf, buflen*2);
cp = REALLOCARRAY (buf, buflen * 2, char);
if (NULL == cp) {
return NULL;
}
@ -399,7 +402,7 @@ void endsgent (void)
nis_disabled = true;
}
#endif
while ((sgrp = getsgent ()) != (struct sgrp *) 0) {
while ((sgrp = getsgent ()) != NULL) {
if (strcmp (name, sgrp->sg_name) == 0) {
break;
}
@ -437,7 +440,7 @@ int putsgent (const struct sgrp *sgrp, FILE * fp)
size += strlen (sgrp->sg_mem[i]) + 1;
}
buf = malloc (size);
buf = MALLOCARRAY (size, char);
if (NULL == buf) {
return -1;
}
@ -502,5 +505,5 @@ int putsgent (const struct sgrp *sgrp, FILE * fp)
return 0;
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /*} SHADOWGRP */

2
lib/lockpw.c
View File

@ -81,5 +81,5 @@ int ulckpwdf (void)
return (pw_unlock () && spw_unlock ())? 0 : -1;
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif

31
lib/mempcpy.h Normal file
View File

@ -0,0 +1,31 @@
/*
* SPDX-FileCopyrightText: 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SHADOW_INCLUDE_LIB_MEMPCPY_H_
#define SHADOW_INCLUDE_LIB_MEMPCPY_H_
#include <config.h>
#if !defined(HAVE_MEMPCPY)
#include <stddef.h>
#include <string.h>
inline void *mempcpy(void *restrict dst, const void *restrict src, size_t n);
inline void *
mempcpy(void *restrict dst, const void *restrict src, size_t n)
{
return memcpy(dst, src, n) + n;
}
#endif // !HAVE_MEMPCPY
#endif // include guard

2
lib/nscd.c
View File

@ -53,6 +53,6 @@ int nscd_flush_cache (const char *service)
return 0;
}
#else /* USE_NSCD */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* USE_NSCD */

7
lib/nss.c
View File

@ -6,6 +6,8 @@
#include <strings.h>
#include <ctype.h>
#include <stdatomic.h>
#include "alloc.h"
#include "prototypes.h"
#include "../libsubid/subid.h"
#include "shadowlog_internal.h"
@ -59,6 +61,9 @@ void nss_init(const char *nsswitch_path) {
// subid: files
nssfp = fopen(nsswitch_path, "r");
if (!nssfp) {
if (errno != ENOENT)
fprintf(shadow_logfd, "Failed opening %s: %m\n", nsswitch_path);
atomic_store(&nss_init_completed, true);
return;
}
@ -97,7 +102,7 @@ void nss_init(const char *nsswitch_path) {
subid_nss = NULL;
goto done;
}
subid_nss = malloc(sizeof(*subid_nss));
subid_nss = MALLOC(struct subid_nss_ops);
if (!subid_nss) {
dlclose(h);
goto done;

2
lib/pam_defs.h
View File

@ -15,7 +15,7 @@
#endif
static struct pam_conv conv = {
static const struct pam_conv conv = {
SHADOW_PAM_CONVERSATION,
NULL
};

14
lib/port.c
View File

@ -79,7 +79,7 @@ static void endportent (void)
(void) fclose (ports);
}
ports = (FILE *) 0;
ports = NULL;
}
/*
@ -130,11 +130,11 @@ static struct port *getportent (void)
again:
/*
* Get the next line and remove the last character, which
* is a '\n'. Lines which begin with '#' are all ignored.
* Get the next line and remove optional trailing '\n'.
* Lines which begin with '#' are all ignored.
*/
if (fgets (buf, (int) sizeof buf, ports) == 0) {
if (fgets (buf, sizeof buf, ports) == 0) {
errno = saveerr;
return 0;
}
@ -149,7 +149,7 @@ static struct port *getportent (void)
* TTY devices.
*/
buf[strlen (buf) - 1] = 0;
buf[strcspn (buf, "\n")] = 0;
port.pt_names = ttys;
for (cp = buf, j = 0; j < PORT_TTY; j++) {
@ -172,13 +172,13 @@ static struct port *getportent (void)
}
*cp = '\0';
cp++;
port.pt_names[j + 1] = (char *) 0;
port.pt_names[j + 1] = NULL;
/*
* Get the list of user names. It is the second colon
* separated field, and is a comma separated list of user
* names. The entry '*' is used to specify all usernames.
* The last entry in the list is a (char *) 0 pointer.
* The last entry in the list is a NULL pointer.
*/
if (':' != *cp) {

37
lib/prototypes.h
View File

@ -21,12 +21,9 @@
#include <config.h>
#include <sys/socket.h>
#include <sys/stat.h>
#ifdef USE_UTMPX
#include <utmpx.h>
#else
#include <utmp.h>
#endif
#include <sys/types.h>
#include <pwd.h>
#include <grp.h>
@ -44,6 +41,12 @@ extern int add_groups (const char *);
/* age.c */
extern void agecheck (/*@null@*/const struct spwd *);
extern int expire (const struct passwd *, /*@null@*/const struct spwd *);
/* agetpass.c */
extern void erase_pass(char *pass);
ATTR_MALLOC(erase_pass)
extern char *agetpass(const char *prompt);
/* isexpired.c */
extern int isexpired (const struct passwd *, /*@null@*/const struct spwd *);
@ -157,6 +160,8 @@ extern int getlong (const char *numstr, /*@out@*/long int *result);
/* get_pid.c */
extern int get_pid (const char *pidstr, pid_t *pid);
extern int get_pidfd_from_fd(const char *pidfdstr);
extern int open_pidfd(const char *pidstr);
/* getrange */
extern int getrange (const char *range,
@ -186,7 +191,6 @@ extern void __gr_set_changed (void);
extern /*@null@*/ /*@only@*/struct group *__gr_dup (const struct group *grent);
extern void gr_free_members (struct group *grent);
extern void gr_free (/*@out@*/ /*@only@*/struct group *grent);
extern bool gr_append_member (struct group *grp, char *member);
/* hushed.c */
extern bool hushed (const char *username);
@ -229,7 +233,7 @@ extern void dolastlog (
extern int login_access (const char *user, const char *from);
/* loginprompt.c */
extern void login_prompt (const char *, char *, int);
extern void login_prompt (char *, int);
/* mail.c */
extern void mailcheck (void);
@ -353,6 +357,11 @@ extern /*@dependent@*/ /*@null@*/struct commonio_entry *__pw_get_head (void);
extern /*@null@*/ /*@only@*/struct passwd *__pw_dup (const struct passwd *pwent);
extern void pw_free (/*@out@*/ /*@only@*/struct passwd *pwent);
/* csrand.c */
unsigned long csrand (void);
unsigned long csrand_uniform (unsigned long n);
unsigned long csrand_interval (unsigned long min, unsigned long max);
/* remove_tree.c */
extern int remove_tree (const char *root, bool remove_root);
@ -376,7 +385,7 @@ extern int check_selinux_permit (const char *perm_name);
/* semanage.c */
#ifdef WITH_SELINUX
extern int set_seuser(const char *login_name, const char *seuser_name);
extern int set_seuser(const char *login_name, const char *seuser_name, const char *serange);
extern int del_seuser(const char *login_name);
#endif
@ -460,30 +469,16 @@ extern int set_filesize_limit (int blocks);
extern int user_busy (const char *name, uid_t uid);
/* utmp.c */
#ifndef USE_UTMPX
extern /*@null@*/struct utmp *get_current_utmp (void);
extern struct utmp *prepare_utmp (const char *name,
const char *line,
const char *host,
/*@null@*/const struct utmp *ut);
extern int setutmp (struct utmp *ut);
#else
extern /*@null@*/struct utmpx *get_current_utmp (void);
extern struct utmpx *prepare_utmpx (const char *name,
const char *line,
const char *host,
/*@null@*/const struct utmpx *ut);
extern int setutmpx (struct utmpx *utx);
#endif /* USE_UTMPX */
/* valid.c */
extern bool valid (const char *, const struct passwd *);
/* xmalloc.c */
extern /*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/void *xmalloc (size_t size)
/*@ensures MaxSet(result) == (size - 1); @*/;
extern /*@maynotreturn@*/ /*@only@*//*@notnull@*/char *xstrdup (const char *);
/* xgetpwnam.c */
extern /*@null@*/ /*@only@*/struct passwd *xgetpwnam (const char *);
/* xgetpwuid.c */

2
lib/pwauth.c
View File

@ -207,5 +207,5 @@ int pw_auth (const char *cipher,
return retval;
}
#else /* !USE_PAM */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !USE_PAM */

4
lib/pwio.c
View File

@ -42,7 +42,7 @@ static const char *passwd_getname (const void *ent)
static void *passwd_parse (const char *line)
{
return (void *) sgetpwent (line);
return sgetpwent (line);
}
static int passwd_put (const void *ent, FILE * file)
@ -137,7 +137,7 @@ int pw_open (int mode)
int pw_update (const struct passwd *pw)
{
return commonio_update (&passwd_db, (const void *) pw);
return commonio_update (&passwd_db, pw);
}
int pw_remove (const char *name)

5
lib/pwmem.c
View File

@ -13,6 +13,8 @@
#ident "$Id$"
#include <stdio.h>
#include "alloc.h"
#include "defines.h"
#include "prototypes.h"
#include "pwio.h"
@ -21,12 +23,11 @@
{
struct passwd *pw;
pw = (struct passwd *) malloc (sizeof *pw);
pw = CALLOC (1, struct passwd);
if (NULL == pw) {
return NULL;
}
/* The libc might define other fields. They won't be copied. */
memset (pw, 0, sizeof *pw);
pw->pw_uid = pwent->pw_uid;
pw->pw_gid = pwent->pw_gid;
/*@-mustfreeonly@*/

4
lib/run_part.c
View File

@ -8,6 +8,8 @@
#include <sys/wait.h>
#include <unistd.h>
#include <lib/prototypes.h>
#include "alloc.h"
#include "run_part.h"
#include "shadowlog_internal.h"
@ -57,7 +59,7 @@ int run_parts (const char *directory, const char *name, const char *action)
struct stat sb;
path_length=strlen(directory) + strlen(namelist[n]->d_name) + 2;
char *s = (char*)malloc(path_length);
char *s = MALLOCARRAY(path_length, char);
if (!s) {
printf ("could not allocate memory\n");
for (; n<scanlist; n++) {

4
lib/selinux.c
View File

@ -188,7 +188,7 @@ int check_selinux_permit (const char *perm_name)
return 0;
}
selinux_set_callback (SELINUX_CB_LOG, (union selinux_callback) selinux_log_cb);
selinux_set_callback (SELINUX_CB_LOG, (union selinux_callback) { .func_log = selinux_log_cb });
if (getprevcon_raw (&user_context_raw) != 0) {
fprintf (shadow_logfd,
@ -206,5 +206,5 @@ int check_selinux_permit (const char *perm_name)
}
#else /* !WITH_SELINUX */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !WITH_SELINUX */

41
lib/semanage.c
View File

@ -22,10 +22,6 @@
#include "shadowlog_internal.h"
#ifndef DEFAULT_SERANGE
#define DEFAULT_SERANGE "s0"
#endif
format_attr(printf, 3, 4)
static void semanage_error_callback (unused void *varg,
@ -101,6 +97,8 @@ static semanage_handle_t *semanage_init (void)
return handle;
fail:
if (handle)
semanage_disconnect (handle);
semanage_handle_destroy (handle);
return NULL;
}
@ -109,7 +107,8 @@ fail:
static int semanage_user_mod (semanage_handle_t *handle,
semanage_seuser_key_t *key,
const char *login_name,
const char *seuser_name)
const char *seuser_name,
const char *serange)
{
int ret;
semanage_seuser_t *seuser = NULL;
@ -122,11 +121,12 @@ static int semanage_user_mod (semanage_handle_t *handle,
goto done;
}
if (semanage_mls_enabled(handle)) {
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
if (serange && semanage_mls_enabled(handle)) {
ret = semanage_seuser_set_mlsrange (handle, seuser, serange);
if (ret != 0) {
fprintf (shadow_logfd,
_("Could not set serange for %s\n"), login_name);
_("Could not set serange for %s to %s\n"),
login_name, serange);
ret = 1;
goto done;
}
@ -158,9 +158,10 @@ done:
static int semanage_user_add (semanage_handle_t *handle,
semanage_seuser_key_t *key,
const semanage_seuser_key_t *key,
const char *login_name,
const char *seuser_name)
const char *seuser_name,
const char *serange)
{
int ret;
semanage_seuser_t *seuser = NULL;
@ -181,11 +182,12 @@ static int semanage_user_add (semanage_handle_t *handle,
goto done;
}
if (semanage_mls_enabled(handle)) {
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
if (serange && semanage_mls_enabled(handle)) {
ret = semanage_seuser_set_mlsrange (handle, seuser, serange);
if (ret != 0) {
fprintf (shadow_logfd,
_("Could not set serange for %s\n"), login_name);
_("Could not set serange for %s to %s\n"),
login_name, serange);
ret = 1;
goto done;
}
@ -216,7 +218,7 @@ done:
}
int set_seuser (const char *login_name, const char *seuser_name)
int set_seuser (const char *login_name, const char *seuser_name, const char *serange)
{
semanage_handle_t *handle = NULL;
semanage_seuser_key_t *key = NULL;
@ -250,7 +252,7 @@ int set_seuser (const char *login_name, const char *seuser_name)
}
if (0 != seuser_exists) {
ret = semanage_user_mod (handle, key, login_name, seuser_name);
ret = semanage_user_mod (handle, key, login_name, seuser_name, serange);
if (ret != 0) {
fprintf (shadow_logfd,
_("Cannot modify SELinux user mapping\n"));
@ -258,7 +260,7 @@ int set_seuser (const char *login_name, const char *seuser_name)
goto done;
}
} else {
ret = semanage_user_add (handle, key, login_name, seuser_name);
ret = semanage_user_add (handle, key, login_name, seuser_name, serange);
if (ret != 0) {
fprintf (shadow_logfd,
_("Cannot add SELinux user mapping\n"));
@ -279,6 +281,8 @@ int set_seuser (const char *login_name, const char *seuser_name)
done:
semanage_seuser_key_free (key);
if (handle)
semanage_disconnect (handle);
semanage_handle_destroy (handle);
return ret;
}
@ -353,9 +357,12 @@ int del_seuser (const char *login_name)
ret = 0;
done:
semanage_seuser_key_free (key);
if (handle)
semanage_disconnect (handle);
semanage_handle_destroy (handle);
return ret;
}
#else /* !WITH_SELINUX */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !WITH_SELINUX */

39
lib/sgetgrent.c
View File

@ -14,6 +14,8 @@
#include <stdio.h>
#include <sys/types.h>
#include <grp.h>
#include "alloc.h"
#include "defines.h"
#include "prototypes.h"
@ -34,10 +36,9 @@
*/
static char **list (char *s)
{
static char **members = 0;
static char **members = NULL;
static int size = 0; /* max members + 1 */
int i;
char **rbuf;
i = 0;
for (;;) {
@ -45,21 +46,9 @@ static char **list (char *s)
member name, or terminating NULL). */
if (i >= size) {
size = i + 100; /* at least: i + 1 */
if (members) {
rbuf =
realloc (members, size * sizeof (char *));
} else {
/* for old (before ANSI C) implementations of
realloc() that don't handle NULL properly */
rbuf = malloc (size * sizeof (char *));
}
if (!rbuf) {
free (members);
members = 0;
size = 0;
return (char **) 0;
}
members = rbuf;
members = REALLOCARRAYF(members, size, char *);
if (!members)
return NULL;
}
if (!s || s[0] == '\0')
break;
@ -71,14 +60,14 @@ static char **list (char *s)
*s++ = '\0';
}
}
members[i] = (char *) 0;
members[i] = NULL;
return members;
}
struct group *sgetgrent (const char *buf)
{
static char *grpbuf = 0;
static char *grpbuf = NULL;
static size_t size = 0;
static char *grpfields[NFIELDS];
static struct group grent;
@ -90,10 +79,10 @@ struct group *sgetgrent (const char *buf)
allocate a larger block */
free (grpbuf);
size = strlen (buf) + 1000; /* at least: strlen(buf) + 1 */
grpbuf = malloc (size);
if (!grpbuf) {
grpbuf = MALLOCARRAY (size, char);
if (grpbuf == NULL) {
size = 0;
return 0;
return NULL;
}
}
strcpy (grpbuf, buf);
@ -112,16 +101,16 @@ struct group *sgetgrent (const char *buf)
}
}
if (i < (NFIELDS - 1) || *grpfields[2] == '\0' || cp != NULL) {
return (struct group *) 0;
return NULL;
}
grent.gr_name = grpfields[0];
grent.gr_passwd = grpfields[1];
if (get_gid (grpfields[2], &grent.gr_gid) == 0) {
return (struct group *) 0;
return NULL;
}
grent.gr_mem = list (grpfields[3]);
if (NULL == grent.gr_mem) {
return (struct group *) 0; /* out of memory */
return NULL; /* out of memory */
}
return &grent;

2
lib/sgetspent.c
View File

@ -182,6 +182,6 @@ struct spwd *sgetspent (const char *string)
return (&spwd);
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif

14
lib/sgroupio.c
View File

@ -14,6 +14,7 @@
#ident "$Id$"
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include "commonio.h"
@ -25,13 +26,12 @@
struct sgrp *sg;
int i;
sg = (struct sgrp *) malloc (sizeof *sg);
sg = CALLOC (1, struct sgrp);
if (NULL == sg) {
return NULL;
}
/* Do the same as the other _dup function, even if we know the
* structure. */
memset (sg, 0, sizeof *sg);
/*@-mustfreeonly@*/
sg->sg_name = strdup (sgent->sg_name);
/*@=mustfreeonly@*/
@ -50,7 +50,7 @@
for (i = 0; NULL != sgent->sg_adm[i]; i++);
/*@-mustfreeonly@*/
sg->sg_adm = (char **) malloc ((i + 1) * sizeof (char *));
sg->sg_adm = MALLOCARRAY (i + 1, char *);
/*@=mustfreeonly@*/
if (NULL == sg->sg_adm) {
free (sg->sg_passwd);
@ -75,7 +75,7 @@
for (i = 0; NULL != sgent->sg_mem[i]; i++);
/*@-mustfreeonly@*/
sg->sg_mem = (char **) malloc ((i + 1) * sizeof (char *));
sg->sg_mem = MALLOCARRAY (i + 1, char *);
/*@=mustfreeonly@*/
if (NULL == sg->sg_mem) {
for (i = 0; NULL != sg->sg_adm[i]; i++) {
@ -151,7 +151,7 @@ static const char *gshadow_getname (const void *ent)
static void *gshadow_parse (const char *line)
{
return (void *) sgetsgent (line);
return sgetsgent (line);
}
static int gshadow_put (const void *ent, FILE * file)
@ -253,7 +253,7 @@ int sgr_open (int mode)
int sgr_update (const struct sgrp *sg)
{
return commonio_update (&gshadow_db, (const void *) sg);
return commonio_update (&gshadow_db, sg);
}
int sgr_remove (const char *name)
@ -302,5 +302,5 @@ int sgr_sort ()
return commonio_sort_wrt (&gshadow_db, __gr_get_db ());
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif

10
lib/shadow.c
View File

@ -94,7 +94,7 @@ void endspent (void)
(void) fclose (shadow);
}
shadow = (FILE *) 0;
shadow = NULL;
}
/*
@ -336,9 +336,9 @@ struct spwd *fgetspent (FILE * fp)
}
#ifdef USE_NIS
while (fgets (buf, (int) sizeof buf, fp) != (char *) 0)
while (fgets (buf, sizeof buf, fp) != NULL)
#else
if (fgets (buf, (int) sizeof buf, fp) != (char *) 0)
if (fgets (buf, sizeof buf, fp) != NULL)
#endif
{
cp = strchr (buf, '\n');
@ -511,7 +511,7 @@ struct spwd *getspnam (const char *name)
nis_disabled = true;
}
#endif
while ((sp = getspent ()) != (struct spwd *) 0) {
while ((sp = getspent ()) != NULL) {
if (strcmp (name, sp->sp_namp) == 0) {
break;
}
@ -525,6 +525,6 @@ struct spwd *getspnam (const char *name)
return (sp);
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif

4
lib/shadowio.c
View File

@ -47,7 +47,7 @@ static const char *shadow_getname (const void *ent)
static void *shadow_parse (const char *line)
{
return (void *) sgetspent (line);
return sgetspent (line);
}
static int shadow_put (const void *ent, FILE * file)
@ -164,7 +164,7 @@ int spw_open (int mode)
int spw_update (const struct spwd *sp)
{
return commonio_update (&shadow_db, (const void *) sp);
return commonio_update (&shadow_db, sp);
}
int spw_remove (const char *name)

2
lib/shadowlog_internal.h
View File

@ -2,6 +2,6 @@
#define _SHADOWLOG_INTERNAL_H
extern const char *shadow_progname; /* Program name showed in error messages */
extern FILE *shadow_logfd; /* file descripter to which error messages are printed */
extern FILE *shadow_logfd; /* file descriptor to which error messages are printed */
#endif /* _SHADOWLOG_INTERNAL_H */

5
lib/shadowmem.c
View File

@ -16,18 +16,19 @@
#include "defines.h"
#include <shadow.h>
#include <stdio.h>
#include "alloc.h"
#include "shadowio.h"
/*@null@*/ /*@only@*/struct spwd *__spw_dup (const struct spwd *spent)
{
struct spwd *sp;
sp = (struct spwd *) malloc (sizeof *sp);
sp = CALLOC (1, struct spwd);
if (NULL == sp) {
return NULL;
}
/* The libc might define other fields. They won't be copied. */
memset (sp, 0, sizeof *sp);
sp->sp_lstchg = spent->sp_lstchg;
sp->sp_min = spent->sp_min;
sp->sp_max = spent->sp_max;

12
lib/sssd.c
View File

@ -4,8 +4,11 @@
#ifdef USE_SSSD
#include <stdio.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/types.h>
#include "alloc.h"
#include "exitcodes.h"
#include "defines.h"
#include "prototypes.h"
@ -19,12 +22,17 @@ int sssd_flush_cache (int dbflags)
{
int status, code, rv;
const char *cmd = "/usr/sbin/sss_cache";
struct stat sb;
char *sss_cache_args = NULL;
const char *spawnedArgs[] = {"sss_cache", NULL, NULL};
const char *spawnedEnv[] = {NULL};
int i = 0;
sss_cache_args = malloc(4);
rv = stat(cmd, &sb);
if (rv == -1 && errno == ENOENT)
return 0;
sss_cache_args = MALLOCARRAY(4, char);
if (sss_cache_args == NULL) {
return -1;
}
@ -70,6 +78,6 @@ int sssd_flush_cache (int dbflags)
return 0;
}
#else /* USE_SSSD */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* USE_SSSD */

92
lib/stpecpy.h Normal file
View File

@ -0,0 +1,92 @@
/*
* SPDX-FileCopyrightText: 2022 - 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SHADOW_INCLUDE_LIB_STPECPY_H_
#define SHADOW_INCLUDE_LIB_STPECPY_H_
#include <config.h>
#if !defined(HAVE_STPECPY)
#include <stdbool.h>
#include <stddef.h>
#include <string.h>
#include "defines.h"
inline char *stpecpy(char *dst, char *end, const char *restrict src);
/*
* SYNOPSIS
* char *_Nullable stpecpy(char *_Nullable dst, char end[0],
* const char *restrict src);
*
* ARGUMENTS
* dst Destination buffer where to copy a string.
*
* end Pointer to one after the last element of the buffer
* pointed to by `dst`. Usually, it should be calculated
* as `dst + NITEMS(dst)`.
*
* src Source string to be copied into dst.
*
* DESCRIPTION
* This function copies the string pointed to by src, into a string
* at the buffer pointed to by dst. If the destination buffer,
* limited by a pointer to its end --one after its last element--,
* isn't large enough to hold the copy, the resulting string is
* truncated.
*
* This function can be chained with calls to [v]stpeprintf().
*
* RETURN VALUE
* dst + strlen(dst)
* • On success, this function returns a pointer to the
* terminating NUL byte.
*
* end
* • If this call truncated the resulting string.
* • If `dst == end` (a previous chained call to these
* functions truncated).
* NULL
* • If `dst == NULL` (a previous chained call to
* [v]stpeprintf() failed).
*
* ERRORS
* This function doesn't set errno.
*/
inline char *
stpecpy(char *dst, char *end, const char *restrict src)
{
bool trunc;
char *p;
size_t dsize, dlen, slen;
if (dst == end)
return end;
if (dst == NULL)
return NULL;
dsize = end - dst;
slen = strnlen(src, dsize);
trunc = (slen == dsize);
dlen = slen - trunc;
p = mempcpy(dst, src, dlen);
*p = '\0';
return p + trunc;
}
#endif // !HAVE_STPECPY
#endif // include guard

119
lib/stpeprintf.h Normal file
View File

@ -0,0 +1,119 @@
/*
* SPDX-FileCopyrightText: 2022 - 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SHADOW_INCLUDE_LIB_STPEPRINTF_H_
#define SHADOW_INCLUDE_LIB_STPEPRINTF_H_
#include <config.h>
#if !defined(HAVE_STPEPRINTF)
#include <stdarg.h>
#include <stddef.h>
#include <stdio.h>
#include "defines.h"
format_attr(printf, 3, 4)
inline char *stpeprintf(char *dst, char *end, const char *restrict fmt, ...);
format_attr(printf, 3, 0)
inline char *vstpeprintf(char *dst, char *end, const char *restrict fmt,
va_list ap);
/*
* SYNOPSIS
* [[gnu::format(printf, 3, 4)]]
* char *_Nullable stpeprintf(char *_Nullable dst, char end[0],
* const char *restrict fmt, ...);
*
* [[gnu::format(printf, 3, 0)]]
* char *_Nullable vstpeprintf(char *_Nullable dst, char end[0],
* const char *restrict fmt, va_list ap);
*
*
* ARGUMENTS
* dst Destination buffer where to write a string.
*
* end Pointer to one after the last element of the buffer
* pointed to by `dst`. Usually, it should be calculated
* as `dst + NITEMS(dst)`.
*
* fmt Format string
*
* ...
* ap Variadic argument list
*
* DESCRIPTION
* These functions are very similar to [v]snprintf(3).
*
* The destination buffer is limited by a pointer to its end --one
* after its last element-- instead of a size. This allows
* chaining calls to it safely, unlike [v]snprintf(3), which is
* difficult to chain without invoking Undefined Behavior.
*
* RETURN VALUE
* dst + strlen(dst)
* • On success, these functions return a pointer to the
* terminating NUL byte.
*
* end
* • If this call truncated the resulting string.
* • If `dst == end` (a previous chained call to these
* functions truncated).
* NULL
* • If this function failed (see ERRORS).
* • If `dst == NULL` (a previous chained call to these
* functions failed).
*
* ERRORS
* These functions may fail for the same reasons as vsnprintf(3).
*/
inline char *
stpeprintf(char *dst, char *end, const char *restrict fmt, ...)
{
char *p;
va_list ap;
va_start(ap, fmt);
p = vstpeprintf(dst, end, fmt, ap);
va_end(ap);
return p;
}
inline char *
vstpeprintf(char *dst, char *end, const char *restrict fmt, va_list ap)
{
int len;
ptrdiff_t size;
if (dst == end)
return end;
if (dst == NULL)
return NULL;
size = end - dst;
len = vsnprintf(dst, size, fmt, ap);
if (len == -1)
return NULL;
if (len >= size)
return end;
return dst + len;
}
#endif // !HAVE_STPEPRINTF
#endif // include guard

71
lib/subordinateio.c
View File

@ -17,6 +17,8 @@
#include <ctype.h>
#include <fcntl.h>
#include "alloc.h"
#define ID_SIZE 31
/*
@ -32,7 +34,7 @@ static /*@null@*/ /*@only@*/void *subordinate_dup (const void *ent)
const struct subordinate_range *rangeent = ent;
struct subordinate_range *range;
range = (struct subordinate_range *) malloc (sizeof *range);
range = MALLOC (struct subordinate_range);
if (NULL == range) {
return NULL;
}
@ -314,12 +316,12 @@ static bool have_range(struct commonio_db *db,
static bool append_range(struct subid_range **ranges, const struct subordinate_range *new, int n)
{
if (!*ranges) {
*ranges = malloc(sizeof(struct subid_range));
*ranges = MALLOC(struct subid_range);
if (!*ranges)
return false;
} else {
struct subid_range *alloced;
alloced = realloc(*ranges, (n + 1) * (sizeof(struct subid_range)));
alloced = REALLOCARRAY(*ranges, n + 1, struct subid_range);
if (!alloced)
return false;
*ranges = alloced;
@ -355,13 +357,14 @@ static int subordinate_range_cmp (const void *p1, const void *p2)
{
struct subordinate_range *range1, *range2;
if ((*(struct commonio_entry **) p1)->eptr == NULL)
return 1;
if ((*(struct commonio_entry **) p2)->eptr == NULL)
return -1;
range1 = ((struct subordinate_range *) (*(struct commonio_entry **) p1)->eptr);
range2 = ((struct subordinate_range *) (*(struct commonio_entry **) p2)->eptr);
range1 = (*(struct commonio_entry **) p1)->eptr;
if (range1 == NULL)
return 1;
range2 = (*(struct commonio_entry **) p2)->eptr;
if (range2 == NULL)
return -1;
if (range1->start < range2->start)
return -1;
@ -620,17 +623,28 @@ bool have_sub_uids(const char *owner, uid_t start, unsigned long count)
return have_range (&subordinate_uid_db, owner, start, count);
}
/*
* sub_uid_add: add a subuid range, perhaps through nss.
*
* Return 1 if the range is already present or on success. On error
* return 0 and set errno appropriately.
*/
int sub_uid_add (const char *owner, uid_t start, unsigned long count)
{
if (get_subid_nss_handle())
return -EOPNOTSUPP;
if (get_subid_nss_handle()) {
errno = EOPNOTSUPP;
return 0;
}
return add_range (&subordinate_uid_db, owner, start, count);
}
/* Return 1 on success. on failure, return 0 and set errno appropriately */
int sub_uid_remove (const char *owner, uid_t start, unsigned long count)
{
if (get_subid_nss_handle())
return -EOPNOTSUPP;
if (get_subid_nss_handle()) {
errno = EOPNOTSUPP;
return 0;
}
return remove_range (&subordinate_uid_db, owner, start, count);
}
@ -716,17 +730,28 @@ bool local_sub_gid_assigned(const char *owner)
return range_exists (&subordinate_gid_db, owner);
}
/*
* sub_gid_add: add a subgid range, perhaps through nss.
*
* Return 1 if the range is already present or on success. On error
* return 0 and set errno appropriately.
*/
int sub_gid_add (const char *owner, gid_t start, unsigned long count)
{
if (get_subid_nss_handle())
return -EOPNOTSUPP;
if (get_subid_nss_handle()) {
errno = EOPNOTSUPP;
return 0;
}
return add_range (&subordinate_gid_db, owner, start, count);
}
/* Return 1 on success. on failure, return 0 and set errno appropriately */
int sub_gid_remove (const char *owner, gid_t start, unsigned long count)
{
if (get_subid_nss_handle())
return -EOPNOTSUPP;
if (get_subid_nss_handle()) {
errno = EOPNOTSUPP;
return 0;
}
return remove_range (&subordinate_gid_db, owner, start, count);
}
@ -910,7 +935,7 @@ static int append_uids(uid_t **uids, const char *owner, int n)
return n;
}
ret = realloc(*uids, (n + 1) * sizeof(uid_t));
ret = REALLOCARRAY(*uids, n + 1, uid_t);
if (!ret) {
free(*uids);
return -1;
@ -985,7 +1010,7 @@ bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, b
switch (id_type) {
case ID_TYPE_UID:
if (!sub_uid_lock()) {
printf("Failed loging subuids (errno %d)\n", errno);
printf("Failed locking subuids (errno %d)\n", errno);
return false;
}
if (!sub_uid_open(O_CREAT | O_RDWR)) {
@ -997,7 +1022,7 @@ bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, b
break;
case ID_TYPE_GID:
if (!sub_gid_lock()) {
printf("Failed loging subgids (errno %d)\n", errno);
printf("Failed locking subgids (errno %d)\n", errno);
return false;
}
if (!sub_gid_open(O_CREAT | O_RDWR)) {
@ -1057,7 +1082,7 @@ bool release_subid_range(struct subordinate_range *range, enum subid_type id_typ
switch (id_type) {
case ID_TYPE_UID:
if (!sub_uid_lock()) {
printf("Failed loging subuids (errno %d)\n", errno);
printf("Failed locking subuids (errno %d)\n", errno);
return false;
}
if (!sub_uid_open(O_CREAT | O_RDWR)) {
@ -1069,7 +1094,7 @@ bool release_subid_range(struct subordinate_range *range, enum subid_type id_typ
break;
case ID_TYPE_GID:
if (!sub_gid_lock()) {
printf("Failed loging subgids (errno %d)\n", errno);
printf("Failed locking subgids (errno %d)\n", errno);
return false;
}
if (!sub_gid_open(O_CREAT | O_RDWR)) {
@ -1097,6 +1122,6 @@ bool release_subid_range(struct subordinate_range *range, enum subid_type id_typ
}
#else /* !ENABLE_SUBIDS */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !ENABLE_SUBIDS */

2
lib/tcbfuncs.c
View File

@ -141,7 +141,7 @@ static /*@null@*/ char *shadowtcb_path_rel_existing (const char *name)
shadow_progname, link);
return NULL;
}
link[(size_t)ret] = '\0';
link[ret] = '\0';
rval = strdup (link);
if (NULL == rval) {
OUT_OF_MEMORY;

70
lib/utent.c
View File

@ -1,70 +0,0 @@
/*
* SPDX-FileCopyrightText: 1993 - 1994, Julianne Frances Haugh
* SPDX-FileCopyrightText: 1996 - 1998, Marek Michałkiewicz
* SPDX-FileCopyrightText: 2005 , Tomasz Kłoczko
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <config.h>
#ifndef HAVE_GETUTENT
#include "defines.h"
#include <stdio.h>
#include <fcntl.h>
#include <utmp.h>
#ifndef lint
static char rcsid[] = "$Id$";
#endif
static int utmp_fd = -1;
static struct utmp utmp_buf;
/*
* setutent - open or rewind the utmp file
*/
void setutent (void)
{
if (utmp_fd == -1)
if ((utmp_fd = open (_UTMP_FILE, O_RDWR)) == -1)
utmp_fd = open (_UTMP_FILE, O_RDONLY);
if (utmp_fd != -1)
lseek (utmp_fd, (off_t) 0L, SEEK_SET);
}
/*
* endutent - close the utmp file
*/
void endutent (void)
{
if (utmp_fd != -1)
close (utmp_fd);
utmp_fd = -1;
}
/*
* getutent - get the next record from the utmp file
*/
struct utmp *getutent (void)
{
if (utmp_fd == -1)
setutent ();
if (utmp_fd == -1)
return 0;
if (read (utmp_fd, &utmp_buf, sizeof utmp_buf) != sizeof utmp_buf)
return 0;
return &utmp_buf;
}
#else
extern int errno; /* warning: ANSI C forbids an empty source file */
#endif

9
libmisc/Makefile.am
View File

@ -5,11 +5,15 @@ AM_CPPFLAGS = -I$(top_srcdir)/lib -I$(top_srcdir) $(ECONF_CPPFLAGS)
noinst_LTLIBRARIES = libmisc.la
libmisc_la_CFLAGS = $(LIBBSD_CFLAGS)
libmisc_la_SOURCES = \
addgrps.c \
age.c \
agetpass.c \
alloc.c \
audit_help.c \
basename.c \
bit.c \
chkname.c \
chkname.h \
chowndir.c \
@ -41,6 +45,7 @@ libmisc_la_SOURCES = \
list.c log.c \
loginprompt.c \
mail.c \
mempcpy.c \
motd.c \
myname.c \
obscure.c \
@ -50,6 +55,7 @@ libmisc_la_SOURCES = \
pwd2spwd.c \
pwdcheck.c \
pwd_init.c \
csrand.c \
remove_tree.c \
rlogin.c \
root_flag.c \
@ -57,6 +63,8 @@ libmisc_la_SOURCES = \
setugid.c \
setupenv.c \
shell.c \
stpecpy.c \
stpeprintf.c \
strtoday.c \
sub.c \
sulog.c \
@ -71,7 +79,6 @@ libmisc_la_SOURCES = \
xgetgrnam.c \
xgetgrgid.c \
xgetspnam.c \
xmalloc.c \
yesno.c
if WITH_BTRFS

18
libmisc/addgrps.c
View File

@ -17,6 +17,8 @@
#include <stdio.h>
#include <grp.h>
#include <errno.h>
#include "alloc.h"
#include "shadowlog.h"
#ident "$Id$"
@ -29,7 +31,7 @@
*/
int add_groups (const char *list)
{
GETGROUPS_T *grouplist, *tmp;
GETGROUPS_T *grouplist;
size_t i;
int ngroups;
bool added;
@ -46,7 +48,7 @@ int add_groups (const char *list)
i = 16;
for (;;) {
grouplist = (gid_t *) malloc (i * sizeof (GETGROUPS_T));
grouplist = MALLOCARRAY (i, GETGROUPS_T);
if (NULL == grouplist) {
return -1;
}
@ -88,19 +90,17 @@ int add_groups (const char *list)
fputs (_("Warning: too many groups\n"), shadow_logfd);
break;
}
tmp = (gid_t *) realloc (grouplist, (size_t)(ngroups + 1) * sizeof (GETGROUPS_T));
if (NULL == tmp) {
free (grouplist);
grouplist = REALLOCARRAYF(grouplist, (size_t) ngroups + 1, GETGROUPS_T);
if (grouplist == NULL) {
return -1;
}
tmp[ngroups] = grp->gr_gid;
grouplist[ngroups] = grp->gr_gid;
ngroups++;
grouplist = tmp;
added = true;
}
if (added) {
ret = setgroups ((size_t)ngroups, grouplist);
ret = setgroups (ngroups, grouplist);
free (grouplist);
return ret;
}
@ -109,6 +109,6 @@ int add_groups (const char *list)
return 0;
}
#else /* HAVE_SETGROUPS && !USE_PAM */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* HAVE_SETGROUPS && !USE_PAM */

4
libmisc/age.c
View File

@ -112,7 +112,7 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
_exit (126);
}
(void) execl (PASSWD_PROGRAM, PASSWD_PROGRAM, pw->pw_name, (char *) 0);
(void) execl (PASSWD_PROGRAM, PASSWD_PROGRAM, pw->pw_name, (char *) NULL);
err = errno;
perror ("Can't execute " PASSWD_PROGRAM);
_exit ((ENOENT == err) ? E_CMD_NOTFOUND : E_CMD_NOEXEC);
@ -139,7 +139,7 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
void agecheck (/*@null@*/const struct spwd *sp)
{
long now = (long) time ((time_t *) 0) / SCALE;
long now = time(NULL) / SCALE;
long remain;
if (NULL == sp) {

130
libmisc/agetpass.c Normal file
View File

@ -0,0 +1,130 @@
/*
* SPDX-FileCopyrightText: 2022, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <config.h>
#include <limits.h>
#include <readpassphrase.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ident "$Id$"
#include "alloc.h"
#include "prototypes.h"
#if !defined(PASS_MAX)
#define PASS_MAX BUFSIZ - 1
#endif
/*
* SYNOPSIS
* [[gnu::malloc(erase_pass)]]
* char *agetpass(const char *prompt);
*
* void erase_pass(char *pass);
*
* ARGUMENTS
* agetpass()
* prompt String to be printed before reading a password.
*
* erase_pass()
* pass password previously returned by agetpass().
*
* DESCRIPTION
* agetpass()
* This function is very similar to getpass(3). It has several
* advantages compared to getpass(3):
*
* - Instead of using a static buffer, agetpass() allocates memory
* through malloc(3). This makes the function thread-safe, and
* also reduces the visibility of the buffer.
*
* - agetpass() doesn't reallocate internally. Some
* implementations of getpass(3), such as glibc, do that, as a
* consequence of calling getline(3). That's a bug in glibc,
* which allows leaking prefixes of passwords in freed memory.
*
* - agetpass() doesn't overrun the output buffer. If the input
* password is too long, it simply fails. Some implementations
* of getpass(3), share the same bug that gets(3) has.
*
* As soon as possible, the password obtained from agetpass() be
* erased by calling erase_pass(), to avoid possibly leaking the
* password.
*
* erase_pass()
* This function first clears the password, by calling
* explicit_bzero(3) (or an equivalent call), and then frees the
* allocated memory by calling free(3).
*
* NULL is a valid input pointer, and in such a case, this call is
* a no-op.
*
* RETURN VALUE
* agetpass() returns a newly allocated buffer containing the
* password on success. On error, errno is set to indicate the
* error, and NULL is returned.
*
* ERRORS
* agetpass()
* This function may fail for any errors that malloc(3) or
* readpassphrase(3) may fail, and in addition it may fail for the
* following errors:
*
* ENOBUFS
* The input password was longer than PASS_MAX.
*
* CAVEATS
* If a password is passed twice to erase_pass(), the behavior is
* undefined.
*/
char *
agetpass(const char *prompt)
{
char *pass;
size_t len;
/*
* Since we want to support passwords upto PASS_MAX, we need
* PASS_MAX bytes for the password itself, and one more byte for
* the terminating '\0'. We also want to detect truncation, and
* readpassphrase(3) doesn't detect it, so we need some trick.
* Let's add one more byte, and if the password uses it, it
* means the introduced password was longer than PASS_MAX.
*/
pass = MALLOCARRAY(PASS_MAX + 2, char);
if (pass == NULL)
return NULL;
if (readpassphrase(prompt, pass, PASS_MAX + 2, RPP_REQUIRE_TTY) == NULL)
goto fail;
len = strlen(pass);
if (len == PASS_MAX + 1) {
errno = ENOBUFS;
goto fail;
}
return pass;
fail:
freezero(pass, PASS_MAX + 2);
return NULL;
}
void
erase_pass(char *pass)
{
freezero(pass, PASS_MAX + 2);
}

57
libmisc/xmalloc.c → libmisc/alloc.c
View File

@ -3,6 +3,7 @@
* SPDX-FileCopyrightText: 1996 - 1998, Marek Michałkiewicz
* SPDX-FileCopyrightText: 2003 - 2006, Tomasz Kłoczko
* SPDX-FileCopyrightText: 2008 , Nicolas François
* SPDX-FileCopyrightText: 2023 , Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
@ -11,7 +12,7 @@
to be worth copyrighting :-). I did that because a lot of code used
malloc and strdup without checking for NULL pointer, and I like some
message better than a core dump... --marekm
Yeh, but. Remember that bailing out might leave the system in some
bizarre state. You really want to put in error checking, then add
some back-out failure recovery code. -- jfh */
@ -20,27 +21,53 @@
#ident "$Id$"
#include <stdio.h>
#include "alloc.h"
#include <errno.h>
#include <stddef.h>
#include <stdio.h>
#include "defines.h"
#include "prototypes.h"
#include "shadowlog.h"
/*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/void *xmalloc (size_t size)
{
void *ptr;
ptr = malloc (size);
if (NULL == ptr) {
(void) fprintf (log_get_logfd(),
_("%s: failed to allocate memory: %s\n"),
log_get_progname(), strerror (errno));
exit (13);
}
return ptr;
extern inline void *xmalloc(size_t size);
extern inline void *xmallocarray(size_t nmemb, size_t size);
extern inline void *mallocarray(size_t nmemb, size_t size);
extern inline void *reallocarrayf(void *p, size_t nmemb, size_t size);
extern inline char *xstrdup(const char *str);
void *
xcalloc(size_t nmemb, size_t size)
{
void *p;
p = calloc(nmemb, size);
if (p == NULL)
goto x;
return p;
x:
fprintf(log_get_logfd(), _("%s: %s\n"),
log_get_progname(), strerror(errno));
exit(13);
}
/*@maynotreturn@*/ /*@only@*//*@notnull@*/char *xstrdup (const char *str)
void *
xreallocarray(void *p, size_t nmemb, size_t size)
{
return strcpy (xmalloc (strlen (str) + 1), str);
p = reallocarrayf(p, nmemb, size);
if (p == NULL)
goto x;
return p;
x:
fprintf(log_get_logfd(), _("%s: %s\n"),
log_get_progname(), strerror(errno));
exit(13);
}

6
libmisc/audit_help.c
View File

@ -62,7 +62,7 @@ void audit_logger (int type, unused const char *pgname, const char *op,
return;
} else {
audit_log_acct_message (audit_fd, type, NULL, op, name, id,
NULL, NULL, NULL, (int) result);
NULL, NULL, NULL, result);
}
}
@ -77,11 +77,11 @@ void audit_logger_message (const char *message, shadow_audit_result result)
NULL, /* hostname */
NULL, /* addr */
NULL, /* tty */
(int) result);
result);
}
}
#else /* WITH_AUDIT */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* WITH_AUDIT */

4
libmisc/basename.c
View File

@ -21,6 +21,10 @@
#include "prototypes.h"
/*@observer@*/const char *Basename (const char *str)
{
if (str == NULL) {
abort ();
}
char *cp = strrchr (str, '/');
return (NULL != cp) ? cp + 1 : str;

19
libmisc/bit.c Normal file
View File

@ -0,0 +1,19 @@
/*
* SPDX-FileCopyrightText: 2022 - 2023, Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <config.h>
#ident "$Id$"
#include "bit.h"
#include <limits.h>
extern inline unsigned long bit_ceilul(unsigned long x);
extern inline unsigned long bit_ceil_wrapul(unsigned long x);
extern inline int leading_zerosul(unsigned long x);

2
libmisc/chowntty.c
View File

@ -51,7 +51,7 @@ void chown_tty (const struct passwd *info)
*/
if ( (fchown (STDIN_FILENO, info->pw_uid, gid) != 0)
|| (fchmod (STDIN_FILENO, (mode_t)getdef_num ("TTYPERM", 0600)) != 0)) {
|| (fchmod (STDIN_FILENO, getdef_num ("TTYPERM", 0600)) != 0)) {
int err = errno;
FILE *shadow_logfd = log_get_logfd();

12
libmisc/cleanup_group.c
View File

@ -22,7 +22,7 @@
*/
void cleanup_report_add_group (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR, "failed to add group %s", name));
#ifdef WITH_AUDIT
@ -40,7 +40,7 @@ void cleanup_report_add_group (void *group_name)
*/
void cleanup_report_del_group (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR, "failed to remove group %s", name));
#ifdef WITH_AUDIT
@ -95,7 +95,7 @@ void cleanup_report_mod_gshadow (void *cleanup_info)
*/
void cleanup_report_add_group_group (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, gr_dbname ()));
#ifdef WITH_AUDIT
@ -115,7 +115,7 @@ void cleanup_report_add_group_group (void *group_name)
*/
void cleanup_report_add_group_gshadow (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, sgr_dbname ()));
#ifdef WITH_AUDIT
@ -136,7 +136,7 @@ void cleanup_report_add_group_gshadow (void *group_name)
*/
void cleanup_report_del_group_group (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR,
"failed to remove group %s from %s",
@ -159,7 +159,7 @@ void cleanup_report_del_group_group (void *group_name)
*/
void cleanup_report_del_group_gshadow (void *group_name)
{
const char *name = (const char *)group_name;
const char *name = group_name;
SYSLOG ((LOG_ERR,
"failed to remove group %s from %s",

18
libmisc/cleanup_user.c
View File

@ -16,13 +16,13 @@
#include "shadowlog.h"
/*
* cleanup_report_add_user - Report failure to add an user to the system
* cleanup_report_add_user - Report failure to add a user to the system
*
* It should be registered when it is decided to add an user to the system.
* It should be registered when it is decided to add a user to the system.
*/
void cleanup_report_add_user (void *user_name)
{
const char *name = (const char *)user_name;
const char *name = user_name;
SYSLOG ((LOG_ERR, "failed to add user %s", name));
#ifdef WITH_AUDIT
@ -51,15 +51,15 @@ void cleanup_report_mod_passwd (void *cleanup_info)
}
/*
* cleanup_report_add_user_passwd - Report failure to add an user to
* cleanup_report_add_user_passwd - Report failure to add a user to
* /etc/passwd
*
* It should be registered when it is decided to add an user to the
* It should be registered when it is decided to add a user to the
* /etc/passwd database.
*/
void cleanup_report_add_user_passwd (void *user_name)
{
const char *name = (const char *)user_name;
const char *name = user_name;
SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, pw_dbname ()));
#ifdef WITH_AUDIT
@ -71,15 +71,15 @@ void cleanup_report_add_user_passwd (void *user_name)
}
/*
* cleanup_report_add_user_shadow - Report failure to add an user to
* cleanup_report_add_user_shadow - Report failure to add a user to
* /etc/shadow
*
* It should be registered when it is decided to add an user to the
* It should be registered when it is decided to add a user to the
* /etc/shadow database.
*/
void cleanup_report_add_user_shadow (void *user_name)
{
const char *name = (const char *)user_name;
const char *name = user_name;
SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, spw_dbname ()));
#ifdef WITH_AUDIT

8
libmisc/console.c
View File

@ -44,8 +44,7 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
if (*cons != '/') {
char *pbuf;
strncpy (buf, cons, sizeof (buf));
buf[sizeof (buf) - 1] = '\0';
strlcpy (buf, cons, sizeof (buf));
pbuf = &buf[0];
while ((s = strtok (pbuf, ":")) != NULL) {
if (strcmp (s, tty) == 0) {
@ -71,8 +70,9 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
* See if this tty is listed in the console file.
*/
while (fgets (buf, (int) sizeof (buf), fp) != NULL) {
buf[strlen (buf) - 1] = '\0';
while (fgets (buf, sizeof (buf), fp) != NULL) {
/* Remove optional trailing '\n'. */
buf[strcspn (buf, "\n")] = '\0';
if (strcmp (buf, tty) == 0) {
(void) fclose (fp);
return true;

54
libmisc/copydir.c
View File

@ -17,6 +17,8 @@
#include <sys/time.h>
#include <fcntl.h>
#include <stdio.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#ifdef WITH_SELINUX
@ -226,7 +228,7 @@ static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, c
return NULL;
}
lp = (struct link_name *) xmalloc (sizeof *lp);
lp = XMALLOC (struct link_name);
src_len = strlen (src_orig);
dst_len = strlen (dst_orig);
name_len = strlen (name);
@ -234,7 +236,7 @@ static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, c
lp->ln_ino = sb->st_ino;
lp->ln_count = sb->st_nlink;
len = name_len - src_len + dst_len + 1;
lp->ln_name = (char *) xmalloc (len);
lp->ln_name = XMALLOCARRAY (len, char);
(void) snprintf (lp->ln_name, len, "%s%s", dst_orig, name + src_len);
lp->ln_next = links;
links = lp;
@ -324,8 +326,8 @@ static int copy_tree_impl (const struct path_info *src, const struct path_info *
src_len += strlen (src->full_path);
dst_len += strlen (dst->full_path);
src_name = (char *) malloc (src_len);
dst_name = (char *) malloc (dst_len);
src_name = MALLOCARRAY (src_len, char);
dst_name = MALLOCARRAY (dst_len, char);
if ((NULL == src_name) || (NULL == dst_name)) {
err = -1;
@ -419,35 +421,25 @@ static int copy_entry (const struct path_info *src, const struct path_info *dst,
if (fstatat(src->dirfd, src->name, &sb, AT_SYMLINK_NOFOLLOW) == -1) {
/* If we cannot stat the file, do not care. */
} else {
#ifdef HAVE_STRUCT_STAT_ST_ATIM
mt[0].tv_sec = sb.st_atim.tv_sec;
mt[0].tv_nsec = sb.st_atim.tv_nsec;
#else /* !HAVE_STRUCT_STAT_ST_ATIM */
mt[0].tv_sec = sb.st_atime;
# ifdef HAVE_STRUCT_STAT_ST_ATIMENSEC
mt[0].tv_nsec = sb.st_atimensec;
# else /* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
mt[0].tv_nsec = 0;
# endif /* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
#endif /* !HAVE_STRUCT_STAT_ST_ATIM */
#ifdef HAVE_STRUCT_STAT_ST_MTIM
mt[1].tv_sec = sb.st_mtim.tv_sec;
mt[1].tv_nsec = sb.st_mtim.tv_nsec;
#else /* !HAVE_STRUCT_STAT_ST_MTIM */
mt[1].tv_sec = sb.st_mtime;
# ifdef HAVE_STRUCT_STAT_ST_MTIMENSEC
mt[1].tv_nsec = sb.st_mtimensec;
# else /* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
mt[1].tv_nsec = 0;
# endif /* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
#endif /* !HAVE_STRUCT_STAT_ST_MTIM */
if (S_ISDIR (sb.st_mode)) {
err = copy_dir (src, dst, reset_selinux, &sb, mt,
old_uid, new_uid, old_gid, new_gid);
}
/*
* If the destination already exists do nothing.
* This is after the copy_dir above to still iterate into subdirectories.
*/
if (fstatat(dst->dirfd, dst->name, &sb, AT_SYMLINK_NOFOLLOW) != -1) {
return 0;
}
/*
* Copy any symbolic links
*/
@ -507,6 +499,7 @@ static int copy_dir (const struct path_info *src, const struct path_info *dst,
gid_t old_gid, gid_t new_gid)
{
int err = 0;
struct stat dst_sb;
/*
* Create a new target directory, make it owned by
@ -518,6 +511,15 @@ static int copy_dir (const struct path_info *src, const struct path_info *dst,
return -1;
}
#endif /* WITH_SELINUX */
/*
* If the destination is already a directory, don't change it
* but copy into it (recursively).
*/
if (fstatat(dst->dirfd, dst->name, &dst_sb, AT_SYMLINK_NOFOLLOW) == 0 && S_ISDIR(dst_sb.st_mode)) {
return (copy_tree_impl (src, dst, false, reset_selinux,
old_uid, new_uid, old_gid, new_gid) != 0);
}
if ( (mkdirat (dst->dirfd, dst->name, 0700) != 0)
|| (chownat_if_needed (dst, statp,
old_uid, new_uid, old_gid, new_gid) != 0)
@ -559,7 +561,7 @@ static /*@null@*/char *readlink_malloc (const char *filename)
while (true) {
ssize_t nchars;
char *buffer = (char *) malloc (size);
char *buffer = MALLOCARRAY (size, char);
if (NULL == buffer) {
return NULL;
}
@ -624,7 +626,7 @@ static int copy_symlink (const struct path_info *src, const struct path_info *ds
*/
if (strncmp (oldlink, src_orig, strlen (src_orig)) == 0) {
size_t len = strlen (dst_orig) + strlen (oldlink) - strlen (src_orig) + 1;
char *dummy = (char *) xmalloc (len);
char *dummy = XMALLOCARRAY (len, char);
(void) snprintf (dummy, len, "%s%s",
dst_orig,
oldlink + strlen (src_orig));
@ -768,7 +770,7 @@ static ssize_t full_write(int fd, const void *buf, size_t count) {
written += res;
buf = (const unsigned char*)buf + res;
count -= (size_t)res;
count -= res;
}
return written;
@ -850,7 +852,7 @@ static int copy_file (const struct path_info *src, const struct path_info *dst,
break;
}
if (full_write (ofd, buf, (size_t)cnt) < 0) {
if (full_write (ofd, buf, cnt) < 0) {
(void) close (ofd);
(void) close (ifd);
return -1;

141
libmisc/csrand.c Normal file
View File

@ -0,0 +1,141 @@
/*
* SPDX-FileCopyrightText: Alejandro Colomar <alx@kernel.org>
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <config.h>
#ident "$Id$"
#include <limits.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#if HAVE_SYS_RANDOM_H
#include <sys/random.h>
#endif
#include "bit.h"
#include "defines.h"
#include "prototypes.h"
#include "shadowlog.h"
static uint32_t csrand_uniform32(uint32_t n);
static unsigned long csrand_uniform_slow(unsigned long n);
/*
* Return a uniformly-distributed CS random u_long value.
*/
unsigned long
csrand(void)
{
FILE *fp;
unsigned long r;
#ifdef HAVE_GETENTROPY
/* getentropy may exist but lack kernel support. */
if (getentropy(&r, sizeof(r)) == 0)
return r;
#endif
#ifdef HAVE_GETRANDOM
/* Likewise getrandom. */
if (getrandom(&r, sizeof(r), 0) == sizeof(r))
return r;
#endif
#ifdef HAVE_ARC4RANDOM_BUF
/* arc4random_buf can never fail. */
arc4random_buf(&r, sizeof(r));
return r;
#endif
/* Use /dev/urandom as a last resort. */
fp = fopen("/dev/urandom", "r");
if (NULL == fp) {
goto fail;
}
if (fread(&r, sizeof(r), 1, fp) != 1) {
fclose(fp);
goto fail;
}
fclose(fp);
return r;
fail:
fprintf(log_get_logfd(), _("Unable to obtain random bytes.\n"));
exit(1);
}
/*
* Return a uniformly-distributed CS random value in the interval [0, n-1].
*/
unsigned long
csrand_uniform(unsigned long n)
{
if (n == 0 || n > UINT32_MAX)
return csrand_uniform_slow(n);
return csrand_uniform32(n);
}
/*
* Return a uniformly-distributed CS random value in the interval [min, max].
*/
unsigned long
csrand_interval(unsigned long min, unsigned long max)
{
return csrand_uniform(max - min + 1) + min;
}
/*
* Fast Random Integer Generation in an Interval
* ACM Transactions on Modeling and Computer Simulation 29 (1), 2019
* <https://arxiv.org/abs/1805.10941>
*/
static uint32_t
csrand_uniform32(uint32_t n)
{
uint32_t bound, rem;
uint64_t r, mult;
if (n == 0)
return csrand();
bound = -n % n; // analogous to `2^64 % n`, since `x % y == (x-y) % y`
do {
r = csrand();
mult = r * n;
rem = mult; // analogous to `mult % 2^64`
} while (rem < bound); // p = (2^64 % n) / 2^64; W.C.: n=2^63+1, p=0.5
r = mult >> WIDTHOF(n); // analogous to `mult / 2^64`
return r;
}
static unsigned long
csrand_uniform_slow(unsigned long n)
{
unsigned long r, max, mask;
max = n - 1;
mask = bit_ceil_wrapul(n) - 1;
do {
r = csrand();
r &= mask; // optimization
} while (r > max); // p = ((mask+1) % n) / (mask+1); W.C.: p=0.5
return r;
}

22
libmisc/date_to_str.c
View File

@ -33,14 +33,24 @@
#include "prototypes.h"
void date_to_str (size_t size, char buf[size], long date)
void
date_to_str(size_t size, char buf[size], long date)
{
time_t t;
time_t t;
const struct tm *tm;
t = date;
if (date < 0)
(void) strncpy (buf, "never", size);
else
(void) strftime (buf, size, "%Y-%m-%d", gmtime (&t));
if (date < 0) {
(void) strlcpy(buf, "never", size);
return;
}
tm = gmtime(&t);
if (tm == NULL) {
(void) strlcpy(buf, "future", size);
return;
}
(void) strftime(buf, size, "%Y-%m-%d", tm);
buf[size - 1] = '\0';
}

4
libmisc/entry.c
View File

@ -13,6 +13,8 @@
#include <sys/types.h>
#include <stdio.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include <pwd.h>
@ -24,7 +26,7 @@ void pw_entry (const char *name, struct passwd *pwent)
struct spwd *spwd;
if (!(passwd = getpwnam (name))) { /* local, no need for xgetpwnam */
pwent->pw_name = (char *) 0;
pwent->pw_name = NULL;
return;
} else {
pwent->pw_name = xstrdup (passwd->pw_name);

22
libmisc/env.c
View File

@ -15,6 +15,8 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include "shadowlog.h"
@ -26,7 +28,6 @@
#define NEWENVP_STEP 16
size_t newenvc = 0;
/*@null@*/char **newenvp = NULL;
extern char **environ;
static const char *const forbid[] = {
"_RLD_=",
@ -42,7 +43,7 @@ static const char *const forbid[] = {
"PATH=",
"SHELL=",
"SHLIB_PATH=",
(char *) 0
NULL
};
/* these are allowed, but with no slashes inside
@ -51,7 +52,7 @@ static const char *const noslash[] = {
"LANG=",
"LANGUAGE=",
"LC_", /* anything with the LC_ prefix */
(char *) 0
NULL
};
/*
@ -59,7 +60,7 @@ static const char *const noslash[] = {
*/
void initenv (void)
{
newenvp = (char **) xmalloc (NEWENVP_STEP * sizeof (char *));
newenvp = XMALLOCARRAY (NEWENVP_STEP, char *);
*newenvp = NULL;
}
@ -73,7 +74,7 @@ void addenv (const char *string, /*@null@*/const char *value)
if (NULL != value) {
size_t len = strlen (string) + strlen (value) + 2;
int wlen;
newstring = xmalloc (len);
newstring = XMALLOCARRAY (len, char);
wlen = snprintf (newstring, len, "%s=%s", string, value);
assert (wlen == (int) len -1);
} else {
@ -127,16 +128,16 @@ void addenv (const char *string, /*@null@*/const char *value)
*/
if ((newenvc & (NEWENVP_STEP - 1)) == 0) {
char **__newenvp;
size_t newsize;
bool update_environ;
char **__newenvp;
/*
* If the resize operation succeeds we can
* happily go on, else print a message.
*/
update_environ = (environ == newenvp);
newsize = (newenvc + NEWENVP_STEP) * sizeof (char *);
__newenvp = (char **) realloc (newenvp, newsize);
__newenvp = REALLOCARRAY(newenvp, newenvc + NEWENVP_STEP, char *);
if (NULL != __newenvp) {
/*
@ -144,9 +145,8 @@ void addenv (const char *string, /*@null@*/const char *value)
* environ so that it doesn't point to some
* free memory area (realloc() could move it).
*/
if (environ == newenvp) {
if (update_environ)
environ = __newenvp;
}
newenvp = __newenvp;
} else {
(void) fputs (_("Environment overflow\n"), log_get_logfd());

18
libmisc/failure.c
View File

@ -53,7 +53,7 @@ void failure (uid_t uid, const char *tty, struct faillog *fl)
*/
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|| (read (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
|| (read (fd, fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
/* This is not necessarily a failure. The file is
* initially zero length.
*
@ -86,7 +86,7 @@ void failure (uid_t uid, const char *tty, struct faillog *fl)
*/
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|| (write (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)
|| (write (fd, fl, sizeof *fl) != (ssize_t) sizeof *fl)
|| (close (fd) != 0)) {
SYSLOG ((LOG_WARN,
"Can't write faillog entry for UID %lu in %s.",
@ -163,7 +163,7 @@ int failcheck (uid_t uid, struct faillog *fl, bool failed)
*/
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|| (read (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
|| (read (fd, fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
(void) close (fd);
return 1;
}
@ -185,7 +185,7 @@ int failcheck (uid_t uid, struct faillog *fl, bool failed)
fail.fail_cnt = 0;
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|| (write (fd, (const void *) &fail, sizeof fail) != (ssize_t) sizeof fail)
|| (write (fd, &fail, sizeof fail) != (ssize_t) sizeof fail)
|| (close (fd) != 0)) {
SYSLOG ((LOG_WARN,
"Can't reset faillog entry for UID %lu in %s.",
@ -242,13 +242,7 @@ void failprint (const struct faillog *fail)
* maintains a record of all login failures.
*/
void failtmp (const char *username,
#ifdef USE_UTMPX
const struct utmpx *failent
#else /* !USE_UTMPX */
const struct utmp *failent
#endif /* !USE_UTMPX */
)
void failtmp (const char *username, const struct utmp *failent)
{
const char *ftmp;
int fd;
@ -284,7 +278,7 @@ void failtmp (const char *username,
* Append the new failure record and close the log file.
*/
if ( (write (fd, (const void *) failent, sizeof *failent) != (ssize_t) sizeof *failent)
if ( (write (fd, failent, sizeof *failent) != (ssize_t) sizeof *failent)
|| (close (fd) != 0)) {
SYSLOG ((LOG_WARN,
"Can't append failure of user %s to %s.",

8
libmisc/failure.h
View File

@ -13,11 +13,7 @@
#include "defines.h"
#include "faillog.h"
#ifdef USE_UTMPX
#include <utmpx.h>
#else /* !USE_UTMPX */
#include <utmp.h>
#endif /* !USE_UTMPX */
/*
* failure - make failure entry
@ -51,11 +47,7 @@ extern void failprint (const struct faillog *);
* failtmp updates the (struct utmp) formatted failure log which
* maintains a record of all login failures.
*/
#ifdef USE_UTMPX
extern void failtmp (const char *username, const struct utmpx *);
#else /* !USE_UTMPX */
extern void failtmp (const char *username, const struct utmp *);
#endif /* !USE_UTMPX */
#endif

53
libmisc/find_new_gid.c
View File

@ -12,6 +12,7 @@
#include <stdio.h>
#include <errno.h>
#include "alloc.h"
#include "prototypes.h"
#include "groupio.h"
#include "getdef.h"
@ -40,15 +41,14 @@ static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
*preferred_min = (gid_t) 1;
/* Get the minimum ID range from login.defs or default to 101 */
*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
*min_id = getdef_ulong ("SYS_GID_MIN", 101UL);
/*
* If SYS_GID_MAX is unspecified, we should assume it to be one
* less than the GID_MIN (which is reserved for non-system accounts)
*/
gid_def_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
*max_id = (gid_t) getdef_ulong ("SYS_GID_MAX",
(unsigned long) gid_def_max);
gid_def_max = getdef_ulong ("GID_MIN", 1000UL) - 1;
*max_id = getdef_ulong ("SYS_GID_MAX", gid_def_max);
/* Check that the ranges make sense */
if (*max_id < *min_id) {
@ -71,8 +71,8 @@ static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
/* Non-system groups */
/* Get the values from login.defs or use reasonable defaults */
*min_id = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
*max_id = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
*min_id = getdef_ulong ("GID_MIN", 1000UL);
*max_id = getdef_ulong ("GID_MAX", 60000UL);
/*
* The preferred minimum should match the standard ID minimum
@ -99,6 +99,7 @@ static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
*
* On success, return 0
* If the ID is in use, return EEXIST
* If the ID might clash with -1, return EINVAL
* If the ID is outside the range, return ERANGE
* In other cases, return errno from getgrgid()
*/
@ -112,6 +113,11 @@ static int check_gid (const gid_t gid,
return ERANGE;
}
/* Check for compatibility with 16b and 32b gid_t error codes */
if (gid == UINT16_MAX || gid == UINT32_MAX) {
return EINVAL;
}
/*
* Check whether we already detected this GID
* using the gr_next() loop
@ -183,10 +189,10 @@ int find_new_gid (bool sys_group,
* gr_locate_gid() found the GID in an as-yet uncommitted
* entry. We'll proceed below and auto-set a GID.
*/
} else if (result == EEXIST || result == ERANGE) {
} else if (result == EEXIST || result == ERANGE || result == EINVAL) {
/*
* Continue on below. At this time, we won't
* treat these two cases differently.
* treat these three cases differently.
*/
} else {
/*
@ -226,14 +232,13 @@ int find_new_gid (bool sys_group,
*/
/* Create an array to hold all of the discovered GIDs */
used_gids = malloc (sizeof (bool) * (gid_max +1));
used_gids = CALLOC (gid_max + 1, bool);
if (NULL == used_gids) {
fprintf (log_get_logfd(),
_("%s: failed to allocate memory: %s\n"),
log_get_progname(), strerror (errno));
return -1;
}
memset (used_gids, false, sizeof (bool) * (gid_max + 1));
/* First look for the lowest and highest value in the local database */
(void) gr_rewind ();
@ -297,8 +302,11 @@ int find_new_gid (bool sys_group,
*gid = id;
free (used_gids);
return 0;
} else if (result == EEXIST) {
/* This GID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -340,8 +348,11 @@ int find_new_gid (bool sys_group,
*gid = id;
free (used_gids);
return 0;
} else if (result == EEXIST) {
/* This GID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -400,8 +411,11 @@ int find_new_gid (bool sys_group,
*gid = id;
free (used_gids);
return 0;
} else if (result == EEXIST) {
/* This GID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -443,8 +457,11 @@ int find_new_gid (bool sys_group,
*gid = id;
free (used_gids);
return 0;
} else if (result == EEXIST) {
/* This GID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.

2
libmisc/find_new_sub_gids.c
View File

@ -59,6 +59,6 @@ int find_new_sub_gids (gid_t *range_start, unsigned long *range_count)
return 0;
}
#else /* !ENABLE_SUBIDS */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !ENABLE_SUBIDS */

2
libmisc/find_new_sub_uids.c
View File

@ -59,6 +59,6 @@ int find_new_sub_uids (uid_t *range_start, unsigned long *range_count)
return 0;
}
#else /* !ENABLE_SUBIDS */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !ENABLE_SUBIDS */

52
libmisc/find_new_uid.c
View File

@ -12,6 +12,7 @@
#include <stdio.h>
#include <errno.h>
#include "alloc.h"
#include "prototypes.h"
#include "pwio.h"
#include "getdef.h"
@ -40,15 +41,14 @@ static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
*preferred_min = (uid_t) 1;
/* Get the minimum ID range from login.defs or default to 101 */
*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
*min_id = getdef_ulong ("SYS_UID_MIN", 101UL);
/*
* If SYS_UID_MAX is unspecified, we should assume it to be one
* less than the UID_MIN (which is reserved for non-system accounts)
*/
uid_def_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
*max_id = (uid_t) getdef_ulong ("SYS_UID_MAX",
(unsigned long) uid_def_max);
uid_def_max = getdef_ulong ("UID_MIN", 1000UL) - 1;
*max_id = getdef_ulong ("SYS_UID_MAX", uid_def_max);
/* Check that the ranges make sense */
if (*max_id < *min_id) {
@ -71,8 +71,8 @@ static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
/* Non-system users */
/* Get the values from login.defs or use reasonable defaults */
*min_id = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
*max_id = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
*min_id = getdef_ulong ("UID_MIN", 1000UL);
*max_id = getdef_ulong ("UID_MAX", 60000UL);
/*
* The preferred minimum should match the standard ID minimum
@ -99,6 +99,7 @@ static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
*
* On success, return 0
* If the ID is in use, return EEXIST
* If the ID might clash with -1, return EINVAL
* If the ID is outside the range, return ERANGE
* In other cases, return errno from getpwuid()
*/
@ -112,6 +113,11 @@ static int check_uid(const uid_t uid,
return ERANGE;
}
/* Check for compatibility with 16b and 32b uid_t error codes */
if (uid == UINT16_MAX || uid == UINT32_MAX) {
return EINVAL;
}
/*
* Check whether we already detected this UID
* using the pw_next() loop
@ -183,10 +189,10 @@ int find_new_uid(bool sys_user,
* pw_locate_uid() found the UID in an as-yet uncommitted
* entry. We'll proceed below and auto-set an UID.
*/
} else if (result == EEXIST || result == ERANGE) {
} else if (result == EEXIST || result == ERANGE || result == EINVAL) {
/*
* Continue on below. At this time, we won't
* treat these two cases differently.
* treat these three cases differently.
*/
} else {
/*
@ -226,7 +232,7 @@ int find_new_uid(bool sys_user,
*/
/* Create an array to hold all of the discovered UIDs */
used_uids = malloc (sizeof (bool) * (uid_max +1));
used_uids = MALLOCARRAY (uid_max + 1, bool);
if (NULL == used_uids) {
fprintf (log_get_logfd(),
_("%s: failed to allocate memory: %s\n"),
@ -297,8 +303,11 @@ int find_new_uid(bool sys_user,
*uid = id;
free (used_uids);
return 0;
} else if (result == EEXIST) {
/* This UID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -340,8 +349,11 @@ int find_new_uid(bool sys_user,
*uid = id;
free (used_uids);
return 0;
} else if (result == EEXIST) {
/* This UID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -400,8 +412,11 @@ int find_new_uid(bool sys_user,
*uid = id;
free (used_uids);
return 0;
} else if (result == EEXIST) {
/* This UID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.
@ -443,8 +458,11 @@ int find_new_uid(bool sys_user,
*uid = id;
free (used_uids);
return 0;
} else if (result == EEXIST) {
/* This UID is in use, we'll continue to the next */
} else if (result == EEXIST || result == EINVAL) {
/*
* This GID is in use or unusable, we'll
* continue to the next.
*/
} else {
/*
* An unexpected error occurred.

2
libmisc/getgr_nam_gid.c
View File

@ -36,7 +36,7 @@ extern /*@only@*//*@null@*/struct group *getgr_nam_gid (/*@null@*/const char *gr
&& ('\0' == *endptr)
&& (ERANGE != errno)
&& (/*@+longintegral@*/gid == (gid_t)gid)/*@=longintegral@*/) {
return xgetgrgid ((gid_t) gid);
return xgetgrgid (gid);
}
return xgetgrnam (grname);
}

6
libmisc/gettime.c
View File

@ -22,7 +22,7 @@
* Epoch, 1970-01-01 00:00:00 +0000 (UTC), except that if the SOURCE_DATE_EPOCH
* environment variable is exported it will use that instead.
*/
/*@observer@*/time_t gettime ()
/*@observer@*/time_t gettime (void)
{
char *endptr;
char *source_date_epoch;
@ -55,13 +55,13 @@
fprintf (shadow_logfd,
_("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to %lu but was found to be: %llu\n"),
ULONG_MAX, epoch);
} else if (epoch > fallback) {
} else if ((time_t)epoch > fallback) {
fprintf (shadow_logfd,
_("Environment variable $SOURCE_DATE_EPOCH: value must be smaller than or equal to the current time (%lu) but was found to be: %llu\n"),
fallback, epoch);
} else {
/* Valid */
return (time_t)epoch;
return epoch;
}
return fallback;

2
libmisc/hushed.c
View File

@ -66,7 +66,7 @@ bool hushed (const char *username)
if (NULL == fp) {
return false;
}
for (found = false; !found && (fgets (buf, (int) sizeof buf, fp) == buf);) {
for (found = false; !found && (fgets (buf, sizeof buf, fp) == buf);) {
buf[strcspn (buf, "\n")] = '\0';
found = (strcmp (buf, pw->pw_shell) == 0) ||
(strcmp (buf, pw->pw_name) == 0);

30
libmisc/idmapping.c
View File

@ -11,7 +11,10 @@
#include <limits.h>
#include <stdlib.h>
#include <stdio.h>
#include "alloc.h"
#include "prototypes.h"
#include "stpeprintf.h"
#include "idmapping.h"
#if HAVE_SYS_CAPABILITY_H
#include <sys/prctl.h>
@ -43,7 +46,7 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
return NULL;
}
mappings = calloc(ranges, sizeof(*mappings));
mappings = CALLOC(ranges, struct map_range);
if (!mappings) {
fprintf(log_get_logfd(), _( "%s: Memory allocation failure\n"),
log_get_progname());
@ -99,7 +102,7 @@ struct map_range *get_map_ranges(int ranges, int argc, char **argv)
* 8bytes --> 21 ascii estimated -> 18446744073709551616 (20 real)
* 16bytes --> 39 ascii estimated -> 340282366920938463463374607431768211456 (39 real)
*/
#define ULONG_DIGITS ((((sizeof(unsigned long) * CHAR_BIT) + 9)/10)*3)
#define ULONG_DIGITS (((WIDTHOF(unsigned long) + 9)/10)*3)
#if HAVE_SYS_CAPABILITY_H
static inline bool maps_lower_root(int cap, int ranges, const struct map_range *mappings)
@ -141,7 +144,7 @@ void write_mapping(int proc_dir_fd, int ranges, const struct map_range *mappings
int idx;
const struct map_range *mapping;
size_t bufsize;
char *buf, *pos;
char *buf, *pos, *end;
int fd;
#if HAVE_SYS_CAPABILITY_H
@ -188,22 +191,21 @@ void write_mapping(int proc_dir_fd, int ranges, const struct map_range *mappings
#endif
bufsize = ranges * ((ULONG_DIGITS + 1) * 3);
pos = buf = xmalloc(bufsize);
pos = buf = XMALLOCARRAY(bufsize, char);
end = buf + bufsize;
/* Build the mapping command */
mapping = mappings;
for (idx = 0; idx < ranges; idx++, mapping++) {
/* Append this range to the string that will be written */
int written = snprintf(pos, bufsize - (pos - buf),
"%lu %lu %lu\n",
mapping->upper,
mapping->lower,
mapping->count);
if ((written <= 0) || (written >= (bufsize - (pos - buf)))) {
fprintf(log_get_logfd(), _("%s: snprintf failed!\n"), log_get_progname());
exit(EXIT_FAILURE);
}
pos += written;
pos = stpeprintf(pos, end, "%lu %lu %lu\n",
mapping->upper,
mapping->lower,
mapping->count);
}
if (pos == end || pos == NULL) {
fprintf(log_get_logfd(), _("%s: stpeprintf failed!\n"), log_get_progname());
exit(EXIT_FAILURE);
}
/* Write the mapping to the mapping file */

2
libmisc/isexpired.c
View File

@ -40,7 +40,7 @@ int isexpired (const struct passwd *pw, /*@null@*/const struct spwd *sp)
{
long now;
now = (long) time ((time_t *) 0) / SCALE;
now = time(NULL) / SCALE;
if (NULL == sp) {
return 0;

48
libmisc/limits.c
View File

@ -28,11 +28,7 @@
#include <pwd.h>
#include "getdef.h"
#include "shadowlog.h"
#ifdef HAVE_SYS_RESOURCE_H
#include <sys/resource.h>
#define LIMITS
#endif
#ifdef LIMITS
#ifndef LIMITS_FILE
#define LIMITS_FILE "/etc/limits"
#endif
@ -72,7 +68,7 @@ static int setrlimit_value (unsigned int resource,
return 0;
}
longlimit *= multiplier;
limit = (rlim_t)longlimit;
limit = longlimit;
if (longlimit != limit)
{
/* FIXME: Again, silent error handling...
@ -99,7 +95,7 @@ static int set_prio (const char *value)
|| (prio != (int) prio)) {
return 0;
}
if (setpriority (PRIO_PROCESS, 0, (int) prio) != 0) {
if (setpriority (PRIO_PROCESS, 0, prio) != 0) {
return LOGIN_ERROR_RLIMIT;
}
return 0;
@ -115,7 +111,7 @@ static int set_umask (const char *value)
return 0;
}
(void) umask ((mode_t) mask);
(void) umask (mask);
return 0;
}
@ -123,11 +119,7 @@ static int set_umask (const char *value)
/* Counts the number of user logins and check against the limit */
static int check_logins (const char *name, const char *maxlogins)
{
#ifdef USE_UTMPX
struct utmpx *ut;
#else /* !USE_UTMPX */
struct utmp *ut;
#endif /* !USE_UTMPX */
unsigned long limit, count;
if (getulong (maxlogins, &limit) == 0) {
@ -140,13 +132,8 @@ static int check_logins (const char *name, const char *maxlogins)
}
count = 0;
#ifdef USE_UTMPX
setutxent ();
while ((ut = getutxent ()))
#else /* !USE_UTMPX */
setutent ();
while ((ut = getutent ()))
#endif /* !USE_UTMPX */
{
if (USER_PROCESS != ut->ut_type) {
continue;
@ -162,11 +149,7 @@ static int check_logins (const char *name, const char *maxlogins)
break;
}
}
#ifdef USE_UTMPX
endutxent ();
#else /* !USE_UTMPX */
endutent ();
#endif /* !USE_UTMPX */
/*
* This is called after setutmp(), so the number of logins counted
* includes the user who is currently trying to log in.
@ -243,34 +226,26 @@ static int do_user_limits (const char *buf, const char *name)
while ('\0' != *pp) {
switch (*pp++) {
#ifdef RLIMIT_AS
case 'a':
case 'A':
/* RLIMIT_AS - max address space (KB) */
retval |= setrlimit_value (RLIMIT_AS, pp, 1024);
break;
#endif
#ifdef RLIMIT_CORE
case 'c':
case 'C':
/* RLIMIT_CORE - max core file size (KB) */
retval |= setrlimit_value (RLIMIT_CORE, pp, 1024);
break;
#endif
#ifdef RLIMIT_DATA
case 'd':
case 'D':
/* RLIMIT_DATA - max data size (KB) */
retval |= setrlimit_value (RLIMIT_DATA, pp, 1024);
break;
#endif
#ifdef RLIMIT_FSIZE
case 'f':
case 'F':
/* RLIMIT_FSIZE - Maximum filesize (KB) */
retval |= setrlimit_value (RLIMIT_FSIZE, pp, 1024);
break;
#endif
#ifdef RLIMIT_NICE
case 'i':
case 'I':
@ -294,13 +269,11 @@ static int do_user_limits (const char *buf, const char *name)
retval |= setrlimit_value (RLIMIT_MEMLOCK, pp, 1024);
break;
#endif
#ifdef RLIMIT_NOFILE
case 'n':
case 'N':
/* RLIMIT_NOFILE - max number of open files */
retval |= setrlimit_value (RLIMIT_NOFILE, pp, 1);
break;
#endif
#ifdef RLIMIT_RTPRIO
case 'o':
case 'O':
@ -319,20 +292,16 @@ static int do_user_limits (const char *buf, const char *name)
retval |= setrlimit_value (RLIMIT_RSS, pp, 1024);
break;
#endif
#ifdef RLIMIT_STACK
case 's':
case 'S':
/* RLIMIT_STACK - max stack size (KB) */
retval |= setrlimit_value (RLIMIT_STACK, pp, 1024);
break;
#endif
#ifdef RLIMIT_CPU
case 't':
case 'T':
/* RLIMIT_CPU - max CPU time (MIN) */
retval |= setrlimit_value (RLIMIT_CPU, pp, 60);
break;
#endif
#ifdef RLIMIT_NPROC
case 'u':
case 'U':
@ -479,7 +448,6 @@ static int setup_user_limits (const char *uname)
}
return do_user_limits (limits, uname);
}
#endif /* LIMITS */
static void setup_usergroups (const struct passwd *info)
@ -523,7 +491,6 @@ void setup_limits (const struct passwd *info)
*/
if (getdef_bool ("QUOTAS_ENAB")) {
#ifdef LIMITS
if (info->pw_uid != 0) {
if ((setup_user_limits (info->pw_name) & LOGIN_ERROR_LOGIN) != 0) {
(void) fputs (_("Too many logins.\n"), log_get_logfd());
@ -531,7 +498,6 @@ void setup_limits (const struct passwd *info)
exit (EXIT_FAILURE);
}
}
#endif
for (cp = info->pw_gecos; cp != NULL; cp = strchr (cp, ',')) {
if (',' == *cp) {
cp++;
@ -542,7 +508,7 @@ void setup_limits (const struct passwd *info)
if ( (getlong (cp + 4, &inc) == 1)
&& (inc >= -20) && (inc <= 20)) {
errno = 0;
if ( (nice ((int) inc) != -1)
if ( (nice (inc) != -1)
|| (0 != errno)) {
continue;
}
@ -559,7 +525,7 @@ void setup_limits (const struct passwd *info)
long int blocks;
if ( (getlong (cp + 7, &blocks) == 0)
|| (blocks != (int) blocks)
|| (set_filesize_limit ((int) blocks) != 0)) {
|| (set_filesize_limit (blocks) != 0)) {
SYSLOG ((LOG_WARN,
"Can't set the ulimit for user %s",
info->pw_name));
@ -574,7 +540,7 @@ void setup_limits (const struct passwd *info)
"Can't set umask value for user %s",
info->pw_name));
} else {
(void) umask ((mode_t) mask);
(void) umask (mask);
}
continue;
@ -584,6 +550,6 @@ void setup_limits (const struct passwd *info)
}
#else /* !USE_PAM */
extern int errno; /* warning: ANSI C forbids an empty source file */
extern int ISO_C_forbids_an_empty_translation_unit;
#endif /* !USE_PAM */

28
libmisc/list.c
View File

@ -11,6 +11,8 @@
#ident "$Id$"
#include <assert.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
/*
@ -33,7 +35,7 @@
* pointer if it is present.
*/
for (i = 0; list[i] != (char *) 0; i++) {
for (i = 0; list[i] != NULL; i++) {
if (strcmp (list[i], member) == 0) {
return list;
}
@ -44,7 +46,7 @@
* old entries, and the new entries as well.
*/
tmp = (char **) xmalloc ((i + 2) * sizeof member);
tmp = XMALLOCARRAY (i + 2, char *);
/*
* Copy the original list to the new list, then append the
@ -52,12 +54,12 @@
* is returned to the invoker.
*/
for (i = 0; list[i] != (char *) 0; i++) {
for (i = 0; list[i] != NULL; i++) {
tmp[i] = list[i];
}
tmp[i] = xstrdup (member);
tmp[i+1] = (char *) 0;
tmp[i+1] = NULL;
return tmp;
}
@ -83,7 +85,7 @@
* pointer if it is not present.
*/
for (i = j = 0; list[i] != (char *) 0; i++) {
for (i = j = 0; list[i] != NULL; i++) {
if (strcmp (list[i], member) != 0) {
j++;
}
@ -98,7 +100,7 @@
* old entries.
*/
tmp = (char **) xmalloc ((j + 1) * sizeof member);
tmp = XMALLOCARRAY (j + 1, char *);
/*
* Copy the original list except the deleted members to the
@ -106,14 +108,14 @@
* is returned to the invoker.
*/
for (i = j = 0; list[i] != (char *) 0; i++) {
for (i = j = 0; list[i] != NULL; i++) {
if (strcmp (list[i], member) != 0) {
tmp[j] = list[i];
j++;
}
}
tmp[j] = (char *) 0;
tmp[j] = NULL;
return tmp;
}
@ -133,7 +135,7 @@
for (i = 0; NULL != list[i]; i++);
tmp = (char **) xmalloc ((i + 1) * sizeof (char *));
tmp = XMALLOCARRAY (i + 1, char *);
i = 0;
while (NULL != *list) {
@ -142,7 +144,7 @@
list++;
}
tmp[i] = (char *) 0;
tmp[i] = NULL;
return tmp;
}
@ -210,14 +212,14 @@ bool is_on_list (char *const *list, const char *member)
* Allocate the array we're going to store the pointers into.
*/
array = (char **) xmalloc (sizeof (char *) * i);
array = XMALLOCARRAY (i, char *);
/*
* Empty list is special - 0 members, not 1 empty member. --marekm
*/
if ('\0' == *members) {
*array = (char *) 0;
*array = NULL;
free (members);
return array;
}
@ -235,7 +237,7 @@ bool is_on_list (char *const *list, const char *member)
cp2++;
cp = cp2;
} else {
array[i + 1] = (char *) 0;
array[i + 1] = NULL;
break;
}
}

4
libmisc/log.c
View File

@ -67,7 +67,7 @@ void dolastlog (
* the way we read the old one in.
*/
if (read (fd, (void *) &newlog, sizeof newlog) != (ssize_t) sizeof newlog) {
if (read (fd, &newlog, sizeof newlog) != (ssize_t) sizeof newlog) {
memzero (&newlog, sizeof newlog);
}
if (NULL != ll) {
@ -82,7 +82,7 @@ void dolastlog (
strncpy (newlog.ll_host, host, sizeof (newlog.ll_host) - 1);
#endif
if ( (lseek (fd, offset, SEEK_SET) != offset)
|| (write (fd, (const void *) &newlog, sizeof newlog) != (ssize_t) sizeof newlog)
|| (write (fd, &newlog, sizeof newlog) != (ssize_t) sizeof newlog)
|| (close (fd) != 0)) {
SYSLOG ((LOG_WARN,
"Can't write lastlog entry for UID %lu in %s.",

82
libmisc/loginprompt.c
View File

@ -14,14 +14,15 @@
#include <assert.h>
#include <stdio.h>
#include <signal.h>
#include <ctype.h>
#include "alloc.h"
#include "prototypes.h"
#include "defines.h"
#include "getdef.h"
static void login_exit (unused int sig)
{
exit (EXIT_FAILURE);
_exit (EXIT_FAILURE);
}
/*
@ -31,7 +32,7 @@ static void login_exit (unused int sig)
* is set in login.defs, this file is displayed before the prompt.
*/
void login_prompt (const char *prompt, char *name, int namesize)
void login_prompt (char *name, int namesize)
{
char buf[1024];
@ -40,45 +41,38 @@ void login_prompt (const char *prompt, char *name, int namesize)
char *cp;
int i;
FILE *fp;
const char *fname = getdef_str ("ISSUE_FILE");
sighandler_t sigquit;
#ifdef SIGTSTP
sighandler_t sigtstp;
#endif
/*
* There is a small chance that a QUIT character will be part of
* some random noise during a prompt. Deal with this by exiting
* instead of core dumping. If SIGTSTP is defined, do the same
* thing for that signal.
* instead of core dumping. Do the same thing for SIGTSTP.
*/
sigquit = signal (SIGQUIT, login_exit);
#ifdef SIGTSTP
sigtstp = signal (SIGTSTP, login_exit);
#endif
/*
* See if the user has configured the issue file to
* be displayed and display it before the prompt.
*/
if (NULL != prompt) {
const char *fname = getdef_str ("ISSUE_FILE");
if (NULL != fname) {
fp = fopen (fname, "r");
if (NULL != fp) {
while ((i = getc (fp)) != EOF) {
(void) putc (i, stdout);
}
(void) fclose (fp);
if (NULL != fname) {
fp = fopen (fname, "r");
if (NULL != fp) {
while ((i = getc (fp)) != EOF) {
(void) putc (i, stdout);
}
(void) fclose (fp);
}
(void) gethostname (buf, sizeof buf);
printf (prompt, buf);
(void) fflush (stdout);
}
(void) gethostname (buf, sizeof buf);
printf (_("\n%s login: "), buf);
(void) fflush (stdout);
/*
* Read the user's response. The trailing newline will be
@ -86,7 +80,7 @@ void login_prompt (const char *prompt, char *name, int namesize)
*/
memzero (buf, sizeof buf);
if (fgets (buf, (int) sizeof buf, stdin) != buf) {
if (fgets (buf, sizeof buf, stdin) != buf) {
exit (EXIT_FAILURE);
}
@ -98,58 +92,20 @@ void login_prompt (const char *prompt, char *name, int namesize)
/*
* Skip leading whitespace. This makes " username" work right.
* Then copy the rest (up to the end or the first "non-graphic"
* character into the username.
* Then copy the rest (up to the end) into the username.
*/
for (cp = buf; *cp == ' ' || *cp == '\t'; cp++);
for (i = 0; i < namesize - 1 && isgraph (*cp); name[i++] = *cp++);
while (isgraph (*cp)) {
cp++;
}
if ('\0' != *cp) {
cp++;
}
for (i = 0; i < namesize - 1 && *cp != '\0'; name[i++] = *cp++);
name[i] = '\0';
/*
* This is a disaster, at best. The user may have entered extra
* environmental variables at the prompt. There are several ways
* to do this, and I just take the easy way out.
*/
if ('\0' != *cp) { /* process new variables */
char *nvar;
int count = 1;
int envc;
for (envc = 0; envc < MAX_ENV; envc++) {
nvar = strtok ((0 != envc) ? (char *) 0 : cp, " \t,");
if (NULL == nvar) {
break;
}
if (strchr (nvar, '=') != NULL) {
envp[envc] = nvar;
} else {
size_t len = strlen (nvar) + 32;
envp[envc] = xmalloc (len);
(void) snprintf (envp[envc], len,
"L%d=%s", count++, nvar);
}
}
set_env (envc, envp);
}
/*
* Set the SIGQUIT handler back to its original value
*/
(void) signal (SIGQUIT, sigquit);
#ifdef SIGTSTP
(void) signal (SIGTSTP, sigtstp);
#endif
}

Some files were not shown because too many files have changed in this diff Show More