shadow/lib
Serge Hallyn 8492dee663 subids: support nsswitch
Closes #154

When starting any operation to do with subuid delegation, check
nsswitch for a module to use.  If none is specified, then use
the traditional /etc/subuid and /etc/subgid files.

Currently only one module is supported, and there is no fallback
to the files on errors.  Several possibilities could be considered:

1. in case of connection error, fall back to files
2. in case of unknown user, also fall back to files

etc...

When non-files nss module is used, functions to edit the range
are not supported.  It may make sense to support it, but it also
may make sense to require another tool to be used.

libsubordinateio also uses the nss_ helpers.  This is how for instance
lxc could easily be converted to supporting nsswitch.

Add a set of test cases, including a dummy libsubid_zzz module.  This
hardcodes values such that:

'ubuntu' gets 200000 - 300000
'user1' gets 100000 - 165536
'error' emulates an nss module error
'unknown' emulates a user unknown to the nss module
'conn' emulates a connection error ot the nss module

Changes to libsubid:

Change the list_owner_ranges api: return a count instead of making the array
null terminated.

This is a breaking change, so bump the libsubid abi major number.

Rename free_subuid_range and free_subgid_range to ungrant_subuid_range,
because otherwise it's confusing with free_subid_ranges which frees
    memory.

Run libsubid tests in jenkins

Switch argument order in find_subid_owners

Move the db locking into subordinateio.c

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:02:37 -05:00
..
.indent.pro [svn-upgrade] Integrating new upstream version, shadow (4.0.8) 2007-10-07 11:46:07 +00:00
commonio.c commonio: force lock file sync 2020-11-05 17:15:56 +01:00
commonio.h Use the lckpwdf() again if prefix is not set 2019-05-02 14:33:06 +02:00
defines.h gettime: Use secure_getenv over getenv. 2019-03-31 16:00:01 +01:00
encrypt.c Add yescrypt support 2021-02-01 22:11:10 +01:00
exitcodes.h * lib/exitcodes.h: Define E_SUCCESS as EXIT_SUCCESS. Added FIXMEs. 2009-04-30 21:08:49 +00:00
faillog.h Make sure every source files are distributed with a copyright and license. 2008-04-27 00:40:09 +00:00
fields.c * lib/fields.c: Fixed typo from 2010-02-15. field insteadof cp 2011-07-08 19:56:18 +00:00
fputsx.c * lib/fputsx.c: Compare the result of fgets() with the provided 2009-06-12 20:20:45 +00:00
get_gid.c * libmisc/getgr_nam_gid.c, lib/get_gid.c, lib/get_pid.c, 2009-04-30 21:12:33 +00:00
get_pid.c * libmisc/getgr_nam_gid.c, lib/get_gid.c, lib/get_pid.c, 2009-04-30 21:12:33 +00:00
get_uid.c * libmisc/getgr_nam_gid.c, lib/get_gid.c, lib/get_pid.c, 2009-04-30 21:12:33 +00:00
getdef.c login & su: Treat an empty passwd field as invalid (#315) 2021-03-28 22:16:03 -05:00
getdef.h add --prefix option 2017-03-01 22:51:09 +01:00
getlong.c * lib/getlong.c: Do not check for NULL string but empty string. 2009-04-24 23:27:12 +00:00
getulong.c Simplify getulong 2016-08-03 11:51:07 -05:00
groupio.c Use the lckpwdf() again if prefix is not set 2019-05-02 14:33:06 +02:00
groupio.h * lib/commonio.c, lib/commonio.h, lib/groupio.c, lib/groupio.h, 2009-04-23 21:19:02 +00:00
groupmem.c add -U option to groupadd and groupmod 2020-08-09 22:11:33 -05:00
gshadow_.h * lib/gshadow_.h: Fix typo in comment. 2011-08-14 13:16:54 +00:00
gshadow.c 2010-02-14 Michael Bunk <mb@computer-leipzig.com> 2010-03-10 22:30:03 +00:00
lockpw.c Make sure every source files are distributed with a copyright and license. 2008-04-27 00:40:09 +00:00
Makefile.am subids: support nsswitch 2021-04-16 21:02:37 -05:00
nscd.c 2012-02-13 Mike Frysinger <vapier@gentoo.org> 2012-02-13 20:09:59 +00:00
nscd.h * configure.in, lib/nscd.h, lib/nscd.c: Added --with-nscd flag to 2008-08-30 18:30:36 +00:00
nss.c subids: support nsswitch 2021-04-16 21:02:37 -05:00
pam_defs.h * README, NEWS, configure.in, lib/pam_defs.h, src/login.c: Add 2008-07-21 21:14:06 +00:00
port.c * libmisc/console.c, libmisc/hushed.c, libmisc/yesno.c, 2008-06-13 18:11:09 +00:00
port.h Make sure every source files are distributed with a copyright and license. 2008-04-27 00:40:09 +00:00
prototypes.h subids: support nsswitch 2021-04-16 21:02:37 -05:00
pwauth.c Review 52a38d5509 2013-08-04 00:27:53 +02:00
pwauth.h * libmisc/find_new_gid.c, libmisc/find_new_uid.c, 2009-04-23 17:43:27 +00:00
pwio.c Use the lckpwdf() again if prefix is not set 2019-05-02 14:33:06 +02:00
pwio.h * lib/commonio.c, lib/commonio.h, lib/groupio.c, lib/groupio.h, 2009-04-23 21:19:02 +00:00
pwmem.c Clear passwords on __gr_dup/__pw_dup errors. 2015-07-11 13:00:13 +02:00
run_part.c Adding run-parts style for pre and post useradd/del 2020-06-10 00:26:55 -05:00
run_part.h Adding run-parts style for pre and post useradd/del 2020-06-10 00:26:55 -05:00
selinux.c Fix potential resource leak in set_selinux_file_context function 2020-08-04 10:24:46 +03:00
semanage.c * lib/selinux.c, lib/semanage.c: prototypes.h was not included. 2012-01-08 16:06:57 +00:00
sgetgrent.c lib/sgetgrent.c: change to warn when data remains 2019-10-04 18:30:41 -05:00
sgetpwent.c sgetpwent.c/sgetgrent.c: check for additional data at end of line 2019-10-04 18:30:38 -05:00
sgetspent.c Remove unused variable 'cpp' 2020-04-25 12:10:39 +02:00
sgroupio.c Use the lckpwdf() again if prefix is not set 2019-05-02 14:33:06 +02:00
sgroupio.h * lib/sgroupio.h: Harmonize splint annotations of sgr_locate() 2009-09-07 18:59:03 +00:00
shadow.c Remove unused 'buf' in shadow.c 2020-04-25 12:23:10 +02:00
shadowio.c Use the lckpwdf() again if prefix is not set 2019-05-02 14:33:06 +02:00
shadowio.h Update _COMMONIO_H and _SHADOWIO_H to drop leading underscore 2016-12-21 12:45:50 -06:00
shadowmem.c Add splint annotations. 2013-08-13 19:13:45 +02:00
spawn.c lib/spawn.c run_command: don't loop forever if waitpid() is returning ECHILD 2019-05-06 14:26:14 -04:00
sssd.c lib/sssd: redirect warning message to file 2020-10-02 16:09:42 +02:00
sssd.h Flush sssd caches in addition to nscd caches 2018-09-13 14:20:02 +02:00
subordinateio.c subids: support nsswitch 2021-04-16 21:02:37 -05:00
subordinateio.h subids: support nsswitch 2021-04-16 21:02:37 -05:00
tcbfuncs.c Reverse comparison for consistency. 2010-03-18 18:58:52 +00:00
tcbfuncs.h * lib/tcbfuncs.h: Re-indent. 2010-03-18 19:23:00 +00:00
utent.c * lib/utent.c (getutline): Remove getutline(). This function is 2010-03-23 08:56:52 +00:00