2004-03-30  Ulrich Drepper  <drepper@redhat.com>

	* nis/nss_nis/nis-initgroups.c: Implement getting the information
	from the netid.byname map if the system administrator allows this.

	* grp/initgroups.c (initgroups): Limit the initial allocation to 64
	entries to not allocate too much on systems with really high limits.
This commit is contained in:
Ulrich Drepper 2004-03-30 18:23:15 +00:00
parent 3b0b6c369f
commit ff0913d3a3
3 changed files with 217 additions and 13 deletions

View File

@ -1,3 +1,11 @@
2004-03-30 Ulrich Drepper <drepper@redhat.com>
* nis/nss_nis/nis-initgroups.c: Implement getting the information
from the netid.byname map if the system administrator allows this.
* grp/initgroups.c (initgroups): Limit the initial allocation to 64
entries to not allocate too much on systems with really high limits.
2004-03-30 Jakub Jelinek <jakub@redhat.com>
* nis/nss_nis/nis-service.c (struct search_t): New type.

View File

@ -1,4 +1,4 @@
/* Copyright (C) 1989,91,93,1996-2002, 2003 Free Software Foundation, Inc.
/* Copyright (C) 1989,91,93,1996-2003, 2004 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
@ -249,12 +249,11 @@ initgroups (const char *user, gid_t group)
long int limit = __sysconf (_SC_NGROUPS_MAX);
if (limit > 0)
size = limit;
/* We limit the size of the intially allocated array. */
size = MIN (limit, 64);
else
{
/* No fixed limit on groups. Pick a starting buffer size. */
size = 16;
}
/* No fixed limit on groups. Pick a starting buffer size. */
size = 16;
groups = (gid_t *) malloc (size * sizeof (gid_t));
if (__builtin_expect (groups == NULL, 0))

View File

@ -22,6 +22,9 @@
#include <errno.h>
#include <grp.h>
#include <nss.h>
#include <pwd.h>
#include <stdio.h>
#include <stdio_ext.h>
#include <string.h>
#include <unistd.h>
#include <rpcsvc/yp.h>
@ -79,15 +82,11 @@ saveit (int instatus, char *inkey, int inkeylen, char *inval,
}
static enum nss_status
internal_setgrent (intern_t *intern)
internal_setgrent (char *domainname, intern_t *intern)
{
char *domainname;
struct ypall_callback ypcb;
enum nss_status status;
if (yp_get_default_domain (&domainname))
return NSS_STATUS_UNAVAIL;
intern->start = NULL;
ypcb.foreach = saveit;
@ -107,7 +106,7 @@ internal_getgrent_r (struct group *grp, char *buffer, size_t buflen,
char *p;
if (intern->start == NULL)
internal_setgrent (intern);
return NSS_STATUS_NOTFOUND;
/* Get the next entry until we found a correct one. */
do
@ -129,11 +128,209 @@ internal_getgrent_r (struct group *grp, char *buffer, size_t buflen,
return NSS_STATUS_SUCCESS;
}
static int init;
static int use_netid;
static const char default_nss[] = "/etc/default/nss";
static void
check_default_nss (void)
{
FILE *fp = fopen (default_nss, "rc");
if (fp != NULL)
{
char *line = NULL;
size_t linelen = 0;
__fsetlocking (fp, FSETLOCKING_BYCALLER);
while (!feof_unlocked (fp))
{
ssize_t n = getline (&line, &linelen, fp);
if (n <= 0)
break;
/* There currently is only one variable we expect, so
simplify the parsing. Recognize only
NETID_AUTHORITATIVE = TRUE
with arbitrary white spaces. */
char *cp = line;
while (isspace (*cp))
++cp;
static const char netid_authoritative[] = "NETID_AUTHORITATIVE";
if (strncmp (cp, netid_authoritative,
sizeof (netid_authoritative) - 1) != 0)
continue;
cp += sizeof (netid_authoritative) - 1;
while (isspace (*cp))
++cp;
if (*cp++ != '=')
continue;
while (isspace (*cp))
++cp;
if (strncmp (cp, "TRUE", 4) != 0)
continue;
cp +=4;
while (isspace (*cp))
++cp;
if (*cp == '\0')
use_netid = 1;
/* For now, just drop out of the loop. */
break;
}
free (line);
fclose (fp);
}
init = 1;
}
static int
get_uid (const char *user, uid_t *uidp)
{
size_t buflen = sysconf (_SC_GETPW_R_SIZE_MAX);
char *buf = (char *) alloca (buflen);
while (1)
{
struct passwd result;
struct passwd *resp;
int r = getpwnam_r (user, &result, buf, buflen, &resp);
if (r == 0 && resp != NULL)
{
*uidp = resp->pw_uid;
return 0;
}
if (r != ERANGE)
break;
extend_alloca (buf, buflen, 2 * buflen);
}
return 1;
}
static enum nss_status
initgroups_netid (uid_t uid, gid_t group, long int *start, long int *size,
gid_t **groupsp, long int limit, int *errnop,
const char *domainname)
{
/* Prepare the key. The form is "unix.UID@DOMAIN" with the UID and
DOMAIN field filled in appropriately. */
char key[sizeof ("unix.@") + sizeof (uid_t) * 3 + strlen (domainname)];
ssize_t keylen = snprintf (key, sizeof (key), "unix.%lu@%s",
(unsigned long int) uid, domainname);
enum nss_status retval;
char *result;
int reslen;
retval = yperr2nss (yp_match (domainname, "netid.byname", key, keylen,
&result, &reslen));
if (retval != NSS_STATUS_SUCCESS)
return retval;
/* Parse the result: following the colon is a comma separated list of
group IDs. */
char *cp = strchr (result, ':');
if (cp == NULL)
{
errout:
free (result);
return NSS_STATUS_NOTFOUND;
}
/* Skip the colon. */
++cp;
gid_t *groups = *groupsp;
while (*cp != '\0')
{
char *endp;
unsigned long int gid = strtoul (cp, &endp, 0);
if (cp == endp)
goto errout;
if (*endp == ',')
++endp;
else if (*endp != '\0')
goto errout;
cp = endp;
if (gid == group)
/* We do not need this group again. */
continue;
/* Insert this group. */
if (*start == *size)
{
/* Need a bigger buffer. */
gid_t *newgroups;
long int newsize;
if (limit > 0 && *size == limit)
/* We reached the maximum. */
break;
if (limit <= 0)
newsize = 2 * *size;
else
newsize = MIN (limit, 2 * *size);
newgroups = realloc (groups, newsize * sizeof (*groups));
if (newgroups == NULL)
goto errout;
*groupsp = groups = newgroups;
*size = newsize;
}
groups[*start] = gid;
*start += 1;
}
free (result);
return NSS_STATUS_SUCCESS;
}
enum nss_status
_nss_nis_initgroups_dyn (const char *user, gid_t group, long int *start,
long int *size, gid_t **groupsp, long int limit,
int *errnop)
{
/* We always need the domain name. */
char *domainname;
if (yp_get_default_domain (&domainname))
return NSS_STATUS_UNAVAIL;
/* Check whether we are supposed to use the netid.byname map. */
if (!init)
check_default_nss ();
if (use_netid)
{
/* We need the user ID. */
uid_t uid;
if (get_uid (user, &uid) == 0
&& initgroups_netid (uid, group, start, size, groupsp, limit,
errnop, domainname) == NSS_STATUS_SUCCESS)
return NSS_STATUS_SUCCESS;
}
struct group grpbuf, *g;
size_t buflen = sysconf (_SC_GETPW_R_SIZE_MAX);
char *tmpbuf;
@ -141,7 +338,7 @@ _nss_nis_initgroups_dyn (const char *user, gid_t group, long int *start,
intern_t intern = { NULL, NULL };
gid_t *groups = *groupsp;
status = internal_setgrent (&intern);
status = internal_setgrent (domainname, &intern);
if (status != NSS_STATUS_SUCCESS)
return status;