1523 lines
42 KiB
Diff
1523 lines
42 KiB
Diff
From 0a7888b1fad613a052b988b01a71933b67296e68 Mon Sep 17 00:00:00 2001
|
|
From: Serge Hallyn <serge@hallyn.com>
|
|
Date: Sat, 18 Apr 2020 18:03:54 -0500
|
|
Subject: [PATCH] Create a new libsubid
|
|
|
|
Closes #154
|
|
|
|
Currently this has three functions: one which returns the
|
|
list of subuid ranges for a user, one returning the subgids,
|
|
and one which frees the ranges lists.
|
|
|
|
I might be mistaken about what -disable-man means; some of
|
|
the code suggests it means just don't re-generate them, but
|
|
not totally ignore them. But that doesn't seem to really work,
|
|
so let's just ignore man/ when -disable-man.
|
|
|
|
Remove --disable-shared. I'm not sure why it was there, but it stems
|
|
from long, long ago, and I suspect it comes from some ancient
|
|
toolchain bug.
|
|
|
|
Create a tests/run_some, a shorter version of run_all. I'll
|
|
slowly add tests to this as I verify they work, then I can
|
|
work on fixing the once which don't.
|
|
|
|
Also, don't touch man/ if not -enable-man.
|
|
|
|
Changelog:
|
|
Apr 22: change the subid list api as recomended by Dan Walsh.
|
|
Apr 23: implement get_subid_owner
|
|
Apr 24: implement range add/release
|
|
Apr 25: finish tests and rebase
|
|
May 10: make @owner const
|
|
|
|
Signed-off-by: Serge Hallyn <serge@hallyn.com>
|
|
---
|
|
Makefile.am | 13 +-
|
|
configure.ac | 3 +-
|
|
lib/subordinateio.c | 204 +++++++++++++++-
|
|
lib/subordinateio.h | 7 +
|
|
libsubid/Makefile.am | 25 ++
|
|
libsubid/api.c | 231 ++++++++++++++++++
|
|
libsubid/api.h | 17 ++
|
|
libsubid/subid.h | 17 ++
|
|
src/Makefile.am | 60 +++++
|
|
src/free_subid_range.c | 50 ++++
|
|
src/get_subid_owners.c | 40 +++
|
|
src/list_subid_ranges.c | 41 ++++
|
|
src/new_subid_range.c | 57 +++++
|
|
tests/libsubid/01_list_ranges/config.txt | 0
|
|
.../libsubid/01_list_ranges/config/etc/subgid | 2 +
|
|
.../libsubid/01_list_ranges/config/etc/subuid | 3 +
|
|
.../libsubid/01_list_ranges/list_ranges.test | 38 +++
|
|
tests/libsubid/02_get_subid_owners/config.txt | 0
|
|
.../02_get_subid_owners/config/etc/passwd | 20 ++
|
|
.../02_get_subid_owners/config/etc/subgid | 2 +
|
|
.../02_get_subid_owners/config/etc/subuid | 4 +
|
|
.../02_get_subid_owners/get_subid_owners.test | 52 ++++
|
|
.../03_add_remove/add_remove_subids.test | 59 +++++
|
|
tests/libsubid/03_add_remove/config.txt | 0
|
|
.../libsubid/03_add_remove/config/etc/passwd | 20 ++
|
|
.../libsubid/03_add_remove/config/etc/subgid | 2 +
|
|
.../libsubid/03_add_remove/config/etc/subuid | 1 +
|
|
tests/run_some | 136 +++++++++++
|
|
31 files changed, 1105 insertions(+), 17 deletions(-)
|
|
create mode 100644 libsubid/Makefile.am
|
|
create mode 100644 libsubid/api.c
|
|
create mode 100644 libsubid/api.h
|
|
create mode 100644 libsubid/subid.h
|
|
create mode 100644 src/free_subid_range.c
|
|
create mode 100644 src/get_subid_owners.c
|
|
create mode 100644 src/list_subid_ranges.c
|
|
create mode 100644 src/new_subid_range.c
|
|
create mode 100644 tests/libsubid/01_list_ranges/config.txt
|
|
create mode 100644 tests/libsubid/01_list_ranges/config/etc/subgid
|
|
create mode 100644 tests/libsubid/01_list_ranges/config/etc/subuid
|
|
create mode 100755 tests/libsubid/01_list_ranges/list_ranges.test
|
|
create mode 100644 tests/libsubid/02_get_subid_owners/config.txt
|
|
create mode 100644 tests/libsubid/02_get_subid_owners/config/etc/passwd
|
|
create mode 100644 tests/libsubid/02_get_subid_owners/config/etc/subgid
|
|
create mode 100644 tests/libsubid/02_get_subid_owners/config/etc/subuid
|
|
create mode 100755 tests/libsubid/02_get_subid_owners/get_subid_owners.test
|
|
create mode 100755 tests/libsubid/03_add_remove/add_remove_subids.test
|
|
create mode 100644 tests/libsubid/03_add_remove/config.txt
|
|
create mode 100644 tests/libsubid/03_add_remove/config/etc/passwd
|
|
create mode 100644 tests/libsubid/03_add_remove/config/etc/subgid
|
|
create mode 100644 tests/libsubid/03_add_remove/config/etc/subuid
|
|
create mode 100755 tests/run_some
|
|
|
|
diff --git a/Makefile.am b/Makefile.am
|
|
index 8851f5d6..b6456cf9 100644
|
|
--- a/Makefile.am
|
|
+++ b/Makefile.am
|
|
@@ -2,5 +2,14 @@
|
|
|
|
EXTRA_DIST = NEWS README TODO shadow.spec.in
|
|
|
|
-SUBDIRS = po man libmisc lib src \
|
|
- contrib doc etc
|
|
+SUBDIRS = libmisc lib
|
|
+
|
|
+if ENABLE_SUBIDS
|
|
+SUBDIRS += libsubid
|
|
+endif
|
|
+
|
|
+SUBDIRS += src po contrib doc etc
|
|
+
|
|
+if ENABLE_REGENERATE_MAN
|
|
+SUBDIRS += man
|
|
+endif
|
|
diff --git a/configure.ac b/configure.ac
|
|
index b8bc2b7a..b766eff0 100644
|
|
--- a/configure.ac
|
|
+++ b/configure.ac
|
|
@@ -22,8 +22,8 @@ test "$prefix" = "/usr" && exec_prefix=""
|
|
|
|
AC_GNU_SOURCE
|
|
|
|
-AM_DISABLE_SHARED
|
|
AM_ENABLE_STATIC
|
|
+AM_ENABLE_SHARED
|
|
|
|
AM_MAINTAINER_MODE
|
|
|
|
@@ -725,6 +725,7 @@ AC_CONFIG_FILES([
|
|
man/zh_TW/Makefile
|
|
libmisc/Makefile
|
|
lib/Makefile
|
|
+ libsubid/Makefile
|
|
src/Makefile
|
|
contrib/Makefile
|
|
etc/Makefile
|
|
diff --git a/lib/subordinateio.c b/lib/subordinateio.c
|
|
index 0d89a64e..67202c98 100644
|
|
--- a/lib/subordinateio.c
|
|
+++ b/lib/subordinateio.c
|
|
@@ -13,14 +13,7 @@
|
|
#include "subordinateio.h"
|
|
#include <sys/types.h>
|
|
#include <pwd.h>
|
|
-
|
|
-struct subordinate_range {
|
|
- const char *owner;
|
|
- unsigned long start;
|
|
- unsigned long count;
|
|
-};
|
|
-
|
|
-#define NFIELDS 3
|
|
+#include <ctype.h>
|
|
|
|
/*
|
|
* subordinate_dup: create a duplicate range
|
|
@@ -78,7 +71,7 @@ static void *subordinate_parse (const char *line)
|
|
static char rangebuf[1024];
|
|
int i;
|
|
char *cp;
|
|
- char *fields[NFIELDS];
|
|
+ char *fields[SUBID_NFIELDS];
|
|
|
|
/*
|
|
* Copy the string to a temporary buffer so the substrings can
|
|
@@ -93,7 +86,7 @@ static void *subordinate_parse (const char *line)
|
|
* field. The fields are converted into NUL terminated strings.
|
|
*/
|
|
|
|
- for (cp = rangebuf, i = 0; (i < NFIELDS) && (NULL != cp); i++) {
|
|
+ for (cp = rangebuf, i = 0; (i < SUBID_NFIELDS) && (NULL != cp); i++) {
|
|
fields[i] = cp;
|
|
while (('\0' != *cp) && (':' != *cp)) {
|
|
cp++;
|
|
@@ -108,10 +101,10 @@ static void *subordinate_parse (const char *line)
|
|
}
|
|
|
|
/*
|
|
- * There must be exactly NFIELDS colon separated fields or
|
|
+ * There must be exactly SUBID_NFIELDS colon separated fields or
|
|
* the entry is invalid. Also, fields must be non-blank.
|
|
*/
|
|
- if (i != NFIELDS || *fields[0] == '\0' || *fields[1] == '\0' || *fields[2] == '\0')
|
|
+ if (i != SUBID_NFIELDS || *fields[0] == '\0' || *fields[1] == '\0' || *fields[2] == '\0')
|
|
return NULL;
|
|
range.owner = fields[0];
|
|
if (getulong (fields[1], &range.start) == 0)
|
|
@@ -314,6 +307,39 @@ static bool have_range(struct commonio_db *db,
|
|
return false;
|
|
}
|
|
|
|
+static bool append_range(struct subordinate_range ***ranges, const struct subordinate_range *new, int n)
|
|
+{
|
|
+ struct subordinate_range *tmp;
|
|
+ if (!*ranges) {
|
|
+ *ranges = malloc(2 * sizeof(struct subordinate_range **));
|
|
+ if (!*ranges)
|
|
+ return false;
|
|
+ } else {
|
|
+ struct subordinate_range **new;
|
|
+ new = realloc(*ranges, (n + 2) * (sizeof(struct subordinate_range **)));
|
|
+ if (!new)
|
|
+ return false;
|
|
+ *ranges = new;
|
|
+ }
|
|
+ (*ranges)[n] = (*ranges)[n+1] = NULL;
|
|
+ tmp = subordinate_dup(new);
|
|
+ if (!tmp)
|
|
+ return false;
|
|
+ (*ranges)[n] = tmp;
|
|
+ return true;
|
|
+}
|
|
+
|
|
+void free_subordinate_ranges(struct subordinate_range **ranges)
|
|
+{
|
|
+ int i;
|
|
+
|
|
+ if (!ranges)
|
|
+ return;
|
|
+ for (i = 0; ranges[i]; i++)
|
|
+ subordinate_free(ranges[i]);
|
|
+ free(ranges);
|
|
+}
|
|
+
|
|
/*
|
|
* subordinate_range_cmp: compare uid ranges
|
|
*
|
|
@@ -692,6 +718,160 @@ gid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count)
|
|
start = find_free_range (&subordinate_gid_db, min, max, count);
|
|
return start == ULONG_MAX ? (gid_t) -1 : start;
|
|
}
|
|
+
|
|
+/*
|
|
+ struct subordinate_range **list_owner_ranges(const char *owner, enum subid_type id_type)
|
|
+ *
|
|
+ * @owner: username
|
|
+ * @id_type: UID or GUID
|
|
+ *
|
|
+ * Returns the subuid or subgid ranges which are owned by the specified
|
|
+ * user. Username may be a username or a string representation of a
|
|
+ * UID number. If id_type is UID, then subuids are returned, else
|
|
+ * subgids are returned. If there is an error, < 0 is returned.
|
|
+ *
|
|
+ * The caller must free the subordinate range list.
|
|
+ */
|
|
+struct subordinate_range **list_owner_ranges(const char *owner, enum subid_type id_type)
|
|
+{
|
|
+ // TODO - need to handle owner being either uid or username
|
|
+ const struct subordinate_range *range;
|
|
+ struct subordinate_range **ranges = NULL;
|
|
+ struct commonio_db *db;
|
|
+ int size = 0;
|
|
+
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ db = &subordinate_uid_db;
|
|
+ else
|
|
+ db = &subordinate_gid_db;
|
|
+
|
|
+ commonio_rewind(db);
|
|
+ while ((range = commonio_next(db)) != NULL) {
|
|
+ if (0 == strcmp(range->owner, owner)) {
|
|
+ if (!append_range(&ranges, range, size++)) {
|
|
+ free_subordinate_ranges(ranges);
|
|
+ return NULL;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return ranges;
|
|
+}
|
|
+
|
|
+static bool all_digits(const char *str)
|
|
+{
|
|
+ int i;
|
|
+
|
|
+ for (i = 0; str[i] != '\0'; i++)
|
|
+ if (!isdigit(str[i]))
|
|
+ return false;
|
|
+ return true;
|
|
+}
|
|
+
|
|
+static int append_uids(uid_t **uids, const char *owner, int n)
|
|
+{
|
|
+ uid_t owner_uid;
|
|
+ uid_t *ret;
|
|
+ int i;
|
|
+
|
|
+ if (all_digits(owner)) {
|
|
+ i = sscanf(owner, "%d", &owner_uid);
|
|
+ if (i != 1) {
|
|
+ // should not happen
|
|
+ free(*uids);
|
|
+ *uids = NULL;
|
|
+ return -1;
|
|
+ }
|
|
+ } else {
|
|
+ struct passwd *pwd = getpwnam(owner);
|
|
+ if (NULL == pwd) {
|
|
+ /* Username not defined in /etc/passwd, or error occured during lookup */
|
|
+ free(*uids);
|
|
+ *uids = NULL;
|
|
+ return -1;
|
|
+ }
|
|
+ owner_uid = pwd->pw_uid;
|
|
+ }
|
|
+
|
|
+ for (i = 0; i < n; i++) {
|
|
+ if (owner_uid == (*uids)[i])
|
|
+ return n;
|
|
+ }
|
|
+
|
|
+ ret = realloc(*uids, (n + 1) * sizeof(uid_t));
|
|
+ if (!ret) {
|
|
+ free(*uids);
|
|
+ return -1;
|
|
+ }
|
|
+ ret[n] = owner_uid;
|
|
+ *uids = ret;
|
|
+ return n+1;
|
|
+}
|
|
+
|
|
+int find_subid_owners(unsigned long id, uid_t **uids, enum subid_type id_type)
|
|
+{
|
|
+ const struct subordinate_range *range;
|
|
+ struct commonio_db *db;
|
|
+ int n = 0;
|
|
+
|
|
+ *uids = NULL;
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ db = &subordinate_uid_db;
|
|
+ else
|
|
+ db = &subordinate_gid_db;
|
|
+
|
|
+ commonio_rewind(db);
|
|
+ while ((range = commonio_next(db)) != NULL) {
|
|
+ if (id >= range->start && id < range->start + range-> count) {
|
|
+ n = append_uids(uids, range->owner, n);
|
|
+ if (n < 0)
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return n;
|
|
+}
|
|
+
|
|
+bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, bool reuse)
|
|
+{
|
|
+ struct commonio_db *db;
|
|
+ const struct subordinate_range *r;
|
|
+
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ db = &subordinate_uid_db;
|
|
+ else
|
|
+ db = &subordinate_gid_db;
|
|
+ commonio_rewind(db);
|
|
+ if (reuse) {
|
|
+ while ((r = commonio_next(db)) != NULL) {
|
|
+ // TODO account for username vs uid_t
|
|
+ if (0 != strcmp(r->owner, range->owner))
|
|
+ continue;
|
|
+ if (r->count >= range->count) {
|
|
+ range->count = r->count;
|
|
+ range->start = r->start;
|
|
+ return true;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ range->start = find_free_range(db, range->start, ULONG_MAX, range->count);
|
|
+ if (range->start == ULONG_MAX)
|
|
+ return false;
|
|
+
|
|
+ return add_range(db, range->owner, range->start, range->count) == 1;
|
|
+}
|
|
+
|
|
+bool release_subid_range(struct subordinate_range *range, enum subid_type id_type)
|
|
+{
|
|
+ struct commonio_db *db;
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ db = &subordinate_uid_db;
|
|
+ else
|
|
+ db = &subordinate_gid_db;
|
|
+ return remove_range(db, range->owner, range->start, range->count) == 1;
|
|
+}
|
|
+
|
|
#else /* !ENABLE_SUBIDS */
|
|
extern int errno; /* warning: ANSI C forbids an empty source file */
|
|
#endif /* !ENABLE_SUBIDS */
|
|
diff --git a/lib/subordinateio.h b/lib/subordinateio.h
|
|
index a21d72b8..13a21341 100644
|
|
--- a/lib/subordinateio.h
|
|
+++ b/lib/subordinateio.h
|
|
@@ -11,6 +11,8 @@
|
|
|
|
#include <sys/types.h>
|
|
|
|
+#include "../libsubid/subid.h"
|
|
+
|
|
extern int sub_uid_close(void);
|
|
extern bool have_sub_uids(const char *owner, uid_t start, unsigned long count);
|
|
extern bool sub_uid_file_present (void);
|
|
@@ -23,6 +25,11 @@ extern int sub_uid_unlock (void);
|
|
extern int sub_uid_add (const char *owner, uid_t start, unsigned long count);
|
|
extern int sub_uid_remove (const char *owner, uid_t start, unsigned long count);
|
|
extern uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count);
|
|
+extern struct subordinate_range **list_owner_ranges(const char *owner, enum subid_type id_type);
|
|
+extern bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, bool reuse);
|
|
+extern bool release_subid_range(struct subordinate_range *range, enum subid_type id_type);
|
|
+extern int find_subid_owners(unsigned long id, uid_t **uids, enum subid_type id_type);
|
|
+extern void free_subordinate_ranges(struct subordinate_range **ranges);
|
|
|
|
extern int sub_gid_close(void);
|
|
extern bool have_sub_gids(const char *owner, gid_t start, unsigned long count);
|
|
diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
|
|
new file mode 100644
|
|
index 00000000..bdbc52c3
|
|
--- /dev/null
|
|
+++ b/libsubid/Makefile.am
|
|
@@ -0,0 +1,25 @@
|
|
+lib_LTLIBRARIES = libsubid.la
|
|
+libsubid_la_LDFLAGS = -Wl,-soname,libsubid.so.@LIBSUBID_ABI@ \
|
|
+ -shared -version-info @LIBSUBID_ABI_MAJOR@
|
|
+libsubid_la_SOURCES = api.c
|
|
+
|
|
+MISCLIBS = \
|
|
+ $(LIBAUDIT) \
|
|
+ $(LIBSELINUX) \
|
|
+ $(LIBSEMANAGE) \
|
|
+ $(LIBCRYPT_NOPAM) \
|
|
+ $(LIBSKEY) \
|
|
+ $(LIBMD) \
|
|
+ $(LIBECONF) \
|
|
+ $(LIBCRYPT) \
|
|
+ $(LIBTCB)
|
|
+
|
|
+libsubid_la_LIBADD = \
|
|
+ $(top_srcdir)/lib/libshadow.la \
|
|
+ $(top_srcdir)/libmisc/libmisc.a \
|
|
+ $(MISCLIBS)
|
|
+
|
|
+AM_CPPFLAGS = \
|
|
+ -I${top_srcdir}/lib \
|
|
+ -I${top_srcdir}/libmisc \
|
|
+ -DLOCALEDIR=\"$(datadir)/locale\"
|
|
diff --git a/libsubid/api.c b/libsubid/api.c
|
|
new file mode 100644
|
|
index 00000000..91d73bed
|
|
--- /dev/null
|
|
+++ b/libsubid/api.c
|
|
@@ -0,0 +1,231 @@
|
|
+/*
|
|
+ * Copyright (c) 2020 Serge Hallyn
|
|
+ * All rights reserved.
|
|
+ *
|
|
+ * Redistribution and use in source and binary forms, with or without
|
|
+ * modification, are permitted provided that the following conditions
|
|
+ * are met:
|
|
+ * 1. Redistributions of source code must retain the above copyright
|
|
+ * notice, this list of conditions and the following disclaimer.
|
|
+ * 2. Redistributions in binary form must reproduce the above copyright
|
|
+ * notice, this list of conditions and the following disclaimer in the
|
|
+ * documentation and/or other materials provided with the distribution.
|
|
+ * 3. The name of the copyright holders or contributors may not be used to
|
|
+ * endorse or promote products derived from this software without
|
|
+ * specific prior written permission.
|
|
+ *
|
|
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
|
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
+ */
|
|
+
|
|
+#include <config.h>
|
|
+#include <fcntl.h>
|
|
+#include <stdio.h>
|
|
+#include <errno.h>
|
|
+#include <stdlib.h>
|
|
+#include <pwd.h>
|
|
+#include <stdbool.h>
|
|
+#include "subordinateio.h"
|
|
+#include "idmapping.h"
|
|
+#include "api.h"
|
|
+
|
|
+static struct subordinate_range **get_subid_ranges(const char *owner, enum subid_type id_type)
|
|
+{
|
|
+ struct subordinate_range **ranges = NULL;
|
|
+
|
|
+ switch (id_type) {
|
|
+ case ID_TYPE_UID:
|
|
+ if (!sub_uid_open(O_RDONLY)) {
|
|
+ return NULL;
|
|
+ }
|
|
+ break;
|
|
+ case ID_TYPE_GID:
|
|
+ if (!sub_gid_open(O_RDONLY)) {
|
|
+ return NULL;
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ ranges = list_owner_ranges(owner, id_type);
|
|
+
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ sub_uid_close();
|
|
+ else
|
|
+ sub_gid_close();
|
|
+
|
|
+ return ranges;
|
|
+}
|
|
+
|
|
+struct subordinate_range **get_subuid_ranges(const char *owner)
|
|
+{
|
|
+ return get_subid_ranges(owner, ID_TYPE_UID);
|
|
+}
|
|
+
|
|
+struct subordinate_range **get_subgid_ranges(const char *owner)
|
|
+{
|
|
+ return get_subid_ranges(owner, ID_TYPE_GID);
|
|
+}
|
|
+
|
|
+void subid_free_ranges(struct subordinate_range **ranges)
|
|
+{
|
|
+ return free_subordinate_ranges(ranges);
|
|
+}
|
|
+
|
|
+int get_subid_owner(unsigned long id, uid_t **owner, enum subid_type id_type)
|
|
+{
|
|
+ int ret = -1;
|
|
+
|
|
+ switch (id_type) {
|
|
+ case ID_TYPE_UID:
|
|
+ if (!sub_uid_open(O_RDONLY)) {
|
|
+ return -1;
|
|
+ }
|
|
+ break;
|
|
+ case ID_TYPE_GID:
|
|
+ if (!sub_gid_open(O_RDONLY)) {
|
|
+ return -1;
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ ret = find_subid_owners(id, owner, id_type);
|
|
+
|
|
+ if (id_type == ID_TYPE_UID)
|
|
+ sub_uid_close();
|
|
+ else
|
|
+ sub_gid_close();
|
|
+
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+int get_subuid_owners(uid_t uid, uid_t **owner)
|
|
+{
|
|
+ return get_subid_owner((unsigned long)uid, owner, ID_TYPE_UID);
|
|
+}
|
|
+
|
|
+int get_subgid_owners(gid_t gid, uid_t **owner)
|
|
+{
|
|
+ return get_subid_owner((unsigned long)gid, owner, ID_TYPE_GID);
|
|
+}
|
|
+
|
|
+bool grant_subid_range(struct subordinate_range *range, bool reuse,
|
|
+ enum subid_type id_type)
|
|
+{
|
|
+ bool ret;
|
|
+
|
|
+ switch (id_type) {
|
|
+ case ID_TYPE_UID:
|
|
+ if (!sub_uid_lock()) {
|
|
+ printf("Failed loging subuids (errno %d)\n", errno);
|
|
+ return false;
|
|
+ }
|
|
+ if (!sub_uid_open(O_CREAT | O_RDWR)) {
|
|
+ printf("Failed opening subuids (errno %d)\n", errno);
|
|
+ sub_uid_unlock();
|
|
+ return false;
|
|
+ }
|
|
+ break;
|
|
+ case ID_TYPE_GID:
|
|
+ if (!sub_gid_lock()) {
|
|
+ printf("Failed loging subgids (errno %d)\n", errno);
|
|
+ return false;
|
|
+ }
|
|
+ if (!sub_gid_open(O_CREAT | O_RDWR)) {
|
|
+ printf("Failed opening subgids (errno %d)\n", errno);
|
|
+ sub_gid_unlock();
|
|
+ return false;
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ ret = new_subid_range(range, id_type, reuse);
|
|
+
|
|
+ if (id_type == ID_TYPE_UID) {
|
|
+ sub_uid_close();
|
|
+ sub_uid_unlock();
|
|
+ } else {
|
|
+ sub_gid_close();
|
|
+ sub_gid_unlock();
|
|
+ }
|
|
+
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+bool grant_subuid_range(struct subordinate_range *range, bool reuse)
|
|
+{
|
|
+ return grant_subid_range(range, reuse, ID_TYPE_UID);
|
|
+}
|
|
+
|
|
+bool grant_subgid_range(struct subordinate_range *range, bool reuse)
|
|
+{
|
|
+ return grant_subid_range(range, reuse, ID_TYPE_GID);
|
|
+}
|
|
+
|
|
+bool free_subid_range(struct subordinate_range *range, enum subid_type id_type)
|
|
+{
|
|
+ bool ret;
|
|
+
|
|
+ switch (id_type) {
|
|
+ case ID_TYPE_UID:
|
|
+ if (!sub_uid_lock()) {
|
|
+ printf("Failed loging subuids (errno %d)\n", errno);
|
|
+ return false;
|
|
+ }
|
|
+ if (!sub_uid_open(O_CREAT | O_RDWR)) {
|
|
+ printf("Failed opening subuids (errno %d)\n", errno);
|
|
+ sub_uid_unlock();
|
|
+ return false;
|
|
+ }
|
|
+ break;
|
|
+ case ID_TYPE_GID:
|
|
+ if (!sub_gid_lock()) {
|
|
+ printf("Failed loging subgids (errno %d)\n", errno);
|
|
+ return false;
|
|
+ }
|
|
+ if (!sub_gid_open(O_CREAT | O_RDWR)) {
|
|
+ printf("Failed opening subgids (errno %d)\n", errno);
|
|
+ sub_gid_unlock();
|
|
+ return false;
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ ret = release_subid_range(range, id_type);
|
|
+
|
|
+ if (id_type == ID_TYPE_UID) {
|
|
+ sub_uid_close();
|
|
+ sub_uid_unlock();
|
|
+ } else {
|
|
+ sub_gid_close();
|
|
+ sub_gid_unlock();
|
|
+ }
|
|
+
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+bool free_subuid_range(struct subordinate_range *range)
|
|
+{
|
|
+ return free_subid_range(range, ID_TYPE_UID);
|
|
+}
|
|
+
|
|
+bool free_subgid_range(struct subordinate_range *range)
|
|
+{
|
|
+ return free_subid_range(range, ID_TYPE_GID);
|
|
+}
|
|
diff --git a/libsubid/api.h b/libsubid/api.h
|
|
new file mode 100644
|
|
index 00000000..f65e3ec9
|
|
--- /dev/null
|
|
+++ b/libsubid/api.h
|
|
@@ -0,0 +1,17 @@
|
|
+#include "subid.h"
|
|
+#include <stdbool.h>
|
|
+
|
|
+struct subordinate_range **get_subuid_ranges(const char *owner);
|
|
+struct subordinate_range **get_subgid_ranges(const char *owner);
|
|
+void subid_free_ranges(struct subordinate_range **ranges);
|
|
+
|
|
+int get_subuid_owners(uid_t uid, uid_t **owner);
|
|
+int get_subgid_owners(uid_t uid, uid_t **owner);
|
|
+
|
|
+/* range should be pre-allocated with owner and count filled in, start is
|
|
+ * ignored, can be 0 */
|
|
+bool grant_subuid_range(struct subordinate_range *range, bool reuse);
|
|
+bool grant_subgid_range(struct subordinate_range *range, bool reuse);
|
|
+
|
|
+bool free_subuid_range(struct subordinate_range *range);
|
|
+bool free_subgid_range(struct subordinate_range *range);
|
|
diff --git a/libsubid/subid.h b/libsubid/subid.h
|
|
new file mode 100644
|
|
index 00000000..ba9a2f6f
|
|
--- /dev/null
|
|
+++ b/libsubid/subid.h
|
|
@@ -0,0 +1,17 @@
|
|
+#include <sys/types.h>
|
|
+
|
|
+#ifndef SUBID_RANGE_DEFINED
|
|
+#define SUBID_RANGE_DEFINED 1
|
|
+struct subordinate_range {
|
|
+ const char *owner;
|
|
+ unsigned long start;
|
|
+ unsigned long count;
|
|
+};
|
|
+
|
|
+enum subid_type {
|
|
+ ID_TYPE_UID = 1,
|
|
+ ID_TYPE_GID = 2
|
|
+};
|
|
+
|
|
+#define SUBID_NFIELDS 3
|
|
+#endif
|
|
diff --git a/src/Makefile.am b/src/Makefile.am
|
|
index f175928a..8499ce08 100644
|
|
--- a/src/Makefile.am
|
|
+++ b/src/Makefile.am
|
|
@@ -156,4 +156,64 @@ if FCAPS
|
|
setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap
|
|
setcap cap_setgid+ep $(DESTDIR)$(ubindir)/newgidmap
|
|
endif
|
|
+
|
|
+noinst_PROGRAMS += list_subid_ranges \
|
|
+ get_subid_owners \
|
|
+ new_subid_range \
|
|
+ free_subid_range
|
|
+
|
|
+MISCLIBS = \
|
|
+ $(LIBAUDIT) \
|
|
+ $(LIBSELINUX) \
|
|
+ $(LIBSEMANAGE) \
|
|
+ $(LIBCRYPT_NOPAM) \
|
|
+ $(LIBSKEY) \
|
|
+ $(LIBMD) \
|
|
+ $(LIBECONF) \
|
|
+ $(LIBCRYPT) \
|
|
+ $(LIBTCB)
|
|
+
|
|
+list_subid_ranges_LDADD = \
|
|
+ $(top_builddir)/lib/libshadow.la \
|
|
+ $(top_builddir)/libmisc/libmisc.a \
|
|
+ $(top_builddir)/libsubid/libsubid.la \
|
|
+ $(MISCLIBS)
|
|
+
|
|
+list_subid_ranges_CPPFLAGS = \
|
|
+ -I$(top_srcdir)/lib \
|
|
+ -I$(top_srcdir)/libmisc \
|
|
+ -I$(top_srcdir)/libsubid
|
|
+
|
|
+get_subid_owners_LDADD = \
|
|
+ $(top_builddir)/lib/libshadow.la \
|
|
+ $(top_builddir)/libmisc/libmisc.a \
|
|
+ $(top_builddir)/libsubid/libsubid.la \
|
|
+ $(MISCLIBS)
|
|
+
|
|
+get_subid_owners_CPPFLAGS = \
|
|
+ -I$(top_srcdir)/lib \
|
|
+ -I$(top_srcdir)/libmisc \
|
|
+ -I$(top_srcdir)/libsubid
|
|
+
|
|
+new_subid_range_CPPFLAGS = \
|
|
+ -I$(top_srcdir)/lib \
|
|
+ -I$(top_srcdir)/libmisc \
|
|
+ -I$(top_srcdir)/libsubid
|
|
+
|
|
+new_subid_range_LDADD = \
|
|
+ $(top_builddir)/lib/libshadow.la \
|
|
+ $(top_builddir)/libmisc/libmisc.a \
|
|
+ $(top_builddir)/libsubid/libsubid.la \
|
|
+ $(MISCLIBS)
|
|
+
|
|
+free_subid_range_CPPFLAGS = \
|
|
+ -I$(top_srcdir)/lib \
|
|
+ -I$(top_srcdir)/libmisc \
|
|
+ -I$(top_srcdir)/libsubid
|
|
+
|
|
+free_subid_range_LDADD = \
|
|
+ $(top_builddir)/lib/libshadow.la \
|
|
+ $(top_builddir)/libmisc/libmisc.a \
|
|
+ $(top_builddir)/libsubid/libsubid.la \
|
|
+ $(MISCLIBS)
|
|
endif
|
|
diff --git a/src/free_subid_range.c b/src/free_subid_range.c
|
|
new file mode 100644
|
|
index 00000000..36858875
|
|
--- /dev/null
|
|
+++ b/src/free_subid_range.c
|
|
@@ -0,0 +1,50 @@
|
|
+#include <stdio.h>
|
|
+#include <unistd.h>
|
|
+#include "api.h"
|
|
+#include "stdlib.h"
|
|
+#include "prototypes.h"
|
|
+
|
|
+/* Test program for the subid freeing routine */
|
|
+
|
|
+const char *Prog;
|
|
+
|
|
+void usage(void)
|
|
+{
|
|
+ fprintf(stderr, "Usage: %s [-g] user start count\n", Prog);
|
|
+ fprintf(stderr, " Release a user's subuid (or with -g, subgid) range\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int c;
|
|
+ bool ok;
|
|
+ struct subordinate_range range;
|
|
+ bool group = false; // get subuids by default
|
|
+
|
|
+ Prog = Basename (argv[0]);
|
|
+ while ((c = getopt(argc, argv, "g")) != EOF) {
|
|
+ switch(c) {
|
|
+ case 'g': group = true; break;
|
|
+ default: usage();
|
|
+ }
|
|
+ }
|
|
+ argv = &argv[optind];
|
|
+ argc = argc - optind;
|
|
+ if (argc < 3)
|
|
+ usage();
|
|
+ range.owner = argv[0];
|
|
+ range.start = atoi(argv[1]);
|
|
+ range.count = atoi(argv[2]);
|
|
+ if (group)
|
|
+ ok = free_subgid_range(&range);
|
|
+ else
|
|
+ ok = free_subuid_range(&range);
|
|
+
|
|
+ if (!ok) {
|
|
+ fprintf(stderr, "Failed freeing id range\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
diff --git a/src/get_subid_owners.c b/src/get_subid_owners.c
|
|
new file mode 100644
|
|
index 00000000..a4385540
|
|
--- /dev/null
|
|
+++ b/src/get_subid_owners.c
|
|
@@ -0,0 +1,40 @@
|
|
+#include <stdio.h>
|
|
+#include "api.h"
|
|
+#include "stdlib.h"
|
|
+#include "prototypes.h"
|
|
+
|
|
+const char *Prog;
|
|
+
|
|
+void usage(void)
|
|
+{
|
|
+ fprintf(stderr, "Usage: [-g] %s subuid\n", Prog);
|
|
+ fprintf(stderr, " list uids who own the given subuid\n");
|
|
+ fprintf(stderr, " pass -g to query a subgid\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int i, n;
|
|
+ uid_t *uids;
|
|
+
|
|
+ Prog = Basename (argv[0]);
|
|
+ if (argc < 2) {
|
|
+ usage();
|
|
+ }
|
|
+ if (argc == 3 && strcmp(argv[1], "-g") == 0)
|
|
+ n = get_subgid_owners(atoi(argv[2]), &uids);
|
|
+ else if (argc == 2 && strcmp(argv[1], "-h") == 0)
|
|
+ usage();
|
|
+ else
|
|
+ n = get_subuid_owners(atoi(argv[1]), &uids);
|
|
+ if (n < 0) {
|
|
+ fprintf(stderr, "No owners found\n");
|
|
+ exit(1);
|
|
+ }
|
|
+ for (i = 0; i < n; i++) {
|
|
+ printf("%d\n", uids[i]);
|
|
+ }
|
|
+ free(uids);
|
|
+ return 0;
|
|
+}
|
|
diff --git a/src/list_subid_ranges.c b/src/list_subid_ranges.c
|
|
new file mode 100644
|
|
index 00000000..cdba610e
|
|
--- /dev/null
|
|
+++ b/src/list_subid_ranges.c
|
|
@@ -0,0 +1,41 @@
|
|
+#include <stdio.h>
|
|
+#include "api.h"
|
|
+#include "stdlib.h"
|
|
+#include "prototypes.h"
|
|
+
|
|
+const char *Prog;
|
|
+
|
|
+void usage(void)
|
|
+{
|
|
+ fprintf(stderr, "Usage: %s [-g] user\n", Prog);
|
|
+ fprintf(stderr, " list subuid ranges for user\n");
|
|
+ fprintf(stderr, " pass -g to list subgid ranges\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int i;
|
|
+ struct subordinate_range **ranges;
|
|
+
|
|
+ Prog = Basename (argv[0]);
|
|
+ if (argc < 2) {
|
|
+ usage();
|
|
+ }
|
|
+ if (argc == 3 && strcmp(argv[1], "-g") == 0)
|
|
+ ranges = get_subgid_ranges(argv[2]);
|
|
+ else if (argc == 2 && strcmp(argv[1], "-h") == 0)
|
|
+ usage();
|
|
+ else
|
|
+ ranges = get_subuid_ranges(argv[1]);
|
|
+ if (!ranges) {
|
|
+ fprintf(stderr, "Error fetching ranges\n");
|
|
+ exit(1);
|
|
+ }
|
|
+ for (i = 0; ranges[i]; i++) {
|
|
+ printf("%d: %s %lu %lu\n", i, ranges[i]->owner,
|
|
+ ranges[i]->start, ranges[i]->count);
|
|
+ }
|
|
+ subid_free_ranges(ranges);
|
|
+ return 0;
|
|
+}
|
|
diff --git a/src/new_subid_range.c b/src/new_subid_range.c
|
|
new file mode 100644
|
|
index 00000000..6d7b033b
|
|
--- /dev/null
|
|
+++ b/src/new_subid_range.c
|
|
@@ -0,0 +1,57 @@
|
|
+#include <stdio.h>
|
|
+#include <unistd.h>
|
|
+#include "api.h"
|
|
+#include "stdlib.h"
|
|
+#include "prototypes.h"
|
|
+
|
|
+/* Test program for the subid creation routine */
|
|
+
|
|
+const char *Prog;
|
|
+
|
|
+void usage(void)
|
|
+{
|
|
+ fprintf(stderr, "Usage: %s [-g] [-n] user count\n", Prog);
|
|
+ fprintf(stderr, " Find a subuid (or with -g, subgid) range for user\n");
|
|
+ fprintf(stderr, " If -n is given, a new range will be created even if one exists\n");
|
|
+ fprintf(stderr, " count defaults to 65536\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+}
|
|
+
|
|
+int main(int argc, char *argv[])
|
|
+{
|
|
+ int c;
|
|
+ struct subordinate_range range;
|
|
+ bool makenew = false; // reuse existing by default
|
|
+ bool group = false; // get subuids by default
|
|
+ bool ok;
|
|
+
|
|
+ Prog = Basename (argv[0]);
|
|
+ while ((c = getopt(argc, argv, "gn")) != EOF) {
|
|
+ switch(c) {
|
|
+ case 'n': makenew = true; break;
|
|
+ case 'g': group = true; break;
|
|
+ default: usage();
|
|
+ }
|
|
+ }
|
|
+ argv = &argv[optind];
|
|
+ argc = argc - optind;
|
|
+ if (argc == 0)
|
|
+ usage();
|
|
+ range.owner = argv[0];
|
|
+ range.start = 0;
|
|
+ range.count = 65536;
|
|
+ if (argc > 1)
|
|
+ range.count = atoi(argv[1]);
|
|
+ if (group)
|
|
+ ok = grant_subgid_range(&range, !makenew);
|
|
+ else
|
|
+ ok = grant_subuid_range(&range, !makenew);
|
|
+
|
|
+ if (!ok) {
|
|
+ fprintf(stderr, "Failed creating new id range\n");
|
|
+ exit(EXIT_FAILURE);
|
|
+ }
|
|
+ printf("Subuid range %lu:%lu\n", range.start, range.count);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
diff --git a/tests/libsubid/01_list_ranges/config.txt b/tests/libsubid/01_list_ranges/config.txt
|
|
new file mode 100644
|
|
index 00000000..e69de29b
|
|
diff --git a/tests/libsubid/01_list_ranges/config/etc/subgid b/tests/libsubid/01_list_ranges/config/etc/subgid
|
|
new file mode 100644
|
|
index 00000000..b9495cfc
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/01_list_ranges/config/etc/subgid
|
|
@@ -0,0 +1,2 @@
|
|
+foo:200000:10000
|
|
+root:500000:1000
|
|
diff --git a/tests/libsubid/01_list_ranges/config/etc/subuid b/tests/libsubid/01_list_ranges/config/etc/subuid
|
|
new file mode 100644
|
|
index 00000000..e5c537be
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/01_list_ranges/config/etc/subuid
|
|
@@ -0,0 +1,3 @@
|
|
+foo:300000:10000
|
|
+foo:400000:10000
|
|
+root:500000:1000
|
|
diff --git a/tests/libsubid/01_list_ranges/list_ranges.test b/tests/libsubid/01_list_ranges/list_ranges.test
|
|
new file mode 100755
|
|
index 00000000..b131303b
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/01_list_ranges/list_ranges.test
|
|
@@ -0,0 +1,38 @@
|
|
+#!/bin/sh
|
|
+
|
|
+set -e
|
|
+
|
|
+cd $(dirname $0)
|
|
+
|
|
+. ../../common/config.sh
|
|
+. ../../common/log.sh
|
|
+
|
|
+log_start "$0" "list_ranges shows subid ranges"
|
|
+
|
|
+save_config
|
|
+
|
|
+# restore the files on exit
|
|
+trap 'log_status "$0" "FAILURE"; restore_config' 0
|
|
+
|
|
+change_config
|
|
+
|
|
+echo -n "list foo's ranges..."
|
|
+${build_path}/src/list_subid_ranges foo > /tmp/subuidlistout
|
|
+${build_path}/src/list_subid_ranges -g foo > /tmp/subgidlistout
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Check the subuid ranges..."
|
|
+[ $(wc -l /tmp/subuidlistout | awk '{ print $1 }') -eq 2 ]
|
|
+grep "0: foo 300000 10000" /tmp/subuidlistout
|
|
+grep "1: foo 400000 10000" /tmp/subuidlistout
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Check the subgid ranges..."
|
|
+[ $(wc -l /tmp/subgidlistout | awk '{ print $1 }') -eq 1 ]
|
|
+grep "0: foo 200000 10000" /tmp/subgidlistout
|
|
+echo "OK"
|
|
+
|
|
+log_status "$0" "SUCCESS"
|
|
+restore_config
|
|
+trap '' 0
|
|
+
|
|
diff --git a/tests/libsubid/02_get_subid_owners/config.txt b/tests/libsubid/02_get_subid_owners/config.txt
|
|
new file mode 100644
|
|
index 00000000..e69de29b
|
|
diff --git a/tests/libsubid/02_get_subid_owners/config/etc/passwd b/tests/libsubid/02_get_subid_owners/config/etc/passwd
|
|
new file mode 100644
|
|
index 00000000..bf52df00
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/02_get_subid_owners/config/etc/passwd
|
|
@@ -0,0 +1,20 @@
|
|
+root:x:0:0:root:/root:/bin/bash
|
|
+daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
|
+bin:x:2:2:bin:/bin:/bin/sh
|
|
+sys:x:3:3:sys:/dev:/bin/sh
|
|
+sync:x:4:65534:sync:/bin:/bin/sync
|
|
+games:x:5:60:games:/usr/games:/bin/sh
|
|
+man:x:6:12:man:/var/cache/man:/bin/sh
|
|
+lp:x:7:7:lp:/var/spool/lpd:/bin/sh
|
|
+mail:x:8:8:mail:/var/mail:/bin/sh
|
|
+news:x:9:9:news:/var/spool/news:/bin/sh
|
|
+uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
|
|
+proxy:x:13:13:proxy:/bin:/bin/sh
|
|
+www-data:x:33:33:www-data:/var/www:/bin/sh
|
|
+backup:x:34:34:backup:/var/backups:/bin/sh
|
|
+list:x:38:38:Mailing List Manager:/var/list:/bin/sh
|
|
+irc:x:39:39:ircd:/var/run/ircd:/bin/sh
|
|
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
|
|
+nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
|
|
+Debian-exim:x:102:102::/var/spool/exim4:/bin/false
|
|
+foo:x:1000:1000::/home/foo:/bin/false
|
|
diff --git a/tests/libsubid/02_get_subid_owners/config/etc/subgid b/tests/libsubid/02_get_subid_owners/config/etc/subgid
|
|
new file mode 100644
|
|
index 00000000..b9495cfc
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/02_get_subid_owners/config/etc/subgid
|
|
@@ -0,0 +1,2 @@
|
|
+foo:200000:10000
|
|
+root:500000:1000
|
|
diff --git a/tests/libsubid/02_get_subid_owners/config/etc/subuid b/tests/libsubid/02_get_subid_owners/config/etc/subuid
|
|
new file mode 100644
|
|
index 00000000..dd11875a
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/02_get_subid_owners/config/etc/subuid
|
|
@@ -0,0 +1,4 @@
|
|
+foo:300000:10000
|
|
+foo:400000:10000
|
|
+foo:500000:10000
|
|
+root:500000:1000
|
|
diff --git a/tests/libsubid/02_get_subid_owners/get_subid_owners.test b/tests/libsubid/02_get_subid_owners/get_subid_owners.test
|
|
new file mode 100755
|
|
index 00000000..145477cb
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/02_get_subid_owners/get_subid_owners.test
|
|
@@ -0,0 +1,52 @@
|
|
+#!/bin/sh
|
|
+
|
|
+set -e
|
|
+
|
|
+cd $(dirname $0)
|
|
+
|
|
+. ../../common/config.sh
|
|
+. ../../common/log.sh
|
|
+
|
|
+log_start "$0" "get subid owners"
|
|
+
|
|
+save_config
|
|
+
|
|
+# restore the files on exit
|
|
+trap 'log_status "$0" "FAILURE"; restore_config' 0
|
|
+
|
|
+change_config
|
|
+
|
|
+echo -n "Noone owns 0 as a subid..."
|
|
+[ -z "$(${build_path}/src/get_subid_owners 0)" ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "foo owns subuid 300000..."
|
|
+[ "$(${build_path}/src/get_subid_owners 300000)" = "1000" ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "foo owns subgid 200000..."
|
|
+[ "$(${build_path}/src/get_subid_owners -g 200000)" = "1000" ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Noone owns subuid 200000..."
|
|
+[ -z "$(${build_path}/src/get_subid_owners -g 300000)" ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Noone owns subgid 300000..."
|
|
+[ -z "$(${build_path}/src/get_subid_owners -g 300000)" ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Both foo and root own subuid 500000..."
|
|
+cat > /tmp/expected << EOF
|
|
+1000
|
|
+0
|
|
+EOF
|
|
+${build_path}/src/get_subid_owners 500000 > /tmp/actual
|
|
+diff /tmp/expected /tmp/actual
|
|
+
|
|
+echo "OK"
|
|
+
|
|
+log_status "$0" "SUCCESS"
|
|
+restore_config
|
|
+trap '' 0
|
|
+
|
|
diff --git a/tests/libsubid/03_add_remove/add_remove_subids.test b/tests/libsubid/03_add_remove/add_remove_subids.test
|
|
new file mode 100755
|
|
index 00000000..a24a9752
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/03_add_remove/add_remove_subids.test
|
|
@@ -0,0 +1,59 @@
|
|
+#!/bin/sh
|
|
+
|
|
+set -e
|
|
+
|
|
+cd $(dirname $0)
|
|
+
|
|
+. ../../common/config.sh
|
|
+. ../../common/log.sh
|
|
+
|
|
+log_start "$0" "add and remove subid ranges"
|
|
+
|
|
+save_config
|
|
+
|
|
+# restore the files on exit
|
|
+trap 'log_status "$0" "FAILURE"; restore_config' 0
|
|
+
|
|
+change_config
|
|
+
|
|
+echo -n "Existing ranges returned when possible..."
|
|
+res=$(${build_path}/src/new_subid_range foo 500)
|
|
+echo "debug"
|
|
+echo "res is $res"
|
|
+echo "wanted Subuid range 300000:10000"
|
|
+echo "end debug"
|
|
+[ "$res" = "Subuid range 300000:10000" ]
|
|
+[ $(grep -c foo /etc/subuid) -eq 1 ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "New range returned if requested..."
|
|
+res=$(${build_path}/src/new_subid_range foo 500 -n)
|
|
+[ "$res" = "Subuid range 310000:500" ]
|
|
+[ $(grep -c foo /etc/subuid) -eq 2 ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Free works..."
|
|
+res=$(${build_path}/src/free_subid_range foo 310000 500)
|
|
+[ $(grep -c foo /etc/subuid) -eq 1 ]
|
|
+echo "OK"
|
|
+
|
|
+echo -n "Subgids work too..."
|
|
+res=$(${build_path}/src/new_subid_range -g foo 100000)
|
|
+echo "DEBUG: res is ${res}"
|
|
+[ "$res" = "Subuid range 501000:100000" ]
|
|
+echo "DEBUG: subgid is:"
|
|
+cat /etc/subgid
|
|
+[ $(grep -c foo /etc/subgid) -eq 2 ]
|
|
+
|
|
+echo -n "Subgid free works..."
|
|
+res=$(${build_path}/src/free_subid_range -g foo 501000 100000)
|
|
+echo "DEBUG: res is ${res}"
|
|
+echo "DEBUG: subgid is:"
|
|
+cat /etc/subgid
|
|
+[ $(grep -c foo /etc/subgid) -eq 1 ]
|
|
+echo "OK"
|
|
+
|
|
+log_status "$0" "SUCCESS"
|
|
+restore_config
|
|
+trap '' 0
|
|
+
|
|
diff --git a/tests/libsubid/03_add_remove/config.txt b/tests/libsubid/03_add_remove/config.txt
|
|
new file mode 100644
|
|
index 00000000..e69de29b
|
|
diff --git a/tests/libsubid/03_add_remove/config/etc/passwd b/tests/libsubid/03_add_remove/config/etc/passwd
|
|
new file mode 100644
|
|
index 00000000..bf52df00
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/03_add_remove/config/etc/passwd
|
|
@@ -0,0 +1,20 @@
|
|
+root:x:0:0:root:/root:/bin/bash
|
|
+daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
|
+bin:x:2:2:bin:/bin:/bin/sh
|
|
+sys:x:3:3:sys:/dev:/bin/sh
|
|
+sync:x:4:65534:sync:/bin:/bin/sync
|
|
+games:x:5:60:games:/usr/games:/bin/sh
|
|
+man:x:6:12:man:/var/cache/man:/bin/sh
|
|
+lp:x:7:7:lp:/var/spool/lpd:/bin/sh
|
|
+mail:x:8:8:mail:/var/mail:/bin/sh
|
|
+news:x:9:9:news:/var/spool/news:/bin/sh
|
|
+uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
|
|
+proxy:x:13:13:proxy:/bin:/bin/sh
|
|
+www-data:x:33:33:www-data:/var/www:/bin/sh
|
|
+backup:x:34:34:backup:/var/backups:/bin/sh
|
|
+list:x:38:38:Mailing List Manager:/var/list:/bin/sh
|
|
+irc:x:39:39:ircd:/var/run/ircd:/bin/sh
|
|
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
|
|
+nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
|
|
+Debian-exim:x:102:102::/var/spool/exim4:/bin/false
|
|
+foo:x:1000:1000::/home/foo:/bin/false
|
|
diff --git a/tests/libsubid/03_add_remove/config/etc/subgid b/tests/libsubid/03_add_remove/config/etc/subgid
|
|
new file mode 100644
|
|
index 00000000..b9495cfc
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/03_add_remove/config/etc/subgid
|
|
@@ -0,0 +1,2 @@
|
|
+foo:200000:10000
|
|
+root:500000:1000
|
|
diff --git a/tests/libsubid/03_add_remove/config/etc/subuid b/tests/libsubid/03_add_remove/config/etc/subuid
|
|
new file mode 100644
|
|
index 00000000..cf80c2f7
|
|
--- /dev/null
|
|
+++ b/tests/libsubid/03_add_remove/config/etc/subuid
|
|
@@ -0,0 +1 @@
|
|
+foo:300000:10000
|
|
diff --git a/tests/run_some b/tests/run_some
|
|
new file mode 100755
|
|
index 00000000..2d085d59
|
|
--- /dev/null
|
|
+++ b/tests/run_some
|
|
@@ -0,0 +1,136 @@
|
|
+#!/bin/sh
|
|
+
|
|
+set -e
|
|
+
|
|
+export LC_ALL=C
|
|
+unset LANG
|
|
+unset LANGUAGE
|
|
+. common/config.sh
|
|
+
|
|
+USE_PAM="yes"
|
|
+FAILURE_TESTS="yes"
|
|
+
|
|
+succeeded=0
|
|
+failed=0
|
|
+failed_tests=""
|
|
+
|
|
+run_test()
|
|
+{
|
|
+ [ -f RUN_TEST.STOP ] && exit 1
|
|
+
|
|
+ if $1 > $1.log
|
|
+ then
|
|
+ succeeded=$((succeeded+1))
|
|
+ echo -n "+"
|
|
+ else
|
|
+ failed=$((failed+1))
|
|
+ failed_tests="$failed_tests $1"
|
|
+ echo -n "-"
|
|
+ fi
|
|
+ cat $1.log >> testsuite.log
|
|
+ [ -f /etc/passwd.lock ] && echo $1 /etc/passwd.lock || true
|
|
+ [ -f /etc/group.lock ] && echo $1 /etc/group.lock || true
|
|
+ [ -f /etc/shadow.lock ] && echo $1 /etc/shadow.lock || true
|
|
+ [ -f /etc/gshadow.lock ] && echo $1 /etc/gshadow.lock || true
|
|
+ if [ "$(stat -c"%G" /etc/shadow)" != "shadow" ]
|
|
+ then
|
|
+ echo $1
|
|
+ ls -l /etc/shadow
|
|
+ chgrp shadow /etc/shadow
|
|
+ fi
|
|
+ if [ -d /nonexistent ]
|
|
+ then
|
|
+ echo $1 /nonexistent
|
|
+ rmdir /nonexistent
|
|
+ fi
|
|
+}
|
|
+
|
|
+echo "+: test passed"
|
|
+echo "-: test failed"
|
|
+
|
|
+# Empty the complete log.
|
|
+> testsuite.log
|
|
+
|
|
+find ${build_path} -name "*.gcda" -delete
|
|
+run_test ./su/01/su_root.test
|
|
+run_test ./su/01/su_user.test
|
|
+find ${build_path} -name "*.gcda" -exec chmod a+rw {} \;
|
|
+run_test ./su/02/env_FOO-options_--login
|
|
+run_test ./su/02/env_FOO-options_--login_bash
|
|
+run_test ./su/02/env_FOO-options_--preserve-environment
|
|
+run_test ./su/02/env_FOO-options_--preserve-environment_bash
|
|
+run_test ./su/02/env_FOO-options_-
|
|
+run_test ./su/02/env_FOO-options_-_bash
|
|
+run_test ./su/02/env_FOO-options_-l-m
|
|
+run_test ./su/02/env_FOO-options_-l-m_bash
|
|
+run_test ./su/02/env_FOO-options_-l
|
|
+run_test ./su/02/env_FOO-options_-l_bash
|
|
+run_test ./su/02/env_FOO-options_-m_bash
|
|
+run_test ./su/02/env_FOO-options_-m
|
|
+run_test ./su/02/env_FOO-options_-p
|
|
+run_test ./su/02/env_FOO-options_-p_bash
|
|
+run_test ./su/02/env_FOO-options__bash
|
|
+run_test ./su/02/env_FOO-options_
|
|
+run_test ./su/02/env_FOO-options_-p-
|
|
+run_test ./su/02/env_FOO-options_-p-_bash
|
|
+run_test ./su/02/env_special-options_-l-p
|
|
+run_test ./su/02/env_special-options_-l
|
|
+run_test ./su/02/env_special-options_-l-p_bash
|
|
+run_test ./su/02/env_special-options_-l_bash
|
|
+run_test ./su/02/env_special-options_-p
|
|
+run_test ./su/02/env_special-options_-p_bash
|
|
+run_test ./su/02/env_special-options_
|
|
+run_test ./su/02/env_special-options__bash
|
|
+run_test ./su/02/env_special_root-options_-l-p
|
|
+run_test ./su/02/env_special_root-options_-l-p_bash
|
|
+run_test ./su/02/env_special_root-options_-l
|
|
+run_test ./su/02/env_special_root-options_-l_bash
|
|
+run_test ./su/02/env_special_root-options_-p
|
|
+run_test ./su/02/env_special_root-options_-p_bash
|
|
+run_test ./su/02/env_special_root-options_
|
|
+run_test ./su/02/env_special_root-options__bash
|
|
+run_test ./su/03/su_run_command01.test
|
|
+run_test ./su/03/su_run_command02.test
|
|
+run_test ./su/03/su_run_command03.test
|
|
+run_test ./su/03/su_run_command04.test
|
|
+run_test ./su/03/su_run_command05.test
|
|
+run_test ./su/03/su_run_command06.test
|
|
+run_test ./su/03/su_run_command07.test
|
|
+run_test ./su/03/su_run_command08.test
|
|
+run_test ./su/03/su_run_command09.test
|
|
+run_test ./su/03/su_run_command10.test
|
|
+run_test ./su/03/su_run_command11.test
|
|
+run_test ./su/03/su_run_command12.test
|
|
+run_test ./su/03/su_run_command13.test
|
|
+run_test ./su/03/su_run_command14.test
|
|
+run_test ./su/03/su_run_command15.test
|
|
+run_test ./su/03/su_run_command16.test
|
|
+run_test ./su/03/su_run_command17.test
|
|
+run_test ./su/04/su_wrong_user.test
|
|
+run_test ./su/04/su_user_wrong_passwd.test
|
|
+run_test ./su/04/su_user_wrong_passwd_syslog.test
|
|
+run_test ./su/05/su_user_wrong_passwd_syslog.test
|
|
+run_test ./su/06/su_user_syslog.test
|
|
+run_test ./su/07/su_user_syslog.test
|
|
+run_test ./su/08/env_special-options_
|
|
+run_test ./su/08/env_special_root-options_
|
|
+run_test ./su/09/env_special-options_
|
|
+run_test ./su/09/env_special_root-options_
|
|
+run_test ./su/10_su_sulog_success/su.test
|
|
+run_test ./su/11_su_sulog_failure/su.test
|
|
+run_test ./su/12_su_child_failure/su.test
|
|
+run_test ./su/13_su_child_success/su.test
|
|
+run_test ./libsubid/01_list_ranges/list_ranges.test
|
|
+run_test ./libsubid/02_get_subid_owners/get_subid_owners.test
|
|
+run_test ./libsubid/03_add_remove/add_remove_subids.test
|
|
+
|
|
+echo
|
|
+echo "$succeeded test(s) passed"
|
|
+echo "$failed test(s) failed"
|
|
+echo "log written in 'testsuite.log'"
|
|
+if [ "$failed" != "0" ]
|
|
+then
|
|
+ echo "the following tests failed:"
|
|
+ echo $failed_tests
|
|
+fi
|
|
+
|
|
--
|
|
2.30.2
|
|
|
|
From 607f1dd549cf9abc87af1cf29275f0d2d11eea29 Mon Sep 17 00:00:00 2001
|
|
From: Serge Hallyn <shallyn@cisco.com>
|
|
Date: Fri, 19 Jun 2020 22:09:20 -0500
|
|
Subject: [PATCH] libsubid: fix a prototype in api.h
|
|
|
|
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
|
|
---
|
|
libsubid/api.h | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/libsubid/api.h b/libsubid/api.h
|
|
index f65e3ec9..fbdf0f9e 100644
|
|
--- a/libsubid/api.h
|
|
+++ b/libsubid/api.h
|
|
@@ -6,7 +6,7 @@ struct subordinate_range **get_subgid_ranges(const char *owner);
|
|
void subid_free_ranges(struct subordinate_range **ranges);
|
|
|
|
int get_subuid_owners(uid_t uid, uid_t **owner);
|
|
-int get_subgid_owners(uid_t uid, uid_t **owner);
|
|
+int get_subgid_owners(gid_t gid, uid_t **owner);
|
|
|
|
/* range should be pre-allocated with owner and count filled in, start is
|
|
* ignored, can be 0 */
|
|
--
|
|
2.30.2
|
|
|
|
From b5fb1b38eea2fb0489ed088c82daf6700e72363e Mon Sep 17 00:00:00 2001
|
|
From: Serge Hallyn <serge@hallyn.com>
|
|
Date: Fri, 1 Jan 2021 13:01:54 -0600
|
|
Subject: [PATCH] libsubid: move libmisc.a to last LIBADD entry
|
|
|
|
Closes #297
|
|
|
|
Signed-off-by: Serge Hallyn <serge@hallyn.com>
|
|
---
|
|
libsubid/Makefile.am | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
|
|
index bdbc52c3..8bef1ecc 100644
|
|
--- a/libsubid/Makefile.am
|
|
+++ b/libsubid/Makefile.am
|
|
@@ -16,8 +16,8 @@ MISCLIBS = \
|
|
|
|
libsubid_la_LIBADD = \
|
|
$(top_srcdir)/lib/libshadow.la \
|
|
- $(top_srcdir)/libmisc/libmisc.a \
|
|
- $(MISCLIBS)
|
|
+ $(MISCLIBS) \
|
|
+ $(top_srcdir)/libmisc/libmisc.a
|
|
|
|
AM_CPPFLAGS = \
|
|
-I${top_srcdir}/lib \
|
|
--
|
|
2.30.2
|
|
|
|
From 43a917cce54019799a8de037fd63780a2b640afc Mon Sep 17 00:00:00 2001
|
|
From: Serge Hallyn <serge@hallyn.com>
|
|
Date: Sat, 18 Apr 2020 14:57:56 -0500
|
|
Subject: [PATCH] configure: define abi versions
|
|
|
|
Signed-off-by: Serge Hallyn <serge@hallyn.com>
|
|
---
|
|
configure.ac | 12 +++++++++++-
|
|
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/configure.ac b/configure.ac
|
|
index e4c6aaec..b8bc2b7a 100644
|
|
--- a/configure.ac
|
|
+++ b/configure.ac
|
|
@@ -1,11 +1,21 @@
|
|
dnl Process this file with autoconf to produce a configure script.
|
|
-AC_PREREQ([2.64])
|
|
+AC_PREREQ([2.69])
|
|
+m4_define([libsubid_abi_major], 1)
|
|
+m4_define([libsubid_abi_minor], 0)
|
|
+m4_define([libsubid_abi_micro], 0)
|
|
+m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
|
|
AC_INIT([shadow], [4.8.1], [pkg-shadow-devel@lists.alioth.debian.org], [],
|
|
[https://github.com/shadow-maint/shadow])
|
|
AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
|
|
+AC_CONFIG_MACRO_DIRS([m4])
|
|
AM_SILENT_RULES([yes])
|
|
AC_CONFIG_HEADERS([config.h])
|
|
|
|
+AC_SUBST([LIBSUBID_ABI_MAJOR], [libsubid_abi_major])
|
|
+AC_SUBST([LIBSUBID_ABI_MINOR], [libsubid_abi_minor])
|
|
+AC_SUBST([LIBSUBID_ABI_MICRO], [libsubid_abi_micro])
|
|
+AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
|
|
+
|
|
dnl Some hacks...
|
|
test "$prefix" = "NONE" && prefix="/usr"
|
|
test "$prefix" = "/usr" && exec_prefix=""
|
|
--
|
|
2.30.2
|
|
|