From 1fdfca4da739f47516513afc66d4c7008c9badfd Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 5 May 2021 16:05:43 +0200 Subject: [PATCH 1/2] nss-systemd: reset the right field --- src/nss-systemd/nss-systemd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nss-systemd/nss-systemd.c b/src/nss-systemd/nss-systemd.c index 38c214499e..185cb3de24 100644 --- a/src/nss-systemd/nss-systemd.c +++ b/src/nss-systemd/nss-systemd.c @@ -348,7 +348,7 @@ enum nss_status _nss_systemd_setgrent(int stayopen) { _l = pthread_mutex_lock_assert(&getgrent_data.mutex); getgrent_data.iterator = userdb_iterator_free(getgrent_data.iterator); - getpwent_data.by_membership = false; + getgrent_data.by_membership = false; /* See _nss_systemd_setpwent() for an explanation why we use USERDB_DONT_SYNTHESIZE here */ r = groupdb_all(nss_glue_userdb_flags() | USERDB_DONT_SYNTHESIZE, &getgrent_data.iterator); From a1aa41e4e175c2712b97600d7e10e9d6c58e5543 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 5 May 2021 18:57:30 +0200 Subject: [PATCH 2/2] nss-systemd: properly handle empty membership lists When we are queried for membership lists on a system that has exactly zero, then we'll return ESRCH immediately instead of at EOF. Which is OK, but we need to handle this in various places, and not get confused by it. --- src/nss-systemd/nss-systemd.c | 7 +++++-- src/nss-systemd/userdb-glue.c | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/nss-systemd/nss-systemd.c b/src/nss-systemd/nss-systemd.c index 185cb3de24..3ac57441d9 100644 --- a/src/nss-systemd/nss-systemd.c +++ b/src/nss-systemd/nss-systemd.c @@ -441,7 +441,7 @@ enum nss_status _nss_systemd_getgrent_r( getgrent_data.iterator = userdb_iterator_free(getgrent_data.iterator); r = membershipdb_all(nss_glue_userdb_flags(), &getgrent_data.iterator); - if (r < 0) { + if (r < 0 && r != -ESRCH) { UNPROTECT_ERRNO; *errnop = -r; return NSS_STATUS_UNAVAIL; @@ -454,7 +454,7 @@ enum nss_status _nss_systemd_getgrent_r( return NSS_STATUS_UNAVAIL; } else if (!STR_IN_SET(gr->group_name, root_group.gr_name, nobody_group.gr_name)) { r = membershipdb_by_group_strv(gr->group_name, nss_glue_userdb_flags(), &members); - if (r < 0) { + if (r < 0 && r != -ESRCH) { UNPROTECT_ERRNO; *errnop = -r; return NSS_STATUS_UNAVAIL; @@ -465,6 +465,9 @@ enum nss_status _nss_systemd_getgrent_r( if (getgrent_data.by_membership) { _cleanup_(_nss_systemd_unblockp) bool blocked = false; + if (!getgrent_data.iterator) + return NSS_STATUS_NOTFOUND; + for (;;) { _cleanup_free_ char *user_name = NULL, *group_name = NULL; diff --git a/src/nss-systemd/userdb-glue.c b/src/nss-systemd/userdb-glue.c index 0cc84bfac7..8f8988579b 100644 --- a/src/nss-systemd/userdb-glue.c +++ b/src/nss-systemd/userdb-glue.c @@ -216,7 +216,7 @@ enum nss_status userdb_getgrnam( } r = membershipdb_by_group_strv(name, nss_glue_userdb_flags(), &members); - if (r < 0) { + if (r < 0 && r != -ESRCH) { *errnop = -r; return NSS_STATUS_UNAVAIL; } @@ -309,7 +309,7 @@ enum nss_status userdb_getgrgid( from_nss = false; r = membershipdb_by_group_strv(g->group_name, nss_glue_userdb_flags(), &members); - if (r < 0) { + if (r < 0 && r != -ESRCH) { *errnop = -r; return NSS_STATUS_UNAVAIL; }