summaryrefslogtreecommitdiff
path: root/src/nss-mymachines
AgeCommit message (Collapse)Author
2016-12-27nss: when we encounter an invalid user/group name or UID/GID, don't return ↵Lennart Poettering
EINVAL It's not our business to validate invalid user/group names or UID/GID. Ideally, libc would filter these out, but they don't, hence we have to filter, but let's not propagate this as error, but simply as "not found" to the caller. User name rules are pretty vaguely defined, and the rules defined by POSIX clash with reality quite heavily (for example, utmp doesn't offer enough room for user name length, and /usr/bin/chown permits separating user/group names by a single dot, even though POSIX allows dots being used in user/group names themselves.) We enforce stricter rules than POSIX for good reason, and hence in doing so we should not categorically return EINVAL on stuff we don't consider valid, but other components might. Fixes: #4983
2016-08-19nss-mymachines: avoid connecting to dbus from inside dbus-daemonLennart Poettering
Inspired from the new logic in nss-systemd let's make sure we don't end up deadlocking in nss-mymachines either in case dbus-daemon tries to a look up a name and we want to connect to the bus. This case is much simpler though, as there's no point in resolving virtual machine UIDs by dbus-daemon as those should never be able to connect to the host's busses.
2016-02-22tree-wide: make ++/-- usage consistent WRT spacingVito Caputo
Throughout the tree there's spurious use of spaces separating ++ and -- operators from their respective operands. Make ++ and -- operator consistent with the majority of existing uses; discard the spaces.
2016-02-10nss-mymachines: never resolve unmapped UIDs/GIDsLennart Poettering
Don't ever permit successful user or group lookups if no UID/GID mapping is actually applied. THis way, we can be sure that nss-mymachines cannot be used to insert invalid cache entries into nscd's cache. https://bugzilla.redhat.com/show_bug.cgi?id=1285339
2016-02-10tree-wide: remove Emacs lines from all filesDaniel Mack
This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
2016-01-27nss: block various signals while running NSS lookupsLennart Poettering
Let's make sure our poll() calls don't get interrupted where they shouldn't (SIGALRM, ...), but allow them to be interrupted where they should (SIGINT, ...). Fixes #1965
2015-11-27nss-mymachines: link lessZbigniew Jędrzejewski-Szmek
This reduces libraries reported by ldd by liblzma, liblz4, libgcrypt, libgpg-error, libacl, libidn, libseccomp.
2015-11-27tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easyLennart Poettering
GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.
2015-11-23nss-mymachines: do not allow overlong machine namesZbigniew Jędrzejewski-Szmek
https://github.com/systemd/systemd/issues/2002
2015-10-27util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering
2015-10-26util-lib: split out user/group/uid/gid calls into user-util.[ch]Lennart Poettering
2015-10-24util-lib: split our string related calls from util.[ch] into its own file ↵Lennart Poettering
string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.
2015-09-22util: drop UID_IS_INVALID() in favour of uid_is_valid()Lennart Poettering
No need to keep both functions, settle on uid_is_valid() for everything.
2015-08-24util: make machine_name_is_valid() a macro and move it to hostname-util.hLennart Poettering
As it turns out machine_name_is_valid() does the exact same thing as hostname_is_valid() these days, as it just invoked that and checked the name length was < 64. However, hostname_is_valid() checks the length against HOST_NAME_MAX anyway (which is 64 on Linux), hence any additional check is redundant. We hence replace machine_name_is_valid() by a macro that simply maps it to hostname_is_valid() but sets the allow_trailing_dot parameter to false. We also move this this call to hostname-util.h, to the same place as the hostname_is_valid() declaration.
2015-07-09nss-mymachines: map userns users of containers to real user namesLennart Poettering
Given a container "foo", that maps user id $UID to container user, using user namespaces, this NSS module extenstion will now map the $UID to a name "vu-foo-$TUID" for the translated UID $UID. Similar, userns groups are mapped to "vg-foo-$TGID" for translated GIDs of $GID. This simple change should make userns users more discoverable. Also, given that many tools like "adduser" check NSS before allocating a UID, should lower the chance of UID range conflicts between tools.
2015-07-03sd-bus: introduce new sd_bus_flush_close_unref() callLennart Poettering
sd_bus_flush_close_unref() is a call that simply combines sd_bus_flush() (which writes all unwritten messages out) + sd_bus_close() (which terminates the connection, releasing all unread messages) + sd_bus_unref() (which frees the connection). The combination of this call is used pretty frequently in systemd tools right before exiting, and should also be relevant for most external clients, and is hence useful to cover in a call of its own. Previously the combination of the three calls was already done in the _cleanup_bus_close_unref_ macro, but this was only available internally. Also see #327
2014-09-19nss: remove dead codeThomas Hindoe Paaboel Andersen
c > 0 is already guaranteed from earlier checks. We go from ms = ALIGN(l+1) + sizeof(char*) + (c > 0 ? c : 1) * ALIGN(alen) + (c > 0 ? c+1 : 2) * sizeof(char*); to ms = ALIGN(l+1) + sizeof(char*) + c * ALIGN(alen) + (c+1) * sizeof(char*); to ms = ALIGN(l+1) + c * ALIGN(alen) + (c+2) * sizeof(char*); Found by coverity. Fixes: CID#1237570 and CID#1237610
2014-08-04machined: fix address API signaturesLennart Poettering
2014-08-04bus: always explicitly close bus from main programsLennart Poettering
Since b5eca3a2059f9399d1dc52cbcf9698674c4b1cf0 we don't attempt to GC busses anymore when unsent messages remain that keep their reference, when they otherwise are not referenced anymore. This means that if we explicitly want connections to go away, we need to close them. With this change we will no do so explicitly wherver we connect to the bus from a main program (and thus know when the bus connection should go away), or when we create a private bus connection, that really should go away after our use. This fixes connection leaks in the NSS and PAM modules.
2014-08-01nss: always explicitly reset all error variablesLennart Poettering
glibc appears to be broken if we don't explicitly reset all error variables, let's work around that. https://bugzilla.redhat.com/show_bug.cgi?id=1125975
2014-07-18change type for address family to "int"Lennart Poettering
Let's settle on a single type for all address family values, even if UNIX is very inconsitent on the precise type otherwise. Given that socket() is the primary entrypoint for the sockets API, and that uses "int", and "int" is relatively simple and generic, we settle on "int" for this.
2014-07-18shared: rename PROTO_ADDRESS_SIZE() to FAMILY_ADDRESS_SIZE()Lennart Poettering
We mostly use "family" to refer to AF_INET, AF_INET6, etc, let's use this terminology here, too
2014-07-17sd-login: always use "indices" as plural of "index"Lennart Poettering
So far both "indexes" and "indices" was used. Let's clean this up, and stick to indices, since it appears to be used more frequently.
2014-07-16nss: various minor fixes to nss-myhostname + nss-mymachinesLennart Poettering
2014-07-11nss-mymachines: add new NSS module for automatically resolving addresses of ↵Lennart Poettering
all local containers