|
 |
8a8cfb |
commit 99135114ba23c3110b7e4e650fabdc5e639746b7
|
|
|
8a8cfb |
Author: DJ Delorie <dj@redhat.com>
|
|
|
8a8cfb |
Date: Fri Jun 28 18:30:00 2019 -0500
|
|
|
8a8cfb |
|
|
|
8a8cfb |
nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696]
|
|
|
8a8cfb |
|
|
|
8a8cfb |
nss_db allows for getpwent et al to be called without a set*ent,
|
|
|
8a8cfb |
but it only works once. After the last get*ent a set*ent is
|
|
|
8a8cfb |
required to restart, because the end*ent did not properly reset
|
|
|
8a8cfb |
the module. Resetting it to NULL allows for a proper restart.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
If the database doesn't exist, however, end*ent erroniously called
|
|
|
8a8cfb |
munmap which set errno.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
The test case runs "makedb" inside the testroot, so needs selinux
|
|
|
8a8cfb |
DSOs installed.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
diff -rupN a/nss/Makefile b/nss/Makefile
|
|
|
8a8cfb |
--- a/nss/Makefile 2019-11-04 15:14:16.721221038 -0500
|
|
|
8a8cfb |
+++ b/nss/Makefile 2019-11-04 15:15:46.447544678 -0500
|
|
|
8a8cfb |
@@ -60,6 +60,10 @@ tests = test-netdb test-digits-dots ts
|
|
|
8a8cfb |
tst-nss-test5
|
|
|
8a8cfb |
xtests = bug-erange
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+tests-container = \
|
|
|
8a8cfb |
+ tst-nss-db-endpwent \
|
|
|
8a8cfb |
+ tst-nss-db-endgrent
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
# Tests which need libdl
|
|
|
8a8cfb |
ifeq (yes,$(build-shared))
|
|
|
8a8cfb |
tests += tst-nss-files-hosts-erange
|
|
|
8a8cfb |
diff -rupN a/nss/nss_db/db-open.c b/nss/nss_db/db-open.c
|
|
|
8a8cfb |
--- a/nss/nss_db/db-open.c 2018-08-01 01:10:47.000000000 -0400
|
|
|
8a8cfb |
+++ b/nss/nss_db/db-open.c 2019-11-04 15:15:10.520213846 -0500
|
|
|
8a8cfb |
@@ -63,5 +63,9 @@ internal_setent (const char *file, struc
|
|
|
8a8cfb |
void
|
|
|
8a8cfb |
internal_endent (struct nss_db_map *mapping)
|
|
|
8a8cfb |
{
|
|
|
8a8cfb |
- munmap (mapping->header, mapping->len);
|
|
|
8a8cfb |
+ if (mapping->header != NULL)
|
|
|
8a8cfb |
+ {
|
|
|
8a8cfb |
+ munmap (mapping->header, mapping->len);
|
|
|
8a8cfb |
+ mapping->header = NULL;
|
|
|
8a8cfb |
+ }
|
|
|
8a8cfb |
}
|
|
|
8a8cfb |
diff -rupN a/nss/tst-nss-db-endgrent.c b/nss/tst-nss-db-endgrent.c
|
|
|
8a8cfb |
--- a/nss/tst-nss-db-endgrent.c 1969-12-31 19:00:00.000000000 -0500
|
|
|
8a8cfb |
+++ b/nss/tst-nss-db-endgrent.c 2019-11-04 15:15:10.526214069 -0500
|
|
|
8a8cfb |
@@ -0,0 +1,54 @@
|
|
|
8a8cfb |
+/* Test for endgrent changing errno for BZ #24696
|
|
|
8a8cfb |
+ Copyright (C) 2019 Free Software Foundation, Inc.
|
|
|
8a8cfb |
+ This file is part of the GNU C Library.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is free software; you can redistribute it and/or
|
|
|
8a8cfb |
+ modify it under the terms of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License as published by the Free Software Foundation; either
|
|
|
8a8cfb |
+ version 2.1 of the License, or (at your option) any later version.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is distributed in the hope that it will be useful,
|
|
|
8a8cfb |
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
8a8cfb |
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
8a8cfb |
+ Lesser General Public License for more details.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ You should have received a copy of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License along with the GNU C Library; if not, see
|
|
|
8a8cfb |
+ <http://www.gnu.org/licenses/>. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <stdlib.h>
|
|
|
8a8cfb |
+#include <sys/types.h>
|
|
|
8a8cfb |
+#include <grp.h>
|
|
|
8a8cfb |
+#include <unistd.h>
|
|
|
8a8cfb |
+#include <errno.h>
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <support/check.h>
|
|
|
8a8cfb |
+#include <support/support.h>
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+/* The following test verifies that if the db NSS Service is initialized
|
|
|
8a8cfb |
+ with no database (getgrent), that a subsequent closure (endgrent) does
|
|
|
8a8cfb |
+ not set errno. In the case of the db service it is not an error to close
|
|
|
8a8cfb |
+ the service and so it should not set errno. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+static int
|
|
|
8a8cfb |
+do_test (void)
|
|
|
8a8cfb |
+{
|
|
|
8a8cfb |
+ /* Just make sure it's not there, although usually it won't be. */
|
|
|
8a8cfb |
+ unlink ("/var/db/group.db");
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ /* This, in conjunction with the testroot's nsswitch.conf, causes
|
|
|
8a8cfb |
+ the nss_db module to be "connected" and initialized - but the
|
|
|
8a8cfb |
+ testroot has no group.db, so no mapping will be created. */
|
|
|
8a8cfb |
+ getgrent ();
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ errno = 0;
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ /* Before the fix, this would call munmap (NULL) and set errno. */
|
|
|
8a8cfb |
+ endgrent ();
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ if (errno != 0)
|
|
|
8a8cfb |
+ FAIL_EXIT1 ("endgrent set errno to %d\n", errno);
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ return 0;
|
|
|
8a8cfb |
+}
|
|
|
8a8cfb |
+#include <support/test-driver.c>
|
|
|
8a8cfb |
diff -rupN a/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf b/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf
|
|
|
8a8cfb |
--- a/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf 1969-12-31 19:00:00.000000000 -0500
|
|
|
8a8cfb |
+++ b/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf 2019-11-04 15:15:10.539214550 -0500
|
|
|
8a8cfb |
@@ -0,0 +1 @@
|
|
|
8a8cfb |
+group : db files
|
|
|
8a8cfb |
diff -rupN a/nss/tst-nss-db-endpwent.c b/nss/tst-nss-db-endpwent.c
|
|
|
8a8cfb |
--- a/nss/tst-nss-db-endpwent.c 1969-12-31 19:00:00.000000000 -0500
|
|
|
8a8cfb |
+++ b/nss/tst-nss-db-endpwent.c 2019-11-04 15:15:10.545214772 -0500
|
|
|
8a8cfb |
@@ -0,0 +1,66 @@
|
|
|
8a8cfb |
+/* Test for endpwent->getpwent crash for BZ #24695
|
|
|
8a8cfb |
+ Copyright (C) 2019 Free Software Foundation, Inc.
|
|
|
8a8cfb |
+ This file is part of the GNU C Library.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is free software; you can redistribute it and/or
|
|
|
8a8cfb |
+ modify it under the terms of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License as published by the Free Software Foundation; either
|
|
|
8a8cfb |
+ version 2.1 of the License, or (at your option) any later version.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is distributed in the hope that it will be useful,
|
|
|
8a8cfb |
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
8a8cfb |
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
8a8cfb |
+ Lesser General Public License for more details.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ You should have received a copy of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License along with the GNU C Library; if not, see
|
|
|
8a8cfb |
+ <http://www.gnu.org/licenses/>. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <stdlib.h>
|
|
|
8a8cfb |
+#include <string.h>
|
|
|
8a8cfb |
+#include <sys/types.h>
|
|
|
8a8cfb |
+#include <pwd.h>
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <support/support.h>
|
|
|
8a8cfb |
+#include <support/check.h>
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+/* It is entirely allowed to start with a getpwent call without
|
|
|
8a8cfb |
+ resetting the state of the service via a call to setpwent.
|
|
|
8a8cfb |
+ You can also call getpwent more times than you have entries in
|
|
|
8a8cfb |
+ the service, and it should not fail. This test iteratates the
|
|
|
8a8cfb |
+ database once, gets to the end, and then attempts a second
|
|
|
8a8cfb |
+ iteration to look for crashes. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+static void
|
|
|
8a8cfb |
+try_it (void)
|
|
|
8a8cfb |
+{
|
|
|
8a8cfb |
+ struct passwd *pw;
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ /* setpwent is intentionally omitted here. The first call to
|
|
|
8a8cfb |
+ getpwent detects that it's first and initializes. The second
|
|
|
8a8cfb |
+ time try_it is called, this "first call" was not detected before
|
|
|
8a8cfb |
+ the fix, and getpwent would crash. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ while ((pw = getpwent ()) != NULL)
|
|
|
8a8cfb |
+ ;
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ /* We only care if this segfaults or not. */
|
|
|
8a8cfb |
+ endpwent ();
|
|
|
8a8cfb |
+}
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+static int
|
|
|
8a8cfb |
+do_test (void)
|
|
|
8a8cfb |
+{
|
|
|
8a8cfb |
+ char *cmd;
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ cmd = xasprintf ("%s/makedb -o /var/db/passwd.db /var/db/passwd.in",
|
|
|
8a8cfb |
+ support_bindir_prefix);
|
|
|
8a8cfb |
+ system (cmd);
|
|
|
8a8cfb |
+ free (cmd);
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ try_it ();
|
|
|
8a8cfb |
+ try_it ();
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ return 0;
|
|
|
8a8cfb |
+}
|
|
|
8a8cfb |
+#include <support/test-driver.c>
|
|
|
8a8cfb |
diff -rupN a/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf b/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf
|
|
|
8a8cfb |
--- a/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf 1969-12-31 19:00:00.000000000 -0500
|
|
|
8a8cfb |
+++ b/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf 2019-11-04 15:15:10.556215180 -0500
|
|
|
8a8cfb |
@@ -0,0 +1 @@
|
|
|
8a8cfb |
+passwd: db
|
|
|
8a8cfb |
diff -rupN a/nss/tst-nss-db-endpwent.root/var/db/passwd.in b/nss/tst-nss-db-endpwent.root/var/db/passwd.in
|
|
|
8a8cfb |
--- a/nss/tst-nss-db-endpwent.root/var/db/passwd.in 1969-12-31 19:00:00.000000000 -0500
|
|
|
8a8cfb |
+++ b/nss/tst-nss-db-endpwent.root/var/db/passwd.in 2019-11-04 15:15:10.567215588 -0500
|
|
|
8a8cfb |
@@ -0,0 +1,4 @@
|
|
|
8a8cfb |
+.root root:x:0:0:root:/root:/bin/bash
|
|
|
8a8cfb |
+=0 root:x:0:0:root:/root:/bin/bash
|
|
|
8a8cfb |
+.bin bin:x:1:1:bin:/bin:/sbin/nologin
|
|
|
8a8cfb |
+=1 bin:x:1:1:bin:/bin:/sbin/nologin
|
|
|
8a8cfb |
diff -rupN a/support/Makefile b/support/Makefile
|
|
|
8a8cfb |
--- a/support/Makefile 2019-11-04 15:14:20.416357911 -0500
|
|
|
8a8cfb |
+++ b/support/Makefile 2019-11-04 15:15:10.574215847 -0500
|
|
|
8a8cfb |
@@ -180,6 +180,11 @@ LINKS_DSO_PROGRAM = links-dso-program
|
|
|
8a8cfb |
LDLIBS-links-dso-program = -lstdc++ -lgcc -lgcc_s $(libunwind)
|
|
|
8a8cfb |
endif
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+ifeq (yes,$(have-selinux))
|
|
|
8a8cfb |
+LDLIBS-$(LINKS_DSO_PROGRAM) += -lselinux
|
|
|
8a8cfb |
+endif
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
LDLIBS-test-container = $(libsupport)
|
|
|
8a8cfb |
|
|
|
8a8cfb |
others += test-container
|
|
|
8a8cfb |
diff -rupN a/support/links-dso-program-c.c b/support/links-dso-program-c.c
|
|
|
8a8cfb |
--- a/support/links-dso-program-c.c 2019-11-04 15:14:17.073234077 -0500
|
|
|
8a8cfb |
+++ b/support/links-dso-program-c.c 2019-11-04 15:15:10.580216069 -0500
|
|
|
8a8cfb |
@@ -1,9 +1,26 @@
|
|
|
8a8cfb |
#include <stdio.h>
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+/* makedb needs selinux dso's. */
|
|
|
8a8cfb |
+#ifdef HAVE_SELINUX
|
|
|
8a8cfb |
+# include <selinux/selinux.h>
|
|
|
8a8cfb |
+#endif
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+/* The purpose of this file is to indicate to the build system which
|
|
|
8a8cfb |
+ shared objects need to be copied into the testroot, such as gcc or
|
|
|
8a8cfb |
+ selinux support libraries. This program is never executed, only
|
|
|
8a8cfb |
+ scanned for dependencies on shared objects, so the code below may
|
|
|
8a8cfb |
+ seem weird - it's written to survive gcc optimization and force
|
|
|
8a8cfb |
+ such dependencies.
|
|
|
8a8cfb |
+*/
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
int
|
|
|
8a8cfb |
main (int argc, char **argv)
|
|
|
8a8cfb |
{
|
|
|
8a8cfb |
/* Complexity to keep gcc from optimizing this away. */
|
|
|
8a8cfb |
printf ("This is a test %s.\n", argc > 1 ? argv[1] : "null");
|
|
|
8a8cfb |
+#ifdef HAVE_SELINUX
|
|
|
8a8cfb |
+ /* This exists to force libselinux.so to be required. */
|
|
|
8a8cfb |
+ printf ("selinux %d\n", is_selinux_enabled ());
|
|
|
8a8cfb |
+#endif
|
|
|
8a8cfb |
return 0;
|
|
|
8a8cfb |
}
|
|
|
8a8cfb |
diff -rupN a/support/links-dso-program.cc b/support/links-dso-program.cc
|
|
|
8a8cfb |
--- a/support/links-dso-program.cc 2019-11-04 15:14:17.079234300 -0500
|
|
|
8a8cfb |
+++ b/support/links-dso-program.cc 2019-11-04 15:15:10.587216328 -0500
|
|
|
8a8cfb |
@@ -1,11 +1,28 @@
|
|
|
8a8cfb |
#include <iostream>
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+/* makedb needs selinux dso's. */
|
|
|
8a8cfb |
+#ifdef HAVE_SELINUX
|
|
|
8a8cfb |
+# include <selinux/selinux.h>
|
|
|
8a8cfb |
+#endif
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
using namespace std;
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+/* The purpose of this file is to indicate to the build system which
|
|
|
8a8cfb |
+ shared objects need to be copied into the testroot, such as gcc or
|
|
|
8a8cfb |
+ selinux support libraries. This program is never executed, only
|
|
|
8a8cfb |
+ scanned for dependencies on shared objects, so the code below may
|
|
|
8a8cfb |
+ seem weird - it's written to survive gcc optimization and force
|
|
|
8a8cfb |
+ such dependencies.
|
|
|
8a8cfb |
+*/
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
int
|
|
|
8a8cfb |
main (int argc, char **argv)
|
|
|
8a8cfb |
{
|
|
|
8a8cfb |
/* Complexity to keep gcc from optimizing this away. */
|
|
|
8a8cfb |
cout << (argc > 1 ? argv[1] : "null");
|
|
|
8a8cfb |
+#ifdef HAVE_SELINUX
|
|
|
8a8cfb |
+ /* This exists to force libselinux.so to be required. */
|
|
|
8a8cfb |
+ cout << "selinux " << is_selinux_enabled ();
|
|
|
8a8cfb |
+#endif
|
|
|
8a8cfb |
return 0;
|
|
|
8a8cfb |
}
|