mirror of
https://github.com/morgan9e/systemd
synced 2026-04-14 00:14:32 +09:00
490aa05ca1
Sincec5de7b14aefile searching implies a new mount api syscall by default, to trigger automounts. This is problematic in NSS plugins, as they are dlopen'ed inside processes by glibc, for two reasons. First of all, potentially searching on a networked filesystem automount could lead to nasty surprises, such as the process responsible for setting up the network filesystem trying to search on that same filesystem. More importantly, the new mount api syscall was never part of the filesystem seccomp filter that we provide by default, and given mounting/remounting/bind mounting is one of the possible ways to bypass sandboxing it is very likely not allowed when custom filters are used in sandboxed processes, if they don't need to do these operations otherwise. The filesystem seccomp mask we provide has been updated, however this only takes effect on the next restart of a service. When systemd is upgraded via a package upgrade, the new nss plugin is installed and will be immediately dlopen'ed by glibc when needed, without waiting for the process to restart, which means the existing seccomp filter applies, causing the filter to trigger. Given it's not really possible for any arbitrary program to predict which NSS modules glibc will load, given programs do not configure that and instead nsswitch is set up by the sysadmin, it's impossible to handle at each process level. It's also not possible to know when it will be triggered, given the plugin is not linked in each binary tools like need-restart cannot even pre-emptively restart services that may be affected. This means in practice, upgrading from systemd << v258 to >= v258 requires a reboot to avoid either subtle or catastrophic system failures. By avoiding to trigger automounts in nss-systemd we can avoid both issues. userdb drop-ins are searched for in: /etc/userdb/ /run/userdb/ /run/host/userdb/ /usr/local/lib/userdb/ /usr/lib/userdb/ none of which are supported as automounts anyway. Note that this happens only when the userdbd service is not running, as otherwise nss-systemd will go through the varlink IPC, rather than doing the searches in-process. So invert CHASE_NO_AUTOFS to CHASE_AUTOFS and set it in the places where we do want to trigger automounts, like looking for the ESP. Follow-up forc5de7b14aeFixes https://github.com/systemd/systemd/issues/38565
64 lines
2.6 KiB
Bash
Executable File
64 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
set -eux
|
|
set -o pipefail
|
|
|
|
# shellcheck source=test/units/util.sh
|
|
. "$(dirname "$0")"/util.sh
|
|
|
|
# Root
|
|
userdbctl user root
|
|
userdbctl user 0
|
|
|
|
# Nobody
|
|
userdbctl user 65534
|
|
|
|
# The 16bit and 32bit -1 user cannot exist
|
|
(! userdbctl user 65535)
|
|
(! userdbctl user 4294967295)
|
|
|
|
userdbctl user foreign-0
|
|
userdbctl user 2147352576
|
|
userdbctl user foreign-1
|
|
userdbctl user 2147352577
|
|
userdbctl user foreign-65534
|
|
userdbctl user 2147418110
|
|
(! userdbctl user foreign-65535)
|
|
(! userdbctl user 2147418111)
|
|
(! userdbctl user foreign-65536)
|
|
(! userdbctl user 2147418112)
|
|
|
|
assert_eq "$(userdbctl user root -j | jq .uid)" 0
|
|
assert_eq "$(userdbctl user foreign-0 -j | jq .uid)" 2147352576
|
|
assert_eq "$(userdbctl user foreign-1 -j | jq .uid)" 2147352577
|
|
assert_eq "$(userdbctl user foreign-65534 -j | jq .uid)" 2147418110
|
|
|
|
assert_eq "$(userdbctl user 0 -j | jq -r .userName)" root
|
|
assert_eq "$(userdbctl user 2147352576 -j | jq -r .userName)" foreign-0
|
|
assert_eq "$(userdbctl user 2147352577 -j | jq -r .userName)" foreign-1
|
|
assert_eq "$(userdbctl user 2147418110 -j | jq -r .userName)" foreign-65534
|
|
|
|
# Make sure that -F shows same data as if we'd ask directly
|
|
userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root)
|
|
userdbctl user systemd-network -j | userdbctl -F- user | cmp - <(userdbctl user systemd-network)
|
|
userdbctl user 65534 -j | userdbctl -F- user | cmp - <(userdbctl user 65534)
|
|
|
|
userdbctl group root -j | userdbctl -F- group | cmp - <(userdbctl group root)
|
|
userdbctl group systemd-network -j | userdbctl -F- group | cmp - <(userdbctl group systemd-network)
|
|
userdbctl group 65534 -j | userdbctl -F- group | cmp - <(userdbctl group 65534)
|
|
|
|
# Ensure NSS doesn't try to automount via open_tree
|
|
if [[ ! -v ASAN_OPTIONS ]]; then
|
|
systemctl stop systemd-userdbd.socket systemd-userdbd.service
|
|
set +o pipefail
|
|
systemd-run -q -t --property SystemCallFilter=~open_tree id definitelynotarealuser | grep -q "no such user"
|
|
systemd-run -q -t --property SystemCallFilter=~open_tree id --groups definitelynotarealuser | grep -q "no such user"
|
|
systemd-run -q -t --property SystemCallFilter=~open_tree groups definitelynotarealuser | grep -q "no such user"
|
|
set -o pipefail
|
|
# getent shows no output when the entry is not found, but exists with 2, while sd-run crashing will exit
|
|
# with 1
|
|
assert_rc 2 systemd-run -q -t --property SystemCallFilter=~open_tree getent passwd definitelynotarealuser
|
|
assert_rc 2 systemd-run -q -t --property SystemCallFilter=~open_tree getent group definitelynotarealgroup
|
|
systemctl start systemd-userdbd.socket systemd-userdbd.service
|
|
fi
|