search

tests-always-included / libnss_exec

Other
12 stars 4 forks source link

getpwent: infinite loop because of inverted result_status in _nss_exec_getpwent_r_locked #4

Open alexburt opened 1 year ago

alexburt commented 1 year ago

Hello, What is a purpose of invertion of result_status in _nss_exec_getpwent_r_locked ?

NSS_STATUS_SUCCESS is 1. From the _nss_exec_getpwent_r_locked return will be NSS_STATUS_SUCCESS even if it get error from nss_exec_script_long. That may cause infinite loop when getpwent is used to enumerate users because getpwent will always return pointer instead of 0.

https://github.com/tests-always-included/libnss_exec/blob/master/nss_exec-passwd.c#L86

fidian commented 1 year ago

Forgive me for not responding right away. I haven't used this in quite a while and it worked great when I did use it in a production environment with many users.

NSS_STATUS_SUCCESS is indeed defined to be 1 in this case. _nss_exec_getpwent_r_locked is called by _nss_exec_getpwent_r, and that's called by NSS. Return code 0 is NSS_STATUS_NOTFOUND and it appears that there could be an issue with my code but I would it verified.

I'm not entirely sure about why I thought the behavior was correct. 8 years ago I added commit https://github.com/tests-always-included/libnss_exec/commit/c9fb7115d3d46b1e06e2659930de9f848eaade85 to address a problem and included extra code in the test to verify that the code was working as intended. If I recall correctly, I found some other code that operated similarly for a different NSS module.

Are you experiencing problems?

alexburt commented 1 year ago

Some programs hang because getpwent return pointer instead of null. For example python3 -c "import pwd; pwd.getpwall()"

/usr/sbin/nss_exec content:

!/bin/bash

echo $@ >>/tmp/nss_exec.log if [ "$1" == "setpwent" ]; then exit 0 fi exit 1

log is: setpwent getpwent 0 getpwent 0 getpwent 0 getpwent 0 getpwent 0 ......

alexburt commented 1 year ago

Falco hangs when it enumerates users on system: https://github.com/falcosecurity/libs/blob/0790cffa6c4ab485a7eb05126a2d8c6c99ad7328/userspace/libscap/linux/scap_userlist.c#L122

fidian commented 1 year ago

I have not used this module in quite some time and don't have it set up to adequately test any changes. However, if you change the code and test it and submit a pull request, I will be happy to merge it.

Thank you for the time you've already put into diagnosing and solving this problem.