8492dee663
Closes #154 When starting any operation to do with subuid delegation, check nsswitch for a module to use. If none is specified, then use the traditional /etc/subuid and /etc/subgid files. Currently only one module is supported, and there is no fallback to the files on errors. Several possibilities could be considered: 1. in case of connection error, fall back to files 2. in case of unknown user, also fall back to files etc... When non-files nss module is used, functions to edit the range are not supported. It may make sense to support it, but it also may make sense to require another tool to be used. libsubordinateio also uses the nss_ helpers. This is how for instance lxc could easily be converted to supporting nsswitch. Add a set of test cases, including a dummy libsubid_zzz module. This hardcodes values such that: 'ubuntu' gets 200000 - 300000 'user1' gets 100000 - 165536 'error' emulates an nss module error 'unknown' emulates a user unknown to the nss module 'conn' emulates a connection error ot the nss module Changes to libsubid: Change the list_owner_ranges api: return a count instead of making the array null terminated. This is a breaking change, so bump the libsubid abi major number. Rename free_subuid_range and free_subgid_range to ungrant_subuid_range, because otherwise it's confusing with free_subid_ranges which frees memory. Run libsubid tests in jenkins Switch argument order in find_subid_owners Move the db locking into subordinateio.c Signed-off-by: Serge Hallyn <serge@hallyn.com>
49 lines
2.0 KiB
C
49 lines
2.0 KiB
C
/*
|
|
* Copyright (c) 2012- Eric W. Biederman
|
|
*/
|
|
|
|
#ifndef _SUBORDINATEIO_H
|
|
#define _SUBORDINATEIO_H
|
|
|
|
#include <config.h>
|
|
|
|
#ifdef ENABLE_SUBIDS
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include "../libsubid/subid.h"
|
|
|
|
extern int sub_uid_close(void);
|
|
extern bool have_sub_uids(const char *owner, uid_t start, unsigned long count);
|
|
extern bool sub_uid_file_present (void);
|
|
extern bool sub_uid_assigned(const char *owner);
|
|
extern int sub_uid_lock (void);
|
|
extern int sub_uid_setdbname (const char *filename);
|
|
extern /*@observer@*/const char *sub_uid_dbname (void);
|
|
extern int sub_uid_open (int mode);
|
|
extern int sub_uid_unlock (void);
|
|
extern int sub_uid_add (const char *owner, uid_t start, unsigned long count);
|
|
extern int sub_uid_remove (const char *owner, uid_t start, unsigned long count);
|
|
extern uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count);
|
|
extern int list_owner_ranges(const char *owner, enum subid_type id_type, struct subordinate_range ***ranges);
|
|
extern bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, bool reuse);
|
|
extern bool release_subid_range(struct subordinate_range *range, enum subid_type id_type);
|
|
extern int find_subid_owners(unsigned long id, enum subid_type id_type, uid_t **uids);
|
|
extern void free_subordinate_ranges(struct subordinate_range **ranges, int count);
|
|
|
|
extern int sub_gid_close(void);
|
|
extern bool have_sub_gids(const char *owner, gid_t start, unsigned long count);
|
|
extern bool sub_gid_file_present (void);
|
|
extern bool sub_gid_assigned(const char *owner);
|
|
extern int sub_gid_lock (void);
|
|
extern int sub_gid_setdbname (const char *filename);
|
|
extern /*@observer@*/const char *sub_gid_dbname (void);
|
|
extern int sub_gid_open (int mode);
|
|
extern int sub_gid_unlock (void);
|
|
extern int sub_gid_add (const char *owner, gid_t start, unsigned long count);
|
|
extern int sub_gid_remove (const char *owner, gid_t start, unsigned long count);
|
|
extern uid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count);
|
|
#endif /* ENABLE_SUBIDS */
|
|
|
|
#endif
|