Re: [patch] Change libselinux to use getpwnam_r

[Thorsten Kukuk <kukuk@suse.de>]

On Tue, Jan 13, Stephen Smalley wrote:

> The attached patch against libselinux-1.4 changes it to use getpwnam_r
> internally instead of getpwnam, so that it doesn't clobber any existing
> pwd struct previously obtained by the caller.  This showed up as an
> issue for the selinux-enabled gdm.  It doesn't appear to affect login or
> sshd, since they make a copy of the pwd struct themselves.

> +       buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
> +       if (buflen < 0)
> +               return -1;
> +       buf = malloc(buflen);
> +       if (!buf)
> +               return -1;
> +       retval = getpwnam_r (user, pwd, buf, buflen, &pwd );
> +        if (retval < 0 || !pwd) {
> +               free(buf);
> +               return -1;
>          }

While _SC_GETPW_R_SIZE_MAX should return the max. size getpwnam_r
needs for a buffer, in reallity this is often not enough. There is
no limit, how long a line in /etc/passwd can be.
So a better way is:

while (getpwnam_r (user, pwd, buf, buflen, &pwd) != 0
         && errno == ERANGE)
    {
      errno = 0;
      buflen *= 2;
      buf = realloc (buf, buflen);
    }


 Thorsten

-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE Linux AG        Maxfeldstr. 5                 D-90409 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.