src/openrc-user/openrc-user.c: Preserve struct passwd from PAM#984
Merged
Conversation
salahcoronya
force-pushed
the
openrc-user-getpwnam_r
branch
2 times, most recently
from
March 1, 2026 20:52
6b0cd04 to
fb2a25e
Compare
Member
|
a) in truth, this is a sssd bug (and a bad one), no library should be using global storage, we have to report it to them b) this does not handle ERANGE, opting to abort on any error instead c) after initializing the environment, we only need uid, gid, and pw_shell -- the former two are trivially copiable, so, like i mentioned on the gentoo bug, we want to xstrdup pw_shell and pass that directly instead |
salahcoronya
force-pushed
the
openrc-user-getpwnam_r
branch
from
March 1, 2026 22:59
fb2a25e to
134c2b3
Compare
Contributor
Author
|
Ok, I respun the patch to use the copy/xstrdup approach instead. Or am I barking up the wrong tree here, and is really a bug with sssd? |
salahcoronya
changed the title
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
N-R-K
reviewed
Mar 2, 2026
| parts we need */ | ||
| pwd.pw_uid = user->pw_uid; | ||
| pwd.pw_gid = user->pw_gid; | ||
| pwd.pw_shell = xstrdup(user->pw_shell); |
Contributor
There was a problem hiding this comment.
I would store them in different variables instead and change spawn_openrc to accept them separately, instead of a dummy passwd struct.
Having a struct only partially initialized like this is planting a footgun.
Member
There was a problem hiding this comment.
i'm just going to split that when merging this, because agree
Member
it is a bug with sssd -- i'll merge this as a workaround but sssd really should not be using getpwnam in a dynamically loaded module, that's dangerous and we really should open a bug with them |
navi-desu
force-pushed
the
openrc-user-getpwnam_r
branch
from
March 2, 2026 11:03
134c2b3 to
37ed847
Compare
sssd's pam module seems to call getpwnam, clobbering the global struct. while this is a bug on sssd, let's copy the data out of it as a workaround Closes: github.com/OpenRC/issues/979 Bug: https://bugs.gentoo.org/970235 Signed-off-by: Christopher Byrne <[email protected]> Signed-off-by: Anna (navi) Figueiredo Gomes <[email protected]>
navi-desu
force-pushed
the
openrc-user-getpwnam_r
branch
from
March 2, 2026 11:04
37ed847 to
cf3eef0
Compare
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 2, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 4, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 5, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
salahcoronya
added a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 5, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]>
sssd-bot
pushed a commit
to salahcoronya/sssd
that referenced
this pull request
Mar 6, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Tomáš Halman <[email protected]>
alexey-tikhonov
pushed a commit
to SSSD/sssd
that referenced
this pull request
Mar 6, 2026
…sswd If something else uses PAM (like openrc, see OpenRC/openrc#984) and getpwnam, and calls something like pam_open_session, sssd's call to getpwnam in init_sssd_ids clobbers the cached value by the other program. Signed-off-by: Christopher Byrne <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Tomáš Halman <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some PAM modules call getpwnam(), so pam_open_session can clobber our copy. Use getpwnam_r instead.
Closes: #979