configure.ac: release 4.16.0

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Makefile.am

@@ -15,15 +15,4 @@ SUBDIRS += man
 endif
 
 CLEANFILES = man/8.out man/po/remove-potcdate.* man/*/login.defs.d man/*/*.mo
-
 EXTRA_DIST = tests/
-
-dist-hook:
-	chmod -R u+w $(distdir)/tests
-	chmod u+w $(distdir)
-	mv $(distdir)/tests/unit $(distdir)/realunittest
-	mv $(distdir)/tests/tests $(distdir)/realtests
-	rm -rf $(distdir)/tests
-	mv $(distdir)/realtests $(distdir)/tests
-	rm -rf $(distdir)/tests/unit $(distdir)/tests/Makefile*
-	mv $(distdir)/realunittest $(distdir)/tests/unit

configure.ac

@@ -1,10 +1,10 @@
 dnl Process this file with autoconf to produce a configure script.
 AC_PREREQ([2.69])
-m4_define([libsubid_abi_major], 4)
+m4_define([libsubid_abi_major], 5)
 m4_define([libsubid_abi_minor], 0)
 m4_define([libsubid_abi_micro], 0)
 m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
-AC_INIT([shadow], [4.15.3], [pkg-shadow-devel@lists.alioth.debian.org], [],
+AC_INIT([shadow], [4.16.0], [pkg-shadow-devel@lists.alioth.debian.org], [],
 	[https://github.com/shadow-maint/shadow])
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz subdir-objects tar-pax])
 AC_CONFIG_MACRO_DIRS([m4])
@@ -159,13 +159,6 @@ fi])
 AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$shadow_cv_passwd_dir/passwd",
 	[Path to passwd program.])
 
-dnl XXX - quick hack, should disappear before anyone notices :).
-dnl XXX - I just read the above message :).
-if test "$ac_cv_func_ruserok" = "yes"; then
-	AC_DEFINE(RLOGIN, 1, [Define if login should support the -r flag for rlogind.])
-	AC_DEFINE(RUSEROK, 0, [Define to the ruserok() "success" return value (0 or 1).])
-fi
-
 AC_ARG_ENABLE(shadowgrp,
 	[AS_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],
 	[case "${enableval}" in

lib/Makefile.am

@@ -119,7 +119,6 @@ libshadow_la_SOURCES = \
 	pwdcheck.c \
 	pwmem.c \
 	remove_tree.c \
-	rlogin.c \
 	root_flag.c \
 	run_part.h \
 	run_part.c \

lib/csrand.c

@@ -23,7 +23,6 @@
 #include "sizeof.h"
 
 
-static uint32_t csrand32(void);
 static uint32_t csrand_uniform32(uint32_t n);
 static unsigned long csrand_uniform_slow(unsigned long n);
 
@@ -98,13 +97,6 @@ csrand_interval(unsigned long min, unsigned long max)
 }
 
 
-static uint32_t
-csrand32(void)
-{
-	return csrand();
-}
-
-
 /*
  * Fast Random Integer Generation in an Interval
  * ACM Transactions on Modeling and Computer Simulation 29 (1), 2019
@@ -117,12 +109,12 @@ csrand_uniform32(uint32_t n)
 	uint64_t  r, mult;
 
 	if (n == 0)
-		return csrand32();
+		return csrand();
 
 	bound = -n % n;  // analogous to `2^32 % n`, since `x % y == (x-y) % y`
 
 	do {
-		r = csrand32();
+		r = csrand();
 		mult = r * n;
 		rem = mult;  // analogous to `mult % 2^32`
 	} while (rem < bound);  // p = (2^32 % n) / 2^32;  W.C.: n=2^31+1, p=0.5

lib/nss.c

@@ -131,6 +131,11 @@ void nss_init(const char *nsswitch_path) {
 		fprintf(shadow_logfd, "%s did not provide @find_subid_owners@\n", libname);
 		goto close_lib;
 	}
+	subid_nss->free = dlsym(h, "shadow_subid_free");
+	if (!subid_nss->free) {
+		fprintf(shadow_logfd, "%s did not provide @subid_free@\n", libname);
+		goto close_lib;
+	}
 	subid_nss->handle = h;
 	goto done;
 

lib/prototypes.h

@@ -284,6 +284,19 @@ struct subid_nss_ops {
 	 */
 	enum subid_status (*find_subid_owners)(unsigned long id, enum subid_type id_type, uid_t **uids, int *count);
 
+	/*
+	 * nss_free: free a memory block allocated by a subid plugin.
+	 *
+	 * @ptr - a pointer to a memory block to deallocate
+	 *
+	 * Some routines of subid_nss_ops allocate memory which should be freed by
+	 * caller after use. In order to deallocate that memory block, one should
+	 * use this routine to release that memory. By default, this function
+	 * pointer is set to free(3) for backward compatibility. However, it is
+	 * strongly recommended to define this routine explicitly.
+	 */
+	void (*free)(void *ptr);
+
 	/* The dlsym handle to close */
 	void *handle;
 };
@@ -356,10 +369,6 @@ unsigned long csrand_interval (unsigned long min, unsigned long max);
 /* remove_tree.c */
 extern int remove_tree (const char *root, bool remove_root);
 
-/* rlogin.c */
-extern int do_rlogin(const char *remote_host, char *name, size_t namesize,
-                     char *term, size_t termsize);
-
 /* root_flag.c */
 extern void process_root_flag (const char* short_opt, int argc, char **argv);
 

lib/rlogin.c

@@ -1,135 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 1989 - 1994, Julianne Frances Haugh
- * SPDX-FileCopyrightText: 1996 - 1999, Marek Michałkiewicz
- * SPDX-FileCopyrightText: 2003 - 2005, Tomasz Kłoczko
- * SPDX-FileCopyrightText: 2007 - 2008, Nicolas François
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-
-#include <config.h>
-
-#ifdef RLOGIN
-
-#ident "$Id$"
-
-#include "prototypes.h"
-#include "defines.h"
-#include <stdio.h>
-#include <pwd.h>
-#include <netdb.h>
-
-#include "atoi/str2i.h"
-
-
-static struct {
-	int spd_name;
-	int spd_baud;
-} speed_table[] =
-{
-	{ B50, 50},
-	{ B75, 75},
-	{ B110, 110},
-	{ B134, 134},
-	{ B150, 150},
-	{ B200, 200},
-	{ B300, 300},
-	{ B600, 600},
-	{ B1200, 1200},
-	{ B1800, 1800},
-	{ B2400, 2400},
-	{ B4800, 4800},
-	{ B9600, 9600},
-	{ B19200, 19200},
-	{ B38400, 38400},
-	{ -1, -1}
-};
-
-
-static void
-get_remote_string(char *buf, size_t size)
-{
-	for (;;) {
-		if (read (0, buf, 1) != 1) {
-			exit (EXIT_FAILURE);
-		}
-		if ('\0' == *buf) {
-			return;
-		}
-		--size;
-		if (size > 0) {
-			++buf;
-		}
-	}
-	/*NOTREACHED*/
-}
-
-
-int
-do_rlogin(const char *remote_host, char *name, size_t namesize, char *term,
-          size_t termsize)
-{
-	struct passwd *pwd;
-	char remote_name[32];
-	char *cp;
-	unsigned long remote_speed = 9600;
-	int speed_name = B9600;
-	int i;
-	TERMIO termio;
-
-	get_remote_string(remote_name, sizeof(remote_name));
-	get_remote_string(name, namesize);
-	get_remote_string(term, termsize);
-
-	cp = strchr (term, '/');
-	if (NULL != cp) {
-		*cp = '\0';
-		cp++;
-
-		if (str2ul(&remote_speed, cp) == -1)
-			remote_speed = 9600;
-	}
-	for (i = 0;
-	     (   (speed_table[i].spd_baud != remote_speed)
-	      && (speed_table[i].spd_name != -1));
-	     i++);
-
-	if (-1 != speed_table[i].spd_name) {
-		speed_name = speed_table[i].spd_name;
-	}
-
-	/*
-	 * Put the terminal in cooked mode with echo turned on.
-	 */
-
-	GTTY (0, &termio);
-	termio.c_iflag |= ICRNL | IXON;
-	termio.c_oflag |= OPOST | ONLCR;
-	termio.c_lflag |= ICANON | ECHO | ECHOE;
-#ifdef CBAUD
-	termio.c_cflag = (termio.c_cflag & ~CBAUD) | speed_name;
-#else
-	termio.c_cflag = (termio.c_cflag) | speed_name;
-#endif
-	STTY (0, &termio);
-
-	pwd = getpwnam (name); /* local, no need for xgetpwnam */
-	if (NULL == pwd) {
-		return 0;
-	}
-
-	/*
-	 * ruserok() returns 0 for success on modern systems, and 1 on
-	 * older ones.  If you are having trouble with people logging
-	 * in without giving a required password, THIS is the culprit -
-	 * go fix the #define in config.h.
-	 */
-
-#ifndef	RUSEROK
-	return 0;
-#else
-	return ruserok (remote_host, pwd->pw_uid == 0,
-			remote_name, name) == RUSEROK;
-#endif
-}
-#endif				/* RLOGIN */

lib/subordinateio.c

@@ -274,8 +274,40 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
 	return NULL;
 }
 
+/*
+ * have_range: check whether @owner is authorized to use the range
+ *             (@start .. @start+@count-1).
+ * @db: database to check
+ * @owner: owning uid being queried
+ * @start: start of range
+ * @count: number of uids in range
+ *
+ * Returns true if @owner is authorized to use the range, false otherwise.
+ */
 static bool have_range(struct commonio_db *db,
-		       const char *owner, unsigned long start, unsigned long count);
+		       const char *owner, unsigned long start, unsigned long count)
+{
+	const struct subordinate_range *range;
+	unsigned long end;
+
+	if (count == 0)
+		return false;
+
+	end = start + count - 1;
+	range = find_range (db, owner, start);
+	while (range) {
+		unsigned long last;
+
+		last = range->start + range->count - 1;
+		if (last >= (start + count - 1))
+			return true;
+
+		count = end - last;
+		start = last + 1;
+		range = find_range(db, owner, start);
+	}
+	return false;
+}
 
 static bool append_range(struct subid_range **ranges, const struct subordinate_range *new, int n)
 {
@@ -542,64 +574,6 @@ static struct commonio_db subordinate_uid_db = {
 	false			/* setname */
 };
 
-/*
- * have_range: check whether @owner is authorized to use the range
- *             (@start .. @start+@count-1).
- * @db: database to check
- * @owner: owning uid being queried
- * @start: start of range
- * @count: number of uids in range
- *
- * Returns true if @owner is authorized to use the range, false otherwise.
- */
-static bool have_range(struct commonio_db *db,
-		       const char *owner, unsigned long start, unsigned long count)
-{
-	const struct subordinate_range *range;
-	unsigned long end;
-	bool doclose = false;
-	bool ret = false;
-	int rc;
-
-	if (count == 0)
-		return false;
-
-	if (!db->isopen) {
-		doclose = true;
-		if (db == &subordinate_uid_db)
-			rc = sub_uid_open(O_RDONLY);
-		else
-			rc = sub_gid_open(O_RDONLY);
-		if (rc < 0)
-			return false;
-	}
-
-	end = start + count - 1;
-	range = find_range (db, owner, start);
-	while (range) {
-		unsigned long last;
-
-		last = range->start + range->count - 1;
-		if (last >= (start + count - 1)) {
-			ret = true;
-			break;
-		}
-
-		count = end - last;
-		start = last + 1;
-		range = find_range(db, owner, start);
-	}
-
-	if (doclose) {
-		if (db == &subordinate_uid_db)
-			sub_uid_close();
-		else
-			sub_gid_close();
-	}
-
-	return ret;
-}
-
 int sub_uid_setdbname (const char *filename)
 {
 	return commonio_setname (&subordinate_uid_db, filename);
@@ -1143,6 +1117,16 @@ bool release_subid_range(struct subordinate_range *range, enum subid_type id_typ
 	return ret;
 }
 
+void free_subid_pointer(void *ptr)
+{
+	struct subid_nss_ops *h = get_subid_nss_handle();
+	if (h) {
+		h->free(ptr);
+	} else {
+		free(ptr);
+	}
+}
+
 #else				/* !ENABLE_SUBIDS */
 extern int ISO_C_forbids_an_empty_translation_unit;
 #endif				/* !ENABLE_SUBIDS */

lib/subordinateio.h

@@ -43,6 +43,9 @@ extern int sub_gid_unlock (void);
 extern int sub_gid_add (const char *owner, gid_t start, unsigned long count);
 extern int sub_gid_remove (const char *owner, gid_t start, unsigned long count);
 extern uid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count);
+
+extern void free_subid_pointer(void *ptr);
+
 #endif				/* ENABLE_SUBIDS */
 
 #endif

libsubid/api.c

@@ -42,6 +42,11 @@ bool subid_init(const char *progname, FILE * logfd)
 	return true;
 }
 
+void subid_free(void *ptr)
+{
+	free_subid_pointer(ptr);
+}
+
 static
 int get_subid_ranges(const char *owner, enum subid_type id_type, struct subid_range **ranges)
 {

libsubid/subid.h.in

@@ -55,6 +55,19 @@ extern "C" {
  */
 bool subid_init(const char *progname, FILE *logfd);
 
+/*
+ * subid_free: free memory allocated in any subid_* function
+ *
+ * @ptr: Pointer to a memory block to release.
+ *
+ * Some functions like @subid_get_uid_ranges allocate memory internally. As
+ * soon as a result is no longer needed, it should be freed with this routine.
+ * Initially, default function `free()` was used. Thus for backward
+ * compatibility this function falls back to `free()` if a plugin does not
+ * explicitly specify routine to free allocated memory.
+ */
+void subid_free(void *ptr);
+
 /*
  * subid_get_uid_ranges: return a list of UID ranges for a user
  *

man/login.1.xml

@@ -215,14 +215,6 @@
 	  <para>Preserve environment.</para>
 	</listitem>
       </varlistentry>
-      <varlistentry>
-	<term>
-	  <option>-r</option>
-	</term>
-	<listitem>
-	  <para>Perform autologin protocol for rlogin.</para>
-	</listitem>
-      </varlistentry>
     </variablelist>
 
     <para>

po/POTFILES.in

@@ -53,7 +53,6 @@ lib/pwdcheck.c
 lib/pwio.c
 lib/pwmem.c
 lib/remove_tree.c
-lib/rlogin.c
 lib/root_flag.c
 lib/salt.c
 lib/selinux.c

src/getsubids.c

@@ -44,6 +44,6 @@ int main(int argc, char *argv[])
 		printf("%d: %s %lu %lu\n", i, owner,
 			ranges[i].start, ranges[i].count);
 	}
-	free(ranges);
+	subid_free(ranges);
 	return 0;
 }

src/login.c

@@ -85,11 +85,6 @@ static struct lastlog ll;
 static bool pflg = false;
 static bool fflg = false;
 
-#ifdef RLOGIN
-static bool rflg = false;
-#else				/* RLOGIN */
-#define rflg false
-#endif				/* !RLOGIN */
 static bool hflg = false;
 static bool preauth_flag = false;
 
@@ -134,7 +129,6 @@ static void exit_handler (int);
  * usage - print login command usage and exit
  *
  * login [ name ]
- * login -r hostname	(for rlogind)
  * login -h hostname	(for telnetd, etc.)
  * login -f name	(for pre-authenticated login: datakit, xterm, etc.)
  */
@@ -145,9 +139,6 @@ static void usage (void)
 		exit (1);
 	}
 	fprintf (stderr, _("       %s [-p] [-h host] [-f name]\n"), Prog);
-#ifdef RLOGIN
-	fprintf (stderr, _("       %s [-p] -r host\n"), Prog);
-#endif				/* RLOGIN */
 	exit (1);
 }
 
@@ -271,7 +262,7 @@ static void process_flags (int argc, char *const *argv)
 	/*
 	 * Check the flags for proper form. Every argument starting with
 	 * "-" must be exactly two characters long. This closes all the
-	 * clever rlogin, telnet, and getty holes.
+	 * clever telnet, and getty holes.
 	 */
 	for (arg = 1; arg < argc; arg++) {
 		if (argv[arg][0] == '-' && strlen (argv[arg]) > 2) {
@@ -298,13 +289,6 @@ static void process_flags (int argc, char *const *argv)
 			hostname = optarg;
 			reason = PW_TELNET;
 			break;
-#ifdef	RLOGIN
-		case 'r':
-			rflg = true;
-			hostname = optarg;
-			reason = PW_RLOGIN;
-			break;
-#endif				/* RLOGIN */
 		case 'p':
 			pflg = true;
 			break;
@@ -313,21 +297,11 @@ static void process_flags (int argc, char *const *argv)
 		}
 	}
 
-#ifdef RLOGIN
-	/*
-	 * Neither -h nor -f should be combined with -r.
-	 */
-
-	if (rflg && (hflg || fflg)) {
-		usage ();
-	}
-#endif				/* RLOGIN */
-
 	/*
 	 * Allow authentication bypass only if real UID is zero.
 	 */
 
-	if ((rflg || fflg || hflg) && !amroot) {
+	if ((fflg || hflg) && !amroot) {
 		fprintf (stderr, _("%s: Permission denied.\n"), Prog);
 		exit (1);
 	}
@@ -342,11 +316,6 @@ static void process_flags (int argc, char *const *argv)
 		++optind;
 	}
 
-#ifdef	RLOGIN
-	if (rflg && (NULL != username)) {
-		usage ();
-	}
-#endif				/* RLOGIN */
 	if (fflg && (NULL == username)) {
 		usage ();
 	}
@@ -474,7 +443,6 @@ static /*@observer@*/const char *get_failent_user (/*@returned@*/const char *use
  *	the flags which login supports are
  *
  *	-p - preserve the environment
- *	-r - perform autologin protocol for rlogin
  *	-f - do not perform authentication, user is preauthenticated
  *	-h - the name of the remote host
  */
@@ -505,9 +473,6 @@ int main (int argc, char **argv)
 # if defined(ENABLE_LASTLOG)
 	char           ptime[80];
 # endif
-#endif
-#if defined(RLOGIN)
-	char           term[128] = "";
 #endif
 
 	/*
@@ -559,7 +524,7 @@ int main (int argc, char **argv)
 	is_console = console (tty);
 #endif
 
-	if (rflg || hflg) {
+	if (hflg) {
 		/*
 		 * Add remote hostname to the environment. I think
 		 * (not sure) I saw it once on Irix.  --marekm
@@ -572,23 +537,6 @@ int main (int argc, char **argv)
 	if (hflg) {
 		reason = PW_RLOGIN;
 	}
-#ifdef RLOGIN
-	if (rflg) {
-		size_t  max_size;
-
-		max_size = login_name_max_size();
-		assert (NULL == username);
-		username = XMALLOC(max_size, char);
-		username[max_size - 1] = '\0';
-		if (do_rlogin(hostname, username, max_size, term, sizeof(term)))
-		{
-			preauth_flag = true;
-		} else {
-			free (username);
-			username = NULL;
-		}
-	}
-#endif				/* RLOGIN */
 
 	OPENLOG (Prog);
 
@@ -623,18 +571,11 @@ int main (int argc, char **argv)
 		}
 	}
 
-#ifdef RLOGIN
-	if (term[0] != '\0') {
-		addenv ("TERM", term);
-	} else
-#endif				/* RLOGIN */
-	{
-		/* preserve TERM from getty */
-		if (!pflg) {
-			tmp = getenv ("TERM");
-			if (NULL != tmp) {
-				addenv ("TERM", tmp);
-			}
+	/* preserve TERM from getty */
+	if (!pflg) {
+		tmp = getenv ("TERM");
+		if (NULL != tmp) {
+			addenv ("TERM", tmp);
 		}
 	}
 
@@ -644,7 +585,7 @@ int main (int argc, char **argv)
 		set_env (argc - optind, &argv[optind]);
 	}
 
-	if (rflg || hflg) {
+	if (hflg) {
 		cp = hostname;
 	} else if ((host != NULL) && (host[0] != '\0')) {
 		cp = host;
@@ -954,7 +895,7 @@ int main (int argc, char **argv)
 		}
 
 		/*
-		 * The -r and -f flags provide a name which has already
+		 * The -f flag provides a name which has already
 		 * been authenticated by some server.
 		 */
 		if (preauth_flag) {
@@ -1043,8 +984,8 @@ int main (int argc, char **argv)
 
 		(void) puts (_("Login incorrect"));
 
-		/* allow only one attempt with -r or -f */
-		if (rflg || fflg || (retries <= 0)) {
+		/* allow only one attempt with -f */
+		if (fflg || (retries <= 0)) {
 			closelog ();
 			exit (1);
 		}

tests/bug332198-test.exp

@@ -1,61 +0,0 @@
-#!/usr/bin/expect -f
-
-# This is a script for repeatedly logging into the localhost
-# using `rlogin` in order to apparently see a symptoms described
-# in bug #332198.
-# As described in the bug log, sometimes `rlogind` will fail to
-# establish a connection, because it starts "login" process and
-# the latter fails with "unable to determine TTY name, got /dev/pts/1"
-# message.
-# 
-# BUGS
-# 
-# * the script rlogins to localhost
-# * the script doesn't handle passwdord prompt, because it's intended
-#   to use .rhosts auth and expects shell prompt immediately after
-#   `rlogin`
-# * the regexp for shell prompt is hardcoded
-
-log_user 0
-match_max 8192
-
-while {1} {
-    set rlogin_spawn [spawn rlogin localhost]
-    if { $rlogin_spawn == 0 } { exit 1 }
-    expect {
-	-timeout 10 -re "^.*(Last login\[^\r\n\]*).*\n(\[^\r\n\]*\[#$\] )$" {
-	    send_error "$expect_out(1,string)\n"
-	    send_error "$expect_out(2,string)\n"
-#	    send_error "$expect_out(0,string)\n"
-	}
-	timeout {
-	    send_error "TIMEOUT/prompt\n"
-	    send_error "$expect_out(buffer)\n"
-	    send_error "RETRYING\n"
-	    log_user 1
-	    send "tty /\r"
-	    expect -timeout 2 -re "^.*\r?\n(\[^\r\n\]*# )$" {}
-	    send "tty /\r"
-	    expect -timeout 2 -re "^.*\r?\n(\[^\r\n\]*# )$" {}
-	    send_error "\n"
-	    exit 2
-	}
-    }
-    send "tty\r"
-    expect {
-	-timeout 4 -re "tty\r?\n(\[^\r\n\]*)\r?\n(\[^\r\n\]*\[#$\] )$" {
-	    send_error "$expect_out(2,string)$expect_out(1,string)\n"
-#	    send_error "$expect_out(0,string)\n"
-	}
-	timeout { send_error "TIMEOUT/tty\n" ; exit 3 }
-    }
-    send "exit\r"
-    expect {
-	-timeout 2 eof {
-#	    send_error "OK4: EOF\n"
-	}
-	timeout { send_error "TIMEOUT/eof\n" ; exit 4 }
-    }
-    wait
-}
-# vi: set sw=4:

tests/common/config.sh

@@ -2,16 +2,14 @@
 
 set -e
 
-if [ -n "${BUILD_BASE_DIR}" ]; then
-    build_path="${BUILD_BASE_DIR}"
-else
-    build_path=$(git rev-parse --show-toplevel)
+build_path=$(pwd)
+while [ "${build_path}" != "/" -a ! -e "${build_path}/.git" ]; do
+	build_path=$(dirname ${build_path})
+done
+if [ ! -e "${build_path}/.git" ]; then
+	echo "Not inside git directory" 1>&2
+	exit 1
 fi
-if [ -z "${build_path}" ]; then
-    echo "Failed to find build base path"
-    exit 1
-fi
-export build_path
 
 # Save the configuration files in tmp.
 save_config ()

tests/libsubid/04_nss/Makefile

@@ -1,15 +1,12 @@
 all: test_nss libsubid_zzz.so
 
-BASE_TEST_DIR ?= $(shell git rev-parse --show-toplevel)
-basedir := $(BASE_TEST_DIR)
-
-test_nss: test_nss.c $(basedir)/lib/nss.c
-	gcc -c -I$(basedir)/lib/ -I$(basedir) -o test_nss.o test_nss.c
-	gcc -o test_nss test_nss.o $(basedir)/lib/.libs/libshadow.a -ldl
+test_nss: test_nss.c ../../../lib/nss.c
+	gcc -c -I../../../lib/ -I../../.. -o test_nss.o test_nss.c
+	gcc -o test_nss test_nss.o ../../../lib/.libs/libshadow.a -ldl
 
 libsubid_zzz.so: libsubid_zzz.c
-	gcc -c -I$(basedir)/lib/ -I$(basedir) -I$(basedir)/libsubid libsubid_zzz.c
-	gcc -L$(basedir)/libsubid -shared -o libsubid_zzz.so libsubid_zzz.o $(basedir)/lib/.libs/libshadow.a -ldl
+	gcc -c -I../../../lib/ -I../../.. -I../../../libsubid libsubid_zzz.c
+	gcc -L../../../libsubid -shared -o libsubid_zzz.so libsubid_zzz.o ../../../lib/.libs/libshadow.a -ldl
 
 clean:
 	rm -f *.o *.so test_nss

tests/libsubid/04_nss/libsubid_zzz.c

@@ -138,3 +138,8 @@ enum subid_status shadow_subid_list_owner_ranges(const char *owner, enum subid_t
 
 	return SUBID_STATUS_SUCCESS;
 }
+
+void shadow_subid_free(void *ptr)
+{
+	free(ptr);
+}

tests/libsubid/04_nss/subidnss.test

@@ -9,7 +9,7 @@ cd $(dirname $0)
 
 make
 
-export LD_LIBRARY_PATH=.:${build_path}/lib/.libs:$LD_LIBRARY_PATH
+export LD_LIBRARY_PATH=.:../../../lib/.libs:$LD_LIBRARY_PATH
 
 ./test_nss 1
 ./test_nss 2

tests/libsubid/04_nss/test_range

@@ -11,23 +11,23 @@ cleanup1() {
     umount /etc/nsswitch.conf
 }
 trap cleanup1 EXIT HUP INT TERM
-${build_path}/src/check_subid_range user1 u 100000 65535
+../../../src/check_subid_range user1 u 100000 65535
 if [ $? -ne 0 ]; then
     exit 1
 fi
-${build_path}/src/check_subid_range user2 u 100000 65535
+../../../src/check_subid_range user2 u 100000 65535
 if [ $? -eq 0 ]; then
     exit 1
 fi
-${build_path}/src/check_subid_range unknown u 100000 65535
+../../../src/check_subid_range unknown u 100000 65535
 if [ $? -eq 0 ]; then
     exit 1
 fi
-${build_path}/src/check_subid_range error u 100000 65535
+../../../src/check_subid_range error u 100000 65535
 if [ $? -eq 0 ]; then
     exit 1
 fi
-${build_path}/src/check_subid_range user1 u 1000 65535
+../../../src/check_subid_range user1 u 1000 65535
 if [ $? -eq 0 ]; then
     exit 1
 fi
@@ -43,7 +43,7 @@ cleanup2() {
     umount /etc/nsswitch.conf
 }
 trap cleanup2 EXIT HUP INT TERM
-${build_path}/src/check_subid_range user1 u 100000 65535
+../../../src/check_subid_range user1 u 100000 65535
 if [ $? -eq 0 ]; then
     exit 1
 fi

tests/run_some

@@ -7,22 +7,6 @@ unset LANG
 unset LANGUAGE
 . common/config.sh
 
-# When we unshare -Ur, we must be able to descend the build path.
-# But $HOME might not be world x.  Fix that.
-fixup_home_perms() {
-       p="${build_path}"
-       d=""
-       echo "$p" | tr '/' '\n' | while read f; do
-               if [ -z "$f" ]; then
-                       continue
-               fi
-               d="$d/$f"
-               chmod ugo+x "$d"
-       done
-}
-
-fixup_home_perms
-
 USE_PAM="yes"
 FAILURE_TESTS="yes"
 

tests/unit/test_xasprintf.c

@@ -5,7 +5,6 @@
 
 
 #include <setjmp.h>
-#include <stdarg.h>
 #include <stddef.h>
 #include <stdlib.h>
 #include <string.h>
@@ -29,29 +28,13 @@
 static jmp_buf  jmpb;
 
 
+/**********************
+ * WRAPPERS
+ **********************/
 int __real_vasprintf(char **restrict p, const char *restrict fmt, va_list ap);
 int __wrap_vasprintf(char **restrict p, const char *restrict fmt, va_list ap);
 void __wrap_exit(int status);
 
-[[gnu::noipa]]
-static int xasprintf_volatile(char *volatile *restrict s,
-    const char *restrict fmt, ...);
-
-static void test_xasprintf_exit(void **state);
-static void test_xasprintf_ok(void **state);
-
-
-int
-main(void)
-{
-	const struct CMUnitTest  tests[] = {
-		cmocka_unit_test(test_xasprintf_exit),
-		cmocka_unit_test(test_xasprintf_ok),
-	};
-
-	return cmocka_run_group_tests(tests, NULL, NULL);
-}
-
 
 int
 __wrap_vasprintf(char **restrict p, const char *restrict fmt, va_list ap)
@@ -67,16 +50,11 @@ __wrap_exit(int status)
 }
 
 
-static int
-xasprintf_volatile(char *volatile *restrict s, const char *restrict fmt, ...)
-{
-	int      len;
-	va_list  ap;
-
-	va_start(ap, fmt);
-	len = xvasprintf((char **) s, fmt, ap);
-	va_end(ap);
-}
+/**********************
+ * TEST
+ **********************/
+static void test_xasprintf_exit(void **state);
+static void test_xasprintf_ok(void **state);
 
 
 static void
@@ -92,7 +70,7 @@ test_xasprintf_exit(void **state)
 	switch (setjmp(jmpb)) {
 	case 0:
 		len = XASPRINTF_CALLED;
-		len = xasprintf_volatile(&p, "foo%s", "bar");
+		len = xasprintf(&p, "foo%s", "bar");
 		assert_unreachable();
 		break;
 	case EXIT_CALLED:
@@ -122,3 +100,15 @@ test_xasprintf_ok(void **state)
 	assert_string_equal(p, "foo1bar");
 	free(p);
 }
+
+
+int
+main(void)
+{
+    const struct CMUnitTest  tests[] = {
+        cmocka_unit_test(test_xasprintf_exit),
+        cmocka_unit_test(test_xasprintf_ok),
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}