8b36662205
GNU Hurd doesn't define LOGIN_NAME_MAX. GNU Hurd recommends having no
system limits. When a program needs a limit, because it needs to
validate user input, it is recommended that each program defines its own
limit macros. The rationale is that this avoids hard-coded limits in
ABIs, which cannot be modified ever.
However, that doesn't mean that programs should have no limits at all.
We use this limit for validating user input, and so we shouldn't allow
anything just because the system doesn't want to set a limit.
So, when sysconf(2) returns -1, either due to an error or due to a claim
for no limits, we must fall back to the LOGIN_NAME_MAX value. And if
the system doesn't define that value, we must define it ourselves (we're
more or less free to choose any value, so let's pick the one that glibc
provides nowadays).
Fixes: 6a1f45d932 (2024-02-04; "lib/chkname.c: Support unlimited user name lengths")
Closes: <https://github.com/shadow-maint/shadow/issues/1166>
Cc: Chris Hofstaedtler <zeha@debian.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
144 lines
2.7 KiB
C
144 lines
2.7 KiB
C
// SPDX-FileCopyrightText: 1990-1994, Julianne Frances Haugh
|
|
// SPDX-FileCopyrightText: 1996-2000, Marek Michałkiewicz
|
|
// SPDX-FileCopyrightText: 2001-2005, Tomasz Kłoczko
|
|
// SPDX-FileCopyrightText: 2005-2008, Nicolas François
|
|
// SPDX-FileCopyrightText: 2023-2025, Alejandro Colomar <alx@kernel.org>
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
|
|
/*
|
|
* is_valid_user_name(), is_valid_group_name() - check the new user/group
|
|
* name for validity;
|
|
* return values:
|
|
* true - OK
|
|
* false - bad name
|
|
* errors:
|
|
* EINVAL Invalid name characters or sequences
|
|
* EOVERFLOW Name longer than maximum size
|
|
*/
|
|
|
|
|
|
#include <config.h>
|
|
|
|
#ident "$Id$"
|
|
|
|
#include <ctype.h>
|
|
#include <errno.h>
|
|
#include <limits.h>
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <unistd.h>
|
|
|
|
#include "defines.h"
|
|
#include "chkname.h"
|
|
#include "string/strcmp/streq.h"
|
|
|
|
|
|
#ifndef LOGIN_NAME_MAX
|
|
# define LOGIN_NAME_MAX 256
|
|
#endif
|
|
|
|
|
|
int allow_bad_names = false;
|
|
|
|
|
|
size_t
|
|
login_name_max_size(void)
|
|
{
|
|
long conf;
|
|
|
|
conf = sysconf(_SC_LOGIN_NAME_MAX);
|
|
if (conf == -1)
|
|
return LOGIN_NAME_MAX;
|
|
|
|
return conf;
|
|
}
|
|
|
|
|
|
static bool
|
|
is_valid_name(const char *name)
|
|
{
|
|
if (allow_bad_names) {
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* User/group names must match BRE regex:
|
|
* [a-zA-Z0-9_.][a-zA-Z0-9_.-]*$\?
|
|
*
|
|
* as a non-POSIX, extension, allow "$" as the last char for
|
|
* sake of Samba 3.x "add machine script"
|
|
*
|
|
* Also do not allow fully numeric names or just "." or "..".
|
|
*/
|
|
int numeric;
|
|
|
|
if ('\0' == *name ||
|
|
('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
|
|
'\0' == name[1])) ||
|
|
!((*name >= 'a' && *name <= 'z') ||
|
|
(*name >= 'A' && *name <= 'Z') ||
|
|
(*name >= '0' && *name <= '9') ||
|
|
*name == '_' ||
|
|
*name == '.'))
|
|
{
|
|
errno = EINVAL;
|
|
return false;
|
|
}
|
|
|
|
numeric = isdigit(*name);
|
|
|
|
while (!streq(++name, "")) {
|
|
if (!((*name >= 'a' && *name <= 'z') ||
|
|
(*name >= 'A' && *name <= 'Z') ||
|
|
(*name >= '0' && *name <= '9') ||
|
|
*name == '_' ||
|
|
*name == '.' ||
|
|
*name == '-' ||
|
|
(*name == '$' && name[1] == '\0')
|
|
))
|
|
{
|
|
errno = EINVAL;
|
|
return false;
|
|
}
|
|
numeric &= isdigit(*name);
|
|
}
|
|
|
|
if (numeric) {
|
|
errno = EINVAL;
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
|
|
bool
|
|
is_valid_user_name(const char *name)
|
|
{
|
|
if (strlen(name) >= login_name_max_size()) {
|
|
errno = EOVERFLOW;
|
|
return false;
|
|
}
|
|
|
|
return is_valid_name(name);
|
|
}
|
|
|
|
|
|
bool
|
|
is_valid_group_name(const char *name)
|
|
{
|
|
/*
|
|
* Arbitrary limit for group names.
|
|
* HP-UX 10 limits to 16 characters
|
|
*/
|
|
if ( (GROUP_NAME_MAX_LENGTH > 0)
|
|
&& (strlen (name) > GROUP_NAME_MAX_LENGTH))
|
|
{
|
|
errno = EOVERFLOW;
|
|
return false;
|
|
}
|
|
|
|
return is_valid_name (name);
|
|
}
|