libnss_tcb: Disallow potentially-malicious user names in getspnam(3).

Signed-off-by: Björn Esser <[email protected]>

Author: besser82

ChangeLog

@@ -1,4 +1,10 @@
-2021-12-18  Björn Esser  <besser82 at fedoraproject.org>
+2024-12-20  Björn Esser  <besser82 at fedoraproject.org>
+
+	libnss_tcb: Disallow potentially-malicious user names in getspnam(3).
+	* libs/nss.c (_nss_tcb_getspnam_r): Check for potentially-malicious
+	user names, and bail out in case.
+
+2024-12-18  Björn Esser  <besser82 at fedoraproject.org>
 
 	libtcb: Add versioning to exported symbols.
 	This change is implemented for adding some interfaces to libtcb to

libs/nss.c

@@ -27,6 +27,30 @@ int _nss_tcb_endspent(void)
 	return 1;
 }
 
+/* IEEE Std 1003.1-2001 allows only the following characters to appear
+   in group- and usernames: letters, digits, underscores, periods,
+   <at>-signs (@), and dashes.   The name may not start with a dash or @.
+   The "$" sign is allowed at the end of usernames to allow typical
+   Samba machine accounts. */
+static int
+is_valid_username (const char *un)
+{
+	if (!un || !*un || un[0] == '-' || un[0] == '@' ||
+	    /* curdir || parentdir */
+	    !strcmp(un, ".") || !strcmp(un, ".."))
+		return 0;
+
+	do {
+		char c = *un++;
+		if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+		    (c >= '0' && c <= '9') || c == '-' || c == '.' ||
+		    c == '@' || c == '_' || (!*un && c == '$')))
+			return 0;
+	} while (*un);
+
+	return 1;
+}
+
 static FILE *tcb_safe_open(const char *file, const char *name)
 {
 	gid_t grplist[TCB_NGROUPS];
@@ -64,12 +88,18 @@ int _nss_tcb_getspnam_r(const char *name, struct spwd *__result_buf,
 	char *file;
 	int retval, saved_errno;
 
+	/* Disallow potentially-malicious user names */
+	if (!is_valid_username(name)) {
+		errno = ENOENT;
+		return NSS_STATUS_NOTFOUND;
+	}
+
 	if (asprintf(&file, TCB_FMT, name) < 0)
 		return NSS_STATUS_TRYAGAIN;
 	f = tcb_safe_open(file, name);
 	free(file);
 	if (!f)
-		return NSS_STATUS_UNAVAIL;
+		return errno == ENOENT ? NSS_STATUS_NOTFOUND : NSS_STATUS_UNAVAIL;
 
 	retval = fgetspent_r(f, __result_buf, __buffer, __buflen, __result);
 	saved_errno = errno;