getpwent: infinite loop because of inverted result_status in _nss_exec_getpwent_r_locked

[alexburt]

Hello,
What is a purpose of invertion of result_status in _nss_exec_getpwent_r_locked ?

NSS_STATUS_SUCCESS is 1.
From the _nss_exec_getpwent_r_locked return will be NSS_STATUS_SUCCESS even if it get error from nss_exec_script_long.
That may cause infinite loop when getpwent is used to enumerate users because getpwent will always return pointer instead of 0.

https://github.com/tests-always-included/libnss_exec/blob/master/nss_exec-passwd.c#L86

[fidian]

Forgive me for not responding right away. I haven't used this in quite a while and it worked great when I did use it in a production environment with many users.

NSS_STATUS_SUCCESS is indeed defined to be 1 in this case. _nss_exec_getpwent_r_locked is called by _nss_exec_getpwent_r, and that's called by NSS. Return code 0 is NSS_STATUS_NOTFOUND and it appears that there could be an issue with my code but I would it verified.

I'm not entirely sure about why I thought the behavior was correct. 8 years ago I added commit c9fb711 to address a problem and included extra code in the test to verify that the code was working as intended. If I recall correctly, I found some other code that operated similarly for a different NSS module.

Are you experiencing problems?

[alexburt]

Some programs hang because getpwent return pointer instead of null.
For example python3 -c "import pwd; pwd.getpwall()"

/usr/sbin/nss_exec content:
#!/bin/bash
echo $@ >>/tmp/nss_exec.log
if [ "$1" == "setpwent" ]; then
exit 0
fi
exit 1

log is:
setpwent
getpwent 0
getpwent 0
getpwent 0
getpwent 0
getpwent 0
......

[alexburt]

Falco hangs when it enumerates users on system: https://github.com/falcosecurity/libs/blob/0790cffa6c4ab485a7eb05126a2d8c6c99ad7328/userspace/libscap/linux/scap_userlist.c#L122

[fidian]

I have not used this module in quite some time and don't have it set up to adequately test any changes. However, if you change the code and test it and submit a pull request, I will be happy to merge it.

Thank you for the time you've already put into diagnosing and solving this problem.