Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	node_credentials.cc	Lines:	204	235	86.8 %
Date:	2022-12-07 04:23:16	Branches:	98	174	56.3 %


#include "env-inl.h"
#include "node_external_reference.h"
#include "node_internals.h"
#include "util-inl.h"

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
#include <grp.h>  // getgrnam()
#include <pwd.h>  // getpwnam()
#endif            // NODE_IMPLEMENTS_POSIX_CREDENTIALS

#if !defined(_MSC_VER)
#include <unistd.h>  // setuid, getuid
#endif
#ifdef __linux__
#include <linux/capability.h>
#include <sys/auxv.h>
#include <sys/syscall.h>
#endif  // __linux__

namespace node {

using v8::Array;
using v8::Context;
using v8::FunctionCallbackInfo;
using v8::HandleScope;
using v8::Isolate;
using v8::Local;
using v8::MaybeLocal;
using v8::Object;
using v8::String;
using v8::TryCatch;
using v8::Uint32;
using v8::Value;

bool linux_at_secure() {
  // This could reasonably be a static variable, but this way
  // we can guarantee that this function is always usable
  // and returns the correct value,  e.g. even in static
  // initialization code in other files.
#ifdef __linux__
  static const bool value = getauxval(AT_SECURE);
  return value;
#else
  return false;
#endif
}

namespace credentials {

#if defined(__linux__)
// Returns true if the current process only has the passed-in capability.
bool HasOnly(int capability) {
  DCHECK(cap_valid(capability));

  struct __user_cap_data_struct cap_data[2];
  struct __user_cap_header_struct cap_header_data = {
    _LINUX_CAPABILITY_VERSION_3,
    getpid()};


  if (syscall(SYS_capget, &cap_header_data, &cap_data) != 0) {
    return false;
  }
  if (capability < 32) {
    return cap_data[0].permitted ==
        static_cast<unsigned int>(CAP_TO_MASK(capability));
  }
  return cap_data[1].permitted ==
      static_cast<unsigned int>(CAP_TO_MASK(capability));
}
#endif

// Look up the environment variable and allow the lookup if the current
// process only has the capability CAP_NET_BIND_SERVICE set. If the current
// process does not have any capabilities set and the process is running as
// setuid root then lookup will not be allowed.
bool SafeGetenv(const char* key,
                std::string* text,
                std::shared_ptr<KVStore> env_vars,
                v8::Isolate* isolate) {
#if !defined(__CloudABI__) && !defined(_WIN32)
#if defined(__linux__)
  if ((!HasOnly(CAP_NET_BIND_SERVICE) && linux_at_secure()) ||
      getuid() != geteuid() || getgid() != getegid())
#else
  if (linux_at_secure() || getuid() != geteuid() || getgid() != getegid())
#endif
    goto fail;
#endif

  if (env_vars != nullptr) {
    DCHECK_NOT_NULL(isolate);
    HandleScope handle_scope(isolate);
    TryCatch ignore_errors(isolate);
    MaybeLocal<String> maybe_value = env_vars->Get(
        isolate, String::NewFromUtf8(isolate, key).ToLocalChecked());
    Local<String> value;
    if (!maybe_value.ToLocal(&value)) goto fail;
    String::Utf8Value utf8_value(isolate, value);
    if (*utf8_value == nullptr) goto fail;
    *text = std::string(*utf8_value, utf8_value.length());
    return true;
  }

  {
    Mutex::ScopedLock lock(per_process::env_var_mutex);

    size_t init_sz = 256;
    MaybeStackBuffer<char, 256> val;
    int ret = uv_os_getenv(key, *val, &init_sz);

    if (ret == UV_ENOBUFS) {
      // Buffer is not large enough, reallocate to the updated init_sz
      // and fetch env value again.
      val.AllocateSufficientStorage(init_sz);
      ret = uv_os_getenv(key, *val, &init_sz);
    }

    if (ret >= 0) {  // Env key value fetch success.
      *text = *val;
      return true;
    }
  }

fail:
  text->clear();
  return false;
}

static void SafeGetenv(const FunctionCallbackInfo<Value>& args) {
  CHECK(args[0]->IsString());
  Environment* env = Environment::GetCurrent(args);
  Isolate* isolate = env->isolate();
  Utf8Value strenvtag(isolate, args[0]);
  std::string text;
  if (!SafeGetenv(*strenvtag, &text, env->env_vars(), isolate)) return;
  Local<Value> result =
      ToV8Value(isolate->GetCurrentContext(), text).ToLocalChecked();
  args.GetReturnValue().Set(result);
}

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS

static const uid_t uid_not_found = static_cast<uid_t>(-1);
static const gid_t gid_not_found = static_cast<gid_t>(-1);

static uid_t uid_by_name(const char* name) {
  struct passwd pwd;
  struct passwd* pp;
  char buf[8192];

  errno = 0;
  pp = nullptr;

  if (getpwnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
    return pp->pw_uid;

  return uid_not_found;
}

static char* name_by_uid(uid_t uid) {
  struct passwd pwd;
  struct passwd* pp;
  char buf[8192];
  int rc;

  errno = 0;
  pp = nullptr;

  if ((rc = getpwuid_r(uid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
      pp != nullptr) {
    return strdup(pp->pw_name);
  }

  if (rc == 0) errno = ENOENT;

  return nullptr;
}

static gid_t gid_by_name(const char* name) {
  struct group pwd;
  struct group* pp;
  char buf[8192];

  errno = 0;
  pp = nullptr;

  if (getgrnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
    return pp->gr_gid;

  return gid_not_found;
}

#if 0  // For future use.
static const char* name_by_gid(gid_t gid) {
  struct group pwd;
  struct group* pp;
  char buf[8192];
  int rc;

  errno = 0;
  pp = nullptr;

  if ((rc = getgrgid_r(gid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
      pp != nullptr) {
    return strdup(pp->gr_name);
  }

  if (rc == 0)
    errno = ENOENT;

  return nullptr;
}
#endif

static uid_t uid_by_name(Isolate* isolate, Local<Value> value) {
  if (value->IsUint32()) {
    static_assert(std::is_same<uid_t, uint32_t>::value);
    return value.As<Uint32>()->Value();
  } else {
    Utf8Value name(isolate, value);
    return uid_by_name(*name);
  }
}

static gid_t gid_by_name(Isolate* isolate, Local<Value> value) {
  if (value->IsUint32()) {
    static_assert(std::is_same<gid_t, uint32_t>::value);
    return value.As<Uint32>()->Value();
  } else {
    Utf8Value name(isolate, value);
    return gid_by_name(*name);
  }
}

static void GetUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // uid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getuid()));
}

static void GetGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // gid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getgid()));
}

static void GetEUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // uid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(geteuid()));
}

static void GetEGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // gid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getegid()));
}

static void SetGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  gid_t gid = gid_by_name(env->isolate(), args[0]);

  if (gid == gid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setgid(gid)) {
    env->ThrowErrnoException(errno, "setgid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetEGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  gid_t gid = gid_by_name(env->isolate(), args[0]);

  if (gid == gid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setegid(gid)) {
    env->ThrowErrnoException(errno, "setegid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  uid_t uid = uid_by_name(env->isolate(), args[0]);

  if (uid == uid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setuid(uid)) {
    env->ThrowErrnoException(errno, "setuid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetEUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  uid_t uid = uid_by_name(env->isolate(), args[0]);

  if (uid == uid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (seteuid(uid)) {
    env->ThrowErrnoException(errno, "seteuid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void GetGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());

  int ngroups = getgroups(0, nullptr);
  if (ngroups == -1) return env->ThrowErrnoException(errno, "getgroups");

  std::vector<gid_t> groups(ngroups);

  ngroups = getgroups(ngroups, groups.data());
  if (ngroups == -1)
    return env->ThrowErrnoException(errno, "getgroups");

  groups.resize(ngroups);
  gid_t egid = getegid();
  if (std::find(groups.begin(), groups.end(), egid) == groups.end())
    groups.push_back(egid);
  MaybeLocal<Value> array = ToV8Value(env->context(), groups);
  if (!array.IsEmpty())
    args.GetReturnValue().Set(array.ToLocalChecked());
}

static void SetGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsArray());

  Local<Array> groups_list = args[0].As<Array>();
  size_t size = groups_list->Length();
  MaybeStackBuffer<gid_t, 64> groups(size);

  for (size_t i = 0; i < size; i++) {
    gid_t gid = gid_by_name(
        env->isolate(), groups_list->Get(env->context(), i).ToLocalChecked());

    if (gid == gid_not_found) {
      // Tells JS to throw ERR_INVALID_CREDENTIAL
      args.GetReturnValue().Set(static_cast<uint32_t>(i + 1));
      return;
    }

    groups[i] = gid;
  }

  int rc = setgroups(size, *groups);

  if (rc == -1) return env->ThrowErrnoException(errno, "setgroups");

  args.GetReturnValue().Set(0);
}

static void InitGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);

  CHECK_EQ(args.Length(), 2);
  CHECK(args[0]->IsUint32() || args[0]->IsString());
  CHECK(args[1]->IsUint32() || args[1]->IsString());

  Utf8Value arg0(env->isolate(), args[0]);
  gid_t extra_group;
  bool must_free;
  char* user;

  if (args[0]->IsUint32()) {
    user = name_by_uid(args[0].As<Uint32>()->Value());
    must_free = true;
  } else {
    user = *arg0;
    must_free = false;
  }

  if (user == nullptr) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    return args.GetReturnValue().Set(1);
  }

  extra_group = gid_by_name(env->isolate(), args[1]);

  if (extra_group == gid_not_found) {
    if (must_free) free(user);
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    return args.GetReturnValue().Set(2);
  }

  int rc = initgroups(user, extra_group);

  if (must_free) free(user);

  if (rc) return env->ThrowErrnoException(errno, "initgroups");

  args.GetReturnValue().Set(0);
}

#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS

void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
  registry->Register(SafeGetenv);

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
  registry->Register(GetUid);
  registry->Register(GetEUid);
  registry->Register(GetGid);
  registry->Register(GetEGid);
  registry->Register(GetGroups);

  registry->Register(InitGroups);
  registry->Register(SetEGid);
  registry->Register(SetEUid);
  registry->Register(SetGid);
  registry->Register(SetUid);
  registry->Register(SetGroups);
#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS
}

static void Initialize(Local<Object> target,
                       Local<Value> unused,
                       Local<Context> context,
                       void* priv) {
  SetMethod(context, target, "safeGetenv", SafeGetenv);

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
  Environment* env = Environment::GetCurrent(context);
  Isolate* isolate = env->isolate();

  READONLY_TRUE_PROPERTY(target, "implementsPosixCredentials");
  SetMethodNoSideEffect(context, target, "getuid", GetUid);
  SetMethodNoSideEffect(context, target, "geteuid", GetEUid);
  SetMethodNoSideEffect(context, target, "getgid", GetGid);
  SetMethodNoSideEffect(context, target, "getegid", GetEGid);
  SetMethodNoSideEffect(context, target, "getgroups", GetGroups);

  if (env->owns_process_state()) {
    SetMethod(context, target, "initgroups", InitGroups);
    SetMethod(context, target, "setegid", SetEGid);
    SetMethod(context, target, "seteuid", SetEUid);
    SetMethod(context, target, "setgid", SetGid);
    SetMethod(context, target, "setuid", SetUid);
    SetMethod(context, target, "setgroups", SetGroups);
  }
#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS
}

}  // namespace credentials
}  // namespace node

NODE_BINDING_CONTEXT_AWARE_INTERNAL(credentials, node::credentials::Initialize)
NODE_BINDING_EXTERNAL_REFERENCE(credentials,
                                node::credentials::RegisterExternalReferences)


Generated by: GCOVR (Version 4.2)

Line	Branch	Exec	Source
1			#include "env-inl.h"
2			#include "node_external_reference.h"
3			#include "node_internals.h"
4			#include "util-inl.h"
5
6			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
7			#include <grp.h> // getgrnam()
8			#include <pwd.h> // getpwnam()
9			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
10
11			#if !defined(_MSC_VER)
12			#include <unistd.h> // setuid, getuid
13			#endif
14			#ifdef __linux__
15			#include <linux/capability.h>
16			#include <sys/auxv.h>
17			#include <sys/syscall.h>
18			#endif // __linux__
19
20			namespace node {
21
22			using v8::Array;
23			using v8::Context;
24			using v8::FunctionCallbackInfo;
25			using v8::HandleScope;
26			using v8::Isolate;
27			using v8::Local;
28			using v8::MaybeLocal;
29			using v8::Object;
30			using v8::String;
31			using v8::TryCatch;
32			using v8::Uint32;
33			using v8::Value;
34
35		70816	bool linux_at_secure() {
36			// This could reasonably be a static variable, but this way
37			// we can guarantee that this function is always usable
38			// and returns the correct value, e.g. even in static
39			// initialization code in other files.
40			#ifdef __linux__
41	✓✓✓✗	70816	static const bool value = getauxval(AT_SECURE);
42		70816	return value;
43			#else
44			return false;
45			#endif
46			}
47
48			namespace credentials {
49
50			#if defined(__linux__)
51			// Returns true if the current process only has the passed-in capability.
52		70816	bool HasOnly(int capability) {
53			DCHECK(cap_valid(capability));
54
55			struct __user_cap_data_struct cap_data[2];
56		70816	struct __user_cap_header_struct cap_header_data = {
57			_LINUX_CAPABILITY_VERSION_3,
58		70816	getpid()};
59
60
61	✗✓	70816	if (syscall(SYS_capget, &cap_header_data, &cap_data) != 0) {
62			return false;
63			}
64	✓✗	70816	if (capability < 32) {
65		70816	return cap_data[0].permitted ==
66		70816	static_cast<unsigned int>(CAP_TO_MASK(capability));
67			}
68			return cap_data[1].permitted ==
69			static_cast<unsigned int>(CAP_TO_MASK(capability));
70			}
71			#endif
72
73			// Look up the environment variable and allow the lookup if the current
74			// process only has the capability CAP_NET_BIND_SERVICE set. If the current
75			// process does not have any capabilities set and the process is running as
76			// setuid root then lookup will not be allowed.
77		70816	bool SafeGetenv(const char* key,
78			std::string* text,
79			std::shared_ptr<KVStore> env_vars,
80			v8::Isolate* isolate) {
81			#if !defined(__CloudABI__) && !defined(_WIN32)
82			#if defined(__linux__)
83	✓✗✓✗	212448	if ((!HasOnly(CAP_NET_BIND_SERVICE) && linux_at_secure()) \|\|
84	✓✗✗✓ ✗✓	212448	getuid() != geteuid() \|\| getgid() != getegid())
85			#else
86			if (linux_at_secure() \|\| getuid() != geteuid() \|\| getgid() != getegid())
87			#endif
88			goto fail;
89			#endif
90
91	✓✓	70816	if (env_vars != nullptr) {
92			DCHECK_NOT_NULL(isolate);
93		19590	HandleScope handle_scope(isolate);
94		19590	TryCatch ignore_errors(isolate);
95		19590	MaybeLocal<String> maybe_value = env_vars->Get(
96		39180	isolate, String::NewFromUtf8(isolate, key).ToLocalChecked());
97			Local<String> value;
98	✓✓	19590	if (!maybe_value.ToLocal(&value)) goto fail;
99		6533	String::Utf8Value utf8_value(isolate, value);
100	✗✓	6533	if (*utf8_value == nullptr) goto fail;
101		6533	text = std::string(utf8_value, utf8_value.length());
102		6533	return true;
103			}
104
105			{
106		51226	Mutex::ScopedLock lock(per_process::env_var_mutex);
107
108		51226	size_t init_sz = 256;
109		51226	MaybeStackBuffer<char, 256> val;
110		51226	int ret = uv_os_getenv(key, *val, &init_sz);
111
112	✗✓	51226	if (ret == UV_ENOBUFS) {
113			// Buffer is not large enough, reallocate to the updated init_sz
114			// and fetch env value again.
115			val.AllocateSufficientStorage(init_sz);
116			ret = uv_os_getenv(key, *val, &init_sz);
117			}
118
119	✓✓	51226	if (ret >= 0) { // Env key value fetch success.
120		5656	text = val;
121		5656	return true;
122			}
123			}
124
125		58627	fail:
126		58627	text->clear();
127		58627	return false;
128			}
129
130	✓✗	13159	static void SafeGetenv(const FunctionCallbackInfo<Value>& args) {
131	✗✓	26318	CHECK(args[0]->IsString());
132		13159	Environment* env = Environment::GetCurrent(args);
133		13159	Isolate* isolate = env->isolate();
134		13159	Utf8Value strenvtag(isolate, args[0]);
135		13159	std::string text;
136	✓✓	13159	if (!SafeGetenv(*strenvtag, &text, env->env_vars(), isolate)) return;
137			Local<Value> result =
138		12950	ToV8Value(isolate->GetCurrentContext(), text).ToLocalChecked();
139		12950	args.GetReturnValue().Set(result);
140			}
141
142			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
143
144			static const uid_t uid_not_found = static_cast<uid_t>(-1);
145			static const gid_t gid_not_found = static_cast<gid_t>(-1);
146
147		4	static uid_t uid_by_name(const char* name) {
148			struct passwd pwd;
149			struct passwd* pp;
150			char buf[8192];
151
152		4	errno = 0;
153		4	pp = nullptr;
154
155	✓✗✓✓ ✓✓	4	if (getpwnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
156		2	return pp->pw_uid;
157
158		2	return uid_not_found;
159			}
160
161			static char* name_by_uid(uid_t uid) {
162			struct passwd pwd;
163			struct passwd* pp;
164			char buf[8192];
165			int rc;
166
167			errno = 0;
168			pp = nullptr;
169
170			if ((rc = getpwuid_r(uid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
171			pp != nullptr) {
172			return strdup(pp->pw_name);
173			}
174
175			if (rc == 0) errno = ENOENT;
176
177			return nullptr;
178			}
179
180		4	static gid_t gid_by_name(const char* name) {
181			struct group pwd;
182			struct group* pp;
183			char buf[8192];
184
185		4	errno = 0;
186		4	pp = nullptr;
187
188	✓✗✗✓ ✗✓	4	if (getgrnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
189			return pp->gr_gid;
190
191		4	return gid_not_found;
192			}
193
194			#if 0 // For future use.
195			static const char* name_by_gid(gid_t gid) {
196			struct group pwd;
197			struct group* pp;
198			char buf[8192];
199			int rc;
200
201			errno = 0;
202			pp = nullptr;
203
204			if ((rc = getgrgid_r(gid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
205			pp != nullptr) {
206			return strdup(pp->gr_name);
207			}
208
209			if (rc == 0)
210			errno = ENOENT;
211
212			return nullptr;
213			}
214			#endif
215
216		10	static uid_t uid_by_name(Isolate* isolate, Local<Value> value) {
217	✓✓	10	if (value->IsUint32()) {
218			static_assert(std::is_same<uid_t, uint32_t>::value);
219		6	return value.As<Uint32>()->Value();
220			} else {
221		8	Utf8Value name(isolate, value);
222		4	return uid_by_name(*name);
223			}
224			}
225
226		11	static gid_t gid_by_name(Isolate* isolate, Local<Value> value) {
227	✓✓	11	if (value->IsUint32()) {
228			static_assert(std::is_same<gid_t, uint32_t>::value);
229		7	return value.As<Uint32>()->Value();
230			} else {
231		8	Utf8Value name(isolate, value);
232		4	return gid_by_name(*name);
233			}
234			}
235
236		248	static void GetUid(const FunctionCallbackInfo<Value>& args) {
237		248	Environment* env = Environment::GetCurrent(args);
238	✗✓	248	CHECK(env->has_run_bootstrapping_code());
239			// uid_t is an uint32_t on all supported platforms.
240		248	args.GetReturnValue().Set(static_cast<uint32_t>(getuid()));
241		248	}
242
243		114	static void GetGid(const FunctionCallbackInfo<Value>& args) {
244		114	Environment* env = Environment::GetCurrent(args);
245	✗✓	114	CHECK(env->has_run_bootstrapping_code());
246			// gid_t is an uint32_t on all supported platforms.
247		114	args.GetReturnValue().Set(static_cast<uint32_t>(getgid()));
248		114	}
249
250		2	static void GetEUid(const FunctionCallbackInfo<Value>& args) {
251		2	Environment* env = Environment::GetCurrent(args);
252	✗✓	2	CHECK(env->has_run_bootstrapping_code());
253			// uid_t is an uint32_t on all supported platforms.
254		2	args.GetReturnValue().Set(static_cast<uint32_t>(geteuid()));
255		2	}
256
257		2	static void GetEGid(const FunctionCallbackInfo<Value>& args) {
258		2	Environment* env = Environment::GetCurrent(args);
259	✗✓	2	CHECK(env->has_run_bootstrapping_code());
260			// gid_t is an uint32_t on all supported platforms.
261		2	args.GetReturnValue().Set(static_cast<uint32_t>(getegid()));
262		2	}
263
264		4	static void SetGid(const FunctionCallbackInfo<Value>& args) {
265		4	Environment* env = Environment::GetCurrent(args);
266	✗✓	4	CHECK(env->owns_process_state());
267
268	✗✓	4	CHECK_EQ(args.Length(), 1);
269	✓✓✗✓ ✗✓	6	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
270
271		4	gid_t gid = gid_by_name(env->isolate(), args[0]);
272
273	✓✓	4	if (gid == gid_not_found) {
274			// Tells JS to throw ERR_INVALID_CREDENTIAL
275		4	args.GetReturnValue().Set(1);
276	✓✗	2	} else if (setgid(gid)) {
277		2	env->ThrowErrnoException(errno, "setgid");
278			} else {
279			args.GetReturnValue().Set(0);
280			}
281		4	}
282
283		4	static void SetEGid(const FunctionCallbackInfo<Value>& args) {
284		4	Environment* env = Environment::GetCurrent(args);
285	✗✓	4	CHECK(env->owns_process_state());
286
287	✗✓	4	CHECK_EQ(args.Length(), 1);
288	✓✓✗✓ ✗✓	6	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
289
290		4	gid_t gid = gid_by_name(env->isolate(), args[0]);
291
292	✓✓	4	if (gid == gid_not_found) {
293			// Tells JS to throw ERR_INVALID_CREDENTIAL
294		4	args.GetReturnValue().Set(1);
295	✓✗	2	} else if (setegid(gid)) {
296		2	env->ThrowErrnoException(errno, "setegid");
297			} else {
298			args.GetReturnValue().Set(0);
299			}
300		4	}
301
302		8	static void SetUid(const FunctionCallbackInfo<Value>& args) {
303		8	Environment* env = Environment::GetCurrent(args);
304	✗✓	8	CHECK(env->owns_process_state());
305
306	✗✓	8	CHECK_EQ(args.Length(), 1);
307	✓✓✗✓ ✗✓	12	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
308
309		8	uid_t uid = uid_by_name(env->isolate(), args[0]);
310
311	✓✓	8	if (uid == uid_not_found) {
312			// Tells JS to throw ERR_INVALID_CREDENTIAL
313		6	args.GetReturnValue().Set(1);
314	✓✗	5	} else if (setuid(uid)) {
315		5	env->ThrowErrnoException(errno, "setuid");
316			} else {
317			args.GetReturnValue().Set(0);
318			}
319		8	}
320
321		2	static void SetEUid(const FunctionCallbackInfo<Value>& args) {
322		2	Environment* env = Environment::GetCurrent(args);
323	✗✓	2	CHECK(env->owns_process_state());
324
325	✗✓	2	CHECK_EQ(args.Length(), 1);
326	✓✗✗✓ ✗✓	6	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
327
328		2	uid_t uid = uid_by_name(env->isolate(), args[0]);
329
330	✓✓	2	if (uid == uid_not_found) {
331			// Tells JS to throw ERR_INVALID_CREDENTIAL
332		2	args.GetReturnValue().Set(1);
333	✓✗	1	} else if (seteuid(uid)) {
334		1	env->ThrowErrnoException(errno, "seteuid");
335			} else {
336			args.GetReturnValue().Set(0);
337			}
338		2	}
339
340		2	static void GetGroups(const FunctionCallbackInfo<Value>& args) {
341		2	Environment* env = Environment::GetCurrent(args);
342	✗✓	2	CHECK(env->has_run_bootstrapping_code());
343
344		2	int ngroups = getgroups(0, nullptr);
345	✗✓	2	if (ngroups == -1) return env->ThrowErrnoException(errno, "getgroups");
346
347		2	std::vector<gid_t> groups(ngroups);
348
349		2	ngroups = getgroups(ngroups, groups.data());
350	✗✓	2	if (ngroups == -1)
351			return env->ThrowErrnoException(errno, "getgroups");
352
353		2	groups.resize(ngroups);
354		2	gid_t egid = getegid();
355	✗✓	2	if (std::find(groups.begin(), groups.end(), egid) == groups.end())
356			groups.push_back(egid);
357		2	MaybeLocal<Value> array = ToV8Value(env->context(), groups);
358	✓✗	2	if (!array.IsEmpty())
359	✗✓	4	args.GetReturnValue().Set(array.ToLocalChecked());
360			}
361
362		1	static void SetGroups(const FunctionCallbackInfo<Value>& args) {
363		1	Environment* env = Environment::GetCurrent(args);
364
365	✗✓	1	CHECK_EQ(args.Length(), 1);
366	✗✓	1	CHECK(args[0]->IsArray());
367
368		2	Local<Array> groups_list = args[0].As<Array>();
369		1	size_t size = groups_list->Length();
370		1	MaybeStackBuffer<gid_t, 64> groups(size);
371
372	✓✗	2	for (size_t i = 0; i < size; i++) {
373		2	gid_t gid = gid_by_name(
374		2	env->isolate(), groups_list->Get(env->context(), i).ToLocalChecked());
375
376	✓✓	2	if (gid == gid_not_found) {
377			// Tells JS to throw ERR_INVALID_CREDENTIAL
378	✓✗	1	args.GetReturnValue().Set(static_cast<uint32_t>(i + 1));
379		1	return;
380			}
381
382		1	groups[i] = gid;
383			}
384
385			int rc = setgroups(size, *groups);
386
387			if (rc == -1) return env->ThrowErrnoException(errno, "setgroups");
388
389			args.GetReturnValue().Set(0);
390			}
391
392		1	static void InitGroups(const FunctionCallbackInfo<Value>& args) {
393		1	Environment* env = Environment::GetCurrent(args);
394
395	✗✓	1	CHECK_EQ(args.Length(), 2);
396	✓✗✗✓ ✗✓	3	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
397	✓✗✗✓ ✗✓	3	CHECK(args[1]->IsUint32() \|\| args[1]->IsString());
398
399		1	Utf8Value arg0(env->isolate(), args[0]);
400			gid_t extra_group;
401			bool must_free;
402			char* user;
403
404	✗✓	1	if (args[0]->IsUint32()) {
405			user = name_by_uid(args[0].As<Uint32>()->Value());
406			must_free = true;
407			} else {
408		1	user = *arg0;
409		1	must_free = false;
410			}
411
412	✗✓	1	if (user == nullptr) {
413			// Tells JS to throw ERR_INVALID_CREDENTIAL
414			return args.GetReturnValue().Set(1);
415			}
416
417		1	extra_group = gid_by_name(env->isolate(), args[1]);
418
419	✓✗	1	if (extra_group == gid_not_found) {
420	✗✓	1	if (must_free) free(user);
421			// Tells JS to throw ERR_INVALID_CREDENTIAL
422		2	return args.GetReturnValue().Set(2);
423			}
424
425			int rc = initgroups(user, extra_group);
426
427			if (must_free) free(user);
428
429			if (rc) return env->ThrowErrnoException(errno, "initgroups");
430
431			args.GetReturnValue().Set(0);
432			}
433
434			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
435
436		5639	void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
437		5639	registry->Register(SafeGetenv);
438
439			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
440		5639	registry->Register(GetUid);
441		5639	registry->Register(GetEUid);
442		5639	registry->Register(GetGid);
443		5639	registry->Register(GetEGid);
444		5639	registry->Register(GetGroups);
445
446		5639	registry->Register(InitGroups);
447		5639	registry->Register(SetEGid);
448		5639	registry->Register(SetEUid);
449		5639	registry->Register(SetGid);
450		5639	registry->Register(SetUid);
451		5639	registry->Register(SetGroups);
452			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
453		5639	}
454
455		800	static void Initialize(Local<Object> target,
456			Local<Value> unused,
457			Local<Context> context,
458			void* priv) {
459		800	SetMethod(context, target, "safeGetenv", SafeGetenv);
460
461			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
462		800	Environment* env = Environment::GetCurrent(context);
463		800	Isolate* isolate = env->isolate();
464
465		2400	READONLY_TRUE_PROPERTY(target, "implementsPosixCredentials");
466		800	SetMethodNoSideEffect(context, target, "getuid", GetUid);
467		800	SetMethodNoSideEffect(context, target, "geteuid", GetEUid);
468		800	SetMethodNoSideEffect(context, target, "getgid", GetGid);
469		800	SetMethodNoSideEffect(context, target, "getegid", GetEGid);
470		800	SetMethodNoSideEffect(context, target, "getgroups", GetGroups);
471
472	✓✓	800	if (env->owns_process_state()) {
473		58	SetMethod(context, target, "initgroups", InitGroups);
474		58	SetMethod(context, target, "setegid", SetEGid);
475		58	SetMethod(context, target, "seteuid", SetEUid);
476		58	SetMethod(context, target, "setgid", SetGid);
477		58	SetMethod(context, target, "setuid", SetUid);
478		58	SetMethod(context, target, "setgroups", SetGroups);
479			}
480			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
481		800	}
482
483			} // namespace credentials
484			} // namespace node
485
486		5710	NODE_BINDING_CONTEXT_AWARE_INTERNAL(credentials, node::credentials::Initialize)
487		5639	NODE_BINDING_EXTERNAL_REFERENCE(credentials,
488			node::credentials::RegisterExternalReferences)