NSS: Replace exported NSS lookup functions with stubs [BZ #21962]

Commit 384ca551743318bd9c9e24a496d6397f2e3f2a49 from 2007 added this to
nss/XXX-lookup.c:

+#ifndef NO_COMPAT
+int
+internal_function attribute_compat_text_section
+DB_COMPAT_FCT (service_user **ni, const char *fct_name, void **fctp)
+{
+  return DB_LOOKUP_FCT (ni, fct_name, NULL, fctp);
+}
+#endif

That is, it adds a pseudo-compat function with an internal_function
attribute.  The function it was supposed to replace did not have the
attribute:

 extern int DB_LOOKUP_FCT (service_user **ni, const char *fct_name,
-			  void **fctp) internal_function;
+			  const char *fct2_name, void **fctp)
+  internal_function;

This changed the calling convention on i386 for the following
functions in the public ABI:

  __nss_passwd_lookup
  __nss_group_lookup
  __nss_hosts_lookup

This commit replaces the functions with always-failing stubs,
with true compat symbols.  Due to a happy accident, the calling
convention of the stub is identical for the internal_function
and non-internal_function case on i386.

In addition, this commit auto-generates the __nss_*_lookup2
function declarations as part of <nsswitch.h>.

1 files changed, 26 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 3de5a9fc7f..518f54d135 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,29 @@
+2017-08-14  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #21962]
+	NSS: Create stubs for accidentally exported lookup functions.
+	* grp/initgroups.c (__nss_group_lookup, __nss_lookup_function):
+	Remove declaration.
+	* inet/ether_hton.c (__nss_ethers_lookup): Likewise.
+	(ether_hostton): Call __nss_ethers_lookup2 instead.
+	* inet/ether_ntoh.c (__nss_ethers_lookup): Remove declaration.
+	(ether_ntohost): Call __nss_ethers_lookup2 instead.
+	* inet/getnetgrent_r.c (__nss_netgroup_lookup): Remove declaration.
+	(setup): Call __nss_netgroup_lookup2 instead.
+	* nss/Makefile (routines): Add compat-lookup.
+	* nss/Versions (GLIBC_2.27): Add symbol version.
+	* nss/XXX-lookup (DB_LOOKUP_FCT): Remove declaration.  Now provided by <nsswitch.h>.
+	(DB_COMPAT_FCT): Remove.
+	* nss/compat-lookup.c: New file.
+	* nss/nsswitch.h: Generate __nss_*_lookup2 function prototypes
+	from databases.def.
+	* nss/service-lookup.c (NO_COMPAT): Remove definition.
+	* sunrpc/netname.c (__nss_publickey_lookup): Remove declaration.
+	(netname2user): Call __nss_publickey_lookup2 instead.
+	* sunrpc/publickey.c (__nss_publickey_lookup): Remove declaration.
+	(getpublickey, getsecretkey): Call __nss_publickey_lookup2
+	instead.
+
 2017-08-14 Adhemerval Zanella  <adhemerval.zanella@linaro.org>
 	    Sergei Trofimovich  <slyfox@inbox.ru>