Merge pull request #85 from wazuh/fix/25115-fim-group-buffer

Allow longer user/group entries in FIM

Author: vikman90

src/common/syscheck_op/src/syscheck_op.c

@@ -125,7 +125,7 @@ char *get_user(int uid) {
     int errno;
 
     bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
-    if (bufsize == -1) {
+    if (bufsize < 16384) {
         bufsize = 16384;
     }
 
@@ -143,7 +143,7 @@ char *get_user(int uid) {
             mdebug2("User with uid '%d' not found.\n", uid);
         }
         else {
-            mdebug2("Failed getting user_name (%d): '%s'\n", errno, strerror(errno));
+            mdebug2("Failed getting user_name for uid %d: (%d): '%s'\n", uid, errno, strerror(errno));
         }
     } else {
         os_strdup(pwd.pw_name, user_name);
@@ -162,7 +162,7 @@ char *get_group(int gid) {
     int bufsize;
 
     bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
-    if (bufsize == -1) {
+    if (bufsize < 16384) {
         bufsize = 16384;
     }
 
@@ -174,7 +174,7 @@ char *get_group(int gid) {
         if (errno == 0) {
             mdebug2("Group with gid '%d' not found.\n", gid);
         } else {
-            mdebug2("Failed getting group_name (%d): '%s'\n", errno, strerror(errno));
+            mdebug2("Failed getting group_name for gid %d: (%d): '%s'\n", gid, errno, strerror(errno));
         }
     } else {
         os_strdup(grp.gr_name, group_name);

src/common/syscheck_op/tests/unit/tests/test_syscheck_op.c

@@ -482,7 +482,7 @@ static void test_get_user_error(void **state) {
     will_return(__wrap_getpwuid_r, ENOENT);
 #endif
 
-    expect_string(__wrap__mdebug2, formatted_msg, "Failed getting user_name (2): 'No such file or directory'\n");
+    expect_string(__wrap__mdebug2, formatted_msg, "Failed getting user_name for uid 1: (2): 'No such file or directory'\n");
 
     user = get_user(1);
 
@@ -536,6 +536,26 @@ static void test_get_group_no_group(void **state) {
 
     assert_null(output);
 }
+
+static void test_get_group_error(void **state) {
+    const char *output;
+
+    errno = ENOENT;
+
+    will_return(__wrap_sysconf, 8);
+
+    expect_value(__wrap_w_getgrgid, gid, 1000);
+    will_return(__wrap_w_getgrgid, NULL);
+    will_return(__wrap_w_getgrgid, NULL); // We don't care about member buffers
+    will_return(__wrap_w_getgrgid, 0); // Fail
+
+    expect_string(__wrap__mdebug2, formatted_msg, "Failed getting group_name for gid 1000: (2): 'No such file or directory'\n");
+
+    output = get_group(1000);
+
+    assert_null(output);
+}
+
 #else
 static void test_get_group(void **state) {
     assert_string_equal(get_group(0), "");
@@ -3140,6 +3160,7 @@ int main(int argc, char *argv[]) {
         /* get_group tests */
         cmocka_unit_test(test_get_group_success),
         cmocka_unit_test(test_get_group_no_group),
+        cmocka_unit_test_teardown(test_get_group_error, teardown_string),
 
         /* ag_send_syscheck tests */
         cmocka_unit_test(test_ag_send_syscheck_success),