Idea / Patch to add very simple uid filtering to resolv.conf

[Matthias Fulz <mfulz@olznet.de>]

[-- Attachment #1.1: Type: text/plain, Size: 1112 bytes --]

Hi Guys,

I have done some patch to be able to filter lines under /etc/resolv.conf 
by specific uids. I had the need for my system, as I've some users that 
are only accessing specific network devices by uid matching routing rules.

Therefore I've to select different nameservers depending on the user and 
added following to resolv.conf:
uid+int any existing resolv line
ae:
uid+1000 nameserver 1.1.1.1
uid-1001 nameserver 8.8.8.8

This will be interpreted the following way:
uid+ -> that config line will only be added to resolv context if the uid 
matches the one after the +
uid- -> that config line will NOT be added resolv context if the uid 
matches the one after the -

Further if the uid is not added to the line the behavior would be the 
same as it was before the patch.
Would be nice if this could be included, or at least please explain why 
not for my understanding as I can't see any reason that would be against it

I was first thinking about doing this by implementing a nss service but 
came to the conclusion, that would be overkill for that little config 
extension.

--
Thanks & BR,
Matthias

[-- Attachment #2: uid_resolv.patch --]
[-- Type: text/x-patch, Size: 2828 bytes --]

diff --color -Nur glibc/resolv/res_init.c glibc_b/resolv/res_init.c
--- glibc/resolv/res_init.c	2023-09-11 23:15:02.377718008 +0200
+++ glibc_b/resolv/res_init.c	2023-09-12 14:15:53.532479227 +0200
@@ -258,6 +258,8 @@
   char *cp;
   size_t buffer_size = 0;
   bool haveenv = false;
+  char struid[24];
+  unsigned int uid = getuid();
 
   /* Allow user to override the local domain definition.  */
   if ((cp = getenv ("LOCALDOMAIN")) != NULL)
@@ -303,6 +305,11 @@
    && ((line)[sizeof (name) - 1] == ' '           \
        || (line)[sizeof (name) - 1] == '\t'))
 
+#define MATCH_STR(line, name)                       \
+  (!strncmp ((line), name, strlen (name))     \
+   && ((line)[strlen (name)] == ' '           \
+       || (line)[strlen (name)] == '\t'))
+
   if (fp != NULL)
     {
       /* No threads use this stream.  */
@@ -324,6 +331,56 @@
           /* Skip comments.  */
           if (*parser->buffer == ';' || *parser->buffer == '#')
             continue;
+          /* check for user specific config */
+          if (!strncmp(parser->buffer, "uid", sizeof("uid") - 1))
+            {
+              cp = parser->buffer + sizeof ("uid") - 1;
+              if (*cp == '+' || *cp == '-')
+                {
+                  /* Get uid for comparism with user speicific configs */
+                  snprintf(struid, 24, "uid%c%u", *cp, uid); 
+                }
+              else
+                continue;
+
+              if (MATCH_STR (parser->buffer, struid))
+                {
+                  if (*cp == '-') // Remove for user
+                    continue;
+
+                  cp = parser->buffer + strlen(struid);
+                  while (*cp == ' ' || *cp == '\t')
+                    cp++;
+                  if ((*cp == '\0') || (*cp == '\n'))
+                    continue;
+
+                  cp = __strdup (cp);
+                  if (cp == NULL)
+                    return false;
+                  snprintf(parser->buffer, strlen(cp), "%s", cp);
+                  free(cp);
+                }
+              else
+                {
+                  if (*cp == '+') // Remove for user
+                    continue;
+
+                  while (*cp != ' ' && *cp != '\t')
+                    {
+                      cp++;
+                    }
+                  while (*cp == ' ' || *cp == '\t')
+                    cp++;
+                  if (*cp == '\0' || *cp == '\n')
+                    continue;
+                  
+                  cp = __strdup (cp++);
+                  if (cp == NULL)
+                    return false;
+                  snprintf(parser->buffer, strlen(cp), "%s", cp);
+                  free(cp);
+                }
+            }
           /* Read default domain name.  */
           if (MATCH (parser->buffer, "domain"))
             {