20nssdatabases: Check database inodes inside and outside the chroot

If the NSS database files inside and outside the chroot have the
same device and inode number, we risk blanking the file when
piping the output of getent.  stat both and check prior to
writing.

1 files changed, 13 insertions, 0 deletions

diff --git a/etc/setup.d/20nssdatabases b/etc/setup.d/20nssdatabases
index a9573747..09641803 100755
--- a/etc/setup.d/20nssdatabases
+++ b/etc/setup.d/20nssdatabases
@@ -49,6 +49,19 @@ if [ $1 = "setup-start" ] || [ $1 = "setup-recover" ]; then
 		if echo "$db" | egrep -q '^(#|$)' ; then
 		    continue
 		fi
+
+                # Device and inode
+		da=$(/usr/bin/stat --format="%d %i" "/etc/$db")
+		db=$(/usr/bin/stat --format="%d %i" "${CHROOT_PATH}/etc/$db")
+
+	        # If the database inside and outside the chroot is the
+	        # same, it's very likely that dup_nss would blank the
+	        # database, so skip it.
+		if [ "$da" = "$db" ]; then
+		    echo "$db files '/etc/$db' and '${CHROOT_PATH}/etc/$db' are the same file; skipping"
+		    continue;
+		fi
+
 		dup_nss "$db" "${CHROOT_PATH}/etc/$db"
 	    done < "$NSSDATABASES"
 	else