1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 /*
27 * Initialization routines
28 */
29
30 #include "idmapd.h"
31 #include <signal.h>
32 #include <thread.h>
33 #include <string.h>
34 #include <errno.h>
35 #include <assert.h>
36 #include <unistd.h>
37 #include <sys/types.h>
38 #include <sys/stat.h>
39 #include <rpcsvc/daemon_utils.h>
40
41
42 int
init_mapping_system(void)43 init_mapping_system(void)
44 {
45 int rc = 0;
46
47 if ((rc = load_config()) < 0)
48 return (rc);
49
50 (void) setegid(DAEMON_GID);
51 (void) seteuid(DAEMON_UID);
52 if (init_dbs() < 0) {
53 rc = -1;
54 fini_mapping_system();
55 }
56 (void) seteuid(0);
57 (void) setegid(0);
58
59 return (rc);
60 }
61
62 void
fini_mapping_system(void)63 fini_mapping_system(void)
64 {
65 fini_dbs();
66 }
67
68 int
load_config(void)69 load_config(void)
70 {
71 int rc;
72 if ((_idmapdstate.cfg = idmap_cfg_init()) == NULL) {
73 degrade_svc(0, "failed to initialize config");
74 return (-1);
75 }
76
77 rc = idmap_cfg_upgrade(_idmapdstate.cfg);
78 if (rc != 0) {
79 degrade_svc(0, "fatal error while upgrading configuration");
80 return (rc);
81 }
82
83 rc = idmap_cfg_load(_idmapdstate.cfg, 0);
84 if (rc < -1) {
85 /* Total failure */
86 degrade_svc(0, "fatal error while loading configuration");
87 return (rc);
88 }
89
90 if (rc != 0)
91 /* Partial failure */
92 idmapdlog(LOG_ERR, "Various errors occurred while loading "
93 "the configuration; check the logs");
94
95 if ((rc = idmap_cfg_start_updates()) < 0) {
96 /* Total failure */
97 degrade_svc(0, "could not start config updater");
98 return (rc);
99 }
100
101 if (DBG(CONFIG, 1))
102 idmapdlog(LOG_DEBUG, "Initial configuration loaded");
103
104 return (0);
105 }
106
107
108 void
reload_gcs(void)109 reload_gcs(void)
110 {
111 int i, j;
112 adutils_ad_t **new_gcs;
113 adutils_ad_t **old_gcs = _idmapdstate.gcs;
114 int new_num_gcs;
115 int old_num_gcs = _idmapdstate.num_gcs;
116 idmap_pg_config_t *pgcfg = &_idmapdstate.cfg->pgcfg;
117 idmap_trustedforest_t *trustfor = pgcfg->trusted_forests;
118 int num_trustfor = pgcfg->num_trusted_forests;
119 ad_disc_domainsinforest_t *domain_in_forest;
120
121 if (pgcfg->use_ads == B_FALSE ||
122 pgcfg->domain_name == NULL) {
123 /*
124 * ADS disabled, or no domain name specified.
125 * Not using adutils. (but still can use lsa)
126 */
127 new_gcs = NULL;
128 new_num_gcs = 0;
129 goto out;
130 }
131
132 if (pgcfg->global_catalog == NULL ||
133 pgcfg->global_catalog[0].host[0] == '\0') {
134 /*
135 * No GCs. Continue to use the previous AD config in case
136 * that's still good but auto-discovery had a transient failure.
137 * If that stops working we'll go into degraded mode anyways
138 * when it does.
139 */
140 idmapdlog(LOG_INFO,
141 "Global Catalog servers not configured/discoverable");
142 return;
143 }
144
145 new_num_gcs = 1 + num_trustfor;
146 new_gcs = calloc(new_num_gcs, sizeof (adutils_ad_t *));
147 if (new_gcs == NULL) {
148 degrade_svc(0, "could not allocate AD context array "
149 "(out of memory)");
150 return;
151 }
152
153 if (adutils_ad_alloc(&new_gcs[0], NULL, ADUTILS_AD_GLOBAL_CATALOG) !=
154 ADUTILS_SUCCESS) {
155 free(new_gcs);
156 degrade_svc(0, "could not initialize AD context "
157 "(out of memory)");
158 return;
159 }
160
161 for (i = 0; pgcfg->global_catalog[i].host[0] != '\0'; i++) {
162 if (idmap_add_ds(new_gcs[0],
163 pgcfg->global_catalog[i].host,
164 pgcfg->global_catalog[i].port) != 0) {
165 adutils_ad_free(&new_gcs[0]);
166 free(new_gcs);
167 degrade_svc(0, "could not set AD hosts "
168 "(out of memory)");
169 return;
170 }
171 }
172
173 if (pgcfg->domains_in_forest != NULL) {
174 for (i = 0; pgcfg->domains_in_forest[i].domain[0] != '\0';
175 i++) {
176 if (adutils_add_domain(new_gcs[0],
177 pgcfg->domains_in_forest[i].domain,
178 pgcfg->domains_in_forest[i].sid) != 0) {
179 adutils_ad_free(&new_gcs[0]);
180 free(new_gcs);
181 degrade_svc(0, "could not set AD domains "
182 "(out of memory)");
183 return;
184 }
185 }
186 }
187
188 for (i = 0; i < num_trustfor; i++) {
189 if (adutils_ad_alloc(&new_gcs[i + 1], NULL,
190 ADUTILS_AD_GLOBAL_CATALOG) != ADUTILS_SUCCESS) {
191 degrade_svc(0, "could not initialize trusted AD "
192 "context (out of memory)");
193 new_num_gcs = i + 1;
194 goto out;
195 }
196 for (j = 0; trustfor[i].global_catalog[j].host[0] != '\0';
197 j++) {
198 if (idmap_add_ds(new_gcs[i + 1],
199 trustfor[i].global_catalog[j].host,
200 trustfor[i].global_catalog[j].port) != 0) {
201 adutils_ad_free(&new_gcs[i + 1]);
202 degrade_svc(0, "could not set trusted "
203 "AD hosts (out of memory)");
204 new_num_gcs = i + 1;
205 goto out;
206 }
207 }
208 for (j = 0; trustfor[i].domains_in_forest[j].domain[0] != '\0';
209 j++) {
210 domain_in_forest = &trustfor[i].domains_in_forest[j];
211 /* Only add domains which are marked */
212 if (domain_in_forest->trusted) {
213 if (adutils_add_domain(new_gcs[i + 1],
214 domain_in_forest->domain,
215 domain_in_forest->sid) != 0) {
216 adutils_ad_free(&new_gcs[i + 1]);
217 degrade_svc(0, "could not set trusted "
218 "AD domains (out of memory)");
219 new_num_gcs = i + 1;
220 goto out;
221 }
222 }
223 }
224 }
225
226 out:
227 _idmapdstate.gcs = new_gcs;
228 _idmapdstate.num_gcs = new_num_gcs;
229
230 if (old_gcs != NULL) {
231 for (i = 0; i < old_num_gcs; i++)
232 adutils_ad_free(&old_gcs[i]);
233 free(old_gcs);
234 }
235 }
236
237 /*
238 * NEEDSWORK: This should load entries for domain servers for all known
239 * domains - the joined domain, other domains in the forest, and trusted
240 * domains in other forests. However, we don't yet discover any DCs other
241 * than the DCs for the joined domain.
242 */
243 void
reload_dcs(void)244 reload_dcs(void)
245 {
246 int i;
247 adutils_ad_t **new_dcs;
248 adutils_ad_t **old_dcs = _idmapdstate.dcs;
249 int new_num_dcs;
250 int old_num_dcs = _idmapdstate.num_dcs;
251 idmap_pg_config_t *pgcfg = &_idmapdstate.cfg->pgcfg;
252
253 if (pgcfg->use_ads == B_FALSE ||
254 pgcfg->domain_name == NULL) {
255 /*
256 * ADS disabled, or no domain name specified.
257 * Not using adutils. (but still can use lsa)
258 */
259 new_dcs = NULL;
260 new_num_dcs = 0;
261 goto out;
262 }
263
264 if (pgcfg->domain_controller == NULL ||
265 pgcfg->domain_controller[0].host[0] == '\0') {
266 /*
267 * No DCs. Continue to use the previous AD config in case
268 * that's still good but auto-discovery had a transient failure.
269 * If that stops working we'll go into degraded mode anyways
270 * when it does.
271 */
272 idmapdlog(LOG_INFO,
273 "Domain controller servers not configured/discoverable");
274 return;
275 }
276
277 new_num_dcs = 1;
278 new_dcs = calloc(new_num_dcs, sizeof (adutils_ad_t *));
279 if (new_dcs == NULL)
280 goto nomem;
281
282 if (adutils_ad_alloc(&new_dcs[0], pgcfg->domain_name,
283 ADUTILS_AD_DATA) != ADUTILS_SUCCESS)
284 goto nomem;
285
286 for (i = 0; pgcfg->domain_controller[i].host[0] != '\0'; i++) {
287 if (idmap_add_ds(new_dcs[0],
288 pgcfg->domain_controller[i].host,
289 pgcfg->domain_controller[i].port) != 0)
290 goto nomem;
291 }
292
293 /*
294 * NEEDSWORK: All we need here is to add the domain and SID for
295 * this DC to the list of domains supported by this entry. Isn't
296 * there an easier way to find the SID than to walk through the list
297 * of all of the domains in the forest?
298 */
299 ad_disc_domainsinforest_t *dif = pgcfg->domains_in_forest;
300 if (dif != NULL) {
301 for (; dif->domain[0] != '\0'; dif++) {
302 if (domain_eq(pgcfg->domain_name, dif->domain)) {
303 if (adutils_add_domain(new_dcs[0],
304 dif->domain, dif->sid) != 0)
305 goto nomem;
306 break;
307 }
308 }
309 }
310
311 out:
312 _idmapdstate.dcs = new_dcs;
313 _idmapdstate.num_dcs = new_num_dcs;
314
315 if (old_dcs != NULL) {
316 for (i = 0; i < old_num_dcs; i++)
317 adutils_ad_free(&old_dcs[i]);
318 free(old_dcs);
319 }
320
321 return;
322
323 nomem:
324 degrade_svc(0, "out of memory");
325
326 if (new_dcs != NULL) {
327 if (new_dcs[0] != NULL)
328 adutils_ad_free(&new_dcs[0]);
329 free(new_dcs);
330 }
331 }
332
333 void
print_idmapdstate(void)334 print_idmapdstate(void)
335 {
336 int i, j;
337 idmap_pg_config_t *pgcfg;
338 idmap_trustedforest_t *tf;
339
340 RDLOCK_CONFIG();
341
342 if (_idmapdstate.cfg == NULL) {
343 idmapdlog(LOG_INFO, "Null configuration");
344 UNLOCK_CONFIG();
345 return;
346 }
347
348 pgcfg = &_idmapdstate.cfg->pgcfg;
349
350 idmapdlog(LOG_DEBUG, "list_size_limit=%llu", pgcfg->list_size_limit);
351 idmapdlog(LOG_DEBUG, "max_threads=%llu", pgcfg->max_threads);
352 idmapdlog(LOG_DEBUG, "default_domain=%s",
353 CHECK_NULL(pgcfg->default_domain));
354 idmapdlog(LOG_DEBUG, "domain_name=%s", CHECK_NULL(pgcfg->domain_name));
355 idmapdlog(LOG_DEBUG, "machine_sid=%s", CHECK_NULL(pgcfg->machine_sid));
356 if (pgcfg->domain_controller == NULL ||
357 pgcfg->domain_controller[0].host[0] == '\0') {
358 idmapdlog(LOG_DEBUG, "No domain controllers known");
359 } else {
360 for (i = 0; pgcfg->domain_controller[i].host[0] != '\0'; i++)
361 idmapdlog(LOG_DEBUG, "domain_controller=%s port=%d",
362 pgcfg->domain_controller[i].host,
363 pgcfg->domain_controller[i].port);
364 }
365 idmapdlog(LOG_DEBUG, "forest_name=%s", CHECK_NULL(pgcfg->forest_name));
366 idmapdlog(LOG_DEBUG, "site_name=%s", CHECK_NULL(pgcfg->site_name));
367 if (pgcfg->global_catalog == NULL ||
368 pgcfg->global_catalog[0].host[0] == '\0') {
369 idmapdlog(LOG_DEBUG, "No global catalog servers known");
370 } else {
371 for (i = 0; pgcfg->global_catalog[i].host[0] != '\0'; i++)
372 idmapdlog(LOG_DEBUG, "global_catalog=%s port=%d",
373 pgcfg->global_catalog[i].host,
374 pgcfg->global_catalog[i].port);
375 }
376 if (pgcfg->domains_in_forest == NULL ||
377 pgcfg->domains_in_forest[0].domain[0] == '\0') {
378 idmapdlog(LOG_DEBUG, "No domains in forest %s known",
379 CHECK_NULL(pgcfg->forest_name));
380 } else {
381 for (i = 0; pgcfg->domains_in_forest[i].domain[0] != '\0'; i++)
382 idmapdlog(LOG_DEBUG, "domains in forest %s = %s",
383 CHECK_NULL(pgcfg->forest_name),
384 pgcfg->domains_in_forest[i].domain);
385 }
386 if (pgcfg->trusted_domains == NULL ||
387 pgcfg->trusted_domains[0].domain[0] == '\0') {
388 idmapdlog(LOG_DEBUG, "No trusted domains known");
389 } else {
390 for (i = 0; pgcfg->trusted_domains[i].domain[0] != '\0'; i++)
391 idmapdlog(LOG_DEBUG, "trusted domain = %s",
392 pgcfg->trusted_domains[i].domain);
393 }
394
395 for (i = 0; i < pgcfg->num_trusted_forests; i++) {
396 tf = &pgcfg->trusted_forests[i];
397 for (j = 0; tf->global_catalog[j].host[0] != '\0'; j++)
398 idmapdlog(LOG_DEBUG,
399 "trusted forest %s global_catalog=%s port=%d",
400 tf->forest_name,
401 tf->global_catalog[j].host,
402 tf->global_catalog[j].port);
403 for (j = 0; tf->domains_in_forest[j].domain[0] != '\0'; j++) {
404 if (tf->domains_in_forest[j].trusted) {
405 idmapdlog(LOG_DEBUG,
406 "trusted forest %s domain=%s",
407 tf->forest_name,
408 tf->domains_in_forest[j].domain);
409 }
410 }
411 }
412
413 idmapdlog(LOG_DEBUG, "directory_based_mapping=%s",
414 enum_lookup(pgcfg->directory_based_mapping, directory_mapping_map));
415 idmapdlog(LOG_DEBUG, "ad_unixuser_attr=%s",
416 CHECK_NULL(pgcfg->ad_unixuser_attr));
417 idmapdlog(LOG_DEBUG, "ad_unixgroup_attr=%s",
418 CHECK_NULL(pgcfg->ad_unixgroup_attr));
419 idmapdlog(LOG_DEBUG, "nldap_winname_attr=%s",
420 CHECK_NULL(pgcfg->nldap_winname_attr));
421
422 UNLOCK_CONFIG();
423 }
424
425 int
create_directory(const char * path,uid_t uid,gid_t gid)426 create_directory(const char *path, uid_t uid, gid_t gid)
427 {
428 int rc;
429
430 if ((rc = mkdir(path, 0700)) < 0 && errno != EEXIST) {
431 idmapdlog(LOG_ERR, "Error creating directory %s (%s)",
432 path, strerror(errno));
433 return (-1);
434 }
435
436 if (lchown(path, uid, gid) < 0) {
437 idmapdlog(LOG_ERR, "Error creating directory %s (%s)",
438 path, strerror(errno));
439 if (rc == 0)
440 (void) rmdir(path);
441 return (-1);
442 }
443 return (0);
444 }
445