1c5c4113dSnw /*
2c5c4113dSnw * CDDL HEADER START
3c5c4113dSnw *
4c5c4113dSnw * The contents of this file are subject to the terms of the
5c5c4113dSnw * Common Development and Distribution License (the "License").
6c5c4113dSnw * You may not use this file except in compliance with the License.
7c5c4113dSnw *
8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9c5c4113dSnw * or http://www.opensolaris.org/os/licensing.
10c5c4113dSnw * See the License for the specific language governing permissions
11c5c4113dSnw * and limitations under the License.
12c5c4113dSnw *
13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each
14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the
16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying
17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner]
18c5c4113dSnw *
19c5c4113dSnw * CDDL HEADER END
20c5c4113dSnw */
21c5c4113dSnw /*
22c5866007SKeyur Desai * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23fea136a0SMatt Barden * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
24*3cd6e9e1SMatt Barden * Copyright 2023 RackTop Systems, Inc.
25c5c4113dSnw */
26c5c4113dSnw
27c5c4113dSnw
28c5c4113dSnw /*
29bbf21555SRichard Lowe * main() of idmapd(8)
30c5c4113dSnw */
31c5c4113dSnw
32c5c4113dSnw #include "idmapd.h"
3371590c90Snw #include <atomic.h>
34c5c4113dSnw #include <signal.h>
35c5c4113dSnw #include <rpc/pmap_clnt.h> /* for pmap_unset */
36c5c4113dSnw #include <string.h> /* strcmp */
37c5c4113dSnw #include <unistd.h> /* setsid */
38c5c4113dSnw #include <sys/types.h>
39c5c4113dSnw #include <memory.h>
40c5c4113dSnw #include <stropts.h>
41c5c4113dSnw #include <netconfig.h>
42c5c4113dSnw #include <sys/resource.h> /* rlimit */
43c5c4113dSnw #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */
44c5c4113dSnw #include <priv_utils.h> /* privileges */
45c5c4113dSnw #include <locale.h>
46c5c4113dSnw #include <sys/systeminfo.h>
47c5c4113dSnw #include <errno.h>
48c5c4113dSnw #include <sys/wait.h>
49c5c4113dSnw #include <sys/time.h>
50c5c4113dSnw #include <zone.h>
51c5c4113dSnw #include <door.h>
52c8e26105Sjp #include <port.h>
53c5c4113dSnw #include <tsol/label.h>
54c5c4113dSnw #include <sys/resource.h>
55c5c4113dSnw #include <sys/sid.h>
56c5c4113dSnw #include <sys/idmap.h>
57bcced03bSjp #include <pthread.h>
58148c5f43SAlan Wright #include <stdarg.h>
59148c5f43SAlan Wright #include <assert.h>
60148c5f43SAlan Wright #include <note.h>
61c5c4113dSnw
62b3700b07SGordon Ross #define CBUFSIZ 26 /* ctime(3c) */
63b3700b07SGordon Ross
64c5c4113dSnw static void term_handler(int);
65c5c4113dSnw static void init_idmapd();
66c5c4113dSnw static void fini_idmapd();
67c5c4113dSnw
68b3700b07SGordon Ross /* The DC Locator lives inside idmap (for now). */
69b3700b07SGordon Ross extern void init_dc_locator(void);
70b3700b07SGordon Ross extern void fini_dc_locator(void);
71b3700b07SGordon Ross
72c5c4113dSnw idmapd_state_t _idmapdstate;
7360414d47SToomas Soome mutex_t _svcstate_lock = ERRORCHECKMUTEX;
74c5c4113dSnw
75c5c4113dSnw SVCXPRT *xprt = NULL;
76c5c4113dSnw
77c5c4113dSnw static int dfd = -1; /* our door server fildes, for unregistration */
78148c5f43SAlan Wright static boolean_t degraded = B_FALSE;
79c5c4113dSnw
80bcced03bSjp
81bcced03bSjp static uint32_t num_threads = 0;
82bcced03bSjp static pthread_key_t create_threads_key;
83bcced03bSjp static uint32_t max_threads = 40;
84bcced03bSjp
85bcced03bSjp /*
86bcced03bSjp * Server door thread start routine.
87bcced03bSjp *
88bcced03bSjp * Set a TSD value to the door thread. This enables the destructor to
89fea136a0SMatt Barden * be called when this thread exits. Note that we need a non-NULL
90fea136a0SMatt Barden * value for this or the TSD destructor is not called.
91bcced03bSjp */
92bcced03bSjp /*ARGSUSED*/
93bcced03bSjp static void *
idmapd_door_thread_start(void * arg)94bcced03bSjp idmapd_door_thread_start(void *arg)
95bcced03bSjp {
96fea136a0SMatt Barden static void *value = "NON-NULL TSD";
97bcced03bSjp
98bcced03bSjp /*
99bcced03bSjp * Disable cancellation to avoid memory leaks from not running
100bcced03bSjp * the thread cleanup code.
101bcced03bSjp */
102bcced03bSjp (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
103bcced03bSjp (void) pthread_setspecific(create_threads_key, value);
104bcced03bSjp (void) door_return(NULL, 0, NULL, 0);
105bcced03bSjp
106bcced03bSjp /* make lint happy */
107bcced03bSjp return (NULL);
108bcced03bSjp }
109bcced03bSjp
110bcced03bSjp /*
111bcced03bSjp * Server door threads creation
112bcced03bSjp */
113bcced03bSjp /*ARGSUSED*/
114bcced03bSjp static void
idmapd_door_thread_create(door_info_t * dip)115bcced03bSjp idmapd_door_thread_create(door_info_t *dip)
116bcced03bSjp {
117bcced03bSjp int num;
118bcced03bSjp pthread_t thread_id;
119bcced03bSjp
120bcced03bSjp if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) {
121bcced03bSjp atomic_dec_32(&num_threads);
122bcced03bSjp idmapdlog(LOG_DEBUG,
123bcced03bSjp "thread creation refused - %d threads currently active",
124bcced03bSjp num - 1);
125bcced03bSjp return;
126bcced03bSjp }
127bcced03bSjp (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL);
128bcced03bSjp idmapdlog(LOG_DEBUG,
129bcced03bSjp "created thread ID %d - %d threads currently active",
130bcced03bSjp thread_id, num);
131bcced03bSjp }
132bcced03bSjp
133bcced03bSjp /*
134bcced03bSjp * Server door thread cleanup
135bcced03bSjp */
136bcced03bSjp /*ARGSUSED*/
137bcced03bSjp static void
idmapd_door_thread_cleanup(void * arg)138bcced03bSjp idmapd_door_thread_cleanup(void *arg)
139bcced03bSjp {
140bcced03bSjp int num;
141bcced03bSjp
142fea136a0SMatt Barden /* set TSD to NULL so we don't loop infinitely */
143fea136a0SMatt Barden (void) pthread_setspecific(create_threads_key, NULL);
144bcced03bSjp num = atomic_dec_32_nv(&num_threads);
145bcced03bSjp idmapdlog(LOG_DEBUG,
146bcced03bSjp "exiting thread ID %d - %d threads currently active",
147bcced03bSjp pthread_self(), num);
148bcced03bSjp }
149bcced03bSjp
150c5c4113dSnw /*
151c5c4113dSnw * This is needed for mech_krb5 -- we run as daemon, yes, but we want
15278b2cb9aSnw * mech_krb5 to think we're root so it can get host/nodename.fqdn
15378b2cb9aSnw * tickets for us so we can authenticate to AD as the machine account
15478b2cb9aSnw * that we are. For more details look at the entry point in mech_krb5
15578b2cb9aSnw * corresponding to gss_init_sec_context().
15678b2cb9aSnw *
15778b2cb9aSnw * As a side effect of faking our effective UID to mech_krb5 we will use
15878b2cb9aSnw * root's default ccache (/tmp/krb5cc_0). But if that's created by
15978b2cb9aSnw * another process then we won't have access to it: we run as daemon and
16078b2cb9aSnw * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache
16178b2cb9aSnw * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main()
16278b2cb9aSnw * to avoid this issue; see main().
163c5c4113dSnw *
164c5c4113dSnw * Someday we'll have gss/mech_krb5 extensions for acquiring initiator
165c5c4113dSnw * creds with keytabs/raw keys, and someday we'll have extensions to
166c5c4113dSnw * libsasl to specify creds/name to use on the initiator side, and
167c5c4113dSnw * someday we'll have extensions to libldap to pass those through to
168c5c4113dSnw * libsasl. Until then this interposer will have to do.
169c5c4113dSnw *
170c5c4113dSnw * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid()
171c5c4113dSnw * is defined but not used.
172c5c4113dSnw */
173c5c4113dSnw /*LINTLIBRARY*/
174c5c4113dSnw uid_t
app_krb5_user_uid(void)175c5c4113dSnw app_krb5_user_uid(void)
176c5c4113dSnw {
177c5c4113dSnw return (0);
178c5c4113dSnw }
179c5c4113dSnw
180c5c4113dSnw /*ARGSUSED*/
181c5c4113dSnw static void
term_handler(int sig)1824edd44c5Sjp term_handler(int sig)
1834edd44c5Sjp {
18471590c90Snw idmapdlog(LOG_INFO, "Terminating.");
185b3700b07SGordon Ross fini_dc_locator();
186c5c4113dSnw fini_idmapd();
187c5c4113dSnw _exit(0);
188c5c4113dSnw }
189c5c4113dSnw
19071590c90Snw /*ARGSUSED*/
19171590c90Snw static void
usr1_handler(int sig)19271590c90Snw usr1_handler(int sig)
19371590c90Snw {
194148c5f43SAlan Wright NOTE(ARGUNUSED(sig))
19571590c90Snw print_idmapdstate();
19671590c90Snw }
19771590c90Snw
198c5c4113dSnw static int pipe_fd = -1;
199c5c4113dSnw
200c5c4113dSnw static void
daemonize_ready(void)2014edd44c5Sjp daemonize_ready(void)
2024edd44c5Sjp {
203c5c4113dSnw char data = '\0';
204c5c4113dSnw /*
205c5c4113dSnw * wake the parent
206c5c4113dSnw */
207c5c4113dSnw (void) write(pipe_fd, &data, 1);
208c5c4113dSnw (void) close(pipe_fd);
209c5c4113dSnw }
210c5c4113dSnw
211c5c4113dSnw static int
daemonize_start(void)2124edd44c5Sjp daemonize_start(void)
2134edd44c5Sjp {
214c5c4113dSnw char data;
215c5c4113dSnw int status;
216c5c4113dSnw int devnull;
217c5c4113dSnw int filedes[2];
218c5c4113dSnw pid_t pid;
219c5c4113dSnw
22078b2cb9aSnw (void) sigset(SIGPIPE, SIG_IGN);
221c5c4113dSnw devnull = open("/dev/null", O_RDONLY);
222c5c4113dSnw if (devnull < 0)
223c5c4113dSnw return (-1);
224c5c4113dSnw (void) dup2(devnull, 0);
225c5c4113dSnw (void) dup2(2, 1); /* stderr only */
226c5c4113dSnw if (pipe(filedes) < 0)
227c5c4113dSnw return (-1);
228c5c4113dSnw if ((pid = fork1()) < 0)
229c5c4113dSnw return (-1);
230c5c4113dSnw if (pid != 0) {
231c5c4113dSnw /*
232c5c4113dSnw * parent
233c5c4113dSnw */
234c5c4113dSnw (void) close(filedes[1]);
235c5c4113dSnw if (read(filedes[0], &data, 1) == 1) {
236c5c4113dSnw /* presume success */
237c5c4113dSnw _exit(0);
238c5c4113dSnw }
239c5c4113dSnw status = -1;
240c5c4113dSnw (void) wait4(pid, &status, 0, NULL);
241c5c4113dSnw if (WIFEXITED(status))
242c5c4113dSnw _exit(WEXITSTATUS(status));
243c5c4113dSnw else
244c5c4113dSnw _exit(-1);
245c5c4113dSnw }
246c5c4113dSnw
247c5c4113dSnw /*
248c5c4113dSnw * child
249c5c4113dSnw */
250c5c4113dSnw pipe_fd = filedes[1];
251c5c4113dSnw (void) close(filedes[0]);
252c5c4113dSnw (void) setsid();
253c5c4113dSnw (void) umask(0077);
254c5c4113dSnw openlog("idmap", LOG_PID, LOG_DAEMON);
255479ac375Sdm
256c5c4113dSnw return (0);
257c5c4113dSnw }
258c5c4113dSnw
259c5c4113dSnw
260c5c4113dSnw int
main(int argc,char ** argv)261c5c4113dSnw main(int argc, char **argv)
262c5c4113dSnw {
263c5c4113dSnw int c;
2642b3ecdebSjp struct rlimit rl;
265c5c4113dSnw
266b3700b07SGordon Ross if (rwlock_init(&_idmapdstate.rwlk_cfg, USYNC_THREAD, NULL) != 0)
267b3700b07SGordon Ross return (-1);
268b3700b07SGordon Ross if (mutex_init(&_idmapdstate.addisc_lk, USYNC_THREAD, NULL) != 0)
269b3700b07SGordon Ross return (-1);
270b3700b07SGordon Ross if (cond_init(&_idmapdstate.addisc_cv, USYNC_THREAD, NULL) != 0)
271b3700b07SGordon Ross return (-1);
272b3700b07SGordon Ross
27371590c90Snw _idmapdstate.daemon_mode = TRUE;
27471590c90Snw while ((c = getopt(argc, argv, "d")) != -1) {
275c5c4113dSnw switch (c) {
276c5c4113dSnw case 'd':
27771590c90Snw _idmapdstate.daemon_mode = FALSE;
278c5c4113dSnw break;
279c5c4113dSnw default:
280bbf6f00cSJordan Brown (void) fprintf(stderr,
281bbf6f00cSJordan Brown "Usage: /usr/lib/idmapd [-d]\n");
28271590c90Snw return (SMF_EXIT_ERR_CONFIG);
283c5c4113dSnw }
284c5c4113dSnw }
285c5c4113dSnw
286c5c4113dSnw /* set locale and domain for internationalization */
287c5c4113dSnw (void) setlocale(LC_ALL, "");
288c5c4113dSnw (void) textdomain(TEXT_DOMAIN);
289c5c4113dSnw
2907a8a68f5SJulian Pullen idmap_set_logger(idmapdlog);
291c5866007SKeyur Desai adutils_set_logger(idmapdlog);
292479ac375Sdm
293bda89588Sjp if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) {
29471590c90Snw idmapdlog(LOG_ERR,
29571590c90Snw "with Trusted Extensions idmapd runs only in the "
296bda89588Sjp "global zone");
297c5c4113dSnw exit(1);
298c5c4113dSnw }
299c5c4113dSnw
3002b3ecdebSjp /*
3012b3ecdebSjp * Raise the fd limit to max
3022b3ecdebSjp */
3032b3ecdebSjp if (getrlimit(RLIMIT_NOFILE, &rl) != 0) {
3042b3ecdebSjp idmapdlog(LOG_ERR, "getrlimit failed");
3052b3ecdebSjp } else if (rl.rlim_cur < rl.rlim_max) {
3062b3ecdebSjp rl.rlim_cur = rl.rlim_max;
3072b3ecdebSjp if (setrlimit(RLIMIT_NOFILE, &rl) != 0)
3082b3ecdebSjp idmapdlog(LOG_ERR,
3092b3ecdebSjp "Unable to raise RLIMIT_NOFILE to %d",
3102b3ecdebSjp rl.rlim_cur);
3112b3ecdebSjp }
3122b3ecdebSjp
31371590c90Snw if (_idmapdstate.daemon_mode == TRUE) {
314c5c4113dSnw if (daemonize_start() < 0) {
3157a8a68f5SJulian Pullen idmapdlog(LOG_ERR, "unable to daemonize");
316c5c4113dSnw exit(-1);
317c5c4113dSnw }
318c5c4113dSnw } else
319c5c4113dSnw (void) umask(0077);
320c5c4113dSnw
32184decf41Sjp idmap_init_tsd_key();
32284decf41Sjp
323c5c4113dSnw init_idmapd();
324b3700b07SGordon Ross init_dc_locator();
325c5c4113dSnw
32678b2cb9aSnw /* signal handlers that should run only after we're initialized */
32778b2cb9aSnw (void) sigset(SIGTERM, term_handler);
32871590c90Snw (void) sigset(SIGUSR1, usr1_handler);
3290dcc7149Snw (void) sigset(SIGHUP, idmap_cfg_hup_handler);
33078b2cb9aSnw
331c5c4113dSnw if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET,
332c5c4113dSnw DAEMON_UID, DAEMON_GID,
333c5c4113dSnw PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ,
334c5c4113dSnw (char *)NULL) == -1) {
33571590c90Snw idmapdlog(LOG_ERR, "unable to drop privileges");
336c5c4113dSnw exit(1);
337c5c4113dSnw }
338c5c4113dSnw
339c5c4113dSnw __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION,
340c5c4113dSnw PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL);
341c5c4113dSnw
34271590c90Snw if (_idmapdstate.daemon_mode == TRUE)
343c5c4113dSnw daemonize_ready();
344c5c4113dSnw
345c5c4113dSnw /* With doors RPC this just wastes this thread, oh well */
346c5c4113dSnw svc_run();
347c5c4113dSnw return (0);
348c5c4113dSnw }
349c5c4113dSnw
350c5c4113dSnw static void
init_idmapd()3514edd44c5Sjp init_idmapd()
3524edd44c5Sjp {
353c5c4113dSnw int error;
354bcced03bSjp int connmaxrec = IDMAP_MAX_DOOR_RPC;
355bcced03bSjp
356c5c4113dSnw
35778b2cb9aSnw /* create directories as root and chown to daemon uid */
35878b2cb9aSnw if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0)
35978b2cb9aSnw exit(1);
36078b2cb9aSnw if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0)
36178b2cb9aSnw exit(1);
36278b2cb9aSnw
36378b2cb9aSnw /*
36478b2cb9aSnw * Set KRB5CCNAME in the environment. See app_krb5_user_uid()
365e3c2d6aaSnw * for more details. We blow away the existing one, if there is
366e3c2d6aaSnw * one.
36778b2cb9aSnw */
368e3c2d6aaSnw (void) unlink(IDMAP_CACHEDIR "/ccache");
369148c5f43SAlan Wright (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache");
370b3700b07SGordon Ross (void) putenv("MS_INTEROP=1");
37178b2cb9aSnw
372c5c4113dSnw if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname,
3734edd44c5Sjp sizeof (_idmapdstate.hostname)) == -1) {
374c5c4113dSnw error = errno;
37571590c90Snw idmapdlog(LOG_ERR, "unable to determine hostname, error: %d",
3764edd44c5Sjp error);
377c5c4113dSnw exit(1);
378c5c4113dSnw }
379c5c4113dSnw
380e8c27ec8Sbaban if ((error = init_mapping_system()) < 0) {
38171590c90Snw idmapdlog(LOG_ERR, "unable to initialize mapping system");
382e8c27ec8Sbaban exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1);
383c5c4113dSnw }
384c5c4113dSnw
385fea136a0SMatt Barden /*
386fea136a0SMatt Barden * This means max_threads can't be updated without restarting idmap.
387fea136a0SMatt Barden */
388fea136a0SMatt Barden RDLOCK_CONFIG();
389fea136a0SMatt Barden max_threads = _idmapdstate.cfg->pgcfg.max_threads;
390fea136a0SMatt Barden UNLOCK_CONFIG();
391fea136a0SMatt Barden
392bcced03bSjp (void) door_server_create(idmapd_door_thread_create);
393bcced03bSjp if ((error = pthread_key_create(&create_threads_key,
394bcced03bSjp idmapd_door_thread_cleanup)) != 0) {
395bcced03bSjp idmapdlog(LOG_ERR, "unable to create threads key (%s)",
396bcced03bSjp strerror(error));
397bcced03bSjp goto errout;
398bcced03bSjp }
399bcced03bSjp
400d3a612caSnw xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec);
401c5c4113dSnw if (xprt == NULL) {
40271590c90Snw idmapdlog(LOG_ERR, "unable to create door RPC service");
403c5c4113dSnw goto errout;
404c5c4113dSnw }
405c5c4113dSnw
4068e228215Sdm if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) {
40771590c90Snw idmapdlog(LOG_ERR, "unable to limit RPC request size");
4088e228215Sdm goto errout;
4098e228215Sdm }
4108e228215Sdm
411c5c4113dSnw dfd = xprt->xp_fd;
412c5c4113dSnw
413c5c4113dSnw if (dfd == -1) {
41471590c90Snw idmapdlog(LOG_ERR, "unable to register door");
415c5c4113dSnw goto errout;
416c5c4113dSnw }
4179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if ((error = __idmap_reg(dfd)) != 0) {
41871590c90Snw idmapdlog(LOG_ERR, "unable to register door (%s)",
4194edd44c5Sjp strerror(errno));
420c5c4113dSnw goto errout;
421c5c4113dSnw }
422c5c4113dSnw
423c5c4113dSnw if ((error = allocids(_idmapdstate.new_eph_db,
4244edd44c5Sjp 8192, &_idmapdstate.next_uid,
4254edd44c5Sjp 8192, &_idmapdstate.next_gid)) != 0) {
42671590c90Snw idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)",
42771590c90Snw strerror(errno));
4289fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.next_uid = IDMAP_SENTINEL_PID;
4299fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.limit_uid = IDMAP_SENTINEL_PID;
4309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.next_gid = IDMAP_SENTINEL_PID;
4319fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.limit_gid = IDMAP_SENTINEL_PID;
432c5c4113dSnw } else {
433c5c4113dSnw _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192;
434c5c4113dSnw _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192;
435c5c4113dSnw }
436c5c4113dSnw
437148c5f43SAlan Wright if (DBG(CONFIG, 1))
438148c5f43SAlan Wright print_idmapdstate();
439c5c4113dSnw
440c5c4113dSnw return;
441c5c4113dSnw
442c5c4113dSnw errout:
443c5c4113dSnw fini_idmapd();
444c5c4113dSnw exit(1);
445c5c4113dSnw }
446c5c4113dSnw
447c5c4113dSnw static void
fini_idmapd()4484edd44c5Sjp fini_idmapd()
4494edd44c5Sjp {
450148c5f43SAlan Wright (void) __idmap_unreg(dfd);
451c5c4113dSnw fini_mapping_system();
452c5c4113dSnw if (xprt != NULL)
453c5c4113dSnw svc_destroy(xprt);
454c5c4113dSnw }
455c5c4113dSnw
45671590c90Snw static
45771590c90Snw const char *
get_fmri(void)45871590c90Snw get_fmri(void)
45971590c90Snw {
46071590c90Snw static char *fmri = NULL;
46171590c90Snw static char buf[60];
46271590c90Snw char *s;
46371590c90Snw
46471590c90Snw membar_consumer();
46571590c90Snw s = fmri;
46671590c90Snw if (s != NULL && *s == '\0')
46771590c90Snw return (NULL);
46871590c90Snw else if (s != NULL)
46971590c90Snw return (s);
47071590c90Snw
47171590c90Snw if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf))
47271590c90Snw buf[0] = '\0';
47371590c90Snw else
47471590c90Snw (void) strlcpy(buf, s, sizeof (buf));
47571590c90Snw
47671590c90Snw membar_producer();
47771590c90Snw fmri = buf;
47871590c90Snw
47971590c90Snw return (get_fmri());
48071590c90Snw }
48171590c90Snw
48271590c90Snw /*
48371590c90Snw * Wrappers for smf_degrade/restore_instance()
48471590c90Snw *
48571590c90Snw * smf_restore_instance() is too heavy duty to be calling every time we
48671590c90Snw * have a successful AD name<->SID lookup.
48771590c90Snw */
48871590c90Snw void
degrade_svc(int poke_discovery,const char * reason)489349d5d8fSnw degrade_svc(int poke_discovery, const char *reason)
49071590c90Snw {
49171590c90Snw const char *fmri;
49271590c90Snw
49371590c90Snw membar_consumer();
49471590c90Snw if (degraded)
49571590c90Snw return;
496349d5d8fSnw
497148c5f43SAlan Wright idmapdlog(LOG_ERR, "Degraded operation (%s).", reason);
498349d5d8fSnw
49971590c90Snw membar_producer();
500148c5f43SAlan Wright degraded = B_TRUE;
50171590c90Snw
50271590c90Snw if ((fmri = get_fmri()) != NULL)
50371590c90Snw (void) smf_degrade_instance(fmri, 0);
504c5866007SKeyur Desai
505c5866007SKeyur Desai /*
506c5866007SKeyur Desai * If the config update thread is in a state where auto-discovery could
507c5866007SKeyur Desai * be re-tried, then this will make it try it -- a sort of auto-refresh.
508c5866007SKeyur Desai */
509c5866007SKeyur Desai if (poke_discovery)
510c5866007SKeyur Desai idmap_cfg_poke_updates();
51171590c90Snw }
51271590c90Snw
51371590c90Snw void
restore_svc(void)51471590c90Snw restore_svc(void)
51571590c90Snw {
51671590c90Snw const char *fmri;
51771590c90Snw
51871590c90Snw membar_consumer();
51971590c90Snw if (!degraded)
52071590c90Snw return;
52171590c90Snw
52271590c90Snw if ((fmri = get_fmri()) == NULL)
52371590c90Snw (void) smf_restore_instance(fmri);
52471590c90Snw
52571590c90Snw membar_producer();
526148c5f43SAlan Wright degraded = B_FALSE;
527479ac375Sdm
528349d5d8fSnw idmapdlog(LOG_NOTICE, "Normal operation restored");
52971590c90Snw }
53071590c90Snw
5317a8a68f5SJulian Pullen
5327a8a68f5SJulian Pullen /* printflike */
533c5c4113dSnw void
idmapdlog(int pri,const char * format,...)534fea136a0SMatt Barden idmapdlog(int pri, const char *format, ...)
535fea136a0SMatt Barden {
536b3700b07SGordon Ross static time_t prev_ts;
537c5c4113dSnw va_list args;
538b3700b07SGordon Ross char cbuf[CBUFSIZ];
539b3700b07SGordon Ross time_t ts;
540b3700b07SGordon Ross
541b3700b07SGordon Ross ts = time(NULL);
542b3700b07SGordon Ross if (prev_ts != ts) {
543b3700b07SGordon Ross prev_ts = ts;
544b3700b07SGordon Ross /* NB: cbuf has \n */
545b3700b07SGordon Ross (void) fprintf(stderr, "@ %s",
546b3700b07SGordon Ross ctime_r(&ts, cbuf, sizeof (cbuf)));
547b3700b07SGordon Ross }
548c5c4113dSnw
549148c5f43SAlan Wright va_start(args, format);
550148c5f43SAlan Wright (void) vfprintf(stderr, format, args);
551148c5f43SAlan Wright (void) fprintf(stderr, "\n");
552148c5f43SAlan Wright va_end(args);
55371590c90Snw
55471590c90Snw /*
55571590c90Snw * We don't want to fill up the logs with useless messages when
55671590c90Snw * we're degraded, but we still want to log.
55771590c90Snw */
558148c5f43SAlan Wright if (degraded)
55971590c90Snw pri = LOG_DEBUG;
56071590c90Snw
561148c5f43SAlan Wright va_start(args, format);
562148c5f43SAlan Wright vsyslog(pri, format, args);
563148c5f43SAlan Wright va_end(args);
5647a8a68f5SJulian Pullen }
5657a8a68f5SJulian Pullen
566148c5f43SAlan Wright static void
trace_str(nvlist_t * entry,char * n1,char * n2,char * str)567148c5f43SAlan Wright trace_str(nvlist_t *entry, char *n1, char *n2, char *str)
5687a8a68f5SJulian Pullen {
569148c5f43SAlan Wright char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
570148c5f43SAlan Wright
571148c5f43SAlan Wright (void) strlcpy(name, n1, sizeof (name));
572148c5f43SAlan Wright if (n2 != NULL)
573148c5f43SAlan Wright (void) strlcat(name, n2, sizeof (name));
574148c5f43SAlan Wright
575148c5f43SAlan Wright (void) nvlist_add_string(entry, name, str);
5767a8a68f5SJulian Pullen }
5777a8a68f5SJulian Pullen
578148c5f43SAlan Wright static void
trace_int(nvlist_t * entry,char * n1,char * n2,int64_t i)579148c5f43SAlan Wright trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i)
5807a8a68f5SJulian Pullen {
581148c5f43SAlan Wright char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
582148c5f43SAlan Wright
583148c5f43SAlan Wright (void) strlcpy(name, n1, sizeof (name));
584148c5f43SAlan Wright if (n2 != NULL)
585148c5f43SAlan Wright (void) strlcat(name, n2, sizeof (name));
586148c5f43SAlan Wright
587148c5f43SAlan Wright (void) nvlist_add_int64(entry, name, i);
5887a8a68f5SJulian Pullen }
5897a8a68f5SJulian Pullen
590148c5f43SAlan Wright static void
trace_sid(nvlist_t * entry,char * n1,char * n2,idmap_sid * sid)591148c5f43SAlan Wright trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid)
592148c5f43SAlan Wright {
593148c5f43SAlan Wright char *str;
594148c5f43SAlan Wright
595148c5f43SAlan Wright (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid);
596148c5f43SAlan Wright if (str == NULL)
597148c5f43SAlan Wright return;
598148c5f43SAlan Wright
599148c5f43SAlan Wright trace_str(entry, n1, n2, str);
600148c5f43SAlan Wright free(str);
601148c5f43SAlan Wright }
602148c5f43SAlan Wright
603148c5f43SAlan Wright static void
trace_id(nvlist_t * entry,char * fromto,idmap_id * id,char * name,char * domain)604148c5f43SAlan Wright trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain)
605148c5f43SAlan Wright {
606148c5f43SAlan Wright trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype);
607148c5f43SAlan Wright if (IS_ID_SID(*id)) {
608148c5f43SAlan Wright if (name != NULL) {
609148c5f43SAlan Wright char *str;
610148c5f43SAlan Wright
611148c5f43SAlan Wright (void) asprintf(&str, "%s%s%s", name,
612148c5f43SAlan Wright domain == NULL ? "" : "@",
613148c5f43SAlan Wright domain == NULL ? "" : domain);
614148c5f43SAlan Wright if (str != NULL) {
615148c5f43SAlan Wright trace_str(entry, fromto, IDMAP_TRACE_NAME, str);
616148c5f43SAlan Wright free(str);
617148c5f43SAlan Wright }
618148c5f43SAlan Wright }
619148c5f43SAlan Wright if (id->idmap_id_u.sid.prefix != NULL) {
620148c5f43SAlan Wright trace_sid(entry, fromto, IDMAP_TRACE_SID,
621148c5f43SAlan Wright &id->idmap_id_u.sid);
622148c5f43SAlan Wright }
623148c5f43SAlan Wright } else if (IS_ID_POSIX(*id)) {
624148c5f43SAlan Wright if (name != NULL)
625148c5f43SAlan Wright trace_str(entry, fromto, IDMAP_TRACE_NAME, name);
626148c5f43SAlan Wright if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) {
627148c5f43SAlan Wright trace_int(entry, fromto, IDMAP_TRACE_UNIXID,
628148c5f43SAlan Wright (int64_t)id->idmap_id_u.uid);
629148c5f43SAlan Wright }
630148c5f43SAlan Wright }
631148c5f43SAlan Wright }
632148c5f43SAlan Wright
633148c5f43SAlan Wright /*
634148c5f43SAlan Wright * Record a trace event. TRACE() has already decided whether or not
635148c5f43SAlan Wright * tracing is required; what we do here is collect the data and send it
636148c5f43SAlan Wright * to its destination - to the trace log in the response, if
637148c5f43SAlan Wright * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping
638148c5f43SAlan Wright * is greater than zero.
639148c5f43SAlan Wright */
640148c5f43SAlan Wright int
trace(idmap_mapping * req,idmap_id_res * res,char * fmt,...)641148c5f43SAlan Wright trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...)
6427a8a68f5SJulian Pullen {
643148c5f43SAlan Wright va_list va;
644148c5f43SAlan Wright char *buf;
645148c5f43SAlan Wright int err;
646148c5f43SAlan Wright nvlist_t *entry;
647148c5f43SAlan Wright
648148c5f43SAlan Wright assert(req != NULL);
649148c5f43SAlan Wright assert(res != NULL);
650148c5f43SAlan Wright
651148c5f43SAlan Wright err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0);
652148c5f43SAlan Wright if (err != 0) {
653148c5f43SAlan Wright (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n",
654148c5f43SAlan Wright strerror(err));
655148c5f43SAlan Wright return (0);
656148c5f43SAlan Wright }
657148c5f43SAlan Wright
658148c5f43SAlan Wright trace_id(entry, "from", &req->id1, req->id1name, req->id1domain);
659148c5f43SAlan Wright trace_id(entry, "to", &res->id, req->id2name, req->id2domain);
660148c5f43SAlan Wright
661148c5f43SAlan Wright if (IDMAP_ERROR(res->retcode)) {
662148c5f43SAlan Wright trace_int(entry, IDMAP_TRACE_ERROR, NULL,
663148c5f43SAlan Wright (int64_t)res->retcode);
664148c5f43SAlan Wright }
665148c5f43SAlan Wright
666148c5f43SAlan Wright va_start(va, fmt);
667148c5f43SAlan Wright (void) vasprintf(&buf, fmt, va);
668148c5f43SAlan Wright va_end(va);
669148c5f43SAlan Wright if (buf != NULL) {
670148c5f43SAlan Wright trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf);
671148c5f43SAlan Wright free(buf);
672148c5f43SAlan Wright }
673148c5f43SAlan Wright
674148c5f43SAlan Wright if (DBG(MAPPING, 1))
675148c5f43SAlan Wright idmap_trace_print_1(stderr, "", entry);
676148c5f43SAlan Wright
677148c5f43SAlan Wright if (req->flag & IDMAP_REQ_FLG_TRACE) {
678148c5f43SAlan Wright /* Lazily allocate the trace list */
679148c5f43SAlan Wright if (res->info.trace == NULL) {
680148c5f43SAlan Wright err = nvlist_alloc(&res->info.trace, 0, 0);
681148c5f43SAlan Wright if (err != 0) {
682148c5f43SAlan Wright res->info.trace = NULL; /* just in case */
683148c5f43SAlan Wright (void) fprintf(stderr,
684148c5f43SAlan Wright "trace nvlist_alloc(trace): %s\n",
685148c5f43SAlan Wright strerror(err));
686148c5f43SAlan Wright nvlist_free(entry);
687148c5f43SAlan Wright return (0);
688148c5f43SAlan Wright }
689148c5f43SAlan Wright }
690148c5f43SAlan Wright (void) nvlist_add_nvlist(res->info.trace, "", entry);
691148c5f43SAlan Wright /* Note that entry is copied, so we must still free our copy */
692148c5f43SAlan Wright }
693148c5f43SAlan Wright
694148c5f43SAlan Wright nvlist_free(entry);
695148c5f43SAlan Wright
696148c5f43SAlan Wright return (0);
697c5c4113dSnw }
698*3cd6e9e1SMatt Barden
699*3cd6e9e1SMatt Barden /*
700*3cd6e9e1SMatt Barden * Enable libumem debugging by default on DEBUG builds.
701*3cd6e9e1SMatt Barden * idmapd uses rpcgen, so we can't use #ifdef DEBUG without causing
702*3cd6e9e1SMatt Barden * undesirable behavior.
703*3cd6e9e1SMatt Barden */
704*3cd6e9e1SMatt Barden #ifdef IDMAPD_DEBUG
705*3cd6e9e1SMatt Barden const char *
_umem_debug_init(void)706*3cd6e9e1SMatt Barden _umem_debug_init(void)
707*3cd6e9e1SMatt Barden {
708*3cd6e9e1SMatt Barden return ("default,verbose"); /* $UMEM_DEBUG setting */
709*3cd6e9e1SMatt Barden }
710*3cd6e9e1SMatt Barden
711*3cd6e9e1SMatt Barden const char *
_umem_logging_init(void)712*3cd6e9e1SMatt Barden _umem_logging_init(void)
713*3cd6e9e1SMatt Barden {
714*3cd6e9e1SMatt Barden return ("fail,contents"); /* $UMEM_LOGGING setting */
715*3cd6e9e1SMatt Barden }
716*3cd6e9e1SMatt Barden #endif
717