1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22c5c4113dSnw * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw #pragma ident "%Z%%M% %I% %E% SMI" 27c5c4113dSnw 28c5c4113dSnw /* 29c5c4113dSnw * main() of idmapd(1M) 30c5c4113dSnw */ 31c5c4113dSnw 32c5c4113dSnw #include "idmapd.h" 33c5c4113dSnw #include <signal.h> 34c5c4113dSnw #include <rpc/pmap_clnt.h> /* for pmap_unset */ 35c5c4113dSnw #include <string.h> /* strcmp */ 36c5c4113dSnw #include <unistd.h> /* setsid */ 37c5c4113dSnw #include <sys/types.h> 38c5c4113dSnw #include <memory.h> 39c5c4113dSnw #include <stropts.h> 40c5c4113dSnw #include <netconfig.h> 41c5c4113dSnw #include <sys/resource.h> /* rlimit */ 42c5c4113dSnw #include <syslog.h> 43c5c4113dSnw #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */ 44c5c4113dSnw #include <priv_utils.h> /* privileges */ 45c5c4113dSnw #include <locale.h> 46c5c4113dSnw #include <sys/systeminfo.h> 47c5c4113dSnw #include <errno.h> 48c5c4113dSnw #include <sys/wait.h> 49c5c4113dSnw #include <sys/time.h> 50c5c4113dSnw #include <zone.h> 51c5c4113dSnw #include <door.h> 52*c8e26105Sjp #include <port.h> 53c5c4113dSnw #include <tsol/label.h> 54c5c4113dSnw #include <sys/resource.h> 55c5c4113dSnw #include <sys/sid.h> 56c5c4113dSnw #include <sys/idmap.h> 57c5c4113dSnw 58c5c4113dSnw static void hup_handler(int); 59c5c4113dSnw static void term_handler(int); 60c5c4113dSnw static void init_idmapd(); 61c5c4113dSnw static void fini_idmapd(); 62c5c4113dSnw 63c5c4113dSnw #ifndef SIG_PF 64c5c4113dSnw #define SIG_PF void(*)(int) 65c5c4113dSnw #endif 66c5c4113dSnw 67c5c4113dSnw #define _RPCSVC_CLOSEDOWN 120 68c5c4113dSnw 69c5c4113dSnw int _rpcsvcstate = _IDLE; /* Set when a request is serviced */ 70c5c4113dSnw int _rpcsvccount = 0; /* Number of requests being serviced */ 71c5c4113dSnw mutex_t _svcstate_lock; /* lock for _rpcsvcstate, _rpcsvccount */ 72c5c4113dSnw idmapd_state_t _idmapdstate; 73c5c4113dSnw 74*c8e26105Sjp int hupped; 75*c8e26105Sjp extern int hup_ev_port; 76*c8e26105Sjp 77c5c4113dSnw SVCXPRT *xprt = NULL; 78c5c4113dSnw 79c5c4113dSnw static int dfd = -1; /* our door server fildes, for unregistration */ 80c5c4113dSnw 81c5c4113dSnw #ifdef DEBUG 82c5c4113dSnw #define RPC_SVC_FG 83c5c4113dSnw #endif 84c5c4113dSnw 85c5c4113dSnw /* 86c5c4113dSnw * This is needed for mech_krb5 -- we run as daemon, yes, but we want 8778b2cb9aSnw * mech_krb5 to think we're root so it can get host/nodename.fqdn 8878b2cb9aSnw * tickets for us so we can authenticate to AD as the machine account 8978b2cb9aSnw * that we are. For more details look at the entry point in mech_krb5 9078b2cb9aSnw * corresponding to gss_init_sec_context(). 9178b2cb9aSnw * 9278b2cb9aSnw * As a side effect of faking our effective UID to mech_krb5 we will use 9378b2cb9aSnw * root's default ccache (/tmp/krb5cc_0). But if that's created by 9478b2cb9aSnw * another process then we won't have access to it: we run as daemon and 9578b2cb9aSnw * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache 9678b2cb9aSnw * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main() 9778b2cb9aSnw * to avoid this issue; see main(). 98c5c4113dSnw * 99c5c4113dSnw * Someday we'll have gss/mech_krb5 extensions for acquiring initiator 100c5c4113dSnw * creds with keytabs/raw keys, and someday we'll have extensions to 101c5c4113dSnw * libsasl to specify creds/name to use on the initiator side, and 102c5c4113dSnw * someday we'll have extensions to libldap to pass those through to 103c5c4113dSnw * libsasl. Until then this interposer will have to do. 104c5c4113dSnw * 105c5c4113dSnw * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid() 106c5c4113dSnw * is defined but not used. 107c5c4113dSnw */ 108c5c4113dSnw /*LINTLIBRARY*/ 109c5c4113dSnw uid_t 110c5c4113dSnw app_krb5_user_uid(void) 111c5c4113dSnw { 112c5c4113dSnw return (0); 113c5c4113dSnw } 114c5c4113dSnw 115c5c4113dSnw /*ARGSUSED*/ 116c5c4113dSnw static void 117c5c4113dSnw hup_handler(int sig) { 118*c8e26105Sjp hupped = 1; 119*c8e26105Sjp if (hup_ev_port >= 0) 120*c8e26105Sjp (void) port_send(hup_ev_port, 1, &sig /* any ptr will do */); 121c5c4113dSnw } 122c5c4113dSnw 123*c8e26105Sjp 124c5c4113dSnw /*ARGSUSED*/ 125c5c4113dSnw static void 126c5c4113dSnw term_handler(int sig) { 127c5c4113dSnw (void) idmapdlog(LOG_INFO, "idmapd: Terminating."); 128c5c4113dSnw fini_idmapd(); 129c5c4113dSnw _exit(0); 130c5c4113dSnw } 131c5c4113dSnw 132c5c4113dSnw static int pipe_fd = -1; 133c5c4113dSnw 134c5c4113dSnw static void 135c5c4113dSnw daemonize_ready(void) { 136c5c4113dSnw char data = '\0'; 137c5c4113dSnw /* 138c5c4113dSnw * wake the parent 139c5c4113dSnw */ 140c5c4113dSnw (void) write(pipe_fd, &data, 1); 141c5c4113dSnw (void) close(pipe_fd); 142c5c4113dSnw } 143c5c4113dSnw 144c5c4113dSnw static int 145c5c4113dSnw daemonize_start(void) { 146c5c4113dSnw char data; 147c5c4113dSnw int status; 148c5c4113dSnw int devnull; 149c5c4113dSnw int filedes[2]; 150c5c4113dSnw pid_t pid; 151c5c4113dSnw 15278b2cb9aSnw (void) sigset(SIGPIPE, SIG_IGN); 153c5c4113dSnw devnull = open("/dev/null", O_RDONLY); 154c5c4113dSnw if (devnull < 0) 155c5c4113dSnw return (-1); 156c5c4113dSnw (void) dup2(devnull, 0); 157c5c4113dSnw (void) dup2(2, 1); /* stderr only */ 158c5c4113dSnw if (pipe(filedes) < 0) 159c5c4113dSnw return (-1); 160c5c4113dSnw if ((pid = fork1()) < 0) 161c5c4113dSnw return (-1); 162c5c4113dSnw if (pid != 0) { 163c5c4113dSnw /* 164c5c4113dSnw * parent 165c5c4113dSnw */ 166c5c4113dSnw (void) close(filedes[1]); 167c5c4113dSnw if (read(filedes[0], &data, 1) == 1) { 168c5c4113dSnw /* presume success */ 169c5c4113dSnw _exit(0); 170c5c4113dSnw } 171c5c4113dSnw status = -1; 172c5c4113dSnw (void) wait4(pid, &status, 0, NULL); 173c5c4113dSnw if (WIFEXITED(status)) 174c5c4113dSnw _exit(WEXITSTATUS(status)); 175c5c4113dSnw else 176c5c4113dSnw _exit(-1); 177c5c4113dSnw } 178c5c4113dSnw 179c5c4113dSnw /* 180c5c4113dSnw * child 181c5c4113dSnw */ 182c5c4113dSnw pipe_fd = filedes[1]; 183c5c4113dSnw (void) close(filedes[0]); 184c5c4113dSnw (void) setsid(); 185c5c4113dSnw (void) umask(0077); 186c5c4113dSnw openlog("idmap", LOG_PID, LOG_DAEMON); 187c5c4113dSnw _idmapdstate.daemon_mode = TRUE; 188c5c4113dSnw return (0); 189c5c4113dSnw } 190c5c4113dSnw 191c5c4113dSnw 192c5c4113dSnw int 193c5c4113dSnw main(int argc, char **argv) 194c5c4113dSnw { 195c5c4113dSnw int c; 196c5c4113dSnw #ifdef RPC_SVC_FG 197c5c4113dSnw bool_t daemonize = FALSE; 198c5c4113dSnw #else 199c5c4113dSnw bool_t daemonize = TRUE; 200c5c4113dSnw #endif 201c5c4113dSnw 202c5c4113dSnw while ((c = getopt(argc, argv, "d")) != EOF) { 203c5c4113dSnw switch (c) { 204c5c4113dSnw case 'd': 205c5c4113dSnw daemonize = FALSE; 206c5c4113dSnw break; 207c5c4113dSnw default: 208c5c4113dSnw break; 209c5c4113dSnw } 210c5c4113dSnw } 211c5c4113dSnw 212c5c4113dSnw /* set locale and domain for internationalization */ 213c5c4113dSnw (void) setlocale(LC_ALL, ""); 214c5c4113dSnw (void) textdomain(TEXT_DOMAIN); 215c5c4113dSnw 21678b2cb9aSnw if (getzoneid() != GLOBAL_ZONEID) { 217c5c4113dSnw (void) idmapdlog(LOG_ERR, 21878b2cb9aSnw "idmapd: idmapd runs only in the global zone"); 219c5c4113dSnw exit(1); 220c5c4113dSnw } 221c5c4113dSnw 222c5c4113dSnw (void) mutex_init(&_svcstate_lock, USYNC_THREAD, NULL); 223c5c4113dSnw 224c5c4113dSnw if (daemonize == TRUE) { 225c5c4113dSnw if (daemonize_start() < 0) { 226c5c4113dSnw (void) perror("idmapd: unable to daemonize"); 227c5c4113dSnw exit(-1); 228c5c4113dSnw } 229c5c4113dSnw } else 230c5c4113dSnw (void) umask(0077); 231c5c4113dSnw 23284decf41Sjp idmap_init_tsd_key(); 23384decf41Sjp 234c5c4113dSnw init_idmapd(); 235c5c4113dSnw 23678b2cb9aSnw /* signal handlers that should run only after we're initialized */ 23778b2cb9aSnw (void) sigset(SIGTERM, term_handler); 23878b2cb9aSnw (void) sigset(SIGHUP, hup_handler); 23978b2cb9aSnw 240c5c4113dSnw if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET, 241c5c4113dSnw DAEMON_UID, DAEMON_GID, 242c5c4113dSnw PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ, 243c5c4113dSnw (char *)NULL) == -1) { 244651c0131Sbaban (void) idmapdlog(LOG_ERR, "idmapd: unable to drop privileges"); 245c5c4113dSnw exit(1); 246c5c4113dSnw } 247c5c4113dSnw 248c5c4113dSnw __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION, 249c5c4113dSnw PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL); 250c5c4113dSnw 251c5c4113dSnw if (daemonize == TRUE) 252c5c4113dSnw daemonize_ready(); 253c5c4113dSnw 254c5c4113dSnw /* With doors RPC this just wastes this thread, oh well */ 255c5c4113dSnw svc_run(); 256c5c4113dSnw return (0); 257c5c4113dSnw } 258c5c4113dSnw 259c5c4113dSnw static void 260c5c4113dSnw init_idmapd() { 261c5c4113dSnw int error; 262d3a612caSnw int connmaxrec = IDMAP_MAX_DOOR_RPC; 263c5c4113dSnw 26478b2cb9aSnw /* create directories as root and chown to daemon uid */ 26578b2cb9aSnw if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0) 26678b2cb9aSnw exit(1); 26778b2cb9aSnw if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0) 26878b2cb9aSnw exit(1); 26978b2cb9aSnw 27078b2cb9aSnw /* 27178b2cb9aSnw * Set KRB5CCNAME in the environment. See app_krb5_user_uid() 27278b2cb9aSnw * for more details. 27378b2cb9aSnw */ 27478b2cb9aSnw putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache"); 27578b2cb9aSnw 276c5c4113dSnw memset(&_idmapdstate, 0, sizeof (_idmapdstate)); 277c5c4113dSnw 278c5c4113dSnw if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname, 279c5c4113dSnw sizeof (_idmapdstate.hostname)) == -1) { 280c5c4113dSnw error = errno; 281c5c4113dSnw idmapdlog(LOG_ERR, 282c5c4113dSnw "idmapd: unable to determine hostname, error: %d", 283c5c4113dSnw error); 284c5c4113dSnw exit(1); 285c5c4113dSnw } 286c5c4113dSnw 287c5c4113dSnw if (init_mapping_system() < 0) { 288c5c4113dSnw idmapdlog(LOG_ERR, 289c5c4113dSnw "idmapd: unable to initialize mapping system"); 290c5c4113dSnw exit(1); 291c5c4113dSnw } 292c5c4113dSnw 293d3a612caSnw xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec); 294c5c4113dSnw if (xprt == NULL) { 295c5c4113dSnw idmapdlog(LOG_ERR, 296c5c4113dSnw "idmapd: unable to create door RPC service"); 297c5c4113dSnw goto errout; 298c5c4113dSnw } 299c5c4113dSnw 3008e228215Sdm if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) { 3018e228215Sdm idmapdlog(LOG_ERR, 3028e228215Sdm "idmapd: unable to limit RPC request size"); 3038e228215Sdm goto errout; 3048e228215Sdm } 3058e228215Sdm 306c5c4113dSnw dfd = xprt->xp_fd; 307c5c4113dSnw 308c5c4113dSnw if (dfd == -1) { 309c5c4113dSnw idmapdlog(LOG_ERR, "idmapd: unable to register door"); 310c5c4113dSnw goto errout; 311c5c4113dSnw } 312c5c4113dSnw if ((error = idmap_reg(dfd)) != 0) { 313c5c4113dSnw idmapdlog(LOG_ERR, "idmapd: unable to register door (%s)", 314c5c4113dSnw strerror(error)); 315c5c4113dSnw goto errout; 316c5c4113dSnw } 317c5c4113dSnw 318c5c4113dSnw if ((error = allocids(_idmapdstate.new_eph_db, 319c5c4113dSnw 8192, &_idmapdstate.next_uid, 320c5c4113dSnw 8192, &_idmapdstate.next_gid)) != 0) { 321c5c4113dSnw idmapdlog(LOG_ERR, "idmapd: unable to allocate ephemeral IDs " 322c5c4113dSnw "(%s)", strerror(error)); 323c5c4113dSnw _idmapdstate.next_uid = _idmapdstate.limit_uid = SENTINEL_PID; 324c5c4113dSnw _idmapdstate.next_gid = _idmapdstate.limit_gid = SENTINEL_PID; 325c5c4113dSnw } else { 326c5c4113dSnw _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192; 327c5c4113dSnw _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192; 328c5c4113dSnw } 329c5c4113dSnw 330c5c4113dSnw print_idmapdstate(); 331c5c4113dSnw 332c5c4113dSnw return; 333c5c4113dSnw 334c5c4113dSnw errout: 335c5c4113dSnw fini_idmapd(); 336c5c4113dSnw exit(1); 337c5c4113dSnw } 338c5c4113dSnw 339c5c4113dSnw static void 340c5c4113dSnw fini_idmapd() { 341c5c4113dSnw idmap_unreg(dfd); 342c5c4113dSnw fini_mapping_system(); 343c5c4113dSnw if (xprt != NULL) 344c5c4113dSnw svc_destroy(xprt); 345c5c4113dSnw } 346c5c4113dSnw 347c5c4113dSnw void 348c5c4113dSnw idmapdlog(int pri, const char *format, ...) { 349c5c4113dSnw va_list args; 350c5c4113dSnw 351c5c4113dSnw va_start(args, format); 352c5c4113dSnw if (_idmapdstate.daemon_mode == FALSE) { 353c5c4113dSnw (void) vfprintf(stderr, format, args); 354c5c4113dSnw (void) fprintf(stderr, "\n"); 355c5c4113dSnw } 356c5c4113dSnw (void) vsyslog(pri, format, args); 357c5c4113dSnw va_end(args); 358c5c4113dSnw } 359