1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
24 */
25
26
27 /*
28 * main() of idmapd(1M)
29 */
30
31 #include "idmapd.h"
32 #include <atomic.h>
33 #include <signal.h>
34 #include <rpc/pmap_clnt.h> /* for pmap_unset */
35 #include <string.h> /* strcmp */
36 #include <unistd.h> /* setsid */
37 #include <sys/types.h>
38 #include <memory.h>
39 #include <stropts.h>
40 #include <netconfig.h>
41 #include <sys/resource.h> /* rlimit */
42 #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */
43 #include <priv_utils.h> /* privileges */
44 #include <locale.h>
45 #include <sys/systeminfo.h>
46 #include <errno.h>
47 #include <sys/wait.h>
48 #include <sys/time.h>
49 #include <zone.h>
50 #include <door.h>
51 #include <port.h>
52 #include <tsol/label.h>
53 #include <sys/resource.h>
54 #include <sys/sid.h>
55 #include <sys/idmap.h>
56 #include <pthread.h>
57 #include <stdarg.h>
58 #include <assert.h>
59 #include <note.h>
60
61 #define CBUFSIZ 26 /* ctime(3c) */
62
63 static void term_handler(int);
64 static void init_idmapd();
65 static void fini_idmapd();
66
67 /* The DC Locator lives inside idmap (for now). */
68 extern void init_dc_locator(void);
69 extern void fini_dc_locator(void);
70
71 idmapd_state_t _idmapdstate;
72 mutex_t _svcstate_lock = ERRORCHECKMUTEX;
73
74 SVCXPRT *xprt = NULL;
75
76 static int dfd = -1; /* our door server fildes, for unregistration */
77 static boolean_t degraded = B_FALSE;
78
79
80 static uint32_t num_threads = 0;
81 static pthread_key_t create_threads_key;
82 static uint32_t max_threads = 40;
83
84 /*
85 * Server door thread start routine.
86 *
87 * Set a TSD value to the door thread. This enables the destructor to
88 * be called when this thread exits. Note that we need a non-NULL
89 * value for this or the TSD destructor is not called.
90 */
91 /*ARGSUSED*/
92 static void *
idmapd_door_thread_start(void * arg)93 idmapd_door_thread_start(void *arg)
94 {
95 static void *value = "NON-NULL TSD";
96
97 /*
98 * Disable cancellation to avoid memory leaks from not running
99 * the thread cleanup code.
100 */
101 (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
102 (void) pthread_setspecific(create_threads_key, value);
103 (void) door_return(NULL, 0, NULL, 0);
104
105 /* make lint happy */
106 return (NULL);
107 }
108
109 /*
110 * Server door threads creation
111 */
112 /*ARGSUSED*/
113 static void
idmapd_door_thread_create(door_info_t * dip)114 idmapd_door_thread_create(door_info_t *dip)
115 {
116 int num;
117 pthread_t thread_id;
118
119 if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) {
120 atomic_dec_32(&num_threads);
121 idmapdlog(LOG_DEBUG,
122 "thread creation refused - %d threads currently active",
123 num - 1);
124 return;
125 }
126 (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL);
127 idmapdlog(LOG_DEBUG,
128 "created thread ID %d - %d threads currently active",
129 thread_id, num);
130 }
131
132 /*
133 * Server door thread cleanup
134 */
135 /*ARGSUSED*/
136 static void
idmapd_door_thread_cleanup(void * arg)137 idmapd_door_thread_cleanup(void *arg)
138 {
139 int num;
140
141 /* set TSD to NULL so we don't loop infinitely */
142 (void) pthread_setspecific(create_threads_key, NULL);
143 num = atomic_dec_32_nv(&num_threads);
144 idmapdlog(LOG_DEBUG,
145 "exiting thread ID %d - %d threads currently active",
146 pthread_self(), num);
147 }
148
149 /*
150 * This is needed for mech_krb5 -- we run as daemon, yes, but we want
151 * mech_krb5 to think we're root so it can get host/nodename.fqdn
152 * tickets for us so we can authenticate to AD as the machine account
153 * that we are. For more details look at the entry point in mech_krb5
154 * corresponding to gss_init_sec_context().
155 *
156 * As a side effect of faking our effective UID to mech_krb5 we will use
157 * root's default ccache (/tmp/krb5cc_0). But if that's created by
158 * another process then we won't have access to it: we run as daemon and
159 * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache
160 * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main()
161 * to avoid this issue; see main().
162 *
163 * Someday we'll have gss/mech_krb5 extensions for acquiring initiator
164 * creds with keytabs/raw keys, and someday we'll have extensions to
165 * libsasl to specify creds/name to use on the initiator side, and
166 * someday we'll have extensions to libldap to pass those through to
167 * libsasl. Until then this interposer will have to do.
168 *
169 * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid()
170 * is defined but not used.
171 */
172 /*LINTLIBRARY*/
173 uid_t
app_krb5_user_uid(void)174 app_krb5_user_uid(void)
175 {
176 return (0);
177 }
178
179 /*ARGSUSED*/
180 static void
term_handler(int sig)181 term_handler(int sig)
182 {
183 idmapdlog(LOG_INFO, "Terminating.");
184 fini_dc_locator();
185 fini_idmapd();
186 _exit(0);
187 }
188
189 /*ARGSUSED*/
190 static void
usr1_handler(int sig)191 usr1_handler(int sig)
192 {
193 NOTE(ARGUNUSED(sig))
194 print_idmapdstate();
195 }
196
197 static int pipe_fd = -1;
198
199 static void
daemonize_ready(void)200 daemonize_ready(void)
201 {
202 char data = '\0';
203 /*
204 * wake the parent
205 */
206 (void) write(pipe_fd, &data, 1);
207 (void) close(pipe_fd);
208 }
209
210 static int
daemonize_start(void)211 daemonize_start(void)
212 {
213 char data;
214 int status;
215 int devnull;
216 int filedes[2];
217 pid_t pid;
218
219 (void) sigset(SIGPIPE, SIG_IGN);
220 devnull = open("/dev/null", O_RDONLY);
221 if (devnull < 0)
222 return (-1);
223 (void) dup2(devnull, 0);
224 (void) dup2(2, 1); /* stderr only */
225 if (pipe(filedes) < 0)
226 return (-1);
227 if ((pid = fork1()) < 0)
228 return (-1);
229 if (pid != 0) {
230 /*
231 * parent
232 */
233 (void) close(filedes[1]);
234 if (read(filedes[0], &data, 1) == 1) {
235 /* presume success */
236 _exit(0);
237 }
238 status = -1;
239 (void) wait4(pid, &status, 0, NULL);
240 if (WIFEXITED(status))
241 _exit(WEXITSTATUS(status));
242 else
243 _exit(-1);
244 }
245
246 /*
247 * child
248 */
249 pipe_fd = filedes[1];
250 (void) close(filedes[0]);
251 (void) setsid();
252 (void) umask(0077);
253 openlog("idmap", LOG_PID, LOG_DAEMON);
254
255 return (0);
256 }
257
258
259 int
main(int argc,char ** argv)260 main(int argc, char **argv)
261 {
262 int c;
263 struct rlimit rl;
264
265 if (rwlock_init(&_idmapdstate.rwlk_cfg, USYNC_THREAD, NULL) != 0)
266 return (-1);
267 if (mutex_init(&_idmapdstate.addisc_lk, USYNC_THREAD, NULL) != 0)
268 return (-1);
269 if (cond_init(&_idmapdstate.addisc_cv, USYNC_THREAD, NULL) != 0)
270 return (-1);
271
272 _idmapdstate.daemon_mode = TRUE;
273 while ((c = getopt(argc, argv, "d")) != -1) {
274 switch (c) {
275 case 'd':
276 _idmapdstate.daemon_mode = FALSE;
277 break;
278 default:
279 (void) fprintf(stderr,
280 "Usage: /usr/lib/idmapd [-d]\n");
281 return (SMF_EXIT_ERR_CONFIG);
282 }
283 }
284
285 /* set locale and domain for internationalization */
286 (void) setlocale(LC_ALL, "");
287 (void) textdomain(TEXT_DOMAIN);
288
289 idmap_set_logger(idmapdlog);
290 adutils_set_logger(idmapdlog);
291
292 if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) {
293 idmapdlog(LOG_ERR,
294 "with Trusted Extensions idmapd runs only in the "
295 "global zone");
296 exit(1);
297 }
298
299 /*
300 * Raise the fd limit to max
301 */
302 if (getrlimit(RLIMIT_NOFILE, &rl) != 0) {
303 idmapdlog(LOG_ERR, "getrlimit failed");
304 } else if (rl.rlim_cur < rl.rlim_max) {
305 rl.rlim_cur = rl.rlim_max;
306 if (setrlimit(RLIMIT_NOFILE, &rl) != 0)
307 idmapdlog(LOG_ERR,
308 "Unable to raise RLIMIT_NOFILE to %d",
309 rl.rlim_cur);
310 }
311
312 if (_idmapdstate.daemon_mode == TRUE) {
313 if (daemonize_start() < 0) {
314 idmapdlog(LOG_ERR, "unable to daemonize");
315 exit(-1);
316 }
317 } else
318 (void) umask(0077);
319
320 idmap_init_tsd_key();
321
322 init_idmapd();
323 init_dc_locator();
324
325 /* signal handlers that should run only after we're initialized */
326 (void) sigset(SIGTERM, term_handler);
327 (void) sigset(SIGUSR1, usr1_handler);
328 (void) sigset(SIGHUP, idmap_cfg_hup_handler);
329
330 if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET,
331 DAEMON_UID, DAEMON_GID,
332 PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ,
333 (char *)NULL) == -1) {
334 idmapdlog(LOG_ERR, "unable to drop privileges");
335 exit(1);
336 }
337
338 __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION,
339 PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL);
340
341 if (_idmapdstate.daemon_mode == TRUE)
342 daemonize_ready();
343
344 /* With doors RPC this just wastes this thread, oh well */
345 svc_run();
346 return (0);
347 }
348
349 static void
init_idmapd()350 init_idmapd()
351 {
352 int error;
353 int connmaxrec = IDMAP_MAX_DOOR_RPC;
354
355
356 /* create directories as root and chown to daemon uid */
357 if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0)
358 exit(1);
359 if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0)
360 exit(1);
361
362 /*
363 * Set KRB5CCNAME in the environment. See app_krb5_user_uid()
364 * for more details. We blow away the existing one, if there is
365 * one.
366 */
367 (void) unlink(IDMAP_CACHEDIR "/ccache");
368 (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache");
369 (void) putenv("MS_INTEROP=1");
370
371 if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname,
372 sizeof (_idmapdstate.hostname)) == -1) {
373 error = errno;
374 idmapdlog(LOG_ERR, "unable to determine hostname, error: %d",
375 error);
376 exit(1);
377 }
378
379 if ((error = init_mapping_system()) < 0) {
380 idmapdlog(LOG_ERR, "unable to initialize mapping system");
381 exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1);
382 }
383
384 /*
385 * This means max_threads can't be updated without restarting idmap.
386 */
387 RDLOCK_CONFIG();
388 max_threads = _idmapdstate.cfg->pgcfg.max_threads;
389 UNLOCK_CONFIG();
390
391 (void) door_server_create(idmapd_door_thread_create);
392 if ((error = pthread_key_create(&create_threads_key,
393 idmapd_door_thread_cleanup)) != 0) {
394 idmapdlog(LOG_ERR, "unable to create threads key (%s)",
395 strerror(error));
396 goto errout;
397 }
398
399 xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec);
400 if (xprt == NULL) {
401 idmapdlog(LOG_ERR, "unable to create door RPC service");
402 goto errout;
403 }
404
405 if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) {
406 idmapdlog(LOG_ERR, "unable to limit RPC request size");
407 goto errout;
408 }
409
410 dfd = xprt->xp_fd;
411
412 if (dfd == -1) {
413 idmapdlog(LOG_ERR, "unable to register door");
414 goto errout;
415 }
416 if ((error = __idmap_reg(dfd)) != 0) {
417 idmapdlog(LOG_ERR, "unable to register door (%s)",
418 strerror(errno));
419 goto errout;
420 }
421
422 if ((error = allocids(_idmapdstate.new_eph_db,
423 8192, &_idmapdstate.next_uid,
424 8192, &_idmapdstate.next_gid)) != 0) {
425 idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)",
426 strerror(errno));
427 _idmapdstate.next_uid = IDMAP_SENTINEL_PID;
428 _idmapdstate.limit_uid = IDMAP_SENTINEL_PID;
429 _idmapdstate.next_gid = IDMAP_SENTINEL_PID;
430 _idmapdstate.limit_gid = IDMAP_SENTINEL_PID;
431 } else {
432 _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192;
433 _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192;
434 }
435
436 if (DBG(CONFIG, 1))
437 print_idmapdstate();
438
439 return;
440
441 errout:
442 fini_idmapd();
443 exit(1);
444 }
445
446 static void
fini_idmapd()447 fini_idmapd()
448 {
449 (void) __idmap_unreg(dfd);
450 fini_mapping_system();
451 if (xprt != NULL)
452 svc_destroy(xprt);
453 }
454
455 static
456 const char *
get_fmri(void)457 get_fmri(void)
458 {
459 static char *fmri = NULL;
460 static char buf[60];
461 char *s;
462
463 membar_consumer();
464 s = fmri;
465 if (s != NULL && *s == '\0')
466 return (NULL);
467 else if (s != NULL)
468 return (s);
469
470 if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf))
471 buf[0] = '\0';
472 else
473 (void) strlcpy(buf, s, sizeof (buf));
474
475 membar_producer();
476 fmri = buf;
477
478 return (get_fmri());
479 }
480
481 /*
482 * Wrappers for smf_degrade/restore_instance()
483 *
484 * smf_restore_instance() is too heavy duty to be calling every time we
485 * have a successful AD name<->SID lookup.
486 */
487 void
degrade_svc(int poke_discovery,const char * reason)488 degrade_svc(int poke_discovery, const char *reason)
489 {
490 const char *fmri;
491
492 membar_consumer();
493 if (degraded)
494 return;
495
496 idmapdlog(LOG_ERR, "Degraded operation (%s).", reason);
497
498 membar_producer();
499 degraded = B_TRUE;
500
501 if ((fmri = get_fmri()) != NULL)
502 (void) smf_degrade_instance(fmri, 0);
503
504 /*
505 * If the config update thread is in a state where auto-discovery could
506 * be re-tried, then this will make it try it -- a sort of auto-refresh.
507 */
508 if (poke_discovery)
509 idmap_cfg_poke_updates();
510 }
511
512 void
restore_svc(void)513 restore_svc(void)
514 {
515 const char *fmri;
516
517 membar_consumer();
518 if (!degraded)
519 return;
520
521 if ((fmri = get_fmri()) == NULL)
522 (void) smf_restore_instance(fmri);
523
524 membar_producer();
525 degraded = B_FALSE;
526
527 idmapdlog(LOG_NOTICE, "Normal operation restored");
528 }
529
530
531 /* printflike */
532 void
idmapdlog(int pri,const char * format,...)533 idmapdlog(int pri, const char *format, ...)
534 {
535 static time_t prev_ts;
536 va_list args;
537 char cbuf[CBUFSIZ];
538 time_t ts;
539
540 ts = time(NULL);
541 if (prev_ts != ts) {
542 prev_ts = ts;
543 /* NB: cbuf has \n */
544 (void) fprintf(stderr, "@ %s",
545 ctime_r(&ts, cbuf, sizeof (cbuf)));
546 }
547
548 va_start(args, format);
549 (void) vfprintf(stderr, format, args);
550 (void) fprintf(stderr, "\n");
551 va_end(args);
552
553 /*
554 * We don't want to fill up the logs with useless messages when
555 * we're degraded, but we still want to log.
556 */
557 if (degraded)
558 pri = LOG_DEBUG;
559
560 va_start(args, format);
561 vsyslog(pri, format, args);
562 va_end(args);
563 }
564
565 static void
trace_str(nvlist_t * entry,char * n1,char * n2,char * str)566 trace_str(nvlist_t *entry, char *n1, char *n2, char *str)
567 {
568 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
569
570 (void) strlcpy(name, n1, sizeof (name));
571 if (n2 != NULL)
572 (void) strlcat(name, n2, sizeof (name));
573
574 (void) nvlist_add_string(entry, name, str);
575 }
576
577 static void
trace_int(nvlist_t * entry,char * n1,char * n2,int64_t i)578 trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i)
579 {
580 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
581
582 (void) strlcpy(name, n1, sizeof (name));
583 if (n2 != NULL)
584 (void) strlcat(name, n2, sizeof (name));
585
586 (void) nvlist_add_int64(entry, name, i);
587 }
588
589 static void
trace_sid(nvlist_t * entry,char * n1,char * n2,idmap_sid * sid)590 trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid)
591 {
592 char *str;
593
594 (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid);
595 if (str == NULL)
596 return;
597
598 trace_str(entry, n1, n2, str);
599 free(str);
600 }
601
602 static void
trace_id(nvlist_t * entry,char * fromto,idmap_id * id,char * name,char * domain)603 trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain)
604 {
605 trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype);
606 if (IS_ID_SID(*id)) {
607 if (name != NULL) {
608 char *str;
609
610 (void) asprintf(&str, "%s%s%s", name,
611 domain == NULL ? "" : "@",
612 domain == NULL ? "" : domain);
613 if (str != NULL) {
614 trace_str(entry, fromto, IDMAP_TRACE_NAME, str);
615 free(str);
616 }
617 }
618 if (id->idmap_id_u.sid.prefix != NULL) {
619 trace_sid(entry, fromto, IDMAP_TRACE_SID,
620 &id->idmap_id_u.sid);
621 }
622 } else if (IS_ID_POSIX(*id)) {
623 if (name != NULL)
624 trace_str(entry, fromto, IDMAP_TRACE_NAME, name);
625 if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) {
626 trace_int(entry, fromto, IDMAP_TRACE_UNIXID,
627 (int64_t)id->idmap_id_u.uid);
628 }
629 }
630 }
631
632 /*
633 * Record a trace event. TRACE() has already decided whether or not
634 * tracing is required; what we do here is collect the data and send it
635 * to its destination - to the trace log in the response, if
636 * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping
637 * is greater than zero.
638 */
639 int
trace(idmap_mapping * req,idmap_id_res * res,char * fmt,...)640 trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...)
641 {
642 va_list va;
643 char *buf;
644 int err;
645 nvlist_t *entry;
646
647 assert(req != NULL);
648 assert(res != NULL);
649
650 err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0);
651 if (err != 0) {
652 (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n",
653 strerror(err));
654 return (0);
655 }
656
657 trace_id(entry, "from", &req->id1, req->id1name, req->id1domain);
658 trace_id(entry, "to", &res->id, req->id2name, req->id2domain);
659
660 if (IDMAP_ERROR(res->retcode)) {
661 trace_int(entry, IDMAP_TRACE_ERROR, NULL,
662 (int64_t)res->retcode);
663 }
664
665 va_start(va, fmt);
666 (void) vasprintf(&buf, fmt, va);
667 va_end(va);
668 if (buf != NULL) {
669 trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf);
670 free(buf);
671 }
672
673 if (DBG(MAPPING, 1))
674 idmap_trace_print_1(stderr, "", entry);
675
676 if (req->flag & IDMAP_REQ_FLG_TRACE) {
677 /* Lazily allocate the trace list */
678 if (res->info.trace == NULL) {
679 err = nvlist_alloc(&res->info.trace, 0, 0);
680 if (err != 0) {
681 res->info.trace = NULL; /* just in case */
682 (void) fprintf(stderr,
683 "trace nvlist_alloc(trace): %s\n",
684 strerror(err));
685 nvlist_free(entry);
686 return (0);
687 }
688 }
689 (void) nvlist_add_nvlist(res->info.trace, "", entry);
690 /* Note that entry is copied, so we must still free our copy */
691 }
692
693 nvlist_free(entry);
694
695 return (0);
696 }
697