xref: /illumos-gate/usr/src/cmd/nscd/nscd_selfcred.c (revision fa845c5d)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2012 Milan Jurik. All rights reserved.
 * Copyright 2018 Joyent Inc.
 */

#include <stdio.h>
#include <stdlib.h>
#include <synch.h>
#include <thread.h>
#include <string.h>
#include <errno.h>
#include <dlfcn.h>
#include <door.h>
#include <libscf.h>
#include <ucred.h>
#include <sys/varargs.h>
#include <signal.h>
#include <unistd.h>
#include <sys/types.h>
#include <dirent.h>
#include <sys/proc.h>
#include <procfs.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <libscf.h>
#include "nscd_door.h"
#include "nscd_config.h"
#include "nscd_log.h"
#include "nscd_frontend.h"
#include "nscd_selfcred.h"
#include "nscd_admin.h"
#include "nscd_common.h"
#include "ns_sldap.h"

extern int	_logfd;
static char	*execpath;
static char	**execargv;
static char	*selfcred_dbs = NULL;

static void *get_smf_prop(const char *var, char type, void *def_val);

/* current self-cred configuration data being used */
static nscd_cfg_global_selfcred_t	nscd_selfcred_cfg_g;

#define	_NSCD_PUN_BLOCK	1024
static uint8_t  pu_nscd_enabled;
static int	max_pu_nscd = _NSCD_PUN_BLOCK;
static int	pu_nscd_ttl;

static nscd_rc_t setup_ldap_backend();
static nscd_rc_t init_user_proc_monitor();

/*
 * clild state
 */
typedef enum {
	CHILD_STATE_NONE	= 0,
	CHILD_STATE_UIDKNOWN,
	CHILD_STATE_FORKSENT,
	CHILD_STATE_PIDKNOWN
} child_state_t;


typedef struct _child {
	int		child_slot;
	int		child_door;
	pid_t		child_pid;
	uid_t		child_uid;
	gid_t		child_gid;
	child_state_t	child_state;
	int		next_open;
	mutex_t		*mutex;
	cond_t		*cond;
} child_t;

static child_t	**child = NULL;
static mutex_t	child_lock = DEFAULTMUTEX;
static int	open_head;
static int	open_tail;
static int	used_slot;

/* nscd door id */
extern int _doorfd;
static pid_t main_uid = 0;

/* nscd id: main, forker, or child */
extern int _whoami;

/* forker nscd pid */
static pid_t forker_pid = 0;
static pid_t forker_uid = 0;

long		activity = 0;
mutex_t		activity_lock = DEFAULTMUTEX;

static int	forking_door = -1;
static mutex_t	forking_lock = DEFAULTMUTEX;

static void
free_slot(int	s)
{
	if (child[s] == NULL)
		return;
	free(child[s]->mutex);
	free(child[s]->cond);
	free(child[s]);
	child[s] = NULL;
}

void
_nscd_free_cslots()
{

	int i;

	(void) mutex_lock(&child_lock);

	for (i = 0; i < max_pu_nscd; i++)
		free_slot(i);

	open_head = -1;
	open_tail = -1;
	used_slot = -1;

	(void) mutex_unlock(&child_lock);

}

static int
init_slot(int	s)
{
	child_t	*ch;
	char	*me = "init_slot";

	if (child[s] == NULL) {
		child[s] = (child_t *)calloc(1, sizeof (child_t));
		if (child[s] == NULL)
			return (-1);
		ch = child[s];

		if ((ch->mutex = (mutex_t *)calloc(1,
		    sizeof (mutex_t))) == NULL) {
			free(ch);
			return (-1);
		}
		(void) mutex_init(ch->mutex, USYNC_THREAD, NULL);

		if ((ch->cond = (cond_t *)calloc(1,
		    sizeof (cond_t))) == NULL) {
			free(ch->mutex);
			free(ch);
			return (-1);
		}
		(void) cond_init(ch->cond, USYNC_THREAD, NULL);

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "slot %d allocated\n", s);
	} else
		ch = child[s];

	ch->child_slot = s;
	ch->child_door = 0;
	ch->child_state = CHILD_STATE_NONE;
	ch->child_pid = 0;
	ch->child_uid = 0;
	ch->child_gid = 0;
	ch->next_open = -1;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "slot %d initialized\n", s);

	return (0);
}

static int
_nscd_init_cslots()
{
	(void) mutex_lock(&child_lock);

	child = (child_t **)calloc(max_pu_nscd, sizeof (child_t *));
	if (child == NULL)
		return (-1);

	open_head = -1;
	open_tail = -1;
	used_slot = -1;

	(void) mutex_unlock(&child_lock);

	return (0);
}

static child_t *
get_cslot(
	uid_t		uid,
	int		no_alloc)
{
	int		i;
	child_t		*ch, *ret = NULL;
	char		*me = "get_cslot";

	(void) mutex_lock(&child_lock);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "looking for uid %d (slot used = %d)\n", uid, used_slot);

	/* first find the slot with a matching uid */
	for (i = 0; i <= used_slot; i++) {
		ch = child[i];
		if (ch->child_state >= CHILD_STATE_UIDKNOWN &&
		    ch->child_uid == uid) {
			ret = ch;
			(void) mutex_unlock(&child_lock);

			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "slot %d found with uid %d\n",
			    ret->child_slot, ret->child_uid);

			return (ret);
		}
	}

	/* if no need to allocate a new slot, return NULL */
	if (no_alloc == 1) {
		(void) mutex_unlock(&child_lock);
		return (ret);
	}

	/* no open slot ? get a new one */
	if (open_head == -1) {
		/* if no slot available, allocate more */
		if (used_slot >= max_pu_nscd - 1) {
			child_t	**tmp;
			int	newmax = max_pu_nscd + _NSCD_PUN_BLOCK;

			tmp = (child_t **)calloc(newmax, sizeof (child_t *));
			if (tmp == NULL) {
				(void) mutex_unlock(&child_lock);
				return (ret);
			}
			(void) memcpy(tmp, child, sizeof (child_t) *
			    max_pu_nscd);
			free(child);
			child = tmp;
			max_pu_nscd = newmax;
		}
		used_slot++;
		if (init_slot(used_slot) == -1) {
			used_slot--;
			(void) mutex_unlock(&child_lock);
			return (ret);
		}
		ch = child[used_slot];
	} else {
		ch = child[open_head];
		open_head = ch->next_open;
		/* got last one ? reset tail */
		if (open_head == -1)
			open_tail = -1;
		ch->next_open = -1;
	}

	ch->child_uid = uid;
	ch->child_state = CHILD_STATE_UIDKNOWN;
	ret = ch;

	(void) mutex_unlock(&child_lock);

	return (ret);
}

static void
return_cslot_nolock(child_t *ch)
{

	int	slot = ch->child_slot;

	/* have open slot ? add to and reset tail */
	if (open_tail != -1) {
		child[open_tail]->next_open = slot;
		open_tail = slot;
	} else {
		/* no open slot ? make one */
		open_head = open_tail = slot;
	}

	(void) init_slot(ch->child_slot);
}

static void
return_cslot(child_t *ch)
{

	char *me = "return_cslot";

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "returning slot %d\n", ch->child_slot);

	/* return if the slot has been returned by another thread */
	if (ch->child_state == CHILD_STATE_NONE)
		return;

	(void) mutex_lock(&child_lock);

	/* check one more time */
	if (ch->child_state == CHILD_STATE_NONE) {
		(void) mutex_unlock(&child_lock);
		return;
	}

	return_cslot_nolock(ch);

	(void) mutex_unlock(&child_lock);
}

static int
selfcred_kill(
	int	fd)
{
	int	ret;
	char	*me = "selfcred_kill";

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "sending kill to door %d\n", fd);

	if (fd != -1)
		ret = _nscd_doorcall_fd(fd, NSCD_KILL, NULL, 0,
		    NULL, 0, NULL);
	else
		ret = _nscd_doorcall(NSCD_KILL);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "kill request sent to door %d (rc = %d)\n", fd, ret);

	return (ret);
}


void
_nscd_kill_forker()
{
	(void) mutex_lock(&forking_lock);
	if (forking_door != -1)
		(void) selfcred_kill(forking_door);
	forking_door = -1;
	(void) mutex_unlock(&forking_lock);
}

void
_nscd_kill_all_children()
{
	int	i;
	int	ret;
	char	*me = "_nscd_kill_all_children";

	(void) mutex_lock(&child_lock);
	for (i = 0; i <= used_slot; i++) {
		if (child[i] == NULL)
			continue;

		if (child[i]->child_state >= CHILD_STATE_PIDKNOWN) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "killing child process %d (doorfd %d)\n",
			    child[i]->child_pid, child[i]->child_door);

			ret = selfcred_kill(child[i]->child_door);

			if (ret != -1)
				(void) kill(child[i]->child_pid, SIGTERM);
		}
		if (child[i]->child_state != CHILD_STATE_NONE)
			(void) return_cslot_nolock(child[i]);
	}
	(void) mutex_unlock(&child_lock);
}
static int
selfcred_pulse(
	int		fd)
{
	int		ret;
	char		*me = "selfcred_pulse";

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "start monitoring door %d\n", fd);

	ret = _nscd_doorcall_fd(fd, NSCD_PULSE |(_whoami & NSCD_WHOAMI),
	    NULL, 0, NULL, 0, NULL);

	/* Close door because the other side exited. */
	(void) close(fd);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "door (%d) monitor exited (rc = %d)\n", fd, ret);

	return (ret);
}

/*ARGSUSED*/
static void *
forker_monitor(
	void		*arg)
{
	pid_t		fpid;
	char		*fmri;
	char		*me = "forker_monitor";

	(void) thr_setname(thr_self(), me);

	/* wait until forker exits */
	fpid = forker_pid;
	(void) selfcred_pulse(forking_door);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "forker (pid = %d) exited or crashed, "
	    "killing all child processes\n", fpid);

	(void) mutex_lock(&forking_lock);
	forking_door = -1;
	forker_pid = -1;
	(void) mutex_unlock(&forking_lock);

	/* forker exited/crashed, kill all the child processes */
	_nscd_kill_all_children();

	/* restart forker */
	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "restarting the forker ...\n");

	switch (fpid = fork1()) {
	case (pid_t)-1:
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "unable to fork and start the forker ...\n");

		/* enter the maintenance mode */
		if ((fmri = getenv("SMF_FMRI")) != NULL) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "entering maintenance mode ...\n");
			(void) smf_maintain_instance(fmri, SMF_TEMPORARY);
		}
		return ((void *)1);
	case 0:
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "execv path = %s\n", execpath);

		(void) execv(execpath, execargv);
		exit(0);
	default:
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "new forker's pid is %d\n", fpid);
		forker_pid = fpid;
		break;
	}

	return (NULL);
}

static void *
child_monitor(
	void		*arg)
{
	child_t		*ch = (child_t *)arg;
	pid_t		cpid;
	char		*me = "child_monitor";

	/* wait until child exits */
	cpid = ch->child_pid;
	(void) selfcred_pulse(ch->child_door);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "child (pid = %d) exited or crashed ...\n", cpid);

	/* return the slot used by the child */
	return_cslot(ch);

	return (NULL);
}


void
_nscd_proc_iamhere(
	void		*buf,
	door_desc_t	*dp,
	uint_t		n_desc,
	int		iam)
{
	int		cslot;
	child_t		*ch;
	int		errnum;
	ucred_t		*uc = NULL;
	uid_t		uid;
	nscd_imhere_t	*ih;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "_nscd_proc_iamhere";


	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "%d receives iamhere from %d\n", _whoami, iam);

	if (door_ucred(&uc) != 0) {
		errnum = errno;
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "door_ucred failed: %s\n", strerror(errnum));

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, errnum,
		    NSCD_DOOR_UCRED_ERROR);
		return;
	}
	uid = ucred_geteuid(uc);

	switch (iam) {

	case NSCD_MAIN:
		if (_whoami == NSCD_MAIN || uid != main_uid) {
			/*
			 * I'm main, or uid from door is not correct,
			 * this must be an imposter
			 */
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "MAIN IMPOSTER CAUGHT!\n");


			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_MAIN_IMPOSTER);
		}
		break;

	case NSCD_FORKER:
		if (_whoami == NSCD_FORKER || uid != forker_uid) {
			/*
			 * I'm forker, or uid from door is not correct,
			 * this must be an imposter
			 */
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "FORKER IMPOSTER CAUGHT!\n");


			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_FORKER_IMPOSTER);
			break;
		}

		/* only main needs to know the forker */
		if (_whoami != NSCD_MAIN) {

			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_WRONG_NSCD);
			break;
		}

		if (ucred_getpid(uc) != forker_pid) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "FORKER IMPOSTER CAUGHT: pid = %d should be %d\n",
			    ucred_getpid(uc), forker_pid);


			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_FORKER_IMPOSTER);
			break;
		}

		if (n_desc < 1) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "BAD FORKER, NO DOOR!\n");


			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_NO_DOOR);
			break;
		}

		if ((dp->d_attributes & DOOR_DESCRIPTOR) &&
		    dp->d_data.d_desc.d_descriptor > 0 &&
		    dp->d_data.d_desc.d_id != 0) {
			(void) mutex_lock(&forking_lock);
			if (forking_door != -1)
				(void) close(forking_door);
			forking_door = dp->d_data.d_desc.d_descriptor;
			(void) mutex_unlock(&forking_lock);

			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "forking door is %d\n", forking_door);

			NSCD_SET_STATUS_SUCCESS(phdr);
		} else {
			NSCD_SET_STATUS(phdr, NSS_ALTRETRY, 0);
			break;
		}

		/* monitor the forker nscd */
		(void) thr_create(NULL, 0, forker_monitor, NULL,
		    THR_DETACHED, NULL);

		break;

	case NSCD_CHILD:
		if (_whoami != NSCD_MAIN) {
			/* child nscd can only talk to the main nscd */
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "CHILD IMPOSTER CAUGHT!\n");

			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_CHILD_IMPOSTER);
			break;
		}

		/* get the main nscd assigned slot number */
		ih = NSCD_N2N_DOOR_DATA(nscd_imhere_t, buf);
		cslot = ih->slot;
		(void) mutex_lock(&child_lock);
		if (cslot < 0 || cslot >= max_pu_nscd)
			ch = NULL;
		else
			ch = child[cslot];
		(void) mutex_unlock(&child_lock);

		if (ch == NULL) {
			/* Bad slot number */
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "bad slot number %d\n", cslot);

			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_INVALID_SLOT_NUMBER);
			break;
		}

		if (uid != ch->child_uid) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "CHILD IMPOSTER CAUGHT: uid = %d should be %d\n",
		    uid, ch->child_uid);

			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_CHILD_IMPOSTER);
			break;
		}

		if (ch->child_state != CHILD_STATE_UIDKNOWN &&
		    ch->child_state != CHILD_STATE_FORKSENT) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "invalid slot/child state (%d) for uid %d\n",
			    ch->child_state, uid);

			NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
			    NSCD_SELF_CRED_INVALID_SLOT_STATE);
			break;
		}

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "d_descriptor = %d, d_id = %lld\n",
		    dp->d_data.d_desc.d_descriptor, dp->d_data.d_desc.d_id);

		if ((dp->d_attributes & DOOR_DESCRIPTOR) &&
		    dp->d_data.d_desc.d_descriptor > 0 &&
		    dp->d_data.d_desc.d_id != 0) {
			(void) mutex_lock(ch->mutex);
			if (ch->child_door != -1)
				(void) close(ch->child_door);
			ch->child_door = dp->d_data.d_desc.d_descriptor;
			ch->child_pid  = ucred_getpid(uc);
			ch->child_state  = CHILD_STATE_PIDKNOWN;
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "child in slot %d has door %d\n",
			    cslot, ch->child_door);

			/*
			 * let waiters know that the child is ready to
			 * serve
			 */
			(void) cond_broadcast(ch->cond);
			(void) mutex_unlock(ch->mutex);

			/* monitor the child nscd */
			(void) thr_create(NULL, 0, child_monitor,
			    ch, THR_DETACHED, NULL);
			NSCD_SET_STATUS_SUCCESS(phdr);
			break;
		} else {
			NSCD_SET_STATUS(phdr, NSS_ALTRETRY, 0);
		}
		break;
	}

	ucred_free(uc);
	uc = NULL;
}

void
_nscd_proc_pulse(
	void		*buf,
	int		iam)
{
	long		last_active;
	int		done = 0;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "_nscd_proc_pulse";

	/* only main nscd sends pulse */
	if (iam != NSCD_MAIN) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "MAIN IMPOSTER CAUGHT! i am %d not NSCD_MAIN\n", iam);

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_MAIN_IMPOSTER);
		return;
	}

	/* forker doesn't return stats, it just pauses */
	if (_whoami == NSCD_FORKER) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "forker ready to pause ...\n");

		for (;;)
			(void) pause();
	}

	/* remember the current activity sequence number */
	(void) mutex_lock(&activity_lock);
	last_active = activity;
	(void) mutex_unlock(&activity_lock);

	while (!done) {

		/* allow per_user_nscd_ttl seconds of inactivity */
		(void) sleep(pu_nscd_ttl);

		(void) mutex_lock(&activity_lock);
		if (last_active == activity)
			done = 1;
		else {
			last_active = activity;
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "active, sleep again for %d seconds\n",
			    pu_nscd_ttl);
		}
		(void) mutex_unlock(&activity_lock);
	}

	/* no activity in the specified seconds, exit and disconnect */
	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "no activity in the last %d seconds, exit\n", pu_nscd_ttl);
	exit(0);
}

void
_nscd_proc_fork(
	void		*buf,
	int		iam)
{
	int		slot;
	int		ret;
	char		*fmri;
	pid_t		cid;
	uid_t		set2uid;
	gid_t		set2gid;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "_nscd_proc_fork";
	nscd_fork_t	*f;
	nscd_imhere_t	ih;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "%d receives fork request from %d\n", _whoami, iam);

	/* only main nscd sends fork requests */
	if (iam != NSCD_MAIN) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "MAIN IMPOSTER CAUGHT! i am %d not NSCD_MAIN\n", iam);

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_MAIN_IMPOSTER);
		return;
	}

	/* only forker handles fork requests */
	if (_whoami != NSCD_FORKER) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "MAIN IMPOSTER CAUGHT! I AM NOT FORKER!\n");

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_WRONG_NSCD);
		return;
	}

	/* fork a child for the slot assigned by the main nscd */
	f = NSCD_N2N_DOOR_DATA(nscd_fork_t, buf);
	slot = f->slot;
	/* set the uid/gid as assigned by the main nscd */
	set2uid = f->uid;
	set2gid = f->gid;

	/* ignore bad slot number */
	if (slot < 0 || slot >= max_pu_nscd) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "bas slot number\n");

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_INVALID_SLOT_NUMBER);
		return;
	}

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "before fork1() ...\n");

	if ((cid = fork1()) == 0) {
		_whoami = NSCD_CHILD;

		/*
		 * remember when this child nscd starts
		 * (replace the forker start time)
		 */
		_nscd_set_start_time(1);

		/* close all except the log file */
		if (_logfd > 0) {
			int i;
			for (i = 0; i < _logfd; i++)
				(void) close(i);
			closefrom(_logfd + 1);
		} else
			closefrom(0);

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "child %d\n", getpid());

		(void) setgid(set2gid);
		(void) setuid(set2uid);

		/* set up the door and server thread pool */
		if ((_doorfd = _nscd_setup_child_server(_doorfd)) == -1)
			exit(-1);

		/* tell libsldap to do self cred only */
		(void) setup_ldap_backend();

		/* notify main that child is active */
		ih.slot = slot;
		for (ret = NSS_ALTRETRY; ret == NSS_ALTRETRY; )
			ret = _nscd_doorcall_sendfd(_doorfd,
			    NSCD_IMHERE | (NSCD_CHILD & NSCD_WHOAMI),
			    &ih, sizeof (ih), NULL);

		NSCD_SET_STATUS_SUCCESS(phdr);
		return;
	} if (cid  == (pid_t)-1) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "forker unable to fork ...\n");

		/* enter the maintenance mode */
		if ((fmri = getenv("SMF_FMRI")) != NULL) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
			(me, "entering maintenance mode ...\n");
			(void) smf_maintain_instance(fmri, SMF_TEMPORARY);
		}
		exit(0);
	} else {
		/*
		 * start the monitor so as to exit as early as
		 * possible if no other processes are running
		 * with the same PUN uid (i.e., this PUN is
		 * not needed any more)
		 */
		(void) init_user_proc_monitor();

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "child forked:  parent pid = %d, child pid = %d\n",
		    getpid(), cid);

		NSCD_SET_STATUS_SUCCESS(phdr);
	}

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "after fork\n");
}

static void
selfcred_fork(
	void		*buf,
	int		doorfd,
	int		cslot,
	uid_t		uid,
	gid_t		gid)
{
	int		ret;
	nscd_fork_t	f;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "selfcred_fork";

	/* if no door fd, do nothing */
	if (doorfd == -1) {
		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_NO_DOOR);
	}

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "sending fork request to door %d for slot %d "
	    "(uid = %d, gid = %d)\n", doorfd, cslot, uid, gid);

	f.slot = cslot;
	f.uid = uid;
	f.gid = gid;

	ret = _nscd_doorcall_fd(doorfd, NSCD_FORK|(_whoami&NSCD_WHOAMI),
	    &f, sizeof (f), NULL, 0, phdr);

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "fork request sent to door %d for slot %d (rc = %d)\n",
	    doorfd, cslot, ret);

	if (NSCD_STATUS_IS_NOT_OK(phdr)) {

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "fork request sent to door %d for slot %d failed: "
		    "status = %d, errno = %s, nscd status = %d\n", doorfd,
		    cslot, NSCD_GET_STATUS(phdr),
		    strerror(NSCD_GET_ERRNO(phdr)),
		    NSCD_GET_NSCD_STATUS(phdr));

	}
}

void
_nscd_proc_alt_get(
	void		*buf,
	int		*door)
{
	int		errnum;
	uid_t		set2uid;
	gid_t		set2gid;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "_nscd_proc_alt_get";
	ucred_t		*uc = NULL;
	child_t		*ch;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "getting an alternate door ...\n");

	/* make sure there is a door to talk to the forker */
	if (forking_door == -1) {
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ERROR)
		(me, "no door to talk to the forker\n");

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_NO_FORKER);
		return;
	}

	/* get door client's credential information */
	if (door_ucred(&uc) != 0) {
		errnum = errno;
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "door_ucred failed: %s\n", strerror(errnum));

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, errnum,
		    NSCD_DOOR_UCRED_ERROR);
		return;
	}

	/* get door client's effective uid and effective gid */
	set2uid = ucred_geteuid(uc);
	set2gid = ucred_getegid(uc);
	ucred_free(uc);
	uc = NULL;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "child uid = %d, gid = %d\n", set2uid, set2gid);

	/* is a slot available ? if not, no one to serve */
	if (child == NULL || (ch = get_cslot(set2uid, 0)) == NULL) {

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "no child slot available (child array = %p, slot = %d)\n",
		    child, ch->child_slot);

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_NO_CHILD_SLOT);
		return;
	}

	/* create the per user nscd if necessary */
	if (ch->child_state != CHILD_STATE_PIDKNOWN) {

		nss_pheader_t	phdr1;
		NSCD_CLEAR_STATUS(&phdr1);

		(void) mutex_lock(ch->mutex);
		if (ch->child_state == CHILD_STATE_UIDKNOWN) {

			/* ask forker to fork a new child */
			selfcred_fork(&phdr1, forking_door, ch->child_slot,
			    set2uid, set2gid);
			if (NSCD_STATUS_IS_NOT_OK(&phdr1)) {
				(void) mutex_unlock(ch->mutex);
				NSCD_COPY_STATUS(phdr, &phdr1);
				return;
			}
			ch->child_state = CHILD_STATE_FORKSENT;
		}

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "waiting for door (slot = %d, uid = %d, gid = %d)\n",
		    ch->child_slot, set2uid, set2gid);

		/* wait for the per user nscd to become available */
		while (ch->child_state == CHILD_STATE_FORKSENT) {
			timestruc_t to;
			int err;
			int ttl = 5;

			to.tv_sec = ttl;
			to.tv_nsec = 0;
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
				(me, "cond_reltimedwait %d seconds\n", ttl);
			err = cond_reltimedwait(ch->cond, ch->mutex, &to);
			if (err == ETIME) {
				ch->child_state = CHILD_STATE_UIDKNOWN;
				_NSCD_LOG(NSCD_LOG_SELF_CRED,
				    NSCD_LOG_LEVEL_DEBUG)
				(me, "door wait timedout (slot = %d)\n",
				    ch->child_slot);
				break;
			}
		}
		(void) mutex_unlock(ch->mutex);
	}

	if (ch->child_state != CHILD_STATE_PIDKNOWN) {

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_INVALID_SLOT_STATE);
		return;
	}

	*door = ch->child_door;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "returning door %d for slot %d, uid %d, gid = %d\n",
	    *door, ch->child_slot, set2uid, set2gid);

	NSCD_SET_STATUS(phdr, NSS_ALTRETRY, 0);
}

static char **
cpargv(
	int	argc,
	char	**inargv)
{
	char	**newargv;
	int	c = 4;
	int	i = 0, j, k = 0, n = 0;

	newargv = (char **)calloc(c + 1, sizeof (char *));
	if (newargv == NULL)
		return (NULL);

	newargv[n] = strdup(inargv[0]);
	if (newargv[n++] == NULL) {
		free(newargv);
		return (NULL);
	}

	newargv[n] = strdup("-F");
	if (newargv[n++] == NULL) {
		free(newargv[0]);
		free(newargv);
		return (NULL);
	}

	for (i = 1; i < argc; i++) {
		if (strcmp(inargv[i], "-f") == 0)
			k = 2;
		if (k  == 0)
			continue;

		newargv[n] = strdup(inargv[i]);
		if (newargv[n] == NULL) {
			for (j = 0; j < n; j++)
				free(newargv[j]);
			free(newargv);
			return (NULL);
		}

		k--;
		n++;
	}
	return (newargv);
}


void
_nscd_start_forker(
	char	*path,
	int	argc,
	char	**argv)
{
	pid_t	cid;

	/* if self cred is not configured, do nothing */
	if (!_nscd_is_self_cred_on(1, NULL))
		return;

	/* save pathname and generate the new argv for the forker */
	execpath = strdup(path);
	execargv = cpargv(argc, argv);
	if (execpath == NULL || execargv == NULL)
		exit(1);

	switch (cid = fork1()) {
		case (pid_t)-1:
			exit(1);
			break;
		case 0:
			/* start the forker nscd */
			(void) execv(path, execargv);
			exit(0);
			break;
		default:
			/* main nscd */
			/* remember process id of the forker */
			forker_pid = cid;

			/* enable child nscd management */
			(void) _nscd_init_cslots();
			break;
	}
}

static nscd_rc_t
get_ldap_funcs(
	char			*name,
	void			**func_p)
{
	char			*me = "get_ldap_funcs";
	static void		*handle = NULL;
	void			*sym;

	if (name == NULL && handle != NULL) {
		(void) dlclose(handle);
		return (NSCD_SUCCESS);
	}
	/* no handle to close, it's OK */
	if (name == NULL)
		return (NSCD_SUCCESS);

	if (handle == NULL) {
		handle = dlopen("libsldap.so.1", RTLD_LAZY);
		if (handle == NULL) {

			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ERROR)
			(me, "unable to dlopen libsldap.so.1");
			return (NSCD_CFG_DLOPEN_ERROR);
		}
	}

	if ((sym = dlsym(handle, name)) == NULL) {

			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ERROR)
			(me, "unable to find symbol %s", name);
			return (NSCD_CFG_DLSYM_ERROR);
	} else
		(void) memcpy(func_p, &sym, sizeof (void *));

	return (NSCD_SUCCESS);
}


int
_nscd_is_self_cred_on(int recheck, char **dblist)
{
	static int	checked = 0;
	static int	is_on = 0;
	static int	(*ldap_func)();
	char		*srcs = "ldap"; /* only ldap support self cred */
	int		ldap_on = 0;

	char		*ldap_sc_func = "__ns_ldap_self_gssapi_config";
	ns_ldap_self_gssapi_config_t ldap_config;

	if (checked && !recheck) {
		if (is_on && dblist != NULL)
			*dblist = selfcred_dbs;
		return (is_on);
	}

	if (selfcred_dbs != NULL)
		free(selfcred_dbs);
	selfcred_dbs = _nscd_srcs_in_db_nsw_policy(1, &srcs);

	if (selfcred_dbs == NULL) {
		is_on =  0;
		checked = 1;
		return (0);
	}

	/*
	 * also check the ldap backend to see if
	 * the configuration there is good for
	 * doing self credentialing
	 */
	if (ldap_func == NULL)
		(void) get_ldap_funcs(ldap_sc_func, (void **)&ldap_func);
	if (ldap_func != NULL) {
		if (ldap_func(&ldap_config) == NS_LDAP_SUCCESS &&
		    ldap_config != NS_LDAP_SELF_GSSAPI_CONFIG_NONE)
			ldap_on = 1;
	}

	is_on = (pu_nscd_enabled == nscd_true) && ldap_on;

	checked = 1;

	if (is_on && dblist != NULL)
		*dblist = selfcred_dbs;

	return (is_on);
}

static nscd_rc_t
setup_ldap_backend()
{
	nscd_rc_t	rc;
	static void	(*ldap_func)();
	char		*ldap_sc_func = "__ns_ldap_self_gssapi_only_set";
	if (ldap_func == NULL)
		rc = get_ldap_funcs(ldap_sc_func, (void **)&ldap_func);
	if (ldap_func != NULL) {
		ldap_func(1);
		return (NSCD_SUCCESS);
	}
	return (rc);
}

/*ARGSUSED*/
void
_nscd_peruser_getadmin(
	void		*buf,
	int		buf_size)
{
	void		*result_mn = NSCD_N2N_DOOR_DATA(void, buf);
	int		errnum = 0;
	int		ret;
	uid_t		uid;
	nss_pheader_t	*phdr = (nss_pheader_t *)buf;
	char		*me = "_nscd_peruser_getadmin";
	ucred_t		*uc = NULL;
	child_t		*ch;

	/* get door client's credential information */
	if (door_ucred(&uc) != 0) {
		errnum = errno;
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "door_ucred failed: %s\n", strerror(errnum));

		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, errnum,
		    NSCD_DOOR_UCRED_ERROR);
		return;
	}

	/* get door client's effective uid */
	uid = ucred_geteuid(uc);
	ucred_free(uc);
	uc = NULL;

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "per user get admin ... (uid = %d)\n", uid);

	/* is the per-user nscd running ? if not, no one to serve */
	ch = get_cslot(uid, 1);
	if (ch == NULL) {
		NSCD_SET_N2N_STATUS(phdr, NSS_NSCD_PRIV, 0,
		    NSCD_SELF_CRED_NO_CHILD_SLOT);
		return;
	}

	ret = _nscd_doorcall_fd(ch->child_door, NSCD_GETADMIN,
	    NULL, sizeof (nscd_admin_t), result_mn,
	    sizeof (nscd_admin_t), phdr);

	if (ret == NSS_SUCCESS) {
		phdr->data_len = sizeof (nscd_admin_t);
		return;
	}
}

static void
set_selfcred_cfg(
	char	param,
	void	*data)
{
	int64_t	prop_int;
	uint8_t prop_boolean;
	char	*me = "set_selfcred_cfg";

	if (param == 'e') {
		prop_boolean = *(uint8_t *)data;
		pu_nscd_enabled = *(uint8_t *)get_smf_prop(
		    "enable_per_user_lookup", 'b', &prop_boolean);

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "self cred config: enabled = %d\n", pu_nscd_enabled);
	}

	if (param == 't') {
		prop_int = *(int *)data;
		pu_nscd_ttl = *(int64_t *)get_smf_prop(
		    "per_user_nscd_time_to_live", 'i', &prop_int);

		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
		(me, "self cred config: PUN TTL = %d\n", pu_nscd_ttl);
	}
}

/* ARGSUSED */
nscd_rc_t
_nscd_cfg_selfcred_notify(
	void				*data,
	struct nscd_cfg_param_desc	*pdesc,
	nscd_cfg_id_t			*nswdb,
	nscd_cfg_flag_t			dflag,
	nscd_cfg_error_t		**errorp,
	void				*cookie)
{

	nscd_cfg_global_selfcred_t	*sc_cfg = &nscd_selfcred_cfg_g;
	int				off;

	/*
	 * At init time, the whole group of config params are received.
	 * At update time, group or individual parameter value could
	 * be received.
	 */

	if (_nscd_cfg_flag_is_set(dflag, NSCD_CFG_DFLAG_GROUP)) {

		*sc_cfg = *(nscd_cfg_global_selfcred_t *)data;

		off = offsetof(nscd_cfg_global_selfcred_t,
		    enable_selfcred);
		set_selfcred_cfg('e', (char *)data + off);

		off = offsetof(nscd_cfg_global_selfcred_t,
		    per_user_nscd_ttl);
		set_selfcred_cfg('t', (char *)data + off);

		return (NSCD_SUCCESS);
	}

	/*
	 * individual config parameter
	 */
	off = offsetof(nscd_cfg_global_selfcred_t, enable_selfcred);
	if (pdesc->p_offset == off) {
		sc_cfg->enable_selfcred = *(nscd_bool_t *)data;
		set_selfcred_cfg('e', data);
		return (NSCD_SUCCESS);
	}

	off = offsetof(nscd_cfg_global_selfcred_t, per_user_nscd_ttl);
	if (pdesc->p_offset == off) {
		sc_cfg->per_user_nscd_ttl = *(int *)data;
		set_selfcred_cfg('t', data);
		return (NSCD_SUCCESS);
	}

	return (NSCD_SUCCESS);
}

/* ARGSUSED */
nscd_rc_t
_nscd_cfg_selfcred_verify(
	void				*data,
	struct	nscd_cfg_param_desc	*pdesc,
	nscd_cfg_id_t			*nswdb,
	nscd_cfg_flag_t			dflag,
	nscd_cfg_error_t		**errorp,
	void				**cookie)
{

	return (NSCD_SUCCESS);
}

/* ARGSUSED */
nscd_rc_t
_nscd_cfg_selfcred_get_stat(
	void				**stat,
	struct nscd_cfg_stat_desc	*sdesc,
	nscd_cfg_id_t			*nswdb,
	nscd_cfg_flag_t			*dflag,
	void				(**free_stat)(void *stat),
	nscd_cfg_error_t		**errorp)
{
	return (NSCD_SUCCESS);
}

static int
check_uid(char *pid_name)
{
	char		pname[PATH_MAX];
	static pid_t	pid = 0;
	static uid_t	uid = 0;
	static uid_t	euid = 0;
	int		pfd; /* file descriptor for /proc/<pid>/psinfo */
	psinfo_t	info;  /* process information from /proc */

	if (uid == 0)  {
		pid = getpid();
		uid = getuid();
		euid = geteuid();
	}

	(void) snprintf(pname, sizeof (pname), "/proc/%s/psinfo", pid_name);
retry:
	if ((pfd = open(pname, O_RDONLY)) == -1) {
		/* Process may have exited */
			return (1);
	}

	/*
	 * Get the info structure for the process and close quickly.
	 */
	if (read(pfd, (char *)&info, sizeof (info)) < 0) {
		int	saverr = errno;

		(void) close(pfd);
		if (saverr == EAGAIN)
			goto retry;
		if (saverr != ENOENT)
			return (1);
	}
	(void) close(pfd);

	if (info.pr_pid != pid &&
	    info.pr_uid == uid && info.pr_euid == euid)
		return (0);
	else
		return (1);
}


/*
 * FUNCTION: check_user_process
 */
/*ARGSUSED*/
static void *
check_user_process(void *arg)
{

	DIR		*dp;
	struct dirent	*ep;
	int		found;
	char		*me = "check_user_process";

	(void) thr_setname(thr_self(), me);

	for (;;) {
		(void) sleep(60);

		found = 0;

		/*
		 * search the /proc directory and look at each process
		 */
		if ((dp = opendir("/proc")) == NULL) {
			_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ERROR)
			(me, "unable to open the /proc directory\n");
			continue;
		}

		/* for each active process */
		while (ep = readdir(dp)) {
			if (ep->d_name[0] == '.')    /* skip . and .. */
				continue;
			if (check_uid(ep->d_name) == 0) {
				found = 1;
				break;
			}
		}

		/*
		 * if no process running as the PUN uid found, exit
		 * to kill this PUN
		 */
		if (found == 0) {
			(void) closedir(dp);
			exit(1);
		}
		(void) closedir(dp);
	}
	/*LINTED E_FUNC_HAS_NO_RETURN_STMT*/
}

static nscd_rc_t
init_user_proc_monitor(void)
{

	int	errnum;
	char	*me = "init_user_proc_monitor";

	_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_DEBUG)
	(me, "initializing the user process monitor\n");

	/*
	 * start a thread to make sure there is at least a process
	 * running as the PUN user. If not, terminate this PUN.
	 */
	if (thr_create(NULL, 0, check_user_process,
	    NULL, THR_DETACHED, NULL) != 0) {
		errnum = errno;
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ERROR)
		(me, "thr_create: %s\n", strerror(errnum));
		return (NSCD_THREAD_CREATE_ERROR);
	}

	return (NSCD_SUCCESS);
}

static void *
get_smf_prop(const char *var, char type, void *def_val)
{
	scf_simple_prop_t	*prop;
	void			*val;
	char			*me = "get_smf_prop";

	prop = scf_simple_prop_get(NULL, NULL, "config", var);
	if (prop) {
		switch (type) {
		case 'b':
			val = scf_simple_prop_next_boolean(prop);
			if (val != NULL)
				(void) memcpy(def_val, val, sizeof (uint8_t));
			break;

		case 'i':
			val = scf_simple_prop_next_integer(prop);
			if (val != NULL)
				(void) memcpy(def_val, val, sizeof (int64_t));
			break;
		}
		scf_simple_prop_free(prop);
	}

	if (prop == NULL || val == NULL) {
		char	vs[64];

		switch (type) {
		case 'b':
			if (*(uint8_t *)def_val)
				(void) strcpy(vs, "yes");
			else
				(void) strcpy(vs, "no");

			break;

		case 'i':
			(void) sprintf(vs, "%lld", *(int64_t *)def_val);
			break;

		}
		_NSCD_LOG(NSCD_LOG_SELF_CRED, NSCD_LOG_LEVEL_ALERT)
		(me, "no value for config/%s (%s). "
		    "Using default \"%s\"\n", var,
		    scf_strerror(scf_error()), vs);
	}

	return (def_val);
}