17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
524da5b34Srie * Common Development and Distribution License (the "License").
624da5b34Srie * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
2224da5b34Srie * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate /*
277c478bd9Sstevel@tonic-gate * Usermode daemon which assists the kernel when handling gssapi calls.
287c478bd9Sstevel@tonic-gate * It is gssd that actually implements all gssapi calls.
297c478bd9Sstevel@tonic-gate * Some calls, such as gss_sign, are implemented in the kernel on a per
307c478bd9Sstevel@tonic-gate * mechanism basis.
317c478bd9Sstevel@tonic-gate */
327c478bd9Sstevel@tonic-gate
337c478bd9Sstevel@tonic-gate #include <stdio.h>
347c478bd9Sstevel@tonic-gate #include <rpc/rpc.h>
357c478bd9Sstevel@tonic-gate #include <rpc/rpc_com.h>
367c478bd9Sstevel@tonic-gate #include <sys/syslog.h>
377c478bd9Sstevel@tonic-gate #include <sys/termios.h>
387c478bd9Sstevel@tonic-gate #include <unistd.h>
397c478bd9Sstevel@tonic-gate #include <sys/utsname.h>
407c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h>
417c478bd9Sstevel@tonic-gate #include <stdlib.h>
427c478bd9Sstevel@tonic-gate #include <stropts.h>
437c478bd9Sstevel@tonic-gate #include <fcntl.h>
447c478bd9Sstevel@tonic-gate #include <strings.h>
457c478bd9Sstevel@tonic-gate #include <signal.h>
467c478bd9Sstevel@tonic-gate #include <syslog.h>
477c478bd9Sstevel@tonic-gate #include "gssd.h"
487c478bd9Sstevel@tonic-gate
497c478bd9Sstevel@tonic-gate int gssd_debug = 0; /* enable debugging printfs */
507c478bd9Sstevel@tonic-gate extern void gsscred_set_options(void);
517c478bd9Sstevel@tonic-gate
527c478bd9Sstevel@tonic-gate void gssprog_1();
537c478bd9Sstevel@tonic-gate void gssd_setup(char *);
547c478bd9Sstevel@tonic-gate static void usage(void);
557c478bd9Sstevel@tonic-gate static void daemonize_start();
567c478bd9Sstevel@tonic-gate static void daemonize_ready(unsigned char status);
577c478bd9Sstevel@tonic-gate extern int svc_create_local_service();
587c478bd9Sstevel@tonic-gate
597c478bd9Sstevel@tonic-gate /* following declarations needed in rpcgen-generated code */
607c478bd9Sstevel@tonic-gate int _rpcpmstart = 0; /* Started by a port monitor ? */
617c478bd9Sstevel@tonic-gate int _rpcfdtype; /* Whether Stream or Datagram ? */
627c478bd9Sstevel@tonic-gate int _rpcsvcdirty; /* Still serving ? */
6360414d47SToomas Soome mutex_t _svcstate_lock = ERRORCHECKMUTEX;
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate static void
667c478bd9Sstevel@tonic-gate /* LINTED */
catch_hup(int sig_num)677c478bd9Sstevel@tonic-gate catch_hup(int sig_num)
687c478bd9Sstevel@tonic-gate {
697c478bd9Sstevel@tonic-gate sigset_t mask_set; /* used to set a signal masking set. */
707c478bd9Sstevel@tonic-gate sigset_t old_set; /* used to store the old mask set. */
717c478bd9Sstevel@tonic-gate
727c478bd9Sstevel@tonic-gate /* re-set the signal handler again to catch_hup, for next time */
737c478bd9Sstevel@tonic-gate (void) signal(SIGHUP, catch_hup);
747c478bd9Sstevel@tonic-gate /* mask any further signals while we're inside the handler. */
757c478bd9Sstevel@tonic-gate (void) sigfillset(&mask_set);
767c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &mask_set, &old_set);
777c478bd9Sstevel@tonic-gate
787c478bd9Sstevel@tonic-gate gsscred_set_options();
797c478bd9Sstevel@tonic-gate
807c478bd9Sstevel@tonic-gate /* let admin know the sighup was caught and conf file re-read */
817c478bd9Sstevel@tonic-gate syslog(LOG_INFO,
827c478bd9Sstevel@tonic-gate "catch_hup: read gsscred.conf opts");
837c478bd9Sstevel@tonic-gate if (gssd_debug)
8460414d47SToomas Soome (void) fprintf(stderr, "catch_hup: read gsscred.conf opts");
857c478bd9Sstevel@tonic-gate
867c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &old_set, NULL);
877c478bd9Sstevel@tonic-gate }
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate int
main(int argc,char ** argv)9160414d47SToomas Soome main(int argc, char **argv)
927c478bd9Sstevel@tonic-gate {
937c478bd9Sstevel@tonic-gate register SVCXPRT *transp;
947c478bd9Sstevel@tonic-gate int maxrecsz = RPC_MAXDATASIZE;
957c478bd9Sstevel@tonic-gate extern int optind;
967c478bd9Sstevel@tonic-gate int c;
977c478bd9Sstevel@tonic-gate char mname[FMNAMESZ + 1];
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate /* set locale and domain for internationalization */
1007c478bd9Sstevel@tonic-gate setlocale(LC_ALL, "");
1017c478bd9Sstevel@tonic-gate textdomain(TEXT_DOMAIN);
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /*
10424da5b34Srie * Take special note that "getuid()" is called here. This call is used
105*bbf21555SRichard Lowe * rather than app_krb5_user_uid(), to ensure gssd(8) is running as
10624da5b34Srie * root.
1077c478bd9Sstevel@tonic-gate */
1087c478bd9Sstevel@tonic-gate #ifdef DEBUG
1097c478bd9Sstevel@tonic-gate (void) setuid(0); /* DEBUG: set ruid to root */
1107c478bd9Sstevel@tonic-gate #endif /* DEBUG */
11124da5b34Srie if (getuid()) {
1127c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
11360414d47SToomas Soome gettext("[%s] must be run as root\n"), argv[0]);
1147c478bd9Sstevel@tonic-gate #ifdef DEBUG
1157c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(" warning only\n"));
1167c478bd9Sstevel@tonic-gate #else /* DEBUG */
1177c478bd9Sstevel@tonic-gate exit(1);
1187c478bd9Sstevel@tonic-gate #endif /* DEBUG */
1197c478bd9Sstevel@tonic-gate }
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gate gssd_setup(argv[0]);
1227c478bd9Sstevel@tonic-gate
1237c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, "d")) != -1)
1247c478bd9Sstevel@tonic-gate switch (c) {
12560414d47SToomas Soome case 'd':
1267c478bd9Sstevel@tonic-gate /* turn on debugging */
1277c478bd9Sstevel@tonic-gate gssd_debug = 1;
1287c478bd9Sstevel@tonic-gate break;
12960414d47SToomas Soome default:
1307c478bd9Sstevel@tonic-gate usage();
1317c478bd9Sstevel@tonic-gate }
1327c478bd9Sstevel@tonic-gate
1337c478bd9Sstevel@tonic-gate if (optind != argc) {
1347c478bd9Sstevel@tonic-gate usage();
1357c478bd9Sstevel@tonic-gate }
1367c478bd9Sstevel@tonic-gate
1377c478bd9Sstevel@tonic-gate gsscred_set_options();
1387c478bd9Sstevel@tonic-gate (void) signal(SIGHUP, catch_hup);
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate /*
1417c478bd9Sstevel@tonic-gate * Started by inetd if name of module just below stream
1427c478bd9Sstevel@tonic-gate * head is either a sockmod or timod.
1437c478bd9Sstevel@tonic-gate */
14460414d47SToomas Soome if (!ioctl(0, I_LOOK, mname) && ((strcmp(mname, "sockmod") == 0) ||
14560414d47SToomas Soome (strcmp(mname, "timod") == 0))) {
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate char *netid;
1487c478bd9Sstevel@tonic-gate struct netconfig *nconf;
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate openlog("gssd", LOG_PID, LOG_DAEMON);
1517c478bd9Sstevel@tonic-gate
1527c478bd9Sstevel@tonic-gate if ((netid = getenv("NLSPROVIDER")) == NULL) {
1537c478bd9Sstevel@tonic-gate netid = "ticotsord";
1547c478bd9Sstevel@tonic-gate }
1557c478bd9Sstevel@tonic-gate
1567c478bd9Sstevel@tonic-gate if ((nconf = getnetconfigent(netid)) == NULL) {
1577c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("cannot get transport info"));
1587c478bd9Sstevel@tonic-gate exit(1);
1597c478bd9Sstevel@tonic-gate }
1607c478bd9Sstevel@tonic-gate
1617c478bd9Sstevel@tonic-gate if (strcmp(mname, "sockmod") == 0) {
1627c478bd9Sstevel@tonic-gate if (ioctl(0, I_POP, 0) || ioctl(0, I_PUSH, "timod")) {
1637c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
16460414d47SToomas Soome gettext("could not get the "
16560414d47SToomas Soome "right module"));
1667c478bd9Sstevel@tonic-gate exit(1);
1677c478bd9Sstevel@tonic-gate }
1687c478bd9Sstevel@tonic-gate }
1697c478bd9Sstevel@tonic-gate if (!rpc_control(RPC_SVC_CONNMAXREC_SET, &maxrecsz)) {
1707c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
17160414d47SToomas Soome gettext("unable to set RPC max record size"));
1727c478bd9Sstevel@tonic-gate exit(1);
1737c478bd9Sstevel@tonic-gate }
1747c478bd9Sstevel@tonic-gate /* XXX - is nconf even needed here? */
1757c478bd9Sstevel@tonic-gate if ((transp = svc_tli_create(0, nconf, NULL, 0, 0)) == NULL) {
1767c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("cannot create server handle"));
1777c478bd9Sstevel@tonic-gate exit(1);
1787c478bd9Sstevel@tonic-gate }
1797c478bd9Sstevel@tonic-gate
1807c478bd9Sstevel@tonic-gate /*
1817c478bd9Sstevel@tonic-gate * We use a NULL nconf because GSSPROG has already been
1827c478bd9Sstevel@tonic-gate * registered with rpcbind.
1837c478bd9Sstevel@tonic-gate */
1847c478bd9Sstevel@tonic-gate if (!svc_reg(transp, GSSPROG, GSSVERS, gssprog_1, NULL)) {
1857c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
18660414d47SToomas Soome gettext("unable to register "
18760414d47SToomas Soome "(GSSPROG, GSSVERS)"));
1887c478bd9Sstevel@tonic-gate exit(1);
1897c478bd9Sstevel@tonic-gate }
1907c478bd9Sstevel@tonic-gate
1917c478bd9Sstevel@tonic-gate if (nconf)
1927c478bd9Sstevel@tonic-gate freenetconfigent(nconf);
1937c478bd9Sstevel@tonic-gate } else {
1947c478bd9Sstevel@tonic-gate if (!gssd_debug)
1957c478bd9Sstevel@tonic-gate daemonize_start();
1967c478bd9Sstevel@tonic-gate
1977c478bd9Sstevel@tonic-gate openlog("gssd", LOG_PID, LOG_DAEMON);
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate if (svc_create_local_service(gssprog_1, GSSPROG, GSSVERS,
2007c478bd9Sstevel@tonic-gate "netpath", "gssd") == 0) {
2017c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("unable to create service"));
2027c478bd9Sstevel@tonic-gate exit(1);
2037c478bd9Sstevel@tonic-gate }
2047c478bd9Sstevel@tonic-gate
2057c478bd9Sstevel@tonic-gate /* service created, now the daemon parent can exit */
2067c478bd9Sstevel@tonic-gate daemonize_ready(0);
2077c478bd9Sstevel@tonic-gate }
2087c478bd9Sstevel@tonic-gate
2097c478bd9Sstevel@tonic-gate
2107c478bd9Sstevel@tonic-gate if (gssd_debug) {
2117c478bd9Sstevel@tonic-gate fprintf(stderr,
2127c478bd9Sstevel@tonic-gate gettext("gssd start: \n"));
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate svc_run();
2157c478bd9Sstevel@tonic-gate abort();
2167c478bd9Sstevel@tonic-gate /*NOTREACHED*/
2177c478bd9Sstevel@tonic-gate #ifdef lint
2187c478bd9Sstevel@tonic-gate return (1);
2197c478bd9Sstevel@tonic-gate #endif
2207c478bd9Sstevel@tonic-gate }
2217c478bd9Sstevel@tonic-gate
2227c478bd9Sstevel@tonic-gate static void
usage(void)2237c478bd9Sstevel@tonic-gate usage(void)
2247c478bd9Sstevel@tonic-gate {
2257c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("usage: gssd [-dg]\n"));
2267c478bd9Sstevel@tonic-gate exit(1);
2277c478bd9Sstevel@tonic-gate }
2287c478bd9Sstevel@tonic-gate
2297c478bd9Sstevel@tonic-gate
2307c478bd9Sstevel@tonic-gate /*
2317c478bd9Sstevel@tonic-gate * Fork, detach from tty, etc...
2327c478bd9Sstevel@tonic-gate */
2337c478bd9Sstevel@tonic-gate static int write_pipe_fd = -1;
2347c478bd9Sstevel@tonic-gate static
2357c478bd9Sstevel@tonic-gate void
daemonize_start()2367c478bd9Sstevel@tonic-gate daemonize_start()
2377c478bd9Sstevel@tonic-gate {
2387c478bd9Sstevel@tonic-gate int pipe_fds[2];
2397c478bd9Sstevel@tonic-gate unsigned char status = 1;
2407c478bd9Sstevel@tonic-gate
2417c478bd9Sstevel@tonic-gate closefrom(0);
2427c478bd9Sstevel@tonic-gate
2437c478bd9Sstevel@tonic-gate /* Open stdin/out/err, chdir, get a pipe */
2447c478bd9Sstevel@tonic-gate if (open("/dev/null", O_RDONLY) < 0 ||
2457c478bd9Sstevel@tonic-gate open("/dev/null", O_WRONLY) < 0 || dup(1) < 0 ||
2467c478bd9Sstevel@tonic-gate chdir("/") < 0 || pipe(pipe_fds) < 0)
2477c478bd9Sstevel@tonic-gate exit(1);
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate /* For daemonize_ready() */
2507c478bd9Sstevel@tonic-gate write_pipe_fd = pipe_fds[1];
2517c478bd9Sstevel@tonic-gate
2527c478bd9Sstevel@tonic-gate switch (fork()) {
2537c478bd9Sstevel@tonic-gate case -1:
2547c478bd9Sstevel@tonic-gate exit(1);
2557c478bd9Sstevel@tonic-gate /* NOTREACHED */
2567c478bd9Sstevel@tonic-gate case 0:
2577c478bd9Sstevel@tonic-gate break;
2587c478bd9Sstevel@tonic-gate default:
2597c478bd9Sstevel@tonic-gate /* Wait for child to be ready befor exiting */
2607c478bd9Sstevel@tonic-gate (void) close(pipe_fds[1]);
2617c478bd9Sstevel@tonic-gate (void) signal(SIGPIPE, SIG_DFL);
2627c478bd9Sstevel@tonic-gate (void) read(pipe_fds[0], &status, sizeof (status));
2637c478bd9Sstevel@tonic-gate exit(status);
2647c478bd9Sstevel@tonic-gate }
2657c478bd9Sstevel@tonic-gate
2667c478bd9Sstevel@tonic-gate (void) close(pipe_fds[0]);
2677c478bd9Sstevel@tonic-gate (void) setsid();
2687c478bd9Sstevel@tonic-gate }
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gate static
2717c478bd9Sstevel@tonic-gate void
daemonize_ready(unsigned char status)2727c478bd9Sstevel@tonic-gate daemonize_ready(unsigned char status)
2737c478bd9Sstevel@tonic-gate {
2747c478bd9Sstevel@tonic-gate if (write_pipe_fd == -1)
2757c478bd9Sstevel@tonic-gate return;
2767c478bd9Sstevel@tonic-gate
2777c478bd9Sstevel@tonic-gate (void) write(write_pipe_fd, &status, sizeof (status));
2787c478bd9Sstevel@tonic-gate (void) close(write_pipe_fd);
2797c478bd9Sstevel@tonic-gate write_pipe_fd = -1;
2807c478bd9Sstevel@tonic-gate }
2817c478bd9Sstevel@tonic-gate
2827c478bd9Sstevel@tonic-gate /*ARGSUSED*/
2837c478bd9Sstevel@tonic-gate int
gssprog_1_freeresult(SVCXPRT * transport,xdrproc_t xdr_res,caddr_t res)2847c478bd9Sstevel@tonic-gate gssprog_1_freeresult(SVCXPRT *transport, xdrproc_t xdr_res, caddr_t res)
2857c478bd9Sstevel@tonic-gate {
2867c478bd9Sstevel@tonic-gate xdr_free(xdr_res, res);
2877c478bd9Sstevel@tonic-gate return (1);
2887c478bd9Sstevel@tonic-gate }
289