xref: /illumos-gate/usr/src/cmd/tsol/labeld/svc-labeld (revision ec530482)
1#!/sbin/sh
2#
3# CDDL HEADER START
4#
5# The contents of this file are subject to the terms of the
6# Common Development and Distribution License (the "License").
7# You may not use this file except in compliance with the License.
8#
9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10# or http://www.opensolaris.org/os/licensing.
11# See the License for the specific language governing permissions
12# and limitations under the License.
13#
14# When distributing Covered Code, include this CDDL HEADER in each
15# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16# If applicable, add the following below this CDDL HEADER, with the
17# fields enclosed by brackets "[]" replaced with your own identifying
18# information: Portions Copyright [yyyy] [name of copyright owner]
19#
20# CDDL HEADER END
21#
22# Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23# Use is subject to license terms.
24#
25
26. /lib/svc/share/smf_include.sh
27
28ROOT_PATH=""
29if [ $# -gt 1 ]; then
30	if [ $# -ne 3 -o "$2" != "-R" ]; then
31		echo "$0: invalid syntax"
32		exit $SMF_EXIT_ERR_CONFIG
33	fi
34	if [ "$3" != "/" ]; then
35		ROOT_PATH=$3
36	fi
37fi
38if [ -n "$ROOT_PATH" -a "$1" != "start" ]; then
39	echo "$0: invalid syntax: -R allowed for start method only"
40	exit $SMF_EXIT_ERR_CONFIG
41fi
42if [ -n "$ROOT_PATH" -a ! -d "$ROOT_PATH" ]; then
43	echo "$0: invalid -R rootpath dir specified"
44	exit $SMF_EXIT_ERR_CONFIG
45fi
46
47if smf_is_nonglobalzone; then
48	echo "$0: not supported in a local zone"
49	exit $SMF_EXIT_ERR_CONFIG
50fi
51
52rewrite_logindev()
53{
54	from="$1"
55	to="$2"
56	# Comment out audio, usb, removable-media, and hotpluggable device
57	# entries in /etc/logindevperm.
58	LOGINDEVPERM=$ROOT_PATH/etc/logindevperm
59	if [ ! -f $LOGINDEVPERM ]; then
60		return
61	fi
62	for line in \
63		"/dev/sound/" \
64		"/dev/removable-media/" \
65		"/dev/hotpluggable/" \
66		"/dev/usb/\[0-9a-f\]" \
67			; do
68		sed -e "s!^$from\([^# 	]\{1,\}[ 	}\{1,\}[0-9]\{1,\}[ 	]\{1,\}\)$line!$to\1$line!" \
69		    $LOGINDEVPERM > /tmp/tmp.$$
70		cp /tmp/tmp.$$ $LOGINDEVPERM
71	done
72	rm -f /tmp/tmp.$$
73}
74
75do_logindev()
76{
77	rewrite_logindev "" "#"
78}
79
80do_otherservices()
81{
82	# Setup dependent services
83	cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__ENABLE_OTHERS
84		/usr/sbin/svcadm enable -s svc:/network/tnd:default
85		/usr/sbin/svcadm enable -s svc:/system/tsol-zones:default
86		/usr/sbin/svcadm enable svc:/network/rpc/rstat:default
87__ENABLE_OTHERS
88
89}
90
91do_bsmconv()
92{
93	# Run bsmconv so audit and device allocation is enabled by
94	# default with Trusted Extensions.
95	if [ "$ROOT_PATH" = "/" -o "$ROOT_PATH" = "" ]; then
96		BSMDIR=""
97	else
98		BSMDIR=$ROOT_PATH
99	fi
100	echo "Running bsmconv ..."
101	echo `TEXTDOMAIN="SUNW_OST_OSCMD" gettext "y"` | \
102	    $ROOT_PATH/etc/security/bsmconv $ROOT_PATH
103}
104
105do_nscd()
106{
107# For Trusted Extensions, make nscd service transient in local zones.
108cat >> $ROOT_PATH/var/svc/profile/upgrade <<\_DEL_LOCAL_NSCD
109	if [ `/sbin/zonename` != "global" ]; then
110		nscd="svc:/system/name-service-cache"
111		duration=""
112		if /bin/svcprop -q -c -p startd/duration $nscd ; then
113			duration=`/bin/svcprop -c -p startd/duration $nscd`
114		fi
115		if [ "$duration" != "transient" ]; then
116			/usr/sbin/svccfg -s $nscd addpg startd framework
117			/usr/sbin/svccfg -s $nscd setprop \
118			    startd/duration = astring: transient
119			/usr/sbin/svccfg -s $nscd setprop stop/exec = :true
120			/usr/sbin/svcadm refresh $nscd
121		fi
122	fi
123_DEL_LOCAL_NSCD
124}
125
126do_bootupd()
127{
128	if [ -f $ROOT_PATH/platform/`/sbin/uname -m`/boot_archive ]; then
129		if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
130			/sbin/bootadm update-archive
131		else
132			/sbin/bootadm update-archive -R $ROOT_PATH
133		fi
134	fi
135}
136
137setup_tx_changes(){
138#
139# No comments or blanks lines allowed in entries below
140#
141cat > ${TX_ENTRIES} << EOF
142dtlogin		account		requisite	pam_roles.so.1
143dtlogin		account		required	pam_unix_account.so.1
144dtsession	account		requisite	pam_roles.so.1
145dtsession	account		required	pam_unix_account.so.1
146gdm		account		requisite	pam_roles.so.1
147gdm		account		required	pam_unix_account.so.1
148xscreensaver	account		requisite	pam_roles.so.1
149xscreensaver	account		required	pam_unix_account.so.1
150passwd		account		requisite	pam_roles.so.1
151passwd		account		required	pam_unix_account.so.1
152dtpasswd	account		requisite	pam_roles.so.1
153dtpasswd	account		required	pam_unix_account.so.1
154tsoljds-tstripe	account		requisite	pam_roles.so.1
155tsoljds-tstripe	account		required	pam_unix_account.so.1
156other		account		required	pam_tsol_account.so.1
157EOF
158}
159
160do_addpam()
161{
162	PAM_TMP=/tmp/pam_conf.$$
163	TX_ENTRIES=$PAM_TMP/sct.$$
164	PAM_DEST=$ROOT_PATH/etc/pam.conf
165
166	mkdir $PAM_TMP  || exit $SMF_EXIT_ERR_FATAL
167	setup_tx_changes
168
169	# verify that pam.conf file exists...
170	if [ ! -f ${PAM_DEST} ]; then
171		echo "$0: ${PAM_DEST} not found; aborting"
172		exit $SMF_EXIT_ERR_FATAL
173	fi
174
175	#
176	# Update pam.conf to append Trusted Extensions entries if not
177	# already present.
178	#
179	rm -f /tmp/pamconf.$$
180	while read e1 e2 e3 e4 e5
181	do
182		# If this is the 'other' entry, add it unless it already
183		# exists.
184		if [ $e1 = "other" ]; then
185			grep \
186"^[# 	]*$e1[ 	][ 	]*$e2[ 	][ 	]*$e3[ 	][ 	]*$e4" \
187			    $PAM_DEST >/dev/null 2>&1
188			if [ $? = 1 ] ; then
189				# Doesn't exist, enter into pam.conf
190				echo "$e1\t$e2 $e3\t\t$e4 $e5" \
191				    >> /tmp/pamconf.$$
192			fi
193		else
194			# Add other entries unless they already have a
195			# stack of their own.
196			grep "^[# 	]*$e1[ 	][ 	]*$e2[ 	]" \
197			    $PAM_DEST >/dev/null 2>&1
198			if [ $? = 1 ] ; then
199				echo "$e1\t$e2 $e3\t\t$e4 $e5" \
200				    >> /tmp/pamconf.$$
201			fi
202		fi
203	done < ${TX_ENTRIES}
204	# Append TX lines if any were not present already.
205	if [ -f /tmp/pamconf.$$ ] ; then
206		echo "# Entries for Trusted Extensions" >> $PAM_DEST
207		cat /tmp/pamconf.$$ >> $PAM_DEST
208		echo "$0: updating $PAM_DEST entries for Trusted Extensions;"
209		echo "$0: please examine/update any new entries"
210    		rm -f /tmp/pamconf.$$
211    	fi
212
213	rm -rf $PAM_TMP
214}
215
216do_pamremove()
217{
218	PAM_TMP=/tmp/pam_conf.$$
219	TX_ENTRIES=$PAM_TMP/sct.$$
220	PAM_DEST=$ROOT_PATH/etc/pam.conf
221	TMPFILE=$PAM_TMP/pam.conf
222
223	mkdir $PAM_TMP  || exit $SMF_EXIT_ERR_FATAL
224
225	# verify that pam.conf file exists...
226	if [ ! -f ${PAM_DEST} ]; then
227		echo "$0: ${PAM_DEST} not found; aborting"
228		exit $SMF_EXIT_ERR_FATAL
229	fi
230
231
232	grep '^[a-z].*pam_tsol_account' $PAM_DEST > /dev/null 2>&1
233	if [ $? -ne 0 ]; then
234		echo "$0: pam_tsol_account module not present,"
235		echo "$0: No changes were made to $PAM_DEST."
236		return
237	fi
238
239	grep -v pam_tsol_account $PAM_DEST > $TMPFILE
240	echo "$0: $PAM_DEST "tsol" entries removed"
241	cp $TMPFILE $PAM_DEST
242
243	rm -rf $PAM_TMP
244}
245
246do_commonstart()
247{
248	echo "$0: Updating $ROOT_PATH/etc/system..."
249	if [ ! -f ${ROOT_PATH}/etc/system ]; then
250		touch ${ROOT_PATH}/etc/system
251	fi
252
253	# Set sys_labeling in etc/system
254	grep -v "sys_labeling=" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
255	echo "set sys_labeling=1" >> /tmp/etc.system.$$
256	mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
257	grep "set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
258	if [ $? -ne 0 ]; then
259    		echo "$0: ERROR: cannot set sys_labeling in $ROOT_PATH/etc/system"
260		exit $SMF_EXIT_ERR_FATAL
261	fi
262
263	# Setup dependent services
264	do_otherservices
265
266	do_logindev
267	do_bsmconv
268	do_nscd
269	do_addpam
270
271	do_bootupd
272}
273
274do_servicetag_register()
275{
276	ROOTDIR=$1
277	SOL_ARCH=`/sbin/uname -p`
278	SOL_VERS=`/sbin/uname -r`
279	TX_PROD_URN="urn:uuid:fc720df3-410f-11dc-9b8e-080020a9ed93"
280
281	if [ ! -x /usr/bin/stclient ]; then
282		return
283	fi
284
285	# if already registered then do nothing more here
286	inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null`
287	if [ -n "$inst" ]; then
288		# this instance id was saved in a SMF property
289		/usr/bin/stclient -g -i $inst -r $ROOTDIR >/dev/null 2>&1
290		if [ $? = 0 ]; then
291			# matching service tag found, so do nothing
292			return
293		else
294			# no match for instance id saved in SMF property
295			/usr/sbin/svccfg -s $SMF_FMRI delprop \
296			    labeld/svctag_inst
297			/usr/sbin/svcadm refresh $SMF_FMRI
298		fi
299	fi
300
301
302	# fall through: no service tag, or does not match saved instance id
303
304	# determine the urn of the parent (Solaris)
305	SOL_PROD_URN=""
306	case $SOL_VERS in
307	5.11)
308		SOL_PROD_URN="-F urn:uuid:6df19e63-7ef5-11db-a4bd-080020a9ed93"
309		;;
310	5.10)
311		SOL_PROD_URN="-F urn:uuid:5005588c-36f3-11d6-9cec-fc96f718e113"
312		;;
313	esac
314
315	# add the service tag
316	RC=`/usr/bin/stclient -a -p "Solaris Trusted Extensions"	\
317	    -e $SOL_VERS -t $TX_PROD_URN -P Solaris $SOL_PROD_URN	\
318	    -m Sun -A $SOL_ARCH -z global -S $0 -r $ROOTDIR`
319	if [ $? = 0 ]; then
320		# save instance id in SMF property
321		inst=`echo "$RC" | grep -i urn|awk -F=  '{print $2}'`
322		/usr/sbin/svccfg -s $SMF_FMRI setprop \
323		    labeld/svctag_inst = astring: "$inst"
324		/usr/sbin/svcadm refresh $SMF_FMRI
325	fi
326}
327
328do_servicetag_delete()
329{
330	if [ ! -x /usr/bin/stclient ]; then
331		return
332	fi
333
334	inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null`
335
336	if [ -n "$inst" ]; then
337		# delete service tag
338		/usr/bin/stclient -d -i $inst
339		# delete saved instance id
340		/usr/sbin/svccfg -s $SMF_FMRI delprop labeld/svctag_inst
341		/usr/sbin/svcadm refresh $SMF_FMRI
342	fi
343}
344
345
346daemon_start()
347{
348	# If a labeld door exists, check for a labeld process and exit
349	# if the daemon is already running.
350	if [ -r /var/tsol/doors/labeld ]; then
351		if /usr/bin/pgrep -x -u 0 -P 1 labeld >/dev/null 2>&1; then
352			echo "$0: labeld is already running"
353			exit $SMF_EXIT_ERR_FATAL
354		fi
355	fi
356	/usr/bin/rm -f /var/tsol/doors/labeld
357	/usr/lib/labeld
358}
359
360PATH=/usr/sbin:/usr/bin; export PATH
361
362case "$1" in
363'start')
364	if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
365		# native
366
367		if [ -z "$SMF_FMRI" ]; then
368			echo "$0: this script can only be invoked by smf(5)"
369			exit $SMF_EXIT_ERR_NOSMF
370		fi
371
372		tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
373		if [ "$tx_enabled" = "false" ]; then
374			# A sign of trying temporary enablement...no-no
375			echo "$0: Temporarily enabling Trusted Extensions is not allowed."
376			exit $SMF_EXIT_ERR_CONFIG
377		fi
378
379		if (smf_is_system_labeled); then
380			do_servicetag_register /
381			daemon_start
382			exit $SMF_EXIT_OK
383		fi
384
385		# Make changes to enable Trusted Extensions
386		grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
387		if [ $? -eq 0 ]; then
388			echo "$0: already enabled. Exiting."
389			exit $SMF_EXIT_OK
390		fi
391
392		if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
393			echo "$0: Must remove zones before enabling Trusted Extensions."
394			exit $SMF_EXIT_ERR_CONFIG
395		fi
396
397		do_commonstart
398
399		do_servicetag_register /
400
401		# start daemon proccess so our service doesn't go into
402		# maintenance state
403		daemon_start
404
405		echo "$0: Started.  Must reboot and configure Trusted Extensions."
406	else
407		# Support jumpstart etc
408
409		# Make changes to enable Trusted Extensions
410		grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
411		if [ $? -eq 0 ]; then
412			echo "$0: already enabled. Exiting."
413			exit $SMF_EXIT_OK
414		fi
415
416		# Setup dependent services
417		cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__TRUSTED_ENABLE
418			/usr/sbin/svcadm enable -s svc:/system/labeld:default
419__TRUSTED_ENABLE
420
421		do_commonstart
422		do_servicetag_register $ROOT_PATH
423		echo "$0: Started.  Must configure Trusted Extensions before booting."
424	fi
425	;;
426
427'stop')
428	tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
429	if [ "$tx_enabled" = "true" ]; then
430		/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
431		exit $SMF_EXIT_OK
432	fi
433
434	if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
435		echo "$0: Must remove zones before disabling Trusted Extensions."
436		exit $SMF_EXIT_ERR_CONFIG
437	fi
438
439	# Stop Trusted services.
440	/usr/sbin/svcadm disable svc:/system/tsol-zones:default 2>/dev/null
441	/usr/sbin/svcadm disable svc:/network/tnd:default 2>/dev/null
442
443	# Uncomment audio, usb, removable-media, and hotpluggable device
444	# entries in /etc/logindevperm.
445	rewrite_logindev "#" ""
446
447	# Remove sys_labeling from /etc/system
448	grep -v "sys_labeling" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
449	mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
450	grep "sys_labeling" ${ROOT_PATH}/etc/system > /dev/null 2>&1
451	if [ $? -eq 0 ]; then
452    		echo "$0: ERROR: cannot remove sys_labeling in $ROOT_PATH/etc/system"
453		exit $SMF_EXIT_ERR_FATAL
454	fi
455
456	do_pamremove
457	do_servicetag_delete
458
459	do_bootupd
460
461	/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
462	echo "$0: Stopped.  Will take effect at next boot."
463	;;
464
465*)
466	echo "Usage: $0 { start | stop }"
467	exit 1
468	;;
469esac
470
471exit $SMF_EXIT_OK
472
473
474