1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25
26 /*
27 * main() of idmapd(1M)
28 */
29
30 #include "idmapd.h"
31 #include <atomic.h>
32 #include <signal.h>
33 #include <rpc/pmap_clnt.h> /* for pmap_unset */
34 #include <string.h> /* strcmp */
35 #include <unistd.h> /* setsid */
36 #include <sys/types.h>
37 #include <memory.h>
38 #include <stropts.h>
39 #include <netconfig.h>
40 #include <sys/resource.h> /* rlimit */
41 #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */
42 #include <priv_utils.h> /* privileges */
43 #include <locale.h>
44 #include <sys/systeminfo.h>
45 #include <errno.h>
46 #include <sys/wait.h>
47 #include <sys/time.h>
48 #include <zone.h>
49 #include <door.h>
50 #include <port.h>
51 #include <tsol/label.h>
52 #include <sys/resource.h>
53 #include <sys/sid.h>
54 #include <sys/idmap.h>
55 #include <pthread.h>
56 #include <stdarg.h>
57 #include <assert.h>
58 #include <note.h>
59
60 static void term_handler(int);
61 static void init_idmapd();
62 static void fini_idmapd();
63
64 idmapd_state_t _idmapdstate;
65
66 SVCXPRT *xprt = NULL;
67
68 static int dfd = -1; /* our door server fildes, for unregistration */
69 static boolean_t degraded = B_FALSE;
70
71
72 static uint32_t num_threads = 0;
73 static pthread_key_t create_threads_key;
74 static uint32_t max_threads = 40;
75
76 /*
77 * Server door thread start routine.
78 *
79 * Set a TSD value to the door thread. This enables the destructor to
80 * be called when this thread exits.
81 */
82 /*ARGSUSED*/
83 static void *
idmapd_door_thread_start(void * arg)84 idmapd_door_thread_start(void *arg)
85 {
86 static void *value = 0;
87
88 /*
89 * Disable cancellation to avoid memory leaks from not running
90 * the thread cleanup code.
91 */
92 (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
93 (void) pthread_setspecific(create_threads_key, value);
94 (void) door_return(NULL, 0, NULL, 0);
95
96 /* make lint happy */
97 return (NULL);
98 }
99
100 /*
101 * Server door threads creation
102 */
103 /*ARGSUSED*/
104 static void
idmapd_door_thread_create(door_info_t * dip)105 idmapd_door_thread_create(door_info_t *dip)
106 {
107 int num;
108 pthread_t thread_id;
109
110 if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) {
111 atomic_dec_32(&num_threads);
112 idmapdlog(LOG_DEBUG,
113 "thread creation refused - %d threads currently active",
114 num - 1);
115 return;
116 }
117 (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL);
118 idmapdlog(LOG_DEBUG,
119 "created thread ID %d - %d threads currently active",
120 thread_id, num);
121 }
122
123 /*
124 * Server door thread cleanup
125 */
126 /*ARGSUSED*/
127 static void
idmapd_door_thread_cleanup(void * arg)128 idmapd_door_thread_cleanup(void *arg)
129 {
130 int num;
131
132 num = atomic_dec_32_nv(&num_threads);
133 idmapdlog(LOG_DEBUG,
134 "exiting thread ID %d - %d threads currently active",
135 pthread_self(), num);
136 }
137
138 /*
139 * This is needed for mech_krb5 -- we run as daemon, yes, but we want
140 * mech_krb5 to think we're root so it can get host/nodename.fqdn
141 * tickets for us so we can authenticate to AD as the machine account
142 * that we are. For more details look at the entry point in mech_krb5
143 * corresponding to gss_init_sec_context().
144 *
145 * As a side effect of faking our effective UID to mech_krb5 we will use
146 * root's default ccache (/tmp/krb5cc_0). But if that's created by
147 * another process then we won't have access to it: we run as daemon and
148 * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache
149 * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main()
150 * to avoid this issue; see main().
151 *
152 * Someday we'll have gss/mech_krb5 extensions for acquiring initiator
153 * creds with keytabs/raw keys, and someday we'll have extensions to
154 * libsasl to specify creds/name to use on the initiator side, and
155 * someday we'll have extensions to libldap to pass those through to
156 * libsasl. Until then this interposer will have to do.
157 *
158 * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid()
159 * is defined but not used.
160 */
161 /*LINTLIBRARY*/
162 uid_t
app_krb5_user_uid(void)163 app_krb5_user_uid(void)
164 {
165 return (0);
166 }
167
168 /*ARGSUSED*/
169 static void
term_handler(int sig)170 term_handler(int sig)
171 {
172 idmapdlog(LOG_INFO, "Terminating.");
173 fini_idmapd();
174 _exit(0);
175 }
176
177 /*ARGSUSED*/
178 static void
usr1_handler(int sig)179 usr1_handler(int sig)
180 {
181 NOTE(ARGUNUSED(sig))
182 print_idmapdstate();
183 }
184
185 static int pipe_fd = -1;
186
187 static void
daemonize_ready(void)188 daemonize_ready(void)
189 {
190 char data = '\0';
191 /*
192 * wake the parent
193 */
194 (void) write(pipe_fd, &data, 1);
195 (void) close(pipe_fd);
196 }
197
198 static int
daemonize_start(void)199 daemonize_start(void)
200 {
201 char data;
202 int status;
203 int devnull;
204 int filedes[2];
205 pid_t pid;
206
207 (void) sigset(SIGPIPE, SIG_IGN);
208 devnull = open("/dev/null", O_RDONLY);
209 if (devnull < 0)
210 return (-1);
211 (void) dup2(devnull, 0);
212 (void) dup2(2, 1); /* stderr only */
213 if (pipe(filedes) < 0)
214 return (-1);
215 if ((pid = fork1()) < 0)
216 return (-1);
217 if (pid != 0) {
218 /*
219 * parent
220 */
221 (void) close(filedes[1]);
222 if (read(filedes[0], &data, 1) == 1) {
223 /* presume success */
224 _exit(0);
225 }
226 status = -1;
227 (void) wait4(pid, &status, 0, NULL);
228 if (WIFEXITED(status))
229 _exit(WEXITSTATUS(status));
230 else
231 _exit(-1);
232 }
233
234 /*
235 * child
236 */
237 pipe_fd = filedes[1];
238 (void) close(filedes[0]);
239 (void) setsid();
240 (void) umask(0077);
241 openlog("idmap", LOG_PID, LOG_DAEMON);
242
243 return (0);
244 }
245
246
247 int
main(int argc,char ** argv)248 main(int argc, char **argv)
249 {
250 int c;
251 struct rlimit rl;
252
253 _idmapdstate.daemon_mode = TRUE;
254 while ((c = getopt(argc, argv, "d")) != -1) {
255 switch (c) {
256 case 'd':
257 _idmapdstate.daemon_mode = FALSE;
258 break;
259 default:
260 (void) fprintf(stderr,
261 "Usage: /usr/lib/idmapd [-d]\n");
262 return (SMF_EXIT_ERR_CONFIG);
263 }
264 }
265
266 /* set locale and domain for internationalization */
267 (void) setlocale(LC_ALL, "");
268 (void) textdomain(TEXT_DOMAIN);
269
270 idmap_set_logger(idmapdlog);
271 adutils_set_logger(idmapdlog);
272
273 if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) {
274 idmapdlog(LOG_ERR,
275 "with Trusted Extensions idmapd runs only in the "
276 "global zone");
277 exit(1);
278 }
279
280 /*
281 * Raise the fd limit to max
282 */
283 if (getrlimit(RLIMIT_NOFILE, &rl) != 0) {
284 idmapdlog(LOG_ERR, "getrlimit failed");
285 } else if (rl.rlim_cur < rl.rlim_max) {
286 rl.rlim_cur = rl.rlim_max;
287 if (setrlimit(RLIMIT_NOFILE, &rl) != 0)
288 idmapdlog(LOG_ERR,
289 "Unable to raise RLIMIT_NOFILE to %d",
290 rl.rlim_cur);
291 }
292
293 (void) mutex_init(&_svcstate_lock, USYNC_THREAD, NULL);
294
295 if (_idmapdstate.daemon_mode == TRUE) {
296 if (daemonize_start() < 0) {
297 idmapdlog(LOG_ERR, "unable to daemonize");
298 exit(-1);
299 }
300 } else
301 (void) umask(0077);
302
303 idmap_init_tsd_key();
304
305 init_idmapd();
306
307 /* signal handlers that should run only after we're initialized */
308 (void) sigset(SIGTERM, term_handler);
309 (void) sigset(SIGUSR1, usr1_handler);
310 (void) sigset(SIGHUP, idmap_cfg_hup_handler);
311
312 if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET,
313 DAEMON_UID, DAEMON_GID,
314 PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ,
315 (char *)NULL) == -1) {
316 idmapdlog(LOG_ERR, "unable to drop privileges");
317 exit(1);
318 }
319
320 __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION,
321 PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL);
322
323 if (_idmapdstate.daemon_mode == TRUE)
324 daemonize_ready();
325
326 /* With doors RPC this just wastes this thread, oh well */
327 svc_run();
328 return (0);
329 }
330
331 static void
init_idmapd()332 init_idmapd()
333 {
334 int error;
335 int connmaxrec = IDMAP_MAX_DOOR_RPC;
336
337
338 /* create directories as root and chown to daemon uid */
339 if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0)
340 exit(1);
341 if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0)
342 exit(1);
343
344 /*
345 * Set KRB5CCNAME in the environment. See app_krb5_user_uid()
346 * for more details. We blow away the existing one, if there is
347 * one.
348 */
349 (void) unlink(IDMAP_CACHEDIR "/ccache");
350 (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache");
351
352 if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname,
353 sizeof (_idmapdstate.hostname)) == -1) {
354 error = errno;
355 idmapdlog(LOG_ERR, "unable to determine hostname, error: %d",
356 error);
357 exit(1);
358 }
359
360 if ((error = init_mapping_system()) < 0) {
361 idmapdlog(LOG_ERR, "unable to initialize mapping system");
362 exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1);
363 }
364
365 (void) door_server_create(idmapd_door_thread_create);
366 if ((error = pthread_key_create(&create_threads_key,
367 idmapd_door_thread_cleanup)) != 0) {
368 idmapdlog(LOG_ERR, "unable to create threads key (%s)",
369 strerror(error));
370 goto errout;
371 }
372
373 xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec);
374 if (xprt == NULL) {
375 idmapdlog(LOG_ERR, "unable to create door RPC service");
376 goto errout;
377 }
378
379 if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) {
380 idmapdlog(LOG_ERR, "unable to limit RPC request size");
381 goto errout;
382 }
383
384 dfd = xprt->xp_fd;
385
386 if (dfd == -1) {
387 idmapdlog(LOG_ERR, "unable to register door");
388 goto errout;
389 }
390 if ((error = __idmap_reg(dfd)) != 0) {
391 idmapdlog(LOG_ERR, "unable to register door (%s)",
392 strerror(errno));
393 goto errout;
394 }
395
396 if ((error = allocids(_idmapdstate.new_eph_db,
397 8192, &_idmapdstate.next_uid,
398 8192, &_idmapdstate.next_gid)) != 0) {
399 idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)",
400 strerror(errno));
401 _idmapdstate.next_uid = IDMAP_SENTINEL_PID;
402 _idmapdstate.limit_uid = IDMAP_SENTINEL_PID;
403 _idmapdstate.next_gid = IDMAP_SENTINEL_PID;
404 _idmapdstate.limit_gid = IDMAP_SENTINEL_PID;
405 } else {
406 _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192;
407 _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192;
408 }
409
410 if (DBG(CONFIG, 1))
411 print_idmapdstate();
412
413 return;
414
415 errout:
416 fini_idmapd();
417 exit(1);
418 }
419
420 static void
fini_idmapd()421 fini_idmapd()
422 {
423 (void) __idmap_unreg(dfd);
424 fini_mapping_system();
425 if (xprt != NULL)
426 svc_destroy(xprt);
427 }
428
429 static
430 const char *
get_fmri(void)431 get_fmri(void)
432 {
433 static char *fmri = NULL;
434 static char buf[60];
435 char *s;
436
437 membar_consumer();
438 s = fmri;
439 if (s != NULL && *s == '\0')
440 return (NULL);
441 else if (s != NULL)
442 return (s);
443
444 if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf))
445 buf[0] = '\0';
446 else
447 (void) strlcpy(buf, s, sizeof (buf));
448
449 membar_producer();
450 fmri = buf;
451
452 return (get_fmri());
453 }
454
455 /*
456 * Wrappers for smf_degrade/restore_instance()
457 *
458 * smf_restore_instance() is too heavy duty to be calling every time we
459 * have a successful AD name<->SID lookup.
460 */
461 void
degrade_svc(int poke_discovery,const char * reason)462 degrade_svc(int poke_discovery, const char *reason)
463 {
464 const char *fmri;
465
466 membar_consumer();
467 if (degraded)
468 return;
469
470 idmapdlog(LOG_ERR, "Degraded operation (%s).", reason);
471
472 membar_producer();
473 degraded = B_TRUE;
474
475 if ((fmri = get_fmri()) != NULL)
476 (void) smf_degrade_instance(fmri, 0);
477
478 /*
479 * If the config update thread is in a state where auto-discovery could
480 * be re-tried, then this will make it try it -- a sort of auto-refresh.
481 */
482 if (poke_discovery)
483 idmap_cfg_poke_updates();
484 }
485
486 void
restore_svc(void)487 restore_svc(void)
488 {
489 const char *fmri;
490
491 membar_consumer();
492 if (!degraded)
493 return;
494
495 if ((fmri = get_fmri()) == NULL)
496 (void) smf_restore_instance(fmri);
497
498 membar_producer();
499 degraded = B_FALSE;
500
501 idmapdlog(LOG_NOTICE, "Normal operation restored");
502 }
503
504
505 /* printflike */
506 void
idmapdlog(int pri,const char * format,...)507 idmapdlog(int pri, const char *format, ...) {
508 va_list args;
509
510 va_start(args, format);
511 (void) vfprintf(stderr, format, args);
512 (void) fprintf(stderr, "\n");
513 va_end(args);
514
515 /*
516 * We don't want to fill up the logs with useless messages when
517 * we're degraded, but we still want to log.
518 */
519 if (degraded)
520 pri = LOG_DEBUG;
521
522 va_start(args, format);
523 vsyslog(pri, format, args);
524 va_end(args);
525 }
526
527 static void
trace_str(nvlist_t * entry,char * n1,char * n2,char * str)528 trace_str(nvlist_t *entry, char *n1, char *n2, char *str)
529 {
530 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
531
532 (void) strlcpy(name, n1, sizeof (name));
533 if (n2 != NULL)
534 (void) strlcat(name, n2, sizeof (name));
535
536 (void) nvlist_add_string(entry, name, str);
537 }
538
539 static void
trace_int(nvlist_t * entry,char * n1,char * n2,int64_t i)540 trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i)
541 {
542 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */
543
544 (void) strlcpy(name, n1, sizeof (name));
545 if (n2 != NULL)
546 (void) strlcat(name, n2, sizeof (name));
547
548 (void) nvlist_add_int64(entry, name, i);
549 }
550
551 static void
trace_sid(nvlist_t * entry,char * n1,char * n2,idmap_sid * sid)552 trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid)
553 {
554 char *str;
555
556 (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid);
557 if (str == NULL)
558 return;
559
560 trace_str(entry, n1, n2, str);
561 free(str);
562 }
563
564 static void
trace_id(nvlist_t * entry,char * fromto,idmap_id * id,char * name,char * domain)565 trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain)
566 {
567 trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype);
568 if (IS_ID_SID(*id)) {
569 if (name != NULL) {
570 char *str;
571
572 (void) asprintf(&str, "%s%s%s", name,
573 domain == NULL ? "" : "@",
574 domain == NULL ? "" : domain);
575 if (str != NULL) {
576 trace_str(entry, fromto, IDMAP_TRACE_NAME, str);
577 free(str);
578 }
579 }
580 if (id->idmap_id_u.sid.prefix != NULL) {
581 trace_sid(entry, fromto, IDMAP_TRACE_SID,
582 &id->idmap_id_u.sid);
583 }
584 } else if (IS_ID_POSIX(*id)) {
585 if (name != NULL)
586 trace_str(entry, fromto, IDMAP_TRACE_NAME, name);
587 if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) {
588 trace_int(entry, fromto, IDMAP_TRACE_UNIXID,
589 (int64_t)id->idmap_id_u.uid);
590 }
591 }
592 }
593
594 /*
595 * Record a trace event. TRACE() has already decided whether or not
596 * tracing is required; what we do here is collect the data and send it
597 * to its destination - to the trace log in the response, if
598 * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping
599 * is greater than zero.
600 */
601 int
trace(idmap_mapping * req,idmap_id_res * res,char * fmt,...)602 trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...)
603 {
604 va_list va;
605 char *buf;
606 int err;
607 nvlist_t *entry;
608
609 assert(req != NULL);
610 assert(res != NULL);
611
612 err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0);
613 if (err != 0) {
614 (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n",
615 strerror(err));
616 return (0);
617 }
618
619 trace_id(entry, "from", &req->id1, req->id1name, req->id1domain);
620 trace_id(entry, "to", &res->id, req->id2name, req->id2domain);
621
622 if (IDMAP_ERROR(res->retcode)) {
623 trace_int(entry, IDMAP_TRACE_ERROR, NULL,
624 (int64_t)res->retcode);
625 }
626
627 va_start(va, fmt);
628 (void) vasprintf(&buf, fmt, va);
629 va_end(va);
630 if (buf != NULL) {
631 trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf);
632 free(buf);
633 }
634
635 if (DBG(MAPPING, 1))
636 idmap_trace_print_1(stderr, "", entry);
637
638 if (req->flag & IDMAP_REQ_FLG_TRACE) {
639 /* Lazily allocate the trace list */
640 if (res->info.trace == NULL) {
641 err = nvlist_alloc(&res->info.trace, 0, 0);
642 if (err != 0) {
643 res->info.trace = NULL; /* just in case */
644 (void) fprintf(stderr,
645 "trace nvlist_alloc(trace): %s\n",
646 strerror(err));
647 nvlist_free(entry);
648 return (0);
649 }
650 }
651 (void) nvlist_add_nvlist(res->info.trace, "", entry);
652 /* Note that entry is copied, so we must still free our copy */
653 }
654
655 nvlist_free(entry);
656
657 return (0);
658 }
659