xref: /titanic_41/usr/src/cmd/svc/configd/configd.c (revision 3dd94f79268fa1debdd48a44e49c9958fcbad2eb)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
28  */
29 
30 #include <assert.h>
31 #include <door.h>
32 #include <errno.h>
33 #include <fcntl.h>
34 #include <limits.h>
35 #include <priv.h>
36 #include <procfs.h>
37 #include <pthread.h>
38 #include <signal.h>
39 #include <stdarg.h>
40 #include <stdio.h>
41 #include <stdio_ext.h>
42 #include <stdlib.h>
43 #include <string.h>
44 #include <syslog.h>
45 #include <sys/corectl.h>
46 #include <sys/resource.h>
47 #include <sys/stat.h>
48 #include <sys/wait.h>
49 #include <ucontext.h>
50 #include <unistd.h>
51 
52 #include "configd.h"
53 
54 /*
55  * This file manages the overall startup and shutdown of configd, as well
56  * as managing its door thread pool and per-thread datastructures.
57  *
58  * 1.  Per-thread Datastructures
59  * -----------------------------
60  * Each configd thread has an associated thread_info_t which contains its
61  * current state.  A pointer is kept to this in TSD, keyed by thread_info_key.
62  * The thread_info_ts for all threads in configd are kept on a single global
63  * list, thread_list.  After creation, the state in the thread_info structure
64  * is only modified by the associated thread, so no locking is needed.  A TSD
65  * destructor removes the thread_info from the global list and frees it at
66  * pthread_exit() time.
67  *
68  * Threads access their per-thread data using thread_self()
69  *
70  * The thread_list is protected by thread_lock, a leaf lock.
71  *
72  * 2. Door Thread Pool Management
73  * ------------------------------
74  * Whenever door_return(3door) returns from the kernel and there are no
75  * other configd threads waiting for requests, libdoor automatically
76  * invokes a function registered with door_server_create(), to request a new
77  * door server thread.  The default function just creates a thread that calls
78  * door_return(3door).  Unfortunately, since it can take a while for the new
79  * thread to *get* to door_return(3door), a stream of requests can cause a
80  * large number of threads to be created, even though they aren't all needed.
81  *
82  * In our callback, new_server_needed(), we limit ourself to two new threads
83  * at a time -- this logic is handled in reserve_new_thread().  This keeps
84  * us from creating an absurd number of threads in response to peaking load.
85  */
86 static pthread_key_t	thread_info_key;
87 static pthread_attr_t	thread_attr;
88 
89 static pthread_mutex_t	thread_lock = PTHREAD_MUTEX_INITIALIZER;
90 int			num_started;	/* number actually running */
91 int			num_servers;	/* number in-progress or running */
92 static uu_list_pool_t	*thread_pool;
93 uu_list_t		*thread_list;
94 
95 static thread_info_t	main_thread_info;
96 
97 static int	finished;
98 
99 static pid_t	privileged_pid = 0;
100 static int	privileged_psinfo_fd = -1;
101 
102 static int	privileged_user = 0;
103 
104 static priv_set_t *privileged_privs;
105 
106 static int	log_to_syslog = 0;
107 
108 int		is_main_repository = 1;
109 
110 int		max_repository_backups = 4;
111 
112 #define	CONFIGD_MAX_FDS		262144
113 
114 const char *
_umem_options_init(void)115 _umem_options_init(void)
116 {
117 	/*
118 	 * Like svc.startd, we set our UMEM_OPTIONS to indicate that we do not
119 	 * wish to have per-CPU magazines to reduce our memory footprint.  And
120 	 * as with svc.startd, if svc.configd is so MT-hot that this becomes a
121 	 * scalability problem, there are deeper issues...
122 	 */
123 	return ("nomagazines");		/* UMEM_OPTIONS setting */
124 }
125 
126 /*
127  * Thanks, Mike
128  */
129 void
abort_handler(int sig,siginfo_t * sip,ucontext_t * ucp)130 abort_handler(int sig, siginfo_t *sip, ucontext_t *ucp)
131 {
132 	struct sigaction act;
133 
134 	(void) sigemptyset(&act.sa_mask);
135 	act.sa_handler = SIG_DFL;
136 	act.sa_flags = 0;
137 	(void) sigaction(sig, &act, NULL);
138 
139 	(void) printstack(2);
140 
141 	if (sip != NULL && SI_FROMUSER(sip))
142 		(void) pthread_kill(pthread_self(), sig);
143 	(void) sigfillset(&ucp->uc_sigmask);
144 	(void) sigdelset(&ucp->uc_sigmask, sig);
145 	ucp->uc_flags |= UC_SIGMASK;
146 	(void) setcontext(ucp);
147 }
148 
149 /*
150  * Don't want to have more than a couple thread creates outstanding
151  */
152 static int
reserve_new_thread(void)153 reserve_new_thread(void)
154 {
155 	(void) pthread_mutex_lock(&thread_lock);
156 	assert(num_started >= 0);
157 	if (num_servers > num_started + 1) {
158 		(void) pthread_mutex_unlock(&thread_lock);
159 		return (0);
160 	}
161 	++num_servers;
162 	(void) pthread_mutex_unlock(&thread_lock);
163 	return (1);
164 }
165 
166 static void
thread_info_free(thread_info_t * ti)167 thread_info_free(thread_info_t *ti)
168 {
169 	uu_list_node_fini(ti, &ti->ti_node, thread_pool);
170 	if (ti->ti_ucred != NULL)
171 		uu_free(ti->ti_ucred);
172 	uu_free(ti);
173 }
174 
175 static void
thread_exiting(void * arg)176 thread_exiting(void *arg)
177 {
178 	thread_info_t *ti = arg;
179 
180 	if (ti != NULL)
181 		log_enter(&ti->ti_log);
182 
183 	(void) pthread_mutex_lock(&thread_lock);
184 	if (ti != NULL) {
185 		num_started--;
186 		uu_list_remove(thread_list, ti);
187 	}
188 	assert(num_servers > 0);
189 	--num_servers;
190 
191 	if (num_servers == 0) {
192 		configd_critical("no door server threads\n");
193 		abort();
194 	}
195 	(void) pthread_mutex_unlock(&thread_lock);
196 
197 	if (ti != NULL && ti != &main_thread_info)
198 		thread_info_free(ti);
199 }
200 
201 void
thread_newstate(thread_info_t * ti,thread_state_t newstate)202 thread_newstate(thread_info_t *ti, thread_state_t newstate)
203 {
204 	ti->ti_ucred_read = 0;			/* invalidate cached ucred */
205 	if (newstate != ti->ti_state) {
206 		ti->ti_prev_state = ti->ti_state;
207 		ti->ti_state = newstate;
208 		ti->ti_lastchange = gethrtime();
209 	}
210 }
211 
212 thread_info_t *
thread_self(void)213 thread_self(void)
214 {
215 	return (pthread_getspecific(thread_info_key));
216 }
217 
218 /*
219  * get_ucred() returns NULL if it was unable to get the credential
220  * information.
221  */
222 ucred_t *
get_ucred(void)223 get_ucred(void)
224 {
225 	thread_info_t *ti = thread_self();
226 	ucred_t **ret = &ti->ti_ucred;
227 
228 	if (ti->ti_ucred_read)
229 		return (*ret);			/* cached value */
230 
231 	if (door_ucred(ret) != 0)
232 		return (NULL);
233 	ti->ti_ucred_read = 1;
234 
235 	return (*ret);
236 }
237 
238 int
ucred_is_privileged(ucred_t * uc)239 ucred_is_privileged(ucred_t *uc)
240 {
241 	const priv_set_t *ps;
242 
243 	if ((ps = ucred_getprivset(uc, PRIV_EFFECTIVE)) != NULL) {
244 		if (priv_isfullset(ps))
245 			return (1);		/* process has all privs */
246 
247 		if (privileged_privs != NULL &&
248 		    priv_issubset(privileged_privs, ps))
249 			return (1);		/* process has zone privs */
250 	}
251 
252 	return (0);
253 }
254 
255 /*
256  * The purpose of this function is to get the audit session data for use in
257  * generating SMF audit events.  We use a single audit session per client.
258  *
259  * get_audit_session() may return NULL.  It is legal to use a NULL pointer
260  * in subsequent calls to adt_* functions.
261  */
262 adt_session_data_t *
get_audit_session(void)263 get_audit_session(void)
264 {
265 	thread_info_t	*ti = thread_self();
266 
267 	return (ti->ti_active_client->rc_adt_session);
268 }
269 
270 static void *
thread_start(void * arg)271 thread_start(void *arg)
272 {
273 	thread_info_t *ti = arg;
274 
275 	(void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
276 
277 	(void) pthread_mutex_lock(&thread_lock);
278 	num_started++;
279 	(void) uu_list_insert_after(thread_list, uu_list_last(thread_list),
280 	    ti);
281 	(void) pthread_mutex_unlock(&thread_lock);
282 	(void) pthread_setspecific(thread_info_key, ti);
283 
284 	thread_newstate(ti, TI_DOOR_RETURN);
285 
286 	/*
287 	 * Start handling door calls
288 	 */
289 	(void) door_return(NULL, 0, NULL, 0);
290 	return (arg);
291 }
292 
293 static void
new_thread_needed(door_info_t * dip)294 new_thread_needed(door_info_t *dip)
295 {
296 	thread_info_t *ti;
297 
298 	sigset_t new, old;
299 
300 	assert(dip == NULL);
301 
302 	if (!reserve_new_thread())
303 		return;
304 
305 	if ((ti = uu_zalloc(sizeof (*ti))) == NULL)
306 		goto fail;
307 
308 	uu_list_node_init(ti, &ti->ti_node, thread_pool);
309 	ti->ti_state = TI_CREATED;
310 	ti->ti_prev_state = TI_CREATED;
311 
312 	if ((ti->ti_ucred = uu_zalloc(ucred_size())) == NULL)
313 		goto fail;
314 
315 	(void) sigfillset(&new);
316 	(void) pthread_sigmask(SIG_SETMASK, &new, &old);
317 	if ((errno = pthread_create(&ti->ti_thread, &thread_attr, thread_start,
318 	    ti)) != 0) {
319 		(void) pthread_sigmask(SIG_SETMASK, &old, NULL);
320 		goto fail;
321 	}
322 
323 	(void) pthread_sigmask(SIG_SETMASK, &old, NULL);
324 	return;
325 
326 fail:
327 	/*
328 	 * Since the thread_info structure was never linked onto the
329 	 * thread list, thread_exiting() can't handle the cleanup.
330 	 */
331 	thread_exiting(NULL);
332 	if (ti != NULL)
333 		thread_info_free(ti);
334 }
335 
336 int
create_connection(ucred_t * uc,repository_door_request_t * rp,size_t rp_size,int * out_fd)337 create_connection(ucred_t *uc, repository_door_request_t *rp,
338     size_t rp_size, int *out_fd)
339 {
340 	int flags;
341 	int privileged = 0;
342 	uint32_t debugflags = 0;
343 	psinfo_t info;
344 
345 	if (privileged_pid != 0) {
346 		/*
347 		 * in privileged pid mode, we only allow connections from
348 		 * our original parent -- the psinfo read verifies that
349 		 * it is the same process which we started with.
350 		 */
351 		if (ucred_getpid(uc) != privileged_pid ||
352 		    read(privileged_psinfo_fd, &info, sizeof (info)) !=
353 		    sizeof (info))
354 			return (REPOSITORY_DOOR_FAIL_PERMISSION_DENIED);
355 
356 		privileged = 1;			/* he gets full privileges */
357 	} else if (privileged_user != 0) {
358 		/*
359 		 * in privileged user mode, only one particular user is
360 		 * allowed to connect to us, and he can do anything.
361 		 */
362 		if (ucred_geteuid(uc) != privileged_user)
363 			return (REPOSITORY_DOOR_FAIL_PERMISSION_DENIED);
364 
365 		privileged = 1;
366 	}
367 
368 	/*
369 	 * Check that rp, of size rp_size, is large enough to
370 	 * contain field 'f'.  If so, write the value into *out, and return 1.
371 	 * Otherwise, return 0.
372 	 */
373 #define	GET_ARG(rp, rp_size, f, out)					\
374 	(((rp_size) >= offsetofend(repository_door_request_t, f)) ?	\
375 	    ((*(out) = (rp)->f), 1) : 0)
376 
377 	if (!GET_ARG(rp, rp_size, rdr_flags, &flags))
378 		return (REPOSITORY_DOOR_FAIL_BAD_REQUEST);
379 
380 #if (REPOSITORY_DOOR_FLAG_ALL != REPOSITORY_DOOR_FLAG_DEBUG)
381 #error Need to update flag checks
382 #endif
383 
384 	if (flags & ~REPOSITORY_DOOR_FLAG_ALL)
385 		return (REPOSITORY_DOOR_FAIL_BAD_FLAG);
386 
387 	if (flags & REPOSITORY_DOOR_FLAG_DEBUG)
388 		if (!GET_ARG(rp, rp_size, rdr_debug, &debugflags))
389 			return (REPOSITORY_DOOR_FAIL_BAD_REQUEST);
390 #undef GET_ARG
391 
392 	return (create_client(ucred_getpid(uc), debugflags, privileged,
393 	    out_fd));
394 }
395 
396 void
configd_vlog(int severity,const char * prefix,const char * message,va_list args)397 configd_vlog(int severity, const char *prefix, const char *message,
398     va_list args)
399 {
400 	if (log_to_syslog)
401 		vsyslog(severity, message, args);
402 	else {
403 		flockfile(stderr);
404 		if (prefix != NULL)
405 			(void) fprintf(stderr, "%s", prefix);
406 		(void) vfprintf(stderr, message, args);
407 		if (message[0] == 0 || message[strlen(message) - 1] != '\n')
408 			(void) fprintf(stderr, "\n");
409 		funlockfile(stderr);
410 	}
411 }
412 
413 void
configd_vcritical(const char * message,va_list args)414 configd_vcritical(const char *message, va_list args)
415 {
416 	configd_vlog(LOG_CRIT, "svc.configd: Fatal error: ", message, args);
417 }
418 
419 void
configd_critical(const char * message,...)420 configd_critical(const char *message, ...)
421 {
422 	va_list args;
423 	va_start(args, message);
424 	configd_vcritical(message, args);
425 	va_end(args);
426 }
427 
428 void
configd_info(const char * message,...)429 configd_info(const char *message, ...)
430 {
431 	va_list args;
432 	va_start(args, message);
433 	configd_vlog(LOG_INFO, "svc.configd: ", message, args);
434 	va_end(args);
435 }
436 
437 static void
usage(const char * prog,int ret)438 usage(const char *prog, int ret)
439 {
440 	(void) fprintf(stderr,
441 	    "usage: %s [-np] [-d door_path] [-r repository_path]\n"
442 	    "    [-t nonpersist_repository]\n", prog);
443 	exit(ret);
444 }
445 
446 /*ARGSUSED*/
447 static void
handler(int sig,siginfo_t * info,void * data)448 handler(int sig, siginfo_t *info, void *data)
449 {
450 	finished = 1;
451 }
452 
453 static int pipe_fd = -1;
454 
455 static int
daemonize_start(void)456 daemonize_start(void)
457 {
458 	char data;
459 	int status;
460 
461 	int filedes[2];
462 	pid_t pid;
463 
464 	(void) close(0);
465 	(void) dup2(2, 1);		/* stderr only */
466 
467 	if (pipe(filedes) < 0)
468 		return (-1);
469 
470 	if ((pid = fork1()) < 0)
471 		return (-1);
472 
473 	if (pid != 0) {
474 		/*
475 		 * parent
476 		 */
477 		struct sigaction act;
478 
479 		act.sa_sigaction = SIG_DFL;
480 		(void) sigemptyset(&act.sa_mask);
481 		act.sa_flags = 0;
482 
483 		(void) sigaction(SIGPIPE, &act, NULL);	/* ignore SIGPIPE */
484 
485 		(void) close(filedes[1]);
486 		if (read(filedes[0], &data, 1) == 1) {
487 			/* presume success */
488 			_exit(CONFIGD_EXIT_OKAY);
489 		}
490 
491 		status = -1;
492 		(void) wait4(pid, &status, 0, NULL);
493 		if (WIFEXITED(status))
494 			_exit(WEXITSTATUS(status));
495 		else
496 			_exit(-1);
497 	}
498 
499 	/*
500 	 * child
501 	 */
502 	pipe_fd = filedes[1];
503 	(void) close(filedes[0]);
504 
505 	/*
506 	 * generic Unix setup
507 	 */
508 	(void) setsid();
509 	(void) umask(0077);
510 
511 	return (0);
512 }
513 
514 static void
daemonize_ready(void)515 daemonize_ready(void)
516 {
517 	char data = '\0';
518 
519 	/*
520 	 * wake the parent
521 	 */
522 	(void) write(pipe_fd, &data, 1);
523 	(void) close(pipe_fd);
524 }
525 
526 const char *
regularize_path(const char * dir,const char * base,char * tmpbuf)527 regularize_path(const char *dir, const char *base, char *tmpbuf)
528 {
529 	if (base == NULL)
530 		return (NULL);
531 	if (base[0] == '/')
532 		return (base);
533 
534 	if (snprintf(tmpbuf, PATH_MAX, "%s/%s", dir, base) >= PATH_MAX) {
535 		(void) fprintf(stderr, "svc.configd: %s/%s: path too long\n",
536 		    dir, base);
537 		exit(CONFIGD_EXIT_BAD_ARGS);
538 	}
539 
540 	return (tmpbuf);
541 }
542 
543 int
main(int argc,char * argv[])544 main(int argc, char *argv[])
545 {
546 	thread_info_t *ti = &main_thread_info;
547 
548 	char pidpath[sizeof ("/proc/" "/psinfo") + 10];
549 
550 	struct rlimit fd_new;
551 
552 	const char *endptr;
553 	sigset_t myset;
554 	int c;
555 	int ret;
556 	int fd;
557 
558 	char curdir[PATH_MAX];
559 	char dbtmp[PATH_MAX];
560 	char npdbtmp[PATH_MAX];
561 	char doortmp[PATH_MAX];
562 
563 	const char *dbpath = NULL;
564 	const char *npdbpath = NULL;
565 	const char *doorpath = REPOSITORY_DOOR_NAME;
566 	struct sigaction act;
567 
568 	int daemonize = 1;		/* default to daemonizing */
569 	int have_npdb = 1;
570 
571 	closefrom(3);			/* get rid of extraneous fds */
572 
573 	if (getcwd(curdir, sizeof (curdir)) == NULL) {
574 		(void) fprintf(stderr,
575 		    "%s: unable to get current directory: %s\n",
576 		    argv[0], strerror(errno));
577 		exit(CONFIGD_EXIT_INIT_FAILED);
578 	}
579 
580 	while ((c = getopt(argc, argv, "Dnpd:r:t:")) != -1) {
581 		switch (c) {
582 		case 'n':
583 			daemonize = 0;
584 			break;
585 		case 'd':
586 			doorpath = regularize_path(curdir, optarg, doortmp);
587 			have_npdb = 0;		/* default to no non-persist */
588 			break;
589 		case 'p':
590 			log_to_syslog = 0;	/* don't use syslog */
591 
592 			/*
593 			 * If our parent exits while we're opening its /proc
594 			 * psinfo, we're vulnerable to a pid wrapping.  To
595 			 * protect against that, re-check our ppid after
596 			 * opening it.
597 			 */
598 			privileged_pid = getppid();
599 			(void) snprintf(pidpath, sizeof (pidpath),
600 			    "/proc/%d/psinfo", privileged_pid);
601 			if ((fd = open(pidpath, O_RDONLY)) < 0 ||
602 			    getppid() != privileged_pid) {
603 				(void) fprintf(stderr,
604 				    "%s: unable to get parent info\n", argv[0]);
605 				exit(CONFIGD_EXIT_BAD_ARGS);
606 			}
607 			privileged_psinfo_fd = fd;
608 			break;
609 		case 'r':
610 			dbpath = regularize_path(curdir, optarg, dbtmp);
611 			is_main_repository = 0;
612 			break;
613 		case 't':
614 			npdbpath = regularize_path(curdir, optarg, npdbtmp);
615 			is_main_repository = 0;
616 			break;
617 		default:
618 			usage(argv[0], CONFIGD_EXIT_BAD_ARGS);
619 			break;
620 		}
621 	}
622 
623 	/*
624 	 * If we're not running as root, allow our euid full access, and
625 	 * everyone else no access.
626 	 */
627 	if (privileged_pid == 0 && geteuid() != 0) {
628 		privileged_user = geteuid();
629 	}
630 
631 	privileged_privs = priv_str_to_set("zone", "", &endptr);
632 	if (endptr != NULL && privileged_privs != NULL) {
633 		priv_freeset(privileged_privs);
634 		privileged_privs = NULL;
635 	}
636 
637 	openlog("svc.configd", LOG_PID | LOG_CONS, LOG_DAEMON);
638 	(void) setlogmask(LOG_UPTO(LOG_NOTICE));
639 
640 	/*
641 	 * if a non-persist db is specified, always enable it
642 	 */
643 	if (npdbpath)
644 		have_npdb = 1;
645 
646 	if (optind != argc)
647 		usage(argv[0], CONFIGD_EXIT_BAD_ARGS);
648 
649 	if (daemonize) {
650 		if (getuid() == 0)
651 			(void) chdir("/");
652 		if (daemonize_start() < 0) {
653 			(void) perror("unable to daemonize");
654 			exit(CONFIGD_EXIT_INIT_FAILED);
655 		}
656 	}
657 	if (getuid() == 0)
658 		(void) core_set_process_path(CONFIGD_CORE,
659 		    strlen(CONFIGD_CORE) + 1, getpid());
660 
661 	/*
662 	 * this should be enabled once we can drop privileges and still get
663 	 * a core dump.
664 	 */
665 #if 0
666 	/* turn off basic privileges we do not need */
667 	(void) priv_set(PRIV_OFF, PRIV_PERMITTED, PRIV_FILE_LINK_ANY,
668 	    PRIV_PROC_EXEC, PRIV_PROC_FORK, PRIV_PROC_SESSION, NULL);
669 #endif
670 
671 	/* not that we can exec, but to be safe, shut them all off... */
672 	(void) priv_set(PRIV_SET, PRIV_INHERITABLE, NULL);
673 
674 	(void) sigfillset(&act.sa_mask);
675 
676 	/* signals to ignore */
677 	act.sa_sigaction = SIG_IGN;
678 	act.sa_flags = 0;
679 	(void) sigaction(SIGPIPE, &act, NULL);
680 	(void) sigaction(SIGALRM, &act, NULL);
681 	(void) sigaction(SIGUSR1, &act, NULL);
682 	(void) sigaction(SIGUSR2, &act, NULL);
683 	(void) sigaction(SIGPOLL, &act, NULL);
684 
685 	/* signals to abort on */
686 	act.sa_sigaction = (void (*)(int, siginfo_t *, void *))&abort_handler;
687 	act.sa_flags = SA_SIGINFO;
688 
689 	(void) sigaction(SIGABRT, &act, NULL);
690 
691 	/* signals to handle */
692 	act.sa_sigaction = &handler;
693 	act.sa_flags = SA_SIGINFO;
694 
695 	(void) sigaction(SIGHUP, &act, NULL);
696 	(void) sigaction(SIGINT, &act, NULL);
697 	(void) sigaction(SIGTERM, &act, NULL);
698 
699 	(void) sigemptyset(&myset);
700 	(void) sigaddset(&myset, SIGHUP);
701 	(void) sigaddset(&myset, SIGINT);
702 	(void) sigaddset(&myset, SIGTERM);
703 
704 	if ((errno = pthread_attr_init(&thread_attr)) != 0) {
705 		(void) perror("initializing");
706 		exit(CONFIGD_EXIT_INIT_FAILED);
707 	}
708 
709 	/*
710 	 * Set the hard and soft limits to CONFIGD_MAX_FDS.
711 	 */
712 	fd_new.rlim_max = fd_new.rlim_cur = CONFIGD_MAX_FDS;
713 	(void) setrlimit(RLIMIT_NOFILE, &fd_new);
714 
715 #ifndef NATIVE_BUILD /* Allow building on snv_38 and earlier; remove later. */
716 	(void) enable_extended_FILE_stdio(-1, -1);
717 #endif
718 
719 	if ((ret = backend_init(dbpath, npdbpath, have_npdb)) !=
720 	    CONFIGD_EXIT_OKAY)
721 		exit(ret);
722 
723 	if (!client_init())
724 		exit(CONFIGD_EXIT_INIT_FAILED);
725 
726 	if (!rc_node_init())
727 		exit(CONFIGD_EXIT_INIT_FAILED);
728 
729 	(void) pthread_attr_setdetachstate(&thread_attr,
730 	    PTHREAD_CREATE_DETACHED);
731 	(void) pthread_attr_setscope(&thread_attr, PTHREAD_SCOPE_SYSTEM);
732 
733 	if ((errno = pthread_key_create(&thread_info_key,
734 	    thread_exiting)) != 0) {
735 		perror("pthread_key_create");
736 		exit(CONFIGD_EXIT_INIT_FAILED);
737 	}
738 
739 	if ((thread_pool = uu_list_pool_create("thread_pool",
740 	    sizeof (thread_info_t), offsetof(thread_info_t, ti_node),
741 	    NULL, UU_LIST_POOL_DEBUG)) == NULL) {
742 		configd_critical("uu_list_pool_create: %s\n",
743 		    uu_strerror(uu_error()));
744 		exit(CONFIGD_EXIT_INIT_FAILED);
745 	}
746 
747 	if ((thread_list = uu_list_create(thread_pool, NULL, 0)) == NULL) {
748 		configd_critical("uu_list_create: %s\n",
749 		    uu_strerror(uu_error()));
750 		exit(CONFIGD_EXIT_INIT_FAILED);
751 	}
752 
753 	(void) memset(ti, '\0', sizeof (*ti));
754 	uu_list_node_init(ti, &ti->ti_node, thread_pool);
755 	(void) uu_list_insert_before(thread_list, uu_list_first(thread_list),
756 	    ti);
757 
758 	ti->ti_thread = pthread_self();
759 	ti->ti_state = TI_SIGNAL_WAIT;
760 	ti->ti_prev_state = TI_SIGNAL_WAIT;
761 
762 	(void) pthread_setspecific(thread_info_key, ti);
763 
764 	(void) door_server_create(new_thread_needed);
765 
766 	if (!setup_main_door(doorpath)) {
767 		configd_critical("Setting up main door failed.\n");
768 		exit(CONFIGD_EXIT_DOOR_INIT_FAILED);
769 	}
770 
771 	if (daemonize)
772 		daemonize_ready();
773 
774 	(void) pthread_sigmask(SIG_BLOCK, &myset, NULL);
775 	while (!finished) {
776 		int sig = sigwait(&myset);
777 		if (sig > 0) {
778 			break;
779 		}
780 	}
781 
782 	backend_fini();
783 
784 	return (CONFIGD_EXIT_OKAY);
785 }
786