1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/acctctl.h> 28 #include <unistd.h> 29 #include <string.h> 30 #include <stdlib.h> 31 #include <errno.h> 32 #include <limits.h> 33 #include <libdllink.h> 34 #include <libscf.h> 35 #include <pwd.h> 36 #include <auth_attr.h> 37 #include <nss_dbdefs.h> 38 #include <secdb.h> 39 #include <priv.h> 40 #include <zone.h> 41 42 #include "aconf.h" 43 #include "utils.h" 44 #include "res.h" 45 46 #define FMRI_FLOW_ACCT "svc:/system/extended-accounting:flow" 47 #define FMRI_PROC_ACCT "svc:/system/extended-accounting:process" 48 #define FMRI_TASK_ACCT "svc:/system/extended-accounting:task" 49 #define FMRI_NET_ACCT "svc:/system/extended-accounting:net" 50 51 #define NELEM(x) (sizeof (x)) / (sizeof (x[0])) 52 53 typedef struct props { 54 char *propname; 55 int proptype; 56 scf_transaction_entry_t *entry; 57 scf_value_t *value; 58 struct props *next; 59 } props_t; 60 61 static void aconf_print_type(acctconf_t *, FILE *, int); 62 static int aconf_get_bool(const char *, const char *, uint8_t *); 63 static int aconf_get_string(const char *, const char *, char *, size_t); 64 static props_t *aconf_prop(const char *, int); 65 static int aconf_fmri2type(const char *); 66 67 static scf_handle_t *handle = NULL; 68 static scf_instance_t *inst = NULL; 69 static props_t *props = NULL; 70 71 void 72 aconf_init(acctconf_t *acp, int type) 73 { 74 void *buf; 75 char *tracked; 76 char *untracked; 77 78 if ((buf = malloc(AC_BUFSIZE)) == NULL) 79 die(gettext("not enough memory\n")); 80 81 if (acctctl(type | AC_STATE_GET, &acp->state, 82 sizeof (acp->state)) == -1) 83 die(gettext("cannot get %s accounting state\n"), 84 ac_type_name(type)); 85 86 (void) memset(acp->file, 0, sizeof (acp->file)); 87 if (acctctl(type | AC_FILE_GET, acp->file, sizeof (acp->file)) == -1) { 88 if (errno == ENOTACTIVE) 89 (void) strlcpy(acp->file, AC_STR_NONE, 90 sizeof (acp->file)); 91 else 92 die(gettext("cannot get %s accounting file name"), 93 ac_type_name(type)); 94 } 95 (void) memset(buf, 0, AC_BUFSIZE); 96 if (acctctl(type | AC_RES_GET, buf, AC_BUFSIZE) == -1) 97 die(gettext("cannot obtain the list of enabled resources\n")); 98 99 tracked = buf2str(buf, AC_BUFSIZE, AC_ON, type); 100 untracked = buf2str(buf, AC_BUFSIZE, AC_OFF, type); 101 (void) strlcpy(acp->tracked, tracked, sizeof (acp->tracked)); 102 (void) strlcpy(acp->untracked, untracked, sizeof (acp->untracked)); 103 free(tracked); 104 free(untracked); 105 free(buf); 106 } 107 108 /* 109 * SMF start method: configure extended accounting from properties stored in 110 * the repository. Any errors encountered while retrieving properties from 111 * the repository, such as missing properties or properties of the wrong type, 112 * are fatal as they indicate severe damage to the service (all required 113 * properties are delivered in the service manifest and should thus always be 114 * present). No attempts will be made to repair such damage; the service will 115 * be forced into maintenance state by returning SMF_EXIT_ERR_CONFIG. For all 116 * other errors we we try to configure as much as possible and return 117 * SMF_EXIT_ERR_FATAL. 118 */ 119 int 120 aconf_setup(const char *fmri) 121 { 122 char file[MAXPATHLEN]; 123 char tracked[MAXRESLEN]; 124 char untracked[MAXRESLEN]; 125 void *buf; 126 int type; 127 int state; 128 uint8_t b; 129 int ret = SMF_EXIT_OK; 130 131 if ((type = aconf_fmri2type(fmri)) == -1) { 132 warn(gettext("no accounting type for %s\n"), fmri); 133 return (SMF_EXIT_ERR_FATAL); 134 } 135 136 /* 137 * Net/Flow accounting is not available in non-global zones and 138 * the service instance should therefore never be 'enabled' in 139 * non-global zones. This is enforced by acctadm(1M), but there is 140 * nothing that prevents someone from calling svcadm enable directly, 141 * so we handle that case here by disabling the instance. 142 */ 143 if ((type == AC_FLOW || type == AC_NET) && 144 getzoneid() != GLOBAL_ZONEID) { 145 (void) smf_disable_instance(fmri, 0); 146 warn(gettext("%s accounting cannot be configured in " 147 "non-global zones\n"), ac_type_name(type)); 148 return (SMF_EXIT_OK); 149 } 150 151 if (aconf_scf_init(fmri) == -1) { 152 warn(gettext("cannot connect to repository\n")); 153 return (SMF_EXIT_ERR_FATAL); 154 } 155 if (aconf_get_string(AC_PGNAME, AC_PROP_TRACKED, tracked, 156 sizeof (tracked)) == -1) { 157 warn(gettext("cannot get %s property\n"), AC_PROP_TRACKED); 158 ret = SMF_EXIT_ERR_CONFIG; 159 goto out; 160 } 161 if (aconf_get_string(AC_PGNAME, AC_PROP_UNTRACKED, untracked, 162 sizeof (untracked)) == -1) { 163 warn(gettext("cannot get %s property\n"), AC_PROP_UNTRACKED); 164 ret = SMF_EXIT_ERR_CONFIG; 165 goto out; 166 } 167 if (aconf_get_string(AC_PGNAME, AC_PROP_FILE, file, 168 sizeof (file)) == -1) { 169 warn(gettext("cannot get %s property\n"), AC_PROP_FILE); 170 ret = SMF_EXIT_ERR_CONFIG; 171 goto out; 172 } 173 if (aconf_get_bool(AC_PGNAME, AC_PROP_STATE, &b) == -1) { 174 warn(gettext("cannot get %s property\n"), AC_PROP_STATE); 175 ret = SMF_EXIT_ERR_CONFIG; 176 goto out; 177 } 178 state = (b ? AC_ON : AC_OFF); 179 180 if ((buf = malloc(AC_BUFSIZE)) == NULL) { 181 warn(gettext("not enough memory\n")); 182 ret = SMF_EXIT_ERR_FATAL; 183 goto out; 184 } 185 (void) memset(buf, 0, AC_BUFSIZE); 186 str2buf(buf, untracked, AC_OFF, type); 187 str2buf(buf, tracked, AC_ON, type); 188 189 (void) priv_set(PRIV_ON, PRIV_EFFECTIVE, PRIV_SYS_ACCT, NULL); 190 if (acctctl(type | AC_RES_SET, buf, AC_BUFSIZE) == -1) { 191 warn(gettext("cannot enable/disable %s accounting resources"), 192 ac_type_name(type)); 193 ret = SMF_EXIT_ERR_FATAL; 194 } 195 free(buf); 196 197 if (strcmp(file, AC_STR_NONE) != 0) { 198 if (open_exacct_file(file, type) == -1) 199 ret = SMF_EXIT_ERR_FATAL; 200 } else { 201 if (acctctl(type | AC_FILE_SET, NULL, 0) == -1) { 202 warn(gettext("cannot close %s accounting file"), 203 ac_type_name(type)); 204 ret = SMF_EXIT_ERR_FATAL; 205 } 206 } 207 if (acctctl(type | AC_STATE_SET, &state, sizeof (state)) == -1) { 208 warn(gettext("cannot %s %s accounting"), 209 state == AC_ON ? gettext("enable") : gettext("disable"), 210 ac_type_name(type)); 211 ret = SMF_EXIT_ERR_FATAL; 212 } 213 (void) priv_set(PRIV_OFF, PRIV_EFFECTIVE, PRIV_SYS_ACCT, NULL); 214 215 if (state == AC_ON && type == AC_NET) { 216 /* 217 * Start logging. 218 */ 219 (void) priv_set(PRIV_ON, PRIV_EFFECTIVE, PRIV_SYS_DL_CONFIG, 220 NULL); 221 (void) dladm_start_usagelog(dld_handle, 222 strncmp(tracked, "basic", strlen("basic")) == 0 ? 223 DLADM_LOGTYPE_LINK : DLADM_LOGTYPE_FLOW, 20); 224 (void) priv_set(PRIV_OFF, PRIV_EFFECTIVE, PRIV_SYS_DL_CONFIG, 225 NULL); 226 } 227 out: 228 aconf_scf_fini(); 229 return (ret); 230 } 231 232 void 233 aconf_print(FILE *fp, int types) 234 { 235 acctconf_t ac; 236 int print_order[] = { AC_TASK, AC_PROC, AC_FLOW, AC_NET }; 237 int i; 238 239 for (i = 0; i < NELEM(print_order); i++) { 240 if (types & print_order[i]) { 241 aconf_init(&ac, print_order[i]); 242 aconf_print_type(&ac, fp, print_order[i]); 243 } 244 } 245 } 246 247 static void 248 aconf_print_type(acctconf_t *acp, FILE *fp, int type) 249 { 250 switch (type) { 251 case AC_TASK: 252 (void) fprintf(fp, 253 gettext(" Task accounting: %s\n"), 254 acp->state == AC_ON ? 255 gettext("active") : gettext("inactive")); 256 (void) fprintf(fp, 257 gettext(" Task accounting file: %s\n"), 258 acp->file); 259 (void) fprintf(fp, 260 gettext(" Tracked task resources: %s\n"), 261 acp->tracked); 262 (void) fprintf(fp, 263 gettext(" Untracked task resources: %s\n"), 264 acp->untracked); 265 break; 266 case AC_PROC: 267 (void) fprintf(fp, 268 gettext(" Process accounting: %s\n"), 269 acp->state == AC_ON ? 270 gettext("active") : gettext("inactive")); 271 (void) fprintf(fp, 272 gettext(" Process accounting file: %s\n"), 273 acp->file); 274 (void) fprintf(fp, 275 gettext(" Tracked process resources: %s\n"), 276 acp->tracked); 277 (void) fprintf(fp, 278 gettext("Untracked process resources: %s\n"), 279 acp->untracked); 280 break; 281 case AC_FLOW: 282 (void) fprintf(fp, 283 gettext(" Flow accounting: %s\n"), 284 acp->state == AC_ON ? 285 gettext("active") : gettext("inactive")); 286 (void) fprintf(fp, 287 gettext(" Flow accounting file: %s\n"), 288 acp->file); 289 (void) fprintf(fp, 290 gettext(" Tracked flow resources: %s\n"), 291 acp->tracked); 292 (void) fprintf(fp, 293 gettext(" Untracked flow resources: %s\n"), 294 acp->untracked); 295 break; 296 case AC_NET: 297 (void) fprintf(fp, 298 gettext(" Net accounting: %s\n"), 299 acp->state == AC_ON ? 300 gettext("active") : gettext("inactive")); 301 (void) fprintf(fp, 302 gettext(" Net accounting file: %s\n"), 303 acp->file); 304 (void) fprintf(fp, 305 gettext(" Tracked net resources: %s\n"), 306 acp->tracked); 307 (void) fprintf(fp, 308 gettext(" Untracked net resources: %s\n"), 309 acp->untracked); 310 break; 311 } 312 } 313 314 /* 315 * Modified properties are put on the 'props' linked list by aconf_set_string() 316 * and aconf_set_bool(). Walk the list of modified properties and write them 317 * to the repository. The list is deleted on exit. 318 */ 319 int 320 aconf_save(void) 321 { 322 scf_propertygroup_t *pg; 323 scf_transaction_t *tx; 324 props_t *p; 325 props_t *q; 326 int tx_result; 327 328 if (props == NULL) 329 return (0); 330 331 if ((pg = scf_pg_create(handle)) == NULL || 332 scf_instance_get_pg(inst, AC_PGNAME, pg) == -1 || 333 (tx = scf_transaction_create(handle)) == NULL) 334 goto out; 335 336 do { 337 if (scf_pg_update(pg) == -1 || 338 scf_transaction_start(tx, pg) == -1) 339 goto out; 340 341 for (p = props; p != NULL; p = p->next) { 342 if (scf_transaction_property_change(tx, p->entry, 343 p->propname, p->proptype) == -1) 344 goto out; 345 (void) scf_entry_add_value(p->entry, p->value); 346 } 347 tx_result = scf_transaction_commit(tx); 348 scf_transaction_reset(tx); 349 } while (tx_result == 0); 350 351 out: 352 p = props; 353 while (p != NULL) { 354 scf_value_destroy(p->value); 355 scf_entry_destroy(p->entry); 356 free(p->propname); 357 q = p->next; 358 free(p); 359 p = q; 360 } 361 props = NULL; 362 scf_transaction_destroy(tx); 363 scf_pg_destroy(pg); 364 return ((tx_result == 1) ? 0 : -1); 365 } 366 367 boolean_t 368 aconf_have_smf_auths(void) 369 { 370 char auth[NSS_BUFLEN_AUTHATTR]; 371 struct passwd *pw; 372 373 if ((pw = getpwuid(getuid())) == NULL) 374 return (B_FALSE); 375 376 if (aconf_get_string("general", "action_authorization", auth, 377 sizeof (auth)) == -1 || chkauthattr(auth, pw->pw_name) == 0) 378 return (B_FALSE); 379 380 if (aconf_get_string("general", "value_authorization", auth, 381 sizeof (auth)) == -1 || chkauthattr(auth, pw->pw_name) == 0) 382 return (B_FALSE); 383 384 if (aconf_get_string("config", "value_authorization", auth, 385 sizeof (auth)) == -1 || chkauthattr(auth, pw->pw_name) == 0) 386 return (B_FALSE); 387 388 return (B_TRUE); 389 } 390 391 const char * 392 aconf_type2fmri(int type) 393 { 394 switch (type) { 395 case AC_PROC: 396 return (FMRI_PROC_ACCT); 397 case AC_TASK: 398 return (FMRI_TASK_ACCT); 399 case AC_FLOW: 400 return (FMRI_FLOW_ACCT); 401 case AC_NET: 402 return (FMRI_NET_ACCT); 403 default: 404 die(gettext("invalid type %d\n"), type); 405 } 406 /* NOTREACHED */ 407 return (NULL); 408 } 409 410 static int 411 aconf_fmri2type(const char *fmri) 412 { 413 if (strcmp(fmri, FMRI_PROC_ACCT) == 0) 414 return (AC_PROC); 415 else if (strcmp(fmri, FMRI_TASK_ACCT) == 0) 416 return (AC_TASK); 417 else if (strcmp(fmri, FMRI_FLOW_ACCT) == 0) 418 return (AC_FLOW); 419 else if (strcmp(fmri, FMRI_NET_ACCT) == 0) 420 return (AC_NET); 421 else 422 return (-1); 423 } 424 425 int 426 aconf_scf_init(const char *fmri) 427 { 428 if ((handle = scf_handle_create(SCF_VERSION)) == NULL || 429 scf_handle_bind(handle) == -1 || 430 (inst = scf_instance_create(handle)) == NULL || 431 scf_handle_decode_fmri(handle, fmri, NULL, NULL, inst, NULL, NULL, 432 SCF_DECODE_FMRI_EXACT) == -1) { 433 aconf_scf_fini(); 434 return (-1); 435 } 436 return (0); 437 } 438 439 void 440 aconf_scf_fini(void) 441 { 442 scf_instance_destroy(inst); 443 (void) scf_handle_unbind(handle); 444 scf_handle_destroy(handle); 445 } 446 447 static int 448 aconf_get_string(const char *pgname, const char *propname, char *buf, 449 size_t len) 450 { 451 scf_propertygroup_t *pg; 452 scf_property_t *prop; 453 scf_value_t *value; 454 int ret = 0; 455 456 if ((pg = scf_pg_create(handle)) == NULL) 457 return (-1); 458 459 if (scf_instance_get_pg_composed(inst, NULL, pgname, pg) == -1) { 460 scf_pg_destroy(pg); 461 return (-1); 462 } 463 464 if ((prop = scf_property_create(handle)) == NULL || 465 (value = scf_value_create(handle)) == NULL || 466 scf_pg_get_property(pg, propname, prop) == -1 || 467 scf_property_get_value(prop, value) == -1 || 468 scf_value_get_astring(value, buf, len) == -1) 469 ret = -1; 470 471 scf_value_destroy(value); 472 scf_property_destroy(prop); 473 scf_pg_destroy(pg); 474 return (ret); 475 } 476 477 static int 478 aconf_get_bool(const char *pgname, const char *propname, uint8_t *rval) 479 { 480 scf_propertygroup_t *pg; 481 scf_property_t *prop; 482 scf_value_t *value; 483 int ret = 0; 484 485 if ((pg = scf_pg_create(handle)) == NULL) 486 return (-1); 487 488 if (scf_instance_get_pg_composed(inst, NULL, pgname, pg) == -1) { 489 scf_pg_destroy(pg); 490 return (-1); 491 } 492 493 if ((prop = scf_property_create(handle)) == NULL || 494 (value = scf_value_create(handle)) == NULL || 495 scf_pg_get_property(pg, propname, prop) == -1 || 496 scf_property_get_value(prop, value) == -1 || 497 scf_value_get_boolean(value, rval) == -1) 498 ret = -1; 499 500 scf_value_destroy(value); 501 scf_property_destroy(prop); 502 scf_pg_destroy(pg); 503 return (ret); 504 } 505 506 int 507 aconf_set_string(const char *propname, const char *value) 508 { 509 props_t *p; 510 511 if ((p = aconf_prop(propname, SCF_TYPE_ASTRING)) == NULL) 512 return (-1); 513 514 if (scf_value_set_astring(p->value, value) == -1) 515 return (-1); 516 return (0); 517 } 518 519 int 520 aconf_set_bool(const char *propname, boolean_t value) 521 { 522 props_t *p; 523 524 if ((p = aconf_prop(propname, SCF_TYPE_BOOLEAN)) == NULL) 525 return (-1); 526 527 scf_value_set_boolean(p->value, value); 528 return (0); 529 } 530 531 static props_t * 532 aconf_prop(const char *propname, int proptype) 533 { 534 props_t *p; 535 536 if ((p = malloc(sizeof (props_t))) != NULL) { 537 if ((p->propname = strdup(propname)) == NULL) { 538 free(p); 539 return (NULL); 540 } 541 if ((p->entry = scf_entry_create(handle)) == NULL) { 542 free(p->propname); 543 free(p); 544 return (NULL); 545 } 546 if ((p->value = scf_value_create(handle)) == NULL) { 547 scf_entry_destroy(p->entry); 548 free(p->propname); 549 free(p); 550 return (NULL); 551 } 552 p->proptype = proptype; 553 p->next = props; 554 props = p; 555 } 556 return (p); 557 } 558