1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved. 24 */ 25 26 27 /* 28 * main() of idmapd(8) 29 */ 30 31 #include "idmapd.h" 32 #include <atomic.h> 33 #include <signal.h> 34 #include <rpc/pmap_clnt.h> /* for pmap_unset */ 35 #include <string.h> /* strcmp */ 36 #include <unistd.h> /* setsid */ 37 #include <sys/types.h> 38 #include <memory.h> 39 #include <stropts.h> 40 #include <netconfig.h> 41 #include <sys/resource.h> /* rlimit */ 42 #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */ 43 #include <priv_utils.h> /* privileges */ 44 #include <locale.h> 45 #include <sys/systeminfo.h> 46 #include <errno.h> 47 #include <sys/wait.h> 48 #include <sys/time.h> 49 #include <zone.h> 50 #include <door.h> 51 #include <port.h> 52 #include <tsol/label.h> 53 #include <sys/resource.h> 54 #include <sys/sid.h> 55 #include <sys/idmap.h> 56 #include <pthread.h> 57 #include <stdarg.h> 58 #include <assert.h> 59 #include <note.h> 60 61 #define CBUFSIZ 26 /* ctime(3c) */ 62 63 static void term_handler(int); 64 static void init_idmapd(); 65 static void fini_idmapd(); 66 67 /* The DC Locator lives inside idmap (for now). */ 68 extern void init_dc_locator(void); 69 extern void fini_dc_locator(void); 70 71 idmapd_state_t _idmapdstate; 72 mutex_t _svcstate_lock = ERRORCHECKMUTEX; 73 74 SVCXPRT *xprt = NULL; 75 76 static int dfd = -1; /* our door server fildes, for unregistration */ 77 static boolean_t degraded = B_FALSE; 78 79 80 static uint32_t num_threads = 0; 81 static pthread_key_t create_threads_key; 82 static uint32_t max_threads = 40; 83 84 /* 85 * Server door thread start routine. 86 * 87 * Set a TSD value to the door thread. This enables the destructor to 88 * be called when this thread exits. Note that we need a non-NULL 89 * value for this or the TSD destructor is not called. 90 */ 91 /*ARGSUSED*/ 92 static void * 93 idmapd_door_thread_start(void *arg) 94 { 95 static void *value = "NON-NULL TSD"; 96 97 /* 98 * Disable cancellation to avoid memory leaks from not running 99 * the thread cleanup code. 100 */ 101 (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL); 102 (void) pthread_setspecific(create_threads_key, value); 103 (void) door_return(NULL, 0, NULL, 0); 104 105 /* make lint happy */ 106 return (NULL); 107 } 108 109 /* 110 * Server door threads creation 111 */ 112 /*ARGSUSED*/ 113 static void 114 idmapd_door_thread_create(door_info_t *dip) 115 { 116 int num; 117 pthread_t thread_id; 118 119 if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) { 120 atomic_dec_32(&num_threads); 121 idmapdlog(LOG_DEBUG, 122 "thread creation refused - %d threads currently active", 123 num - 1); 124 return; 125 } 126 (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL); 127 idmapdlog(LOG_DEBUG, 128 "created thread ID %d - %d threads currently active", 129 thread_id, num); 130 } 131 132 /* 133 * Server door thread cleanup 134 */ 135 /*ARGSUSED*/ 136 static void 137 idmapd_door_thread_cleanup(void *arg) 138 { 139 int num; 140 141 /* set TSD to NULL so we don't loop infinitely */ 142 (void) pthread_setspecific(create_threads_key, NULL); 143 num = atomic_dec_32_nv(&num_threads); 144 idmapdlog(LOG_DEBUG, 145 "exiting thread ID %d - %d threads currently active", 146 pthread_self(), num); 147 } 148 149 /* 150 * This is needed for mech_krb5 -- we run as daemon, yes, but we want 151 * mech_krb5 to think we're root so it can get host/nodename.fqdn 152 * tickets for us so we can authenticate to AD as the machine account 153 * that we are. For more details look at the entry point in mech_krb5 154 * corresponding to gss_init_sec_context(). 155 * 156 * As a side effect of faking our effective UID to mech_krb5 we will use 157 * root's default ccache (/tmp/krb5cc_0). But if that's created by 158 * another process then we won't have access to it: we run as daemon and 159 * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache 160 * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main() 161 * to avoid this issue; see main(). 162 * 163 * Someday we'll have gss/mech_krb5 extensions for acquiring initiator 164 * creds with keytabs/raw keys, and someday we'll have extensions to 165 * libsasl to specify creds/name to use on the initiator side, and 166 * someday we'll have extensions to libldap to pass those through to 167 * libsasl. Until then this interposer will have to do. 168 * 169 * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid() 170 * is defined but not used. 171 */ 172 /*LINTLIBRARY*/ 173 uid_t 174 app_krb5_user_uid(void) 175 { 176 return (0); 177 } 178 179 /*ARGSUSED*/ 180 static void 181 term_handler(int sig) 182 { 183 idmapdlog(LOG_INFO, "Terminating."); 184 fini_dc_locator(); 185 fini_idmapd(); 186 _exit(0); 187 } 188 189 /*ARGSUSED*/ 190 static void 191 usr1_handler(int sig) 192 { 193 NOTE(ARGUNUSED(sig)) 194 print_idmapdstate(); 195 } 196 197 static int pipe_fd = -1; 198 199 static void 200 daemonize_ready(void) 201 { 202 char data = '\0'; 203 /* 204 * wake the parent 205 */ 206 (void) write(pipe_fd, &data, 1); 207 (void) close(pipe_fd); 208 } 209 210 static int 211 daemonize_start(void) 212 { 213 char data; 214 int status; 215 int devnull; 216 int filedes[2]; 217 pid_t pid; 218 219 (void) sigset(SIGPIPE, SIG_IGN); 220 devnull = open("/dev/null", O_RDONLY); 221 if (devnull < 0) 222 return (-1); 223 (void) dup2(devnull, 0); 224 (void) dup2(2, 1); /* stderr only */ 225 if (pipe(filedes) < 0) 226 return (-1); 227 if ((pid = fork1()) < 0) 228 return (-1); 229 if (pid != 0) { 230 /* 231 * parent 232 */ 233 (void) close(filedes[1]); 234 if (read(filedes[0], &data, 1) == 1) { 235 /* presume success */ 236 _exit(0); 237 } 238 status = -1; 239 (void) wait4(pid, &status, 0, NULL); 240 if (WIFEXITED(status)) 241 _exit(WEXITSTATUS(status)); 242 else 243 _exit(-1); 244 } 245 246 /* 247 * child 248 */ 249 pipe_fd = filedes[1]; 250 (void) close(filedes[0]); 251 (void) setsid(); 252 (void) umask(0077); 253 openlog("idmap", LOG_PID, LOG_DAEMON); 254 255 return (0); 256 } 257 258 259 int 260 main(int argc, char **argv) 261 { 262 int c; 263 struct rlimit rl; 264 265 if (rwlock_init(&_idmapdstate.rwlk_cfg, USYNC_THREAD, NULL) != 0) 266 return (-1); 267 if (mutex_init(&_idmapdstate.addisc_lk, USYNC_THREAD, NULL) != 0) 268 return (-1); 269 if (cond_init(&_idmapdstate.addisc_cv, USYNC_THREAD, NULL) != 0) 270 return (-1); 271 272 _idmapdstate.daemon_mode = TRUE; 273 while ((c = getopt(argc, argv, "d")) != -1) { 274 switch (c) { 275 case 'd': 276 _idmapdstate.daemon_mode = FALSE; 277 break; 278 default: 279 (void) fprintf(stderr, 280 "Usage: /usr/lib/idmapd [-d]\n"); 281 return (SMF_EXIT_ERR_CONFIG); 282 } 283 } 284 285 /* set locale and domain for internationalization */ 286 (void) setlocale(LC_ALL, ""); 287 (void) textdomain(TEXT_DOMAIN); 288 289 idmap_set_logger(idmapdlog); 290 adutils_set_logger(idmapdlog); 291 292 if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) { 293 idmapdlog(LOG_ERR, 294 "with Trusted Extensions idmapd runs only in the " 295 "global zone"); 296 exit(1); 297 } 298 299 /* 300 * Raise the fd limit to max 301 */ 302 if (getrlimit(RLIMIT_NOFILE, &rl) != 0) { 303 idmapdlog(LOG_ERR, "getrlimit failed"); 304 } else if (rl.rlim_cur < rl.rlim_max) { 305 rl.rlim_cur = rl.rlim_max; 306 if (setrlimit(RLIMIT_NOFILE, &rl) != 0) 307 idmapdlog(LOG_ERR, 308 "Unable to raise RLIMIT_NOFILE to %d", 309 rl.rlim_cur); 310 } 311 312 if (_idmapdstate.daemon_mode == TRUE) { 313 if (daemonize_start() < 0) { 314 idmapdlog(LOG_ERR, "unable to daemonize"); 315 exit(-1); 316 } 317 } else 318 (void) umask(0077); 319 320 idmap_init_tsd_key(); 321 322 init_idmapd(); 323 init_dc_locator(); 324 325 /* signal handlers that should run only after we're initialized */ 326 (void) sigset(SIGTERM, term_handler); 327 (void) sigset(SIGUSR1, usr1_handler); 328 (void) sigset(SIGHUP, idmap_cfg_hup_handler); 329 330 if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET, 331 DAEMON_UID, DAEMON_GID, 332 PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ, 333 (char *)NULL) == -1) { 334 idmapdlog(LOG_ERR, "unable to drop privileges"); 335 exit(1); 336 } 337 338 __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION, 339 PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL); 340 341 if (_idmapdstate.daemon_mode == TRUE) 342 daemonize_ready(); 343 344 /* With doors RPC this just wastes this thread, oh well */ 345 svc_run(); 346 return (0); 347 } 348 349 static void 350 init_idmapd() 351 { 352 int error; 353 int connmaxrec = IDMAP_MAX_DOOR_RPC; 354 355 356 /* create directories as root and chown to daemon uid */ 357 if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0) 358 exit(1); 359 if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0) 360 exit(1); 361 362 /* 363 * Set KRB5CCNAME in the environment. See app_krb5_user_uid() 364 * for more details. We blow away the existing one, if there is 365 * one. 366 */ 367 (void) unlink(IDMAP_CACHEDIR "/ccache"); 368 (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache"); 369 (void) putenv("MS_INTEROP=1"); 370 371 if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname, 372 sizeof (_idmapdstate.hostname)) == -1) { 373 error = errno; 374 idmapdlog(LOG_ERR, "unable to determine hostname, error: %d", 375 error); 376 exit(1); 377 } 378 379 if ((error = init_mapping_system()) < 0) { 380 idmapdlog(LOG_ERR, "unable to initialize mapping system"); 381 exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1); 382 } 383 384 /* 385 * This means max_threads can't be updated without restarting idmap. 386 */ 387 RDLOCK_CONFIG(); 388 max_threads = _idmapdstate.cfg->pgcfg.max_threads; 389 UNLOCK_CONFIG(); 390 391 (void) door_server_create(idmapd_door_thread_create); 392 if ((error = pthread_key_create(&create_threads_key, 393 idmapd_door_thread_cleanup)) != 0) { 394 idmapdlog(LOG_ERR, "unable to create threads key (%s)", 395 strerror(error)); 396 goto errout; 397 } 398 399 xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec); 400 if (xprt == NULL) { 401 idmapdlog(LOG_ERR, "unable to create door RPC service"); 402 goto errout; 403 } 404 405 if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) { 406 idmapdlog(LOG_ERR, "unable to limit RPC request size"); 407 goto errout; 408 } 409 410 dfd = xprt->xp_fd; 411 412 if (dfd == -1) { 413 idmapdlog(LOG_ERR, "unable to register door"); 414 goto errout; 415 } 416 if ((error = __idmap_reg(dfd)) != 0) { 417 idmapdlog(LOG_ERR, "unable to register door (%s)", 418 strerror(errno)); 419 goto errout; 420 } 421 422 if ((error = allocids(_idmapdstate.new_eph_db, 423 8192, &_idmapdstate.next_uid, 424 8192, &_idmapdstate.next_gid)) != 0) { 425 idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)", 426 strerror(errno)); 427 _idmapdstate.next_uid = IDMAP_SENTINEL_PID; 428 _idmapdstate.limit_uid = IDMAP_SENTINEL_PID; 429 _idmapdstate.next_gid = IDMAP_SENTINEL_PID; 430 _idmapdstate.limit_gid = IDMAP_SENTINEL_PID; 431 } else { 432 _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192; 433 _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192; 434 } 435 436 if (DBG(CONFIG, 1)) 437 print_idmapdstate(); 438 439 return; 440 441 errout: 442 fini_idmapd(); 443 exit(1); 444 } 445 446 static void 447 fini_idmapd() 448 { 449 (void) __idmap_unreg(dfd); 450 fini_mapping_system(); 451 if (xprt != NULL) 452 svc_destroy(xprt); 453 } 454 455 static 456 const char * 457 get_fmri(void) 458 { 459 static char *fmri = NULL; 460 static char buf[60]; 461 char *s; 462 463 membar_consumer(); 464 s = fmri; 465 if (s != NULL && *s == '\0') 466 return (NULL); 467 else if (s != NULL) 468 return (s); 469 470 if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf)) 471 buf[0] = '\0'; 472 else 473 (void) strlcpy(buf, s, sizeof (buf)); 474 475 membar_producer(); 476 fmri = buf; 477 478 return (get_fmri()); 479 } 480 481 /* 482 * Wrappers for smf_degrade/restore_instance() 483 * 484 * smf_restore_instance() is too heavy duty to be calling every time we 485 * have a successful AD name<->SID lookup. 486 */ 487 void 488 degrade_svc(int poke_discovery, const char *reason) 489 { 490 const char *fmri; 491 492 membar_consumer(); 493 if (degraded) 494 return; 495 496 idmapdlog(LOG_ERR, "Degraded operation (%s).", reason); 497 498 membar_producer(); 499 degraded = B_TRUE; 500 501 if ((fmri = get_fmri()) != NULL) 502 (void) smf_degrade_instance(fmri, 0); 503 504 /* 505 * If the config update thread is in a state where auto-discovery could 506 * be re-tried, then this will make it try it -- a sort of auto-refresh. 507 */ 508 if (poke_discovery) 509 idmap_cfg_poke_updates(); 510 } 511 512 void 513 restore_svc(void) 514 { 515 const char *fmri; 516 517 membar_consumer(); 518 if (!degraded) 519 return; 520 521 if ((fmri = get_fmri()) == NULL) 522 (void) smf_restore_instance(fmri); 523 524 membar_producer(); 525 degraded = B_FALSE; 526 527 idmapdlog(LOG_NOTICE, "Normal operation restored"); 528 } 529 530 531 /* printflike */ 532 void 533 idmapdlog(int pri, const char *format, ...) 534 { 535 static time_t prev_ts; 536 va_list args; 537 char cbuf[CBUFSIZ]; 538 time_t ts; 539 540 ts = time(NULL); 541 if (prev_ts != ts) { 542 prev_ts = ts; 543 /* NB: cbuf has \n */ 544 (void) fprintf(stderr, "@ %s", 545 ctime_r(&ts, cbuf, sizeof (cbuf))); 546 } 547 548 va_start(args, format); 549 (void) vfprintf(stderr, format, args); 550 (void) fprintf(stderr, "\n"); 551 va_end(args); 552 553 /* 554 * We don't want to fill up the logs with useless messages when 555 * we're degraded, but we still want to log. 556 */ 557 if (degraded) 558 pri = LOG_DEBUG; 559 560 va_start(args, format); 561 vsyslog(pri, format, args); 562 va_end(args); 563 } 564 565 static void 566 trace_str(nvlist_t *entry, char *n1, char *n2, char *str) 567 { 568 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 569 570 (void) strlcpy(name, n1, sizeof (name)); 571 if (n2 != NULL) 572 (void) strlcat(name, n2, sizeof (name)); 573 574 (void) nvlist_add_string(entry, name, str); 575 } 576 577 static void 578 trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i) 579 { 580 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 581 582 (void) strlcpy(name, n1, sizeof (name)); 583 if (n2 != NULL) 584 (void) strlcat(name, n2, sizeof (name)); 585 586 (void) nvlist_add_int64(entry, name, i); 587 } 588 589 static void 590 trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid) 591 { 592 char *str; 593 594 (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid); 595 if (str == NULL) 596 return; 597 598 trace_str(entry, n1, n2, str); 599 free(str); 600 } 601 602 static void 603 trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain) 604 { 605 trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype); 606 if (IS_ID_SID(*id)) { 607 if (name != NULL) { 608 char *str; 609 610 (void) asprintf(&str, "%s%s%s", name, 611 domain == NULL ? "" : "@", 612 domain == NULL ? "" : domain); 613 if (str != NULL) { 614 trace_str(entry, fromto, IDMAP_TRACE_NAME, str); 615 free(str); 616 } 617 } 618 if (id->idmap_id_u.sid.prefix != NULL) { 619 trace_sid(entry, fromto, IDMAP_TRACE_SID, 620 &id->idmap_id_u.sid); 621 } 622 } else if (IS_ID_POSIX(*id)) { 623 if (name != NULL) 624 trace_str(entry, fromto, IDMAP_TRACE_NAME, name); 625 if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) { 626 trace_int(entry, fromto, IDMAP_TRACE_UNIXID, 627 (int64_t)id->idmap_id_u.uid); 628 } 629 } 630 } 631 632 /* 633 * Record a trace event. TRACE() has already decided whether or not 634 * tracing is required; what we do here is collect the data and send it 635 * to its destination - to the trace log in the response, if 636 * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping 637 * is greater than zero. 638 */ 639 int 640 trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...) 641 { 642 va_list va; 643 char *buf; 644 int err; 645 nvlist_t *entry; 646 647 assert(req != NULL); 648 assert(res != NULL); 649 650 err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0); 651 if (err != 0) { 652 (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n", 653 strerror(err)); 654 return (0); 655 } 656 657 trace_id(entry, "from", &req->id1, req->id1name, req->id1domain); 658 trace_id(entry, "to", &res->id, req->id2name, req->id2domain); 659 660 if (IDMAP_ERROR(res->retcode)) { 661 trace_int(entry, IDMAP_TRACE_ERROR, NULL, 662 (int64_t)res->retcode); 663 } 664 665 va_start(va, fmt); 666 (void) vasprintf(&buf, fmt, va); 667 va_end(va); 668 if (buf != NULL) { 669 trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf); 670 free(buf); 671 } 672 673 if (DBG(MAPPING, 1)) 674 idmap_trace_print_1(stderr, "", entry); 675 676 if (req->flag & IDMAP_REQ_FLG_TRACE) { 677 /* Lazily allocate the trace list */ 678 if (res->info.trace == NULL) { 679 err = nvlist_alloc(&res->info.trace, 0, 0); 680 if (err != 0) { 681 res->info.trace = NULL; /* just in case */ 682 (void) fprintf(stderr, 683 "trace nvlist_alloc(trace): %s\n", 684 strerror(err)); 685 nvlist_free(entry); 686 return (0); 687 } 688 } 689 (void) nvlist_add_nvlist(res->info.trace, "", entry); 690 /* Note that entry is copied, so we must still free our copy */ 691 } 692 693 nvlist_free(entry); 694 695 return (0); 696 } 697