xref: /illumos-gate/usr/src/uts/common/syscall/sidsys.c (revision f48205be61a214698b763ff550ab9e657525104c)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*
 * SID system call.
 */

#include <sys/sid.h>
#include <sys/cred.h>
#include <sys/errno.h>
#include <sys/systm.h>
#include <sys/policy.h>
#include <sys/door.h>

static kmutex_t idmap_mutex;

typedef struct idmap_reg {
	door_handle_t 	idmap_door;
	int		idmap_flags;
	int		idmap_ref;
} idmap_reg_t;

static idmap_reg_t *idmap_ptr;

static int idmap_unreg_dh(door_handle_t);

static void
idmap_freeone(idmap_reg_t *p)
{
	ASSERT(p->idmap_ref == 0);
	ASSERT(MUTEX_HELD(&idmap_mutex));

	door_ki_rele(p->idmap_door);
	if (idmap_ptr == p)
		idmap_ptr = NULL;

	kmem_free(p, sizeof (*p));
}

static int
idmap_do_call(sidmap_call_t *callp, size_t callsz, void **resp, size_t *respsz)
{
	door_arg_t da;
	idmap_reg_t *p;
	int ret;
	int dres;

	mutex_enter(&idmap_mutex);
	p = idmap_ptr;
	if (p != NULL) {
		p->idmap_ref++;
	} else {
		mutex_exit(&idmap_mutex);
		return (-1);
	}
	mutex_exit(&idmap_mutex);

	da.data_ptr = (char *)callp;
	da.data_size = callsz;
	da.desc_ptr = NULL;
	da.desc_num = 0;
	da.rbuf = *resp;
	da.rsize = *respsz;

	while ((dres = door_ki_upcall(p->idmap_door, &da)) != 0) {
		switch (dres) {
		case EINTR:
		case EAGAIN:
			delay(1);
			continue;
		case EINVAL:
		case EBADF:
			(void) idmap_unreg_dh(p->idmap_door);
			/* FALLTHROUGH */
		default:
			ret = -1;
			goto out;
		}
	}
	*resp = da.rbuf;
	*respsz = da.rsize;
	ret = 0;
out:
	mutex_enter(&idmap_mutex);
	if (--p->idmap_ref == 0)
		idmap_freeone(p);
	mutex_exit(&idmap_mutex);
	return (ret);
}

/*
 * Current code only attempts to map ids to sids.
 */
int
idmap_call_byid(uid_t id, ksid_t *ksid)
{
	sidmap_call_t call;
	domsid_t res, *resp = &res;
	size_t respsz = sizeof (res);

	call.sc_type = SIDSYS_ID2SID;
	call.sc_val.sc_id = id;

	if (idmap_do_call(&call, sizeof (call), (void **)&resp, &respsz) != 0)
		return (-1);

	ksid->ks_domain = ksid_lookupdomain(resp->ds_dom);
	ksid->ks_rid = resp->ds_rid;

	/* Larger SID return value; this usually happens */
	if (resp != &res)
		kmem_free(resp, respsz);

	return (0);
}

uid_t
idmap_call_bysid(ksid_t *ksid)
{
	ksiddomain_t *domp = ksid->ks_domain;
	sidmap_call_t *callp;
	uid_t res = (uid_t)-1;
	uid_t *resp = &res;
	size_t callsz;
	size_t respsz = sizeof (res);

	callsz = sizeof (sidmap_call_t) + domp->kd_len;

	callp = kmem_alloc(callsz, KM_SLEEP);
	callp->sc_type = SIDSYS_SID2ID;
	bcopy(domp->kd_name, callp->sc_val.sc_sid.ds_dom, domp->kd_len);
	callp->sc_val.sc_sid.ds_rid = ksid->ks_rid;

	if (idmap_do_call(callp, callsz, (void **)&resp, &respsz) != 0)
		goto out;

	/* Should never happen; the original buffer should be large enough */
	if (resp != &res) {
		kmem_free(resp, respsz);
		goto out;
	}

	if (respsz != sizeof (uid_t))
		res = (uid_t)-1;

out:
	kmem_free(callp, callsz);
	return (res);
}

static int
idmap_reg(int did)
{
	door_handle_t dh;
	idmap_reg_t *idmp;
	int err;

	if ((err = secpolicy_idmap(CRED())) != 0)
		return (set_errno(err));

	dh = door_ki_lookup(did);

	if (dh == NULL)
		return (set_errno(EBADF));

	idmp = kmem_alloc(sizeof (*idmp), KM_SLEEP);

	idmp->idmap_door = dh;
	mutex_enter(&idmap_mutex);
	if (idmap_ptr != NULL) {
		if (--idmap_ptr->idmap_ref == 0)
			idmap_freeone(idmap_ptr);
	}
	idmp->idmap_flags = 0;
	idmp->idmap_ref = 1;
	idmap_ptr = idmp;
	mutex_exit(&idmap_mutex);
	return (0);
}

static int
idmap_unreg_dh(door_handle_t dh)
{
	mutex_enter(&idmap_mutex);
	if (idmap_ptr == NULL || idmap_ptr->idmap_door != dh) {
		mutex_exit(&idmap_mutex);
		return (EINVAL);
	}

	if (idmap_ptr->idmap_flags != 0) {
		mutex_exit(&idmap_mutex);
		return (EAGAIN);
	}
	idmap_ptr->idmap_flags = 1;
	if (--idmap_ptr->idmap_ref == 0)
		idmap_freeone(idmap_ptr);
	mutex_exit(&idmap_mutex);
	return (0);
}

static int
idmap_unreg(int did)
{
	door_handle_t dh = door_ki_lookup(did);
	int res;

	if (dh == NULL)
		return (set_errno(EINVAL));

	res = idmap_unreg_dh(dh);
	door_ki_rele(dh);

	if (res != 0)
		return (set_errno(res));
	return (0);
}

static boolean_t
its_my_door(void)
{
	mutex_enter(&idmap_mutex);
	if (idmap_ptr != NULL) {
		struct door_info info;
		int err = door_ki_info(idmap_ptr->idmap_door, &info);
		if (err == 0 && info.di_target == curproc->p_pid) {
			mutex_exit(&idmap_mutex);
			return (B_TRUE);
		}
	}
	mutex_exit(&idmap_mutex);
	return (B_FALSE);
}

static uint64_t
allocids(int flag, int nuids, int ngids)
{
	rval_t r;
	uid_t su = 0;
	gid_t sg = 0;
	int err;

	if (!its_my_door())
		return (set_errno(EPERM));

	if (nuids < 0 || ngids < 0)
		return (set_errno(EINVAL));

	if (flag != 0 || nuids > 0)
		err = eph_uid_alloc(flag, &su, nuids);
	if (err == 0 && (flag != 0 || ngids > 0))
		err = eph_gid_alloc(flag, &sg, ngids);

	if (err != 0)
		return (set_errno(EOVERFLOW));

	r.r_val1 = su;
	r.r_val2 = sg;
	return (r.r_vals);
}

uint64_t
sidsys(int op, int flag, int nuids, int ngids)
{
	switch (op) {
	case SIDSYS_ALLOC_IDS:
		return (allocids(flag, nuids, ngids));
	case SIDSYS_IDMAP_REG:
		return (idmap_reg(flag));
	case SIDSYS_IDMAP_UNREG:
		return (idmap_unreg(flag));
	default:
		return (set_errno(EINVAL));
	}
}