1#!/sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22# Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23# Use is subject to license terms. 24# 25 26. /lib/svc/share/smf_include.sh 27 28ROOT_PATH="" 29if [ $# -gt 1 ]; then 30 if [ $# -ne 3 -o "$2" != "-R" ]; then 31 echo "$0: invalid syntax" 32 exit $SMF_EXIT_ERR_CONFIG 33 fi 34 if [ "$3" != "/" ]; then 35 ROOT_PATH=$3 36 fi 37fi 38if [ -n "$ROOT_PATH" -a "$1" != "start" ]; then 39 echo "$0: invalid syntax: -R allowed for start method only" 40 exit $SMF_EXIT_ERR_CONFIG 41fi 42if [ -n "$ROOT_PATH" -a ! -d "$ROOT_PATH" ]; then 43 echo "$0: invalid -R rootpath dir specified" 44 exit $SMF_EXIT_ERR_CONFIG 45fi 46 47if smf_is_nonglobalzone; then 48 echo "$0: not supported in a local zone" 49 exit $SMF_EXIT_ERR_CONFIG 50fi 51 52rewrite_logindev() 53{ 54 from="$1" 55 to="$2" 56 # Comment out audio, usb, removable-media, and hotpluggable device 57 # entries in /etc/logindevperm. 58 LOGINDEVPERM=$ROOT_PATH/etc/logindevperm 59 if [ ! -f $LOGINDEVPERM ]; then 60 return 61 fi 62 for line in \ 63 "/dev/sound/" \ 64 "/dev/removable-media/" \ 65 "/dev/hotpluggable/" \ 66 "/dev/usb/\[0-9a-f\]" \ 67 ; do 68 sed -e "s!^$from\([^# ]\{1,\}[ }\{1,\}[0-9]\{1,\}[ ]\{1,\}\)$line!$to\1$line!" \ 69 $LOGINDEVPERM > /tmp/tmp.$$ 70 cp /tmp/tmp.$$ $LOGINDEVPERM 71 done 72 rm -f /tmp/tmp.$$ 73} 74 75do_logindev() 76{ 77 rewrite_logindev "" "#" 78} 79 80do_otherservices() 81{ 82 # Setup dependent services 83 cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__ENABLE_OTHERS 84 /usr/sbin/svcadm enable -s svc:/network/tnd:default 85 /usr/sbin/svcadm enable -s svc:/system/tsol-zones:default 86 /usr/sbin/svcadm enable svc:/network/rpc/rstat:default 87__ENABLE_OTHERS 88 89} 90 91do_bsmconv() 92{ 93 # Run bsmconv so audit and device allocation is enabled by 94 # default with Trusted Extensions. 95 if [ "$ROOT_PATH" = "/" -o "$ROOT_PATH" = "" ]; then 96 BSMDIR="" 97 else 98 BSMDIR=$ROOT_PATH 99 fi 100 echo "Running bsmconv ..." 101 echo `TEXTDOMAIN="SUNW_OST_OSCMD" gettext "y"` | \ 102 $ROOT_PATH/etc/security/bsmconv $ROOT_PATH 103} 104 105do_nscd() 106{ 107# For Trusted Extensions, make nscd service transient in local zones. 108cat >> $ROOT_PATH/var/svc/profile/upgrade <<\_DEL_LOCAL_NSCD 109 if [ `/sbin/zonename` != "global" ]; then 110 nscd="svc:/system/name-service-cache" 111 duration="" 112 if /bin/svcprop -q -c -p startd/duration $nscd ; then 113 duration=`/bin/svcprop -c -p startd/duration $nscd` 114 fi 115 if [ "$duration" != "transient" ]; then 116 /usr/sbin/svccfg -s $nscd addpg startd framework 117 /usr/sbin/svccfg -s $nscd setprop \ 118 startd/duration = astring: transient 119 /usr/sbin/svccfg -s $nscd setprop stop/exec = :true 120 /usr/sbin/svcadm refresh $nscd 121 fi 122 fi 123_DEL_LOCAL_NSCD 124} 125 126do_bootupd() 127{ 128 if [ -f $ROOT_PATH/platform/`/sbin/uname -m`/boot_archive ]; then 129 if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then 130 /sbin/bootadm update-archive 131 else 132 /sbin/bootadm update-archive -R $ROOT_PATH 133 fi 134 fi 135} 136 137setup_tx_changes(){ 138# 139# No comments or blanks lines allowed in entries below 140# 141cat > ${TX_ENTRIES} << EOF 142dtlogin account requisite pam_roles.so.1 143dtlogin account required pam_unix_account.so.1 144dtsession account requisite pam_roles.so.1 145dtsession account required pam_unix_account.so.1 146gdm account requisite pam_roles.so.1 147gdm account required pam_unix_account.so.1 148xscreensaver account requisite pam_roles.so.1 149xscreensaver account required pam_unix_account.so.1 150passwd account requisite pam_roles.so.1 151passwd account required pam_unix_account.so.1 152dtpasswd account requisite pam_roles.so.1 153dtpasswd account required pam_unix_account.so.1 154tsoljds-tstripe account requisite pam_roles.so.1 155tsoljds-tstripe account required pam_unix_account.so.1 156other account required pam_tsol_account.so.1 157EOF 158} 159 160do_addpam() 161{ 162 PAM_TMP=/tmp/pam_conf.$$ 163 TX_ENTRIES=$PAM_TMP/sct.$$ 164 PAM_DEST=$ROOT_PATH/etc/pam.conf 165 166 mkdir $PAM_TMP || exit $SMF_EXIT_ERR_FATAL 167 setup_tx_changes 168 169 # verify that pam.conf file exists... 170 if [ ! -f ${PAM_DEST} ]; then 171 echo "$0: ${PAM_DEST} not found; aborting" 172 exit $SMF_EXIT_ERR_FATAL 173 fi 174 175 # 176 # Update pam.conf to append Trusted Extensions entries if not 177 # already present. 178 # 179 rm -f /tmp/pamconf.$$ 180 while read e1 e2 e3 e4 e5 181 do 182 # If this is the 'other' entry, add it unless it already 183 # exists. 184 if [ $e1 = "other" ]; then 185 grep \ 186"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \ 187 $PAM_DEST >/dev/null 2>&1 188 if [ $? = 1 ] ; then 189 # Doesn't exist, enter into pam.conf 190 echo "$e1\t$e2 $e3\t\t$e4 $e5" \ 191 >> /tmp/pamconf.$$ 192 fi 193 else 194 # Add other entries unless they already have a 195 # stack of their own. 196 grep "^[# ]*$e1[ ][ ]*$e2[ ]" \ 197 $PAM_DEST >/dev/null 2>&1 198 if [ $? = 1 ] ; then 199 echo "$e1\t$e2 $e3\t\t$e4 $e5" \ 200 >> /tmp/pamconf.$$ 201 fi 202 fi 203 done < ${TX_ENTRIES} 204 # Append TX lines if any were not present already. 205 if [ -f /tmp/pamconf.$$ ] ; then 206 echo "# Entries for Trusted Extensions" >> $PAM_DEST 207 cat /tmp/pamconf.$$ >> $PAM_DEST 208 echo "$0: updating $PAM_DEST entries for Trusted Extensions;" 209 echo "$0: please examine/update any new entries" 210 rm -f /tmp/pamconf.$$ 211 fi 212 213 rm -rf $PAM_TMP 214} 215 216do_pamremove() 217{ 218 PAM_TMP=/tmp/pam_conf.$$ 219 TX_ENTRIES=$PAM_TMP/sct.$$ 220 PAM_DEST=$ROOT_PATH/etc/pam.conf 221 TMPFILE=$PAM_TMP/pam.conf 222 223 mkdir $PAM_TMP || exit $SMF_EXIT_ERR_FATAL 224 225 # verify that pam.conf file exists... 226 if [ ! -f ${PAM_DEST} ]; then 227 echo "$0: ${PAM_DEST} not found; aborting" 228 exit $SMF_EXIT_ERR_FATAL 229 fi 230 231 232 grep '^[a-z].*pam_tsol_account' $PAM_DEST > /dev/null 2>&1 233 if [ $? -ne 0 ]; then 234 echo "$0: pam_tsol_account module not present," 235 echo "$0: No changes were made to $PAM_DEST." 236 return 237 fi 238 239 grep -v pam_tsol_account $PAM_DEST > $TMPFILE 240 echo "$0: $PAM_DEST "tsol" entries removed" 241 cp $TMPFILE $PAM_DEST 242 243 rm -rf $PAM_TMP 244} 245 246do_commonstart() 247{ 248 echo "$0: Updating $ROOT_PATH/etc/system..." 249 if [ ! -f ${ROOT_PATH}/etc/system ]; then 250 touch ${ROOT_PATH}/etc/system 251 fi 252 253 # Set sys_labeling in etc/system 254 grep -v "sys_labeling=" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$ 255 echo "set sys_labeling=1" >> /tmp/etc.system.$$ 256 mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system 257 grep "set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1 258 if [ $? -ne 0 ]; then 259 echo "$0: ERROR: cannot set sys_labeling in $ROOT_PATH/etc/system" 260 exit $SMF_EXIT_ERR_FATAL 261 fi 262 263 # Setup dependent services 264 do_otherservices 265 266 do_logindev 267 do_bsmconv 268 do_nscd 269 do_addpam 270 271 do_bootupd 272} 273 274do_servicetag_register() 275{ 276 ROOTDIR=$1 277 SOL_ARCH=`/sbin/uname -p` 278 SOL_VERS=`/sbin/uname -r` 279 TX_PROD_URN="urn:uuid:fc720df3-410f-11dc-9b8e-080020a9ed93" 280 281 if [ ! -x /usr/bin/stclient ]; then 282 return 283 fi 284 285 # if already registered then do nothing more here 286 inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null` 287 if [ -n "$inst" ]; then 288 # this instance id was saved in a SMF property 289 /usr/bin/stclient -g -i $inst -r $ROOTDIR >/dev/null 2>&1 290 if [ $? = 0 ]; then 291 # matching service tag found, so do nothing 292 return 293 else 294 # no match for instance id saved in SMF property 295 /usr/sbin/svccfg -s $SMF_FMRI delprop \ 296 labeld/svctag_inst 297 /usr/sbin/svcadm refresh $SMF_FMRI 298 fi 299 fi 300 301 302 # fall through: no service tag, or does not match saved instance id 303 304 # determine the urn of the parent (Solaris) 305 SOL_PROD_URN="" 306 case $SOL_VERS in 307 5.11) 308 SOL_PROD_URN="-F urn:uuid:6df19e63-7ef5-11db-a4bd-080020a9ed93" 309 ;; 310 5.10) 311 SOL_PROD_URN="-F urn:uuid:5005588c-36f3-11d6-9cec-fc96f718e113" 312 ;; 313 esac 314 315 # add the service tag 316 RC=`/usr/bin/stclient -a -p "Solaris Trusted Extensions" \ 317 -e $SOL_VERS -t $TX_PROD_URN -P Solaris $SOL_PROD_URN \ 318 -m Sun -A $SOL_ARCH -z global -S $0 -r $ROOTDIR` 319 if [ $? = 0 ]; then 320 # save instance id in SMF property 321 inst=`echo "$RC" | grep -i urn|awk -F= '{print $2}'` 322 /usr/sbin/svccfg -s $SMF_FMRI setprop \ 323 labeld/svctag_inst = astring: "$inst" 324 /usr/sbin/svcadm refresh $SMF_FMRI 325 fi 326} 327 328do_servicetag_delete() 329{ 330 if [ ! -x /usr/bin/stclient ]; then 331 return 332 fi 333 334 inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null` 335 336 if [ -n "$inst" ]; then 337 # delete service tag 338 /usr/bin/stclient -d -i $inst 339 # delete saved instance id 340 /usr/sbin/svccfg -s $SMF_FMRI delprop labeld/svctag_inst 341 /usr/sbin/svcadm refresh $SMF_FMRI 342 fi 343} 344 345 346daemon_start() 347{ 348 # If a labeld door exists, check for a labeld process and exit 349 # if the daemon is already running. 350 if [ -r /var/tsol/doors/labeld ]; then 351 if /usr/bin/pgrep -x -u 0 -P 1 labeld >/dev/null 2>&1; then 352 echo "$0: labeld is already running" 353 exit $SMF_EXIT_ERR_FATAL 354 fi 355 fi 356 /usr/bin/rm -f /var/tsol/doors/labeld 357 /usr/lib/labeld 358} 359 360PATH=/usr/sbin:/usr/bin; export PATH 361 362case "$1" in 363'start') 364 if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then 365 # native 366 367 if [ -z "$SMF_FMRI" ]; then 368 echo "$0: this script can only be invoked by smf(5)" 369 exit $SMF_EXIT_ERR_NOSMF 370 fi 371 372 tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI` 373 if [ "$tx_enabled" = "false" ]; then 374 # A sign of trying temporary enablement...no-no 375 echo "$0: Temporarily enabling Trusted Extensions is not allowed." 376 exit $SMF_EXIT_ERR_CONFIG 377 fi 378 379 if (smf_is_system_labeled); then 380 do_servicetag_register / 381 daemon_start 382 exit $SMF_EXIT_OK 383 fi 384 385 # Make changes to enable Trusted Extensions 386 grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1 387 if [ $? -eq 0 ]; then 388 echo "$0: already enabled. Exiting." 389 exit $SMF_EXIT_OK 390 fi 391 392 if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then 393 echo "$0: Must remove zones before enabling Trusted Extensions." 394 exit $SMF_EXIT_ERR_CONFIG 395 fi 396 397 do_commonstart 398 399 do_servicetag_register / 400 401 # start daemon proccess so our service doesn't go into 402 # maintenance state 403 daemon_start 404 405 echo "$0: Started. Must reboot and configure Trusted Extensions." 406 else 407 # Support jumpstart etc 408 409 # Make changes to enable Trusted Extensions 410 grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1 411 if [ $? -eq 0 ]; then 412 echo "$0: already enabled. Exiting." 413 exit $SMF_EXIT_OK 414 fi 415 416 # Setup dependent services 417 cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__TRUSTED_ENABLE 418 /usr/sbin/svcadm enable -s svc:/system/labeld:default 419__TRUSTED_ENABLE 420 421 do_commonstart 422 do_servicetag_register $ROOT_PATH 423 echo "$0: Started. Must configure Trusted Extensions before booting." 424 fi 425 ;; 426 427'stop') 428 tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI` 429 if [ "$tx_enabled" = "true" ]; then 430 /usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld 431 exit $SMF_EXIT_OK 432 fi 433 434 if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then 435 echo "$0: Must remove zones before disabling Trusted Extensions." 436 exit $SMF_EXIT_ERR_CONFIG 437 fi 438 439 # Stop Trusted services. 440 /usr/sbin/svcadm disable svc:/system/tsol-zones:default 2>/dev/null 441 /usr/sbin/svcadm disable svc:/network/tnd:default 2>/dev/null 442 443 # Uncomment audio, usb, removable-media, and hotpluggable device 444 # entries in /etc/logindevperm. 445 rewrite_logindev "#" "" 446 447 # Remove sys_labeling from /etc/system 448 grep -v "sys_labeling" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$ 449 mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system 450 grep "sys_labeling" ${ROOT_PATH}/etc/system > /dev/null 2>&1 451 if [ $? -eq 0 ]; then 452 echo "$0: ERROR: cannot remove sys_labeling in $ROOT_PATH/etc/system" 453 exit $SMF_EXIT_ERR_FATAL 454 fi 455 456 do_pamremove 457 do_servicetag_delete 458 459 do_bootupd 460 461 /usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld 462 echo "$0: Stopped. Will take effect at next boot." 463 ;; 464 465*) 466 echo "Usage: $0 { start | stop }" 467 exit 1 468 ;; 469esac 470 471exit $SMF_EXIT_OK 472 473 474