xref: /titanic_44/usr/src/cmd/tsol/labeld/svc-labeld (revision ddf7fe95b8ad67aa16deb427a0b78f4dd4ff22b1)
1#!/sbin/sh
2#
3# CDDL HEADER START
4#
5# The contents of this file are subject to the terms of the
6# Common Development and Distribution License (the "License").
7# You may not use this file except in compliance with the License.
8#
9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10# or http://www.opensolaris.org/os/licensing.
11# See the License for the specific language governing permissions
12# and limitations under the License.
13#
14# When distributing Covered Code, include this CDDL HEADER in each
15# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16# If applicable, add the following below this CDDL HEADER, with the
17# fields enclosed by brackets "[]" replaced with your own identifying
18# information: Portions Copyright [yyyy] [name of copyright owner]
19#
20# CDDL HEADER END
21#
22# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23# Use is subject to license terms.
24#
25#ident	"%Z%%M%	%I%	%E% SMI"
26
27. /lib/svc/share/smf_include.sh
28
29ROOT_PATH=""
30if [ $# -gt 1 ]; then
31	if [ $# -ne 3 -o "$2" != "-R" ]; then
32		echo "$0: invalid syntax"
33		exit $SMF_EXIT_ERR_CONFIG
34	fi
35	if [ "$3" != "/" ]; then
36		ROOT_PATH=$3
37	fi
38fi
39if [ -n "$ROOT_PATH" -a "$1" != "start" ]; then
40	echo "$0: invalid syntax: -R allowed for start method only"
41	exit $SMF_EXIT_ERR_CONFIG
42fi
43if [ -n "$ROOT_PATH" -a ! -d "$ROOT_PATH" ]; then
44	echo "$0: invalid -R rootpath dir specified"
45	exit $SMF_EXIT_ERR_CONFIG
46fi
47
48if smf_is_nonglobalzone; then
49	echo "$0: not supported in a local zone"
50	exit $SMF_EXIT_ERR_CONFIG
51fi
52
53rewrite_logindev()
54{
55	from="$1"
56	to="$2"
57	# Comment out audio, usb, removable-media, and hotpluggable device
58	# entries in /etc/logindevperm.
59	LOGINDEVPERM=$ROOT_PATH/etc/logindevperm
60	if [ ! -f $LOGINDEVPERM ]; then
61		return
62	fi
63	for line in \
64		"/dev/console	0600	/dev/sound/" \
65		"/dev/console	0400	/dev/removable-media/" \
66		"/dev/console	0400	/dev/hotpluggable/" \
67		"/dev/console	0600	/dev/usb/\[0-9a-f\]" \
68			; do
69		sed -e "s!^$from$line!$to$line!" $LOGINDEVPERM > /tmp/tmp.$$
70		cp /tmp/tmp.$$ $LOGINDEVPERM
71	done
72	rm -f /tmp/tmp.$$
73}
74
75do_logindev()
76{
77	rewrite_logindev "" "#"
78}
79
80do_otherservices()
81{
82	# Setup dependent services
83	cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__ENABLE_OTHERS
84		/usr/sbin/svcadm enable -s svc:/network/tnd:default
85		/usr/sbin/svcadm enable -s svc:/system/tsol-zones:default
86		/usr/sbin/svccfg -s svc:/application/x11/x11-server \
87		    setprop options/tcp_listen = true
88		/usr/sbin/svcadm enable svc:/network/rpc/rstat:default
89__ENABLE_OTHERS
90
91}
92
93do_bsmconv()
94{
95	# Run bsmconv so audit and device allocation is enabled by
96	# default with Trusted Extensions.
97	if [ "$ROOT_PATH" = "/" -o "$ROOT_PATH" = "" ]; then
98		BSMDIR=""
99	else
100		BSMDIR=$ROOT_PATH
101	fi
102	echo "Running bsmconv ..."
103	echo `TEXTDOMAIN="SUNW_OST_OSCMD" gettext "y"` | \
104	    $ROOT_PATH/etc/security/bsmconv $ROOT_PATH
105}
106
107do_nscd()
108{
109# For Trusted Extensions, make nscd service transient in local zones.
110cat >> $ROOT_PATH/var/svc/profile/upgrade <<\_DEL_LOCAL_NSCD
111	if [ `/sbin/zonename` != "global" ]; then
112		nscd="svc:/system/name-service-cache"
113		duration=""
114		if /bin/svcprop -q -c -p startd/duration $nscd ; then
115			duration=`/bin/svcprop -c -p startd/duration $nscd`
116		fi
117		if [ "$duration" != "transient" ]; then
118			/usr/sbin/svccfg -s $nscd addpg startd framework
119			/usr/sbin/svccfg -s $nscd setprop \
120			    startd/duration = astring: transient
121			/usr/sbin/svccfg -s $nscd setprop stop/exec = :true
122			/usr/sbin/svcadm refresh $nscd
123		fi
124	fi
125_DEL_LOCAL_NSCD
126}
127
128do_bootupd()
129{
130	if [ -f $ROOT_PATH/platform/`/sbin/uname -m`/boot_archive ]; then
131		if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
132			/sbin/bootadm update-archive
133		else
134			/sbin/bootadm update-archive -R $ROOT_PATH
135		fi
136	fi
137}
138
139setup_tx_changes(){
140#
141# No comments or blanks lines allowed in entries below
142#
143cat > ${TX_ENTRIES} << EOF
144dtlogin		account		requisite	pam_roles.so.1
145dtlogin		account		required	pam_unix_account.so.1
146dtsession	account		requisite	pam_roles.so.1
147dtsession	account		required	pam_unix_account.so.1
148gdm		account		requisite	pam_roles.so.1
149gdm		account		required	pam_unix_account.so.1
150xscreensaver	account		requisite	pam_roles.so.1
151xscreensaver	account		required	pam_unix_account.so.1
152passwd		account		requisite	pam_roles.so.1
153passwd		account		required	pam_unix_account.so.1
154dtpasswd	account		requisite	pam_roles.so.1
155dtpasswd	account		required	pam_unix_account.so.1
156tsoljds-tstripe	account		requisite	pam_roles.so.1
157tsoljds-tstripe	account		required	pam_unix_account.so.1
158other		account		required	pam_tsol_account.so.1
159EOF
160}
161
162do_addpam()
163{
164	PAM_TMP=/tmp/pam_conf.$$
165	TX_ENTRIES=$PAM_TMP/sct.$$
166	PAM_DEST=$ROOT_PATH/etc/pam.conf
167
168	mkdir $PAM_TMP  || exit $SMF_EXIT_ERR_FATAL
169	setup_tx_changes
170
171	# verify that pam.conf file exists...
172	if [ ! -f ${PAM_DEST} ]; then
173		echo "$0: ${PAM_DEST} not found; aborting"
174		exit $SMF_EXIT_ERR_FATAL
175	fi
176
177	#
178	# Update pam.conf to append Trusted Extensions entries if not
179	# already present.
180	#
181	rm -f /tmp/pamconf.$$
182	while read e1 e2 e3 e4 e5
183	do
184		# If this is the 'other' entry, add it unless it already
185		# exists.
186		if [ $e1 = "other" ]; then
187			grep \
188"^[# 	]*$e1[ 	][ 	]*$e2[ 	][ 	]*$e3[ 	][ 	]*$e4" \
189			    $PAM_DEST >/dev/null 2>&1
190			if [ $? = 1 ] ; then
191				# Doesn't exist, enter into pam.conf
192				echo "$e1\t$e2 $e3\t\t$e4 $e5" \
193				    >> /tmp/pamconf.$$
194			fi
195		else
196			# Add other entries unless they already have a
197			# stack of their own.
198			grep "^[# 	]*$e1[ 	][ 	]*$e2[ 	]" \
199			    $PAM_DEST >/dev/null 2>&1
200			if [ $? = 1 ] ; then
201				echo "$e1\t$e2 $e3\t\t$e4 $e5" \
202				    >> /tmp/pamconf.$$
203			fi
204		fi
205	done < ${TX_ENTRIES}
206	# Append TX lines if any were not present already.
207	if [ -f /tmp/pamconf.$$ ] ; then
208		echo "# Entries for Trusted Extensions" >> $PAM_DEST
209		cat /tmp/pamconf.$$ >> $PAM_DEST
210		echo "$0: updating $PAM_DEST entries for Trusted Extensions;"
211		echo "$0: please examine/update any new entries"
212    		rm -f /tmp/pamconf.$$
213    	fi
214
215	rm -rf $PAM_TMP
216}
217
218do_pamremove()
219{
220	PAM_TMP=/tmp/pam_conf.$$
221	TX_ENTRIES=$PAM_TMP/sct.$$
222	PAM_DEST=$ROOT_PATH/etc/pam.conf
223	TMPFILE=$PAM_TMP/pam.conf
224
225	mkdir $PAM_TMP  || exit $SMF_EXIT_ERR_FATAL
226
227	# verify that pam.conf file exists...
228	if [ ! -f ${PAM_DEST} ]; then
229		echo "$0: ${PAM_DEST} not found; aborting"
230		exit $SMF_EXIT_ERR_FATAL
231	fi
232
233
234	grep '^[a-z].*pam_tsol_account' $PAM_DEST > /dev/null 2>&1
235	if [ $? -ne 0 ]; then
236		echo "$0: pam_tsol_account module not present,"
237		echo "$0: No changes were made to $PAM_DEST."
238		return
239	fi
240
241	grep -v pam_tsol_account $PAM_DEST > $TMPFILE
242	echo "$0: $PAM_DEST "tsol" entries removed"
243	cp $TMPFILE $PAM_DEST
244
245	rm -rf $PAM_TMP
246}
247
248do_commonstart()
249{
250	echo "$0: Updating $ROOT_PATH/etc/system..."
251	if [ ! -f ${ROOT_PATH}/etc/system ]; then
252		touch ${ROOT_PATH}/etc/system
253	fi
254
255	# Set sys_labeling in etc/system
256	grep -v "sys_labeling=" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
257	echo "set sys_labeling=1" >> /tmp/etc.system.$$
258	mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
259	grep "set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
260	if [ $? -ne 0 ]; then
261    		echo "$0: ERROR: cannot set sys_labeling in $ROOT_PATH/etc/system"
262		exit $SMF_EXIT_ERR_FATAL
263	fi
264
265	# Setup dependent services
266	do_otherservices
267
268	do_logindev
269	do_bsmconv
270	do_nscd
271	do_addpam
272
273	do_bootupd
274}
275
276
277daemon_start()
278{
279	# If a labeld door exists, check for a labeld process and exit
280	# if the daemon is already running.
281	if [ -r /var/tsol/doors/labeld ]; then
282		if /usr/bin/pgrep -x -u 0 -P 1 labeld >/dev/null 2>&1; then
283			echo "$0: labeld is already running"
284			exit $SMF_EXIT_ERR_FATAL
285		fi
286	fi
287	/usr/bin/rm -f /var/tsol/doors/labeld
288	/usr/lib/labeld
289}
290
291PATH=/usr/sbin:/usr/bin; export PATH
292
293case "$1" in
294'start')
295	if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
296		# native
297
298		if [ -z "$SMF_FMRI" ]; then
299			echo "$0: this script can only be invoked by smf(5)"
300			exit $SMF_EXIT_ERR_NOSMF
301		fi
302
303		tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
304		if [ "$tx_enabled" = "false" ]; then
305			# A sign of trying temporary enablement...no-no
306			echo "$0: Temporarily enabling Trusted Extensions is not allowed."
307			exit $SMF_EXIT_ERR_CONFIG
308		fi
309
310		if (smf_is_system_labeled); then
311			daemon_start
312			exit $SMF_EXIT_OK
313		fi
314
315		# Make changes to enable Trusted Extensions
316		grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
317		if [ $? -eq 0 ]; then
318			echo "$0: already enabled. Exiting."
319			exit $SMF_EXIT_OK
320		fi
321
322		if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
323			echo "$0: Must remove zones before enabling Trusted Extensions."
324			exit $SMF_EXIT_ERR_CONFIG
325		fi
326
327		do_commonstart
328
329		# start daemon proccess so our service doesn't go into
330		# maintenance state
331		daemon_start
332
333		echo "$0: Started.  Must reboot and configure Trusted Extensions."
334	else
335		# Support jumpstart etc
336
337		# Make changes to enable Trusted Extensions
338		grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
339		if [ $? -eq 0 ]; then
340			echo "$0: already enabled. Exiting."
341			exit $SMF_EXIT_OK
342		fi
343
344		# Setup dependent services
345		cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__TRUSTED_ENABLE
346			/usr/sbin/svcadm enable -s svc:/system/labeld:default
347__TRUSTED_ENABLE
348
349		do_commonstart
350		echo "$0: Started.  Must configure Trusted Extensions before booting."
351	fi
352	;;
353
354'stop')
355	tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
356	if [ "$tx_enabled" = "true" ]; then
357		/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
358		exit $SMF_EXIT_OK
359	fi
360
361	if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
362		echo "$0: Must remove zones before disabling Trusted Extensions."
363		exit $SMF_EXIT_ERR_CONFIG
364	fi
365
366	# Stop Trusted services.
367	/usr/sbin/svcadm disable svc:/system/tsol-zones:default 2>/dev/null
368	/usr/sbin/svcadm disable svc:/network/tnd:default 2>/dev/null
369
370	# Uncomment audio, usb, removable-media, and hotpluggable device
371	# entries in /etc/logindevperm.
372	rewrite_logindev "#" ""
373
374	# Remove sys_labeling from /etc/system
375	grep -v "sys_labeling" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
376	mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
377	grep "sys_labeling" ${ROOT_PATH}/etc/system > /dev/null 2>&1
378	if [ $? -eq 0 ]; then
379    		echo "$0: ERROR: cannot remove sys_labeling in $ROOT_PATH/etc/system"
380		exit $SMF_EXIT_ERR_FATAL
381	fi
382
383	do_pamremove
384
385	do_bootupd
386
387	/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
388	echo "$0: Stopped.  Will take effect at next boot."
389	;;
390
391*)
392	echo "Usage: $0 { start | stop }"
393	exit 1
394	;;
395esac
396
397exit $SMF_EXIT_OK
398
399