1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 26 /* 27 * main() of idmapd(1M) 28 */ 29 30 #include "idmapd.h" 31 #include <atomic.h> 32 #include <signal.h> 33 #include <rpc/pmap_clnt.h> /* for pmap_unset */ 34 #include <string.h> /* strcmp */ 35 #include <unistd.h> /* setsid */ 36 #include <sys/types.h> 37 #include <memory.h> 38 #include <stropts.h> 39 #include <netconfig.h> 40 #include <sys/resource.h> /* rlimit */ 41 #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */ 42 #include <priv_utils.h> /* privileges */ 43 #include <locale.h> 44 #include <sys/systeminfo.h> 45 #include <errno.h> 46 #include <sys/wait.h> 47 #include <sys/time.h> 48 #include <zone.h> 49 #include <door.h> 50 #include <port.h> 51 #include <tsol/label.h> 52 #include <sys/resource.h> 53 #include <sys/sid.h> 54 #include <sys/idmap.h> 55 #include <pthread.h> 56 #include <stdarg.h> 57 #include <assert.h> 58 #include <note.h> 59 60 static void term_handler(int); 61 static void init_idmapd(); 62 static void fini_idmapd(); 63 64 idmapd_state_t _idmapdstate; 65 66 SVCXPRT *xprt = NULL; 67 68 static int dfd = -1; /* our door server fildes, for unregistration */ 69 static boolean_t degraded = B_FALSE; 70 71 72 static uint32_t num_threads = 0; 73 static pthread_key_t create_threads_key; 74 static uint32_t max_threads = 40; 75 76 /* 77 * Server door thread start routine. 78 * 79 * Set a TSD value to the door thread. This enables the destructor to 80 * be called when this thread exits. 81 */ 82 /*ARGSUSED*/ 83 static void * 84 idmapd_door_thread_start(void *arg) 85 { 86 static void *value = 0; 87 88 /* 89 * Disable cancellation to avoid memory leaks from not running 90 * the thread cleanup code. 91 */ 92 (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL); 93 (void) pthread_setspecific(create_threads_key, value); 94 (void) door_return(NULL, 0, NULL, 0); 95 96 /* make lint happy */ 97 return (NULL); 98 } 99 100 /* 101 * Server door threads creation 102 */ 103 /*ARGSUSED*/ 104 static void 105 idmapd_door_thread_create(door_info_t *dip) 106 { 107 int num; 108 pthread_t thread_id; 109 110 if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) { 111 atomic_dec_32(&num_threads); 112 idmapdlog(LOG_DEBUG, 113 "thread creation refused - %d threads currently active", 114 num - 1); 115 return; 116 } 117 (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL); 118 idmapdlog(LOG_DEBUG, 119 "created thread ID %d - %d threads currently active", 120 thread_id, num); 121 } 122 123 /* 124 * Server door thread cleanup 125 */ 126 /*ARGSUSED*/ 127 static void 128 idmapd_door_thread_cleanup(void *arg) 129 { 130 int num; 131 132 num = atomic_dec_32_nv(&num_threads); 133 idmapdlog(LOG_DEBUG, 134 "exiting thread ID %d - %d threads currently active", 135 pthread_self(), num); 136 } 137 138 /* 139 * This is needed for mech_krb5 -- we run as daemon, yes, but we want 140 * mech_krb5 to think we're root so it can get host/nodename.fqdn 141 * tickets for us so we can authenticate to AD as the machine account 142 * that we are. For more details look at the entry point in mech_krb5 143 * corresponding to gss_init_sec_context(). 144 * 145 * As a side effect of faking our effective UID to mech_krb5 we will use 146 * root's default ccache (/tmp/krb5cc_0). But if that's created by 147 * another process then we won't have access to it: we run as daemon and 148 * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache 149 * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main() 150 * to avoid this issue; see main(). 151 * 152 * Someday we'll have gss/mech_krb5 extensions for acquiring initiator 153 * creds with keytabs/raw keys, and someday we'll have extensions to 154 * libsasl to specify creds/name to use on the initiator side, and 155 * someday we'll have extensions to libldap to pass those through to 156 * libsasl. Until then this interposer will have to do. 157 * 158 * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid() 159 * is defined but not used. 160 */ 161 /*LINTLIBRARY*/ 162 uid_t 163 app_krb5_user_uid(void) 164 { 165 return (0); 166 } 167 168 /*ARGSUSED*/ 169 static void 170 term_handler(int sig) 171 { 172 idmapdlog(LOG_INFO, "Terminating."); 173 fini_idmapd(); 174 _exit(0); 175 } 176 177 /*ARGSUSED*/ 178 static void 179 usr1_handler(int sig) 180 { 181 NOTE(ARGUNUSED(sig)) 182 print_idmapdstate(); 183 } 184 185 static int pipe_fd = -1; 186 187 static void 188 daemonize_ready(void) 189 { 190 char data = '\0'; 191 /* 192 * wake the parent 193 */ 194 (void) write(pipe_fd, &data, 1); 195 (void) close(pipe_fd); 196 } 197 198 static int 199 daemonize_start(void) 200 { 201 char data; 202 int status; 203 int devnull; 204 int filedes[2]; 205 pid_t pid; 206 207 (void) sigset(SIGPIPE, SIG_IGN); 208 devnull = open("/dev/null", O_RDONLY); 209 if (devnull < 0) 210 return (-1); 211 (void) dup2(devnull, 0); 212 (void) dup2(2, 1); /* stderr only */ 213 if (pipe(filedes) < 0) 214 return (-1); 215 if ((pid = fork1()) < 0) 216 return (-1); 217 if (pid != 0) { 218 /* 219 * parent 220 */ 221 (void) close(filedes[1]); 222 if (read(filedes[0], &data, 1) == 1) { 223 /* presume success */ 224 _exit(0); 225 } 226 status = -1; 227 (void) wait4(pid, &status, 0, NULL); 228 if (WIFEXITED(status)) 229 _exit(WEXITSTATUS(status)); 230 else 231 _exit(-1); 232 } 233 234 /* 235 * child 236 */ 237 pipe_fd = filedes[1]; 238 (void) close(filedes[0]); 239 (void) setsid(); 240 (void) umask(0077); 241 openlog("idmap", LOG_PID, LOG_DAEMON); 242 243 return (0); 244 } 245 246 247 int 248 main(int argc, char **argv) 249 { 250 int c; 251 struct rlimit rl; 252 253 _idmapdstate.daemon_mode = TRUE; 254 while ((c = getopt(argc, argv, "d")) != -1) { 255 switch (c) { 256 case 'd': 257 _idmapdstate.daemon_mode = FALSE; 258 break; 259 default: 260 (void) fprintf(stderr, 261 "Usage: /usr/lib/idmapd [-d]\n"); 262 return (SMF_EXIT_ERR_CONFIG); 263 } 264 } 265 266 /* set locale and domain for internationalization */ 267 (void) setlocale(LC_ALL, ""); 268 (void) textdomain(TEXT_DOMAIN); 269 270 idmap_set_logger(idmapdlog); 271 adutils_set_logger(idmapdlog); 272 273 if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) { 274 idmapdlog(LOG_ERR, 275 "with Trusted Extensions idmapd runs only in the " 276 "global zone"); 277 exit(1); 278 } 279 280 /* 281 * Raise the fd limit to max 282 */ 283 if (getrlimit(RLIMIT_NOFILE, &rl) != 0) { 284 idmapdlog(LOG_ERR, "getrlimit failed"); 285 } else if (rl.rlim_cur < rl.rlim_max) { 286 rl.rlim_cur = rl.rlim_max; 287 if (setrlimit(RLIMIT_NOFILE, &rl) != 0) 288 idmapdlog(LOG_ERR, 289 "Unable to raise RLIMIT_NOFILE to %d", 290 rl.rlim_cur); 291 } 292 293 (void) mutex_init(&_svcstate_lock, USYNC_THREAD, NULL); 294 295 if (_idmapdstate.daemon_mode == TRUE) { 296 if (daemonize_start() < 0) { 297 idmapdlog(LOG_ERR, "unable to daemonize"); 298 exit(-1); 299 } 300 } else 301 (void) umask(0077); 302 303 idmap_init_tsd_key(); 304 305 init_idmapd(); 306 307 /* signal handlers that should run only after we're initialized */ 308 (void) sigset(SIGTERM, term_handler); 309 (void) sigset(SIGUSR1, usr1_handler); 310 (void) sigset(SIGHUP, idmap_cfg_hup_handler); 311 312 if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET, 313 DAEMON_UID, DAEMON_GID, 314 PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ, 315 (char *)NULL) == -1) { 316 idmapdlog(LOG_ERR, "unable to drop privileges"); 317 exit(1); 318 } 319 320 __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION, 321 PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL); 322 323 if (_idmapdstate.daemon_mode == TRUE) 324 daemonize_ready(); 325 326 /* With doors RPC this just wastes this thread, oh well */ 327 svc_run(); 328 return (0); 329 } 330 331 static void 332 init_idmapd() 333 { 334 int error; 335 int connmaxrec = IDMAP_MAX_DOOR_RPC; 336 337 338 /* create directories as root and chown to daemon uid */ 339 if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0) 340 exit(1); 341 if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0) 342 exit(1); 343 344 /* 345 * Set KRB5CCNAME in the environment. See app_krb5_user_uid() 346 * for more details. We blow away the existing one, if there is 347 * one. 348 */ 349 (void) unlink(IDMAP_CACHEDIR "/ccache"); 350 (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache"); 351 352 if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname, 353 sizeof (_idmapdstate.hostname)) == -1) { 354 error = errno; 355 idmapdlog(LOG_ERR, "unable to determine hostname, error: %d", 356 error); 357 exit(1); 358 } 359 360 if ((error = init_mapping_system()) < 0) { 361 idmapdlog(LOG_ERR, "unable to initialize mapping system"); 362 exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1); 363 } 364 365 (void) door_server_create(idmapd_door_thread_create); 366 if ((error = pthread_key_create(&create_threads_key, 367 idmapd_door_thread_cleanup)) != 0) { 368 idmapdlog(LOG_ERR, "unable to create threads key (%s)", 369 strerror(error)); 370 goto errout; 371 } 372 373 xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec); 374 if (xprt == NULL) { 375 idmapdlog(LOG_ERR, "unable to create door RPC service"); 376 goto errout; 377 } 378 379 if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) { 380 idmapdlog(LOG_ERR, "unable to limit RPC request size"); 381 goto errout; 382 } 383 384 dfd = xprt->xp_fd; 385 386 if (dfd == -1) { 387 idmapdlog(LOG_ERR, "unable to register door"); 388 goto errout; 389 } 390 if ((error = __idmap_reg(dfd)) != 0) { 391 idmapdlog(LOG_ERR, "unable to register door (%s)", 392 strerror(errno)); 393 goto errout; 394 } 395 396 if ((error = allocids(_idmapdstate.new_eph_db, 397 8192, &_idmapdstate.next_uid, 398 8192, &_idmapdstate.next_gid)) != 0) { 399 idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)", 400 strerror(errno)); 401 _idmapdstate.next_uid = IDMAP_SENTINEL_PID; 402 _idmapdstate.limit_uid = IDMAP_SENTINEL_PID; 403 _idmapdstate.next_gid = IDMAP_SENTINEL_PID; 404 _idmapdstate.limit_gid = IDMAP_SENTINEL_PID; 405 } else { 406 _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192; 407 _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192; 408 } 409 410 if (DBG(CONFIG, 1)) 411 print_idmapdstate(); 412 413 return; 414 415 errout: 416 fini_idmapd(); 417 exit(1); 418 } 419 420 static void 421 fini_idmapd() 422 { 423 (void) __idmap_unreg(dfd); 424 fini_mapping_system(); 425 if (xprt != NULL) 426 svc_destroy(xprt); 427 } 428 429 static 430 const char * 431 get_fmri(void) 432 { 433 static char *fmri = NULL; 434 static char buf[60]; 435 char *s; 436 437 membar_consumer(); 438 s = fmri; 439 if (s != NULL && *s == '\0') 440 return (NULL); 441 else if (s != NULL) 442 return (s); 443 444 if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf)) 445 buf[0] = '\0'; 446 else 447 (void) strlcpy(buf, s, sizeof (buf)); 448 449 membar_producer(); 450 fmri = buf; 451 452 return (get_fmri()); 453 } 454 455 /* 456 * Wrappers for smf_degrade/restore_instance() 457 * 458 * smf_restore_instance() is too heavy duty to be calling every time we 459 * have a successful AD name<->SID lookup. 460 */ 461 void 462 degrade_svc(int poke_discovery, const char *reason) 463 { 464 const char *fmri; 465 466 membar_consumer(); 467 if (degraded) 468 return; 469 470 idmapdlog(LOG_ERR, "Degraded operation (%s).", reason); 471 472 membar_producer(); 473 degraded = B_TRUE; 474 475 if ((fmri = get_fmri()) != NULL) 476 (void) smf_degrade_instance(fmri, 0); 477 478 /* 479 * If the config update thread is in a state where auto-discovery could 480 * be re-tried, then this will make it try it -- a sort of auto-refresh. 481 */ 482 if (poke_discovery) 483 idmap_cfg_poke_updates(); 484 } 485 486 void 487 restore_svc(void) 488 { 489 const char *fmri; 490 491 membar_consumer(); 492 if (!degraded) 493 return; 494 495 if ((fmri = get_fmri()) == NULL) 496 (void) smf_restore_instance(fmri); 497 498 membar_producer(); 499 degraded = B_FALSE; 500 501 idmapdlog(LOG_NOTICE, "Normal operation restored"); 502 } 503 504 505 /* printflike */ 506 void 507 idmapdlog(int pri, const char *format, ...) { 508 va_list args; 509 510 va_start(args, format); 511 (void) vfprintf(stderr, format, args); 512 (void) fprintf(stderr, "\n"); 513 va_end(args); 514 515 /* 516 * We don't want to fill up the logs with useless messages when 517 * we're degraded, but we still want to log. 518 */ 519 if (degraded) 520 pri = LOG_DEBUG; 521 522 va_start(args, format); 523 vsyslog(pri, format, args); 524 va_end(args); 525 } 526 527 static void 528 trace_str(nvlist_t *entry, char *n1, char *n2, char *str) 529 { 530 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 531 532 (void) strlcpy(name, n1, sizeof (name)); 533 if (n2 != NULL) 534 (void) strlcat(name, n2, sizeof (name)); 535 536 (void) nvlist_add_string(entry, name, str); 537 } 538 539 static void 540 trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i) 541 { 542 char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 543 544 (void) strlcpy(name, n1, sizeof (name)); 545 if (n2 != NULL) 546 (void) strlcat(name, n2, sizeof (name)); 547 548 (void) nvlist_add_int64(entry, name, i); 549 } 550 551 static void 552 trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid) 553 { 554 char *str; 555 556 (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid); 557 if (str == NULL) 558 return; 559 560 trace_str(entry, n1, n2, str); 561 free(str); 562 } 563 564 static void 565 trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain) 566 { 567 trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype); 568 if (IS_ID_SID(*id)) { 569 if (name != NULL) { 570 char *str; 571 572 (void) asprintf(&str, "%s%s%s", name, 573 domain == NULL ? "" : "@", 574 domain == NULL ? "" : domain); 575 if (str != NULL) { 576 trace_str(entry, fromto, IDMAP_TRACE_NAME, str); 577 free(str); 578 } 579 } 580 if (id->idmap_id_u.sid.prefix != NULL) { 581 trace_sid(entry, fromto, IDMAP_TRACE_SID, 582 &id->idmap_id_u.sid); 583 } 584 } else if (IS_ID_POSIX(*id)) { 585 if (name != NULL) 586 trace_str(entry, fromto, IDMAP_TRACE_NAME, name); 587 if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) { 588 trace_int(entry, fromto, IDMAP_TRACE_UNIXID, 589 (int64_t)id->idmap_id_u.uid); 590 } 591 } 592 } 593 594 /* 595 * Record a trace event. TRACE() has already decided whether or not 596 * tracing is required; what we do here is collect the data and send it 597 * to its destination - to the trace log in the response, if 598 * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping 599 * is greater than zero. 600 */ 601 int 602 trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...) 603 { 604 va_list va; 605 char *buf; 606 int err; 607 nvlist_t *entry; 608 609 assert(req != NULL); 610 assert(res != NULL); 611 612 err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0); 613 if (err != 0) { 614 (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n", 615 strerror(err)); 616 return (0); 617 } 618 619 trace_id(entry, "from", &req->id1, req->id1name, req->id1domain); 620 trace_id(entry, "to", &res->id, req->id2name, req->id2domain); 621 622 if (IDMAP_ERROR(res->retcode)) { 623 trace_int(entry, IDMAP_TRACE_ERROR, NULL, 624 (int64_t)res->retcode); 625 } 626 627 va_start(va, fmt); 628 (void) vasprintf(&buf, fmt, va); 629 va_end(va); 630 if (buf != NULL) { 631 trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf); 632 free(buf); 633 } 634 635 if (DBG(MAPPING, 1)) 636 idmap_trace_print_1(stderr, "", entry); 637 638 if (req->flag & IDMAP_REQ_FLG_TRACE) { 639 /* Lazily allocate the trace list */ 640 if (res->info.trace == NULL) { 641 err = nvlist_alloc(&res->info.trace, 0, 0); 642 if (err != 0) { 643 res->info.trace = NULL; /* just in case */ 644 (void) fprintf(stderr, 645 "trace nvlist_alloc(trace): %s\n", 646 strerror(err)); 647 nvlist_free(entry); 648 return (0); 649 } 650 } 651 (void) nvlist_add_nvlist(res->info.trace, "", entry); 652 /* Note that entry is copied, so we must still free our copy */ 653 } 654 655 nvlist_free(entry); 656 657 return (0); 658 } 659