1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate /* 30*0Sstevel@tonic-gate * Usermode daemon which assists the kernel when handling gssapi calls. 31*0Sstevel@tonic-gate * It is gssd that actually implements all gssapi calls. 32*0Sstevel@tonic-gate * Some calls, such as gss_sign, are implemented in the kernel on a per 33*0Sstevel@tonic-gate * mechanism basis. 34*0Sstevel@tonic-gate */ 35*0Sstevel@tonic-gate 36*0Sstevel@tonic-gate #include <stdio.h> 37*0Sstevel@tonic-gate #include <rpc/rpc.h> 38*0Sstevel@tonic-gate #include <rpc/rpc_com.h> 39*0Sstevel@tonic-gate #include <sys/syslog.h> 40*0Sstevel@tonic-gate #include <sys/termios.h> 41*0Sstevel@tonic-gate #include <unistd.h> 42*0Sstevel@tonic-gate #include <sys/utsname.h> 43*0Sstevel@tonic-gate #include <sys/systeminfo.h> 44*0Sstevel@tonic-gate #include <stdlib.h> 45*0Sstevel@tonic-gate #include <stropts.h> 46*0Sstevel@tonic-gate #include <fcntl.h> 47*0Sstevel@tonic-gate #include <strings.h> 48*0Sstevel@tonic-gate #include <signal.h> 49*0Sstevel@tonic-gate #include <syslog.h> 50*0Sstevel@tonic-gate #include "gssd.h" 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate int gssd_debug = 0; /* enable debugging printfs */ 53*0Sstevel@tonic-gate extern void gsscred_set_options(void); 54*0Sstevel@tonic-gate 55*0Sstevel@tonic-gate void gssprog_1(); 56*0Sstevel@tonic-gate void gssd_setup(char *); 57*0Sstevel@tonic-gate static void usage(void); 58*0Sstevel@tonic-gate static void daemonize_start(); 59*0Sstevel@tonic-gate static void daemonize_ready(unsigned char status); 60*0Sstevel@tonic-gate extern int svc_create_local_service(); 61*0Sstevel@tonic-gate 62*0Sstevel@tonic-gate /* following declarations needed in rpcgen-generated code */ 63*0Sstevel@tonic-gate int _rpcpmstart = 0; /* Started by a port monitor ? */ 64*0Sstevel@tonic-gate int _rpcfdtype; /* Whether Stream or Datagram ? */ 65*0Sstevel@tonic-gate int _rpcsvcdirty; /* Still serving ? */ 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate static void 69*0Sstevel@tonic-gate /* LINTED */ 70*0Sstevel@tonic-gate catch_hup(int sig_num) 71*0Sstevel@tonic-gate { 72*0Sstevel@tonic-gate sigset_t mask_set; /* used to set a signal masking set. */ 73*0Sstevel@tonic-gate sigset_t old_set; /* used to store the old mask set. */ 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate /* re-set the signal handler again to catch_hup, for next time */ 76*0Sstevel@tonic-gate (void) signal(SIGHUP, catch_hup); 77*0Sstevel@tonic-gate /* mask any further signals while we're inside the handler. */ 78*0Sstevel@tonic-gate (void) sigfillset(&mask_set); 79*0Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &mask_set, &old_set); 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate gsscred_set_options(); 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate /* let admin know the sighup was caught and conf file re-read */ 84*0Sstevel@tonic-gate syslog(LOG_INFO, 85*0Sstevel@tonic-gate "catch_hup: read gsscred.conf opts"); 86*0Sstevel@tonic-gate if (gssd_debug) 87*0Sstevel@tonic-gate (void) fprintf(stderr, 88*0Sstevel@tonic-gate "catch_hup: read gsscred.conf opts"); 89*0Sstevel@tonic-gate 90*0Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &old_set, NULL); 91*0Sstevel@tonic-gate } 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate int 95*0Sstevel@tonic-gate main(argc, argv) 96*0Sstevel@tonic-gate int argc; 97*0Sstevel@tonic-gate char **argv; 98*0Sstevel@tonic-gate { 99*0Sstevel@tonic-gate register SVCXPRT *transp; 100*0Sstevel@tonic-gate int maxrecsz = RPC_MAXDATASIZE; 101*0Sstevel@tonic-gate extern int optind; 102*0Sstevel@tonic-gate int c; 103*0Sstevel@tonic-gate char mname[FMNAMESZ + 1]; 104*0Sstevel@tonic-gate extern int _getuid(); 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate /* set locale and domain for internationalization */ 107*0Sstevel@tonic-gate setlocale(LC_ALL, ""); 108*0Sstevel@tonic-gate textdomain(TEXT_DOMAIN); 109*0Sstevel@tonic-gate 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate /* 112*0Sstevel@tonic-gate * take special note that "_getuid()" is called here. This is necessary 113*0Sstevel@tonic-gate * since we must fake out the mechanism libraries calls to getuid() 114*0Sstevel@tonic-gate * with a special routine that is provided as part of gssd. However, 115*0Sstevel@tonic-gate * the call below MUST call the real getuid() to ensure it is running 116*0Sstevel@tonic-gate * as root. 117*0Sstevel@tonic-gate */ 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate #ifdef DEBUG 120*0Sstevel@tonic-gate (void) setuid(0); /* DEBUG: set ruid to root */ 121*0Sstevel@tonic-gate #endif /* DEBUG */ 122*0Sstevel@tonic-gate if (_getuid()) { 123*0Sstevel@tonic-gate (void) fprintf(stderr, 124*0Sstevel@tonic-gate gettext("[%s] must be run as root\n"), argv[0]); 125*0Sstevel@tonic-gate #ifdef DEBUG 126*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" warning only\n")); 127*0Sstevel@tonic-gate #else /* DEBUG */ 128*0Sstevel@tonic-gate exit(1); 129*0Sstevel@tonic-gate #endif /* DEBUG */ 130*0Sstevel@tonic-gate } 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate gssd_setup(argv[0]); 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate while ((c = getopt(argc, argv, "d")) != -1) 135*0Sstevel@tonic-gate switch (c) { 136*0Sstevel@tonic-gate case 'd': 137*0Sstevel@tonic-gate /* turn on debugging */ 138*0Sstevel@tonic-gate gssd_debug = 1; 139*0Sstevel@tonic-gate break; 140*0Sstevel@tonic-gate default: 141*0Sstevel@tonic-gate usage(); 142*0Sstevel@tonic-gate } 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate if (optind != argc) { 145*0Sstevel@tonic-gate usage(); 146*0Sstevel@tonic-gate } 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate gsscred_set_options(); 149*0Sstevel@tonic-gate (void) signal(SIGHUP, catch_hup); 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate /* 152*0Sstevel@tonic-gate * Started by inetd if name of module just below stream 153*0Sstevel@tonic-gate * head is either a sockmod or timod. 154*0Sstevel@tonic-gate */ 155*0Sstevel@tonic-gate if (!ioctl(0, I_LOOK, mname) && 156*0Sstevel@tonic-gate ((strcmp(mname, "sockmod") == 0) || 157*0Sstevel@tonic-gate (strcmp(mname, "timod") == 0))) { 158*0Sstevel@tonic-gate 159*0Sstevel@tonic-gate char *netid; 160*0Sstevel@tonic-gate struct netconfig *nconf; 161*0Sstevel@tonic-gate 162*0Sstevel@tonic-gate openlog("gssd", LOG_PID, LOG_DAEMON); 163*0Sstevel@tonic-gate 164*0Sstevel@tonic-gate if ((netid = getenv("NLSPROVIDER")) == NULL) { 165*0Sstevel@tonic-gate netid = "ticotsord"; 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate if ((nconf = getnetconfigent(netid)) == NULL) { 169*0Sstevel@tonic-gate syslog(LOG_ERR, gettext("cannot get transport info")); 170*0Sstevel@tonic-gate exit(1); 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate if (strcmp(mname, "sockmod") == 0) { 174*0Sstevel@tonic-gate if (ioctl(0, I_POP, 0) || ioctl(0, I_PUSH, "timod")) { 175*0Sstevel@tonic-gate syslog(LOG_ERR, 176*0Sstevel@tonic-gate gettext("could not get the " 177*0Sstevel@tonic-gate "right module")); 178*0Sstevel@tonic-gate exit(1); 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate } 181*0Sstevel@tonic-gate if (!rpc_control(RPC_SVC_CONNMAXREC_SET, &maxrecsz)) { 182*0Sstevel@tonic-gate syslog(LOG_ERR, 183*0Sstevel@tonic-gate gettext("unable to set RPC max record size")); 184*0Sstevel@tonic-gate exit(1); 185*0Sstevel@tonic-gate } 186*0Sstevel@tonic-gate /* XXX - is nconf even needed here? */ 187*0Sstevel@tonic-gate if ((transp = svc_tli_create(0, nconf, NULL, 0, 0)) == NULL) { 188*0Sstevel@tonic-gate syslog(LOG_ERR, gettext("cannot create server handle")); 189*0Sstevel@tonic-gate exit(1); 190*0Sstevel@tonic-gate } 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate /* 193*0Sstevel@tonic-gate * We use a NULL nconf because GSSPROG has already been 194*0Sstevel@tonic-gate * registered with rpcbind. 195*0Sstevel@tonic-gate */ 196*0Sstevel@tonic-gate if (!svc_reg(transp, GSSPROG, GSSVERS, gssprog_1, NULL)) { 197*0Sstevel@tonic-gate syslog(LOG_ERR, 198*0Sstevel@tonic-gate gettext("unable to register " 199*0Sstevel@tonic-gate "(GSSPROG, GSSVERS)")); 200*0Sstevel@tonic-gate exit(1); 201*0Sstevel@tonic-gate } 202*0Sstevel@tonic-gate 203*0Sstevel@tonic-gate if (nconf) 204*0Sstevel@tonic-gate freenetconfigent(nconf); 205*0Sstevel@tonic-gate } else { 206*0Sstevel@tonic-gate if (!gssd_debug) 207*0Sstevel@tonic-gate daemonize_start(); 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate openlog("gssd", LOG_PID, LOG_DAEMON); 210*0Sstevel@tonic-gate 211*0Sstevel@tonic-gate if (svc_create_local_service(gssprog_1, GSSPROG, GSSVERS, 212*0Sstevel@tonic-gate "netpath", "gssd") == 0) { 213*0Sstevel@tonic-gate syslog(LOG_ERR, gettext("unable to create service")); 214*0Sstevel@tonic-gate exit(1); 215*0Sstevel@tonic-gate } 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate /* service created, now the daemon parent can exit */ 218*0Sstevel@tonic-gate daemonize_ready(0); 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate 222*0Sstevel@tonic-gate if (gssd_debug) { 223*0Sstevel@tonic-gate fprintf(stderr, 224*0Sstevel@tonic-gate gettext("gssd start: \n")); 225*0Sstevel@tonic-gate } 226*0Sstevel@tonic-gate svc_run(); 227*0Sstevel@tonic-gate abort(); 228*0Sstevel@tonic-gate /*NOTREACHED*/ 229*0Sstevel@tonic-gate #ifdef lint 230*0Sstevel@tonic-gate return (1); 231*0Sstevel@tonic-gate #endif 232*0Sstevel@tonic-gate } 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate static void 235*0Sstevel@tonic-gate usage(void) 236*0Sstevel@tonic-gate { 237*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("usage: gssd [-dg]\n")); 238*0Sstevel@tonic-gate exit(1); 239*0Sstevel@tonic-gate } 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate 242*0Sstevel@tonic-gate /* 243*0Sstevel@tonic-gate * Fork, detach from tty, etc... 244*0Sstevel@tonic-gate */ 245*0Sstevel@tonic-gate static int write_pipe_fd = -1; 246*0Sstevel@tonic-gate static 247*0Sstevel@tonic-gate void 248*0Sstevel@tonic-gate daemonize_start() 249*0Sstevel@tonic-gate { 250*0Sstevel@tonic-gate int pipe_fds[2]; 251*0Sstevel@tonic-gate unsigned char status = 1; 252*0Sstevel@tonic-gate 253*0Sstevel@tonic-gate closefrom(0); 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate /* Open stdin/out/err, chdir, get a pipe */ 256*0Sstevel@tonic-gate if (open("/dev/null", O_RDONLY) < 0 || 257*0Sstevel@tonic-gate open("/dev/null", O_WRONLY) < 0 || dup(1) < 0 || 258*0Sstevel@tonic-gate chdir("/") < 0 || pipe(pipe_fds) < 0) 259*0Sstevel@tonic-gate exit(1); 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate /* For daemonize_ready() */ 262*0Sstevel@tonic-gate write_pipe_fd = pipe_fds[1]; 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate switch (fork()) { 265*0Sstevel@tonic-gate case -1: 266*0Sstevel@tonic-gate exit(1); 267*0Sstevel@tonic-gate /* NOTREACHED */ 268*0Sstevel@tonic-gate case 0: 269*0Sstevel@tonic-gate break; 270*0Sstevel@tonic-gate default: 271*0Sstevel@tonic-gate /* Wait for child to be ready befor exiting */ 272*0Sstevel@tonic-gate (void) close(pipe_fds[1]); 273*0Sstevel@tonic-gate (void) signal(SIGPIPE, SIG_DFL); 274*0Sstevel@tonic-gate (void) read(pipe_fds[0], &status, sizeof (status)); 275*0Sstevel@tonic-gate exit(status); 276*0Sstevel@tonic-gate } 277*0Sstevel@tonic-gate 278*0Sstevel@tonic-gate (void) close(pipe_fds[0]); 279*0Sstevel@tonic-gate (void) setsid(); 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate static 283*0Sstevel@tonic-gate void 284*0Sstevel@tonic-gate daemonize_ready(unsigned char status) 285*0Sstevel@tonic-gate { 286*0Sstevel@tonic-gate if (write_pipe_fd == -1) 287*0Sstevel@tonic-gate return; 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate (void) write(write_pipe_fd, &status, sizeof (status)); 290*0Sstevel@tonic-gate (void) close(write_pipe_fd); 291*0Sstevel@tonic-gate write_pipe_fd = -1; 292*0Sstevel@tonic-gate } 293*0Sstevel@tonic-gate 294*0Sstevel@tonic-gate /*ARGSUSED*/ 295*0Sstevel@tonic-gate int 296*0Sstevel@tonic-gate gssprog_1_freeresult(SVCXPRT *transport, xdrproc_t xdr_res, caddr_t res) 297*0Sstevel@tonic-gate { 298*0Sstevel@tonic-gate xdr_free(xdr_res, res); 299*0Sstevel@tonic-gate return (1); 300*0Sstevel@tonic-gate } 301