1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 1999-2002 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate #include "med_local.h"
30*0Sstevel@tonic-gate #include <sdssc.h>
31*0Sstevel@tonic-gate
32*0Sstevel@tonic-gate #include <grp.h>
33*0Sstevel@tonic-gate #include <pwd.h>
34*0Sstevel@tonic-gate #include <signal.h>
35*0Sstevel@tonic-gate #include <syslog.h>
36*0Sstevel@tonic-gate #include <netdir.h>
37*0Sstevel@tonic-gate #include <netdb.h>
38*0Sstevel@tonic-gate #include <sys/resource.h>
39*0Sstevel@tonic-gate #include <sys/priocntl.h>
40*0Sstevel@tonic-gate #include <sys/rtpriocntl.h>
41*0Sstevel@tonic-gate #include <sys/utsname.h>
42*0Sstevel@tonic-gate
43*0Sstevel@tonic-gate extern void nc_perror(const char *msg);
44*0Sstevel@tonic-gate
45*0Sstevel@tonic-gate /* daemon name */
46*0Sstevel@tonic-gate static char *medname = MED_SERVNAME;
47*0Sstevel@tonic-gate
48*0Sstevel@tonic-gate /*
49*0Sstevel@tonic-gate * reset and exit daemon
50*0Sstevel@tonic-gate */
51*0Sstevel@tonic-gate void
med_exit(int eval)52*0Sstevel@tonic-gate med_exit(
53*0Sstevel@tonic-gate int eval
54*0Sstevel@tonic-gate )
55*0Sstevel@tonic-gate {
56*0Sstevel@tonic-gate med_err_t status = med_null_err;
57*0Sstevel@tonic-gate
58*0Sstevel@tonic-gate if (med_db_finit(&status))
59*0Sstevel@tonic-gate medde_perror(&status, "med_db_finit");
60*0Sstevel@tonic-gate
61*0Sstevel@tonic-gate /* log exit */
62*0Sstevel@tonic-gate med_eprintf("exiting with %d\n", eval);
63*0Sstevel@tonic-gate
64*0Sstevel@tonic-gate /* exit with value */
65*0Sstevel@tonic-gate exit(eval);
66*0Sstevel@tonic-gate }
67*0Sstevel@tonic-gate
68*0Sstevel@tonic-gate /*
69*0Sstevel@tonic-gate * signal catchers
70*0Sstevel@tonic-gate */
71*0Sstevel@tonic-gate static void
med_catcher(int sig)72*0Sstevel@tonic-gate med_catcher(
73*0Sstevel@tonic-gate int sig
74*0Sstevel@tonic-gate )
75*0Sstevel@tonic-gate {
76*0Sstevel@tonic-gate char buf[128];
77*0Sstevel@tonic-gate char *msg;
78*0Sstevel@tonic-gate
79*0Sstevel@tonic-gate /* log signal */
80*0Sstevel@tonic-gate if ((msg = strsignal(sig)) == NULL) {
81*0Sstevel@tonic-gate (void) sprintf(buf, "unknown signal %d", sig);
82*0Sstevel@tonic-gate msg = buf;
83*0Sstevel@tonic-gate }
84*0Sstevel@tonic-gate med_eprintf("%s\n", msg);
85*0Sstevel@tonic-gate
86*0Sstevel@tonic-gate /* let default handler do it's thing */
87*0Sstevel@tonic-gate (void) sigset(sig, SIG_DFL);
88*0Sstevel@tonic-gate if (kill(getpid(), sig) != 0) {
89*0Sstevel@tonic-gate med_perror("kill(getpid())");
90*0Sstevel@tonic-gate med_exit(-sig);
91*0Sstevel@tonic-gate }
92*0Sstevel@tonic-gate }
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate /*
95*0Sstevel@tonic-gate * initialize daemon
96*0Sstevel@tonic-gate */
97*0Sstevel@tonic-gate static int
med_setup(med_err_t * medep)98*0Sstevel@tonic-gate med_setup(
99*0Sstevel@tonic-gate med_err_t *medep
100*0Sstevel@tonic-gate )
101*0Sstevel@tonic-gate {
102*0Sstevel@tonic-gate /* catch common signals */
103*0Sstevel@tonic-gate if ((sigset(SIGHUP, med_catcher) == SIG_ERR) ||
104*0Sstevel@tonic-gate (sigset(SIGINT, med_catcher) == SIG_ERR) ||
105*0Sstevel@tonic-gate (sigset(SIGABRT, med_catcher) == SIG_ERR) ||
106*0Sstevel@tonic-gate (sigset(SIGBUS, med_catcher) == SIG_ERR) ||
107*0Sstevel@tonic-gate (sigset(SIGSEGV, med_catcher) == SIG_ERR) ||
108*0Sstevel@tonic-gate (sigset(SIGPIPE, med_catcher) == SIG_ERR) ||
109*0Sstevel@tonic-gate (sigset(SIGTERM, med_catcher) == SIG_ERR)) {
110*0Sstevel@tonic-gate return (med_error(medep, errno, "sigset"));
111*0Sstevel@tonic-gate }
112*0Sstevel@tonic-gate
113*0Sstevel@tonic-gate /* ignore SIGALRM (used in med_cv_timedwait) */
114*0Sstevel@tonic-gate if (sigset(SIGALRM, SIG_IGN) == SIG_ERR) {
115*0Sstevel@tonic-gate return (med_error(medep, errno, "sigset"));
116*0Sstevel@tonic-gate }
117*0Sstevel@tonic-gate
118*0Sstevel@tonic-gate /* return success */
119*0Sstevel@tonic-gate return (0);
120*0Sstevel@tonic-gate }
121*0Sstevel@tonic-gate
122*0Sstevel@tonic-gate /*
123*0Sstevel@tonic-gate * (re)initalize daemon
124*0Sstevel@tonic-gate */
125*0Sstevel@tonic-gate static int
med_init_daemon(med_err_t * medep)126*0Sstevel@tonic-gate med_init_daemon(
127*0Sstevel@tonic-gate med_err_t *medep
128*0Sstevel@tonic-gate )
129*0Sstevel@tonic-gate {
130*0Sstevel@tonic-gate static int already = 0;
131*0Sstevel@tonic-gate
132*0Sstevel@tonic-gate /* setup */
133*0Sstevel@tonic-gate if (! already) {
134*0Sstevel@tonic-gate if (med_setup(medep) != 0)
135*0Sstevel@tonic-gate return (-1);
136*0Sstevel@tonic-gate openlog(medname, LOG_CONS, LOG_DAEMON);
137*0Sstevel@tonic-gate already = 1;
138*0Sstevel@tonic-gate }
139*0Sstevel@tonic-gate
140*0Sstevel@tonic-gate /* return success */
141*0Sstevel@tonic-gate return (0);
142*0Sstevel@tonic-gate }
143*0Sstevel@tonic-gate
144*0Sstevel@tonic-gate /*
145*0Sstevel@tonic-gate * get my nodename
146*0Sstevel@tonic-gate */
147*0Sstevel@tonic-gate char *
mynode(void)148*0Sstevel@tonic-gate mynode(void)
149*0Sstevel@tonic-gate {
150*0Sstevel@tonic-gate static struct utsname myuname;
151*0Sstevel@tonic-gate static int done = 0;
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate if (! done) {
154*0Sstevel@tonic-gate if (uname(&myuname) == -1) {
155*0Sstevel@tonic-gate med_perror("uname");
156*0Sstevel@tonic-gate assert(0);
157*0Sstevel@tonic-gate }
158*0Sstevel@tonic-gate done = 1;
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate return (myuname.nodename);
161*0Sstevel@tonic-gate }
162*0Sstevel@tonic-gate
163*0Sstevel@tonic-gate /*
164*0Sstevel@tonic-gate * check for trusted host and user
165*0Sstevel@tonic-gate */
166*0Sstevel@tonic-gate static int
check_host(struct svc_req * rqstp)167*0Sstevel@tonic-gate check_host(
168*0Sstevel@tonic-gate struct svc_req *rqstp /* RPC stuff */
169*0Sstevel@tonic-gate )
170*0Sstevel@tonic-gate {
171*0Sstevel@tonic-gate struct authsys_parms *sys_credp;
172*0Sstevel@tonic-gate SVCXPRT *transp = rqstp->rq_xprt;
173*0Sstevel@tonic-gate struct netconfig *nconfp = NULL;
174*0Sstevel@tonic-gate struct nd_hostservlist *hservlistp = NULL;
175*0Sstevel@tonic-gate int i;
176*0Sstevel@tonic-gate int rval = -1;
177*0Sstevel@tonic-gate char *inplace = NULL;
178*0Sstevel@tonic-gate
179*0Sstevel@tonic-gate /* check for root */
180*0Sstevel@tonic-gate /*LINTED*/
181*0Sstevel@tonic-gate sys_credp = (struct authsys_parms *)rqstp->rq_clntcred;
182*0Sstevel@tonic-gate assert(sys_credp != NULL);
183*0Sstevel@tonic-gate if (sys_credp->aup_uid != 0)
184*0Sstevel@tonic-gate goto out;
185*0Sstevel@tonic-gate
186*0Sstevel@tonic-gate /* get hostnames */
187*0Sstevel@tonic-gate if (transp->xp_netid == NULL) {
188*0Sstevel@tonic-gate med_eprintf("transp->xp_netid == NULL\n");
189*0Sstevel@tonic-gate goto out;
190*0Sstevel@tonic-gate }
191*0Sstevel@tonic-gate if ((nconfp = getnetconfigent(transp->xp_netid)) == NULL) {
192*0Sstevel@tonic-gate #ifdef DEBUG
193*0Sstevel@tonic-gate nc_perror("getnetconfigent(transp->xp_netid)");
194*0Sstevel@tonic-gate #endif
195*0Sstevel@tonic-gate goto out;
196*0Sstevel@tonic-gate }
197*0Sstevel@tonic-gate if ((__netdir_getbyaddr_nosrv(nconfp, &hservlistp, &transp->xp_rtaddr)
198*0Sstevel@tonic-gate != 0) || (hservlistp == NULL)) {
199*0Sstevel@tonic-gate #ifdef DEBUG
200*0Sstevel@tonic-gate netdir_perror("netdir_getbyaddr(transp->xp_rtaddr)");
201*0Sstevel@tonic-gate #endif
202*0Sstevel@tonic-gate goto out;
203*0Sstevel@tonic-gate }
204*0Sstevel@tonic-gate
205*0Sstevel@tonic-gate /* check hostnames */
206*0Sstevel@tonic-gate for (i = 0; (i < hservlistp->h_cnt); ++i) {
207*0Sstevel@tonic-gate struct nd_hostserv *hservp = &hservlistp->h_hostservs[i];
208*0Sstevel@tonic-gate char *hostname = hservp->h_host;
209*0Sstevel@tonic-gate
210*0Sstevel@tonic-gate inplace = strdup(hostname);
211*0Sstevel@tonic-gate sdssc_cm_nm2nid(inplace);
212*0Sstevel@tonic-gate if (strcmp(inplace, hostname)) {
213*0Sstevel@tonic-gate
214*0Sstevel@tonic-gate /*
215*0Sstevel@tonic-gate * If the names are now different it indicates
216*0Sstevel@tonic-gate * that hostname was converted to a nodeid. This
217*0Sstevel@tonic-gate * will only occur if hostname is part of the same
218*0Sstevel@tonic-gate * cluster that the current node is in.
219*0Sstevel@tonic-gate * If the machine is not running in a cluster than
220*0Sstevel@tonic-gate * sdssc_cm_nm2nid is a noop which leaves inplace
221*0Sstevel@tonic-gate * alone.
222*0Sstevel@tonic-gate */
223*0Sstevel@tonic-gate rval = 0;
224*0Sstevel@tonic-gate goto out;
225*0Sstevel@tonic-gate }
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate /* localhost is OK */
228*0Sstevel@tonic-gate if (strcmp(hostname, mynode()) == 0) {
229*0Sstevel@tonic-gate rval = 0;
230*0Sstevel@tonic-gate goto out;
231*0Sstevel@tonic-gate }
232*0Sstevel@tonic-gate
233*0Sstevel@tonic-gate if (strcmp(hostname, "localhost") == 0) {
234*0Sstevel@tonic-gate rval = 0;
235*0Sstevel@tonic-gate goto out;
236*0Sstevel@tonic-gate }
237*0Sstevel@tonic-gate
238*0Sstevel@tonic-gate /* check for remote root access */
239*0Sstevel@tonic-gate if (ruserok(hostname, 1, "root", "root") == 0) {
240*0Sstevel@tonic-gate rval = 0;
241*0Sstevel@tonic-gate goto out;
242*0Sstevel@tonic-gate }
243*0Sstevel@tonic-gate }
244*0Sstevel@tonic-gate
245*0Sstevel@tonic-gate /* cleanup, return success */
246*0Sstevel@tonic-gate out:
247*0Sstevel@tonic-gate if (inplace)
248*0Sstevel@tonic-gate free(inplace);
249*0Sstevel@tonic-gate if (hservlistp != NULL)
250*0Sstevel@tonic-gate netdir_free(hservlistp, ND_HOSTSERVLIST);
251*0Sstevel@tonic-gate if (nconfp != NULL)
252*0Sstevel@tonic-gate Free(nconfp);
253*0Sstevel@tonic-gate return (rval);
254*0Sstevel@tonic-gate }
255*0Sstevel@tonic-gate
256*0Sstevel@tonic-gate /*
257*0Sstevel@tonic-gate * check for user in local group 14
258*0Sstevel@tonic-gate */
259*0Sstevel@tonic-gate static int
check_gid14(uid_t uid)260*0Sstevel@tonic-gate check_gid14(
261*0Sstevel@tonic-gate uid_t uid
262*0Sstevel@tonic-gate )
263*0Sstevel@tonic-gate {
264*0Sstevel@tonic-gate struct passwd *pwp;
265*0Sstevel@tonic-gate struct group *grp;
266*0Sstevel@tonic-gate char **namep;
267*0Sstevel@tonic-gate
268*0Sstevel@tonic-gate /* get user info, check default GID */
269*0Sstevel@tonic-gate if ((pwp = getpwuid(uid)) == NULL)
270*0Sstevel@tonic-gate return (-1);
271*0Sstevel@tonic-gate if (pwp->pw_gid == MED_GID)
272*0Sstevel@tonic-gate return (0);
273*0Sstevel@tonic-gate
274*0Sstevel@tonic-gate /* check in group */
275*0Sstevel@tonic-gate if ((grp = getgrgid(MED_GID)) == NULL)
276*0Sstevel@tonic-gate return (-1);
277*0Sstevel@tonic-gate for (namep = grp->gr_mem; ((*namep != NULL) && (**namep != '\0'));
278*0Sstevel@tonic-gate ++namep) {
279*0Sstevel@tonic-gate if (strcmp(*namep, pwp->pw_name) == 0)
280*0Sstevel@tonic-gate return (0);
281*0Sstevel@tonic-gate }
282*0Sstevel@tonic-gate return (-1);
283*0Sstevel@tonic-gate }
284*0Sstevel@tonic-gate
285*0Sstevel@tonic-gate /*
286*0Sstevel@tonic-gate * check AUTH_SYS
287*0Sstevel@tonic-gate */
288*0Sstevel@tonic-gate static int
check_sys(struct svc_req * rqstp,int amode,med_err_t * medep)289*0Sstevel@tonic-gate check_sys(
290*0Sstevel@tonic-gate struct svc_req *rqstp, /* RPC stuff */
291*0Sstevel@tonic-gate int amode, /* R_OK | W_OK */
292*0Sstevel@tonic-gate med_err_t *medep /* returned status */
293*0Sstevel@tonic-gate )
294*0Sstevel@tonic-gate {
295*0Sstevel@tonic-gate #ifdef _REENTRANT
296*0Sstevel@tonic-gate static mutex_t mx = DEFAULTMUTEX;
297*0Sstevel@tonic-gate #endif /* _REENTRANT */
298*0Sstevel@tonic-gate struct authsys_parms *sys_credp;
299*0Sstevel@tonic-gate
300*0Sstevel@tonic-gate /* for read, anything is OK */
301*0Sstevel@tonic-gate if (! (amode & W_OK))
302*0Sstevel@tonic-gate return (0);
303*0Sstevel@tonic-gate
304*0Sstevel@tonic-gate #ifdef _REENTRANT
305*0Sstevel@tonic-gate /* single thread (not really needed if daemon stays single threaded) */
306*0Sstevel@tonic-gate mutex_lock(&mx);
307*0Sstevel@tonic-gate #endif /* _REENTRANT */
308*0Sstevel@tonic-gate
309*0Sstevel@tonic-gate /* check for remote root or METAMED_GID */
310*0Sstevel@tonic-gate /*LINTED*/
311*0Sstevel@tonic-gate sys_credp = (struct authsys_parms *)rqstp->rq_clntcred;
312*0Sstevel@tonic-gate if ((check_gid14(sys_credp->aup_uid) == 0) ||
313*0Sstevel@tonic-gate (check_host(rqstp) == 0)) {
314*0Sstevel@tonic-gate #ifdef _REENTRANT
315*0Sstevel@tonic-gate mutex_unlock(&mx);
316*0Sstevel@tonic-gate #endif /* _REENTRANT */
317*0Sstevel@tonic-gate return (0);
318*0Sstevel@tonic-gate }
319*0Sstevel@tonic-gate
320*0Sstevel@tonic-gate /* return failure */
321*0Sstevel@tonic-gate #ifdef _REENTRANT
322*0Sstevel@tonic-gate mutex_unlock(&mx);
323*0Sstevel@tonic-gate #endif /* _REENTRANT */
324*0Sstevel@tonic-gate return (med_error(medep, EACCES, medname));
325*0Sstevel@tonic-gate }
326*0Sstevel@tonic-gate
327*0Sstevel@tonic-gate /*
328*0Sstevel@tonic-gate * setup RPC service
329*0Sstevel@tonic-gate *
330*0Sstevel@tonic-gate * if can't authenticate return < 0
331*0Sstevel@tonic-gate * if any other error return > 0
332*0Sstevel@tonic-gate */
333*0Sstevel@tonic-gate int
med_init(struct svc_req * rqstp,int amode,med_err_t * medep)334*0Sstevel@tonic-gate med_init(
335*0Sstevel@tonic-gate struct svc_req *rqstp, /* RPC stuff */
336*0Sstevel@tonic-gate int amode, /* R_OK | W_OK */
337*0Sstevel@tonic-gate med_err_t *medep /* returned status */
338*0Sstevel@tonic-gate )
339*0Sstevel@tonic-gate {
340*0Sstevel@tonic-gate SVCXPRT *transp = rqstp->rq_xprt;
341*0Sstevel@tonic-gate
342*0Sstevel@tonic-gate /*
343*0Sstevel@tonic-gate * initialize
344*0Sstevel@tonic-gate */
345*0Sstevel@tonic-gate (void) memset(medep, 0, sizeof (*medep));
346*0Sstevel@tonic-gate
347*0Sstevel@tonic-gate if (sdssc_bind_library() == SDSSC_ERROR) {
348*0Sstevel@tonic-gate (void) med_error(medep, EACCES,
349*0Sstevel@tonic-gate "can't bind to cluster library");
350*0Sstevel@tonic-gate return (1);
351*0Sstevel@tonic-gate }
352*0Sstevel@tonic-gate
353*0Sstevel@tonic-gate /*
354*0Sstevel@tonic-gate * check credentials
355*0Sstevel@tonic-gate */
356*0Sstevel@tonic-gate switch (rqstp->rq_cred.oa_flavor) {
357*0Sstevel@tonic-gate
358*0Sstevel@tonic-gate /* UNIX flavor */
359*0Sstevel@tonic-gate case AUTH_SYS:
360*0Sstevel@tonic-gate {
361*0Sstevel@tonic-gate if (check_sys(rqstp, amode, medep) != 0)
362*0Sstevel@tonic-gate return (1); /* error */
363*0Sstevel@tonic-gate break;
364*0Sstevel@tonic-gate }
365*0Sstevel@tonic-gate
366*0Sstevel@tonic-gate /* can't authenticate anything else */
367*0Sstevel@tonic-gate default:
368*0Sstevel@tonic-gate svcerr_weakauth(transp);
369*0Sstevel@tonic-gate return (-1); /* weak authentication */
370*0Sstevel@tonic-gate
371*0Sstevel@tonic-gate }
372*0Sstevel@tonic-gate
373*0Sstevel@tonic-gate /*
374*0Sstevel@tonic-gate * (re)initialize
375*0Sstevel@tonic-gate */
376*0Sstevel@tonic-gate if (med_init_daemon(medep) != 0)
377*0Sstevel@tonic-gate return (1); /* error */
378*0Sstevel@tonic-gate
379*0Sstevel@tonic-gate /* return success */
380*0Sstevel@tonic-gate return (0);
381*0Sstevel@tonic-gate }
382