kcm/config.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "kcm_locl.h"
  36 #include <getarg.h>
  37 #include <parse_bytes.h>
  38
  39 #define MAX_REQUEST_MAX 67108864ll /* 64MB, the maximum accepted value of max_request */
  40
  41 static const char *config_file; /* location of kcm config file */
  42
  43 size_t max_request = 0;         /* maximal size of a request */
  44 char *socket_path = NULL;
  45
  46 static char *max_request_str;   /* `max_request' as a string */
  47
  48 int detach_from_console = -1;
  49 int daemon_child = -1;
  50 int automatic_renewal = -1;
  51
  52 static const char *system_cache_name = NULL;
  53 static const char *system_keytab = NULL;
  54 static const char *system_principal = NULL;
  55 static const char *system_server = NULL;
  56 static const char *system_perms = NULL;
  57 static const char *system_user = NULL;
  58 static const char *system_group = NULL;
  59
  60 static const char *renew_life = NULL;
  61 static const char *ticket_life = NULL;
  62
  63 int launchd_flag = 0;
  64 int disallow_getting_krbtgt = 0;
  65 int name_constraints = -1;
  66
  67 static int help_flag;
  68 static int version_flag;
  69
  70 static struct getargs args[] = {
  71     {
  72         "cache-name",   0,      arg_string,     &system_cache_name,
  73         "system cache name", "cachename"
  74     },
  75     {
  76         "config-file",  'c',    arg_string,     &config_file,
  77         "location of config file",      "file"
  78     },
  79     {
  80         "group",        'g',    arg_string,     &system_group,
  81         "system cache group",   "group"
  82     },
  83     {
  84         "max-request",  0,      arg_string, &max_request,
  85         "max size for a kcm-request", "size"
  86     },
  87     {
  88         "launchd",      0,      arg_flag, &launchd_flag,
  89         "when in use by launchd", NULL
  90     },
  91     {
  92         "detach",       0 ,      arg_flag, &detach_from_console,
  93         "detach from console", NULL
  94     },
  95     {
  96         "daemon-child",       0 ,      arg_integer, &daemon_child,
  97         "private argument, do not use", NULL
  98     },
  99     {
 100         "automatic-renewal",    0 , arg_negative_flag, &automatic_renewal,
 101         "disable automatic TGT renewal", NULL
 102     },
 103     {   "help",         'h',    arg_flag,   &help_flag, NULL, NULL },
 104     {
 105         "system-principal",     'k',    arg_string,     &system_principal,
 106         "system principal name",        "principal"
 107     },
 108     {
 109         "lifetime",     'l', arg_string, &ticket_life,
 110         "lifetime of system tickets", "time"
 111     },
 112     {
 113         "mode",         'm', arg_string, &system_perms,
 114         "octal mode of system cache", "mode"
 115     },
 116     {
 117         "name-constraints",     'n', arg_negative_flag, &name_constraints,
 118         "disable credentials cache name constraints", NULL
 119     },
 120     {
 121         "disallow-getting-krbtgt", 0, arg_flag, &disallow_getting_krbtgt,
 122         "disable fetching krbtgt from the cache", NULL
 123     },
 124     {
 125         "renewable-life",       'r', arg_string, &renew_life,
 126         "renewable lifetime of system tickets", "time"
 127     },
 128     {
 129         "max-request",  'r', arg_integer, &max_request_str,
 130         "max request size", "bytes"
 131     },
 132     {
 133         "socket-path",          's', arg_string, &socket_path,
 134         "path to kcm domain socket", "path"
 135     },
 136     {
 137         "server",               'S', arg_string, &system_server,
 138         "server to get system ticket for", "principal"
 139     },
 140     {
 141         "keytab",       't',    arg_string,     &system_keytab,
 142         "system keytab name",   "keytab"
 143     },
 144     {
 145         "user",         'u',    arg_string,     &system_user,
 146         "system cache owner",   "user"
 147     },
 148     {   "version",      'v',    arg_flag,   &version_flag, NULL, NULL }
 149 };
 150
 151 static int num_args = sizeof(args) / sizeof(args[0]);
 152
 153 static void
 154 usage(int ret)
 155 {
 156     arg_printusage (args, num_args, NULL, "");
 157     exit (ret);
 158 }
 159
 160 static int parse_owners(kcm_ccache ccache)
 161 {
 162     uid_t uid = 0;
 163     gid_t gid = 0;
 164     struct passwd *pw;
 165     struct group *gr;
 166     int uid_p = 0;
 167     int gid_p = 0;
 168
 169     if (system_user != NULL) {
 170         if (isdigit((unsigned char)system_user[0])) {
 171             pw = getpwuid(atoi(system_user));
 172         } else {
 173             pw = getpwnam(system_user);
 174         }
 175         if (pw == NULL) {
 176             return errno;
 177         }
 178
 179         system_user = strdup(pw->pw_name);
 180         if (system_user == NULL) {
 181             return ENOMEM;
 182         }
 183
 184         uid = pw->pw_uid; uid_p = 1;
 185         gid = pw->pw_gid; gid_p = 1;
 186     }
 187
 188     if (system_group != NULL) {
 189         if (isdigit((unsigned char)system_group[0])) {
 190             gr = getgrgid(atoi(system_group));
 191         } else {
 192             gr = getgrnam(system_group);
 193         }
 194         if (gr == NULL) {
 195             return errno;
 196         }
 197
 198         gid = gr->gr_gid; gid_p = 1;
 199     }
 200
 201     if (uid_p)
 202         ccache->uid = uid;
 203     else
 204         ccache->uid = 0; /* geteuid() XXX */
 205
 206     if (gid_p)
 207         ccache->gid = gid;
 208     else
 209         ccache->gid = 0; /* getegid() XXX */
 210
 211     return 0;
 212 }
 213
 214 static const char *
 215 kcm_system_config_get_string(const char *string)
 216 {
 217     return krb5_config_get_string(kcm_context, NULL, "kcm",
 218                                   "system_ccache", string, NULL);
 219 }
 220
 221 static krb5_error_code
 222 ccache_init_system(void)
 223 {
 224     kcm_ccache ccache;
 225     krb5_error_code ret;
 226
 227     if (system_cache_name == NULL)
 228         system_cache_name = kcm_system_config_get_string("cc_name");
 229
 230     ret = kcm_ccache_new(kcm_context,
 231                          system_cache_name ? system_cache_name : "SYSTEM",
 232                          &ccache);
 233     if (ret)
 234         return ret;
 235
 236     ccache->flags |= KCM_FLAGS_OWNER_IS_SYSTEM;
 237     ccache->flags |= KCM_FLAGS_USE_KEYTAB;
 238
 239     ret = parse_owners(ccache);
 240     if (ret)
 241         return ret;
 242
 243     ret = krb5_parse_name(kcm_context, system_principal, &ccache->client);
 244     if (ret) {
 245         kcm_release_ccache(kcm_context, ccache);
 246         return ret;
 247     }
 248
 249     if (system_server == NULL)
 250         system_server = kcm_system_config_get_string("server");
 251
 252     if (system_server != NULL) {
 253         ret = krb5_parse_name(kcm_context, system_server, &ccache->server);
 254         if (ret) {
 255             kcm_release_ccache(kcm_context, ccache);
 256             return ret;
 257         }
 258     }
 259
 260     if (system_keytab == NULL)
 261         system_keytab = kcm_system_config_get_string("keytab_name");
 262
 263     if (system_keytab != NULL) {
 264         ret = krb5_kt_resolve(kcm_context, system_keytab, &ccache->key.keytab);
 265     } else {
 266         ret = krb5_kt_default(kcm_context, &ccache->key.keytab);
 267     }
 268     if (ret) {
 269         kcm_release_ccache(kcm_context, ccache);
 270         return ret;
 271     }
 272
 273     if (renew_life == NULL)
 274         renew_life = kcm_system_config_get_string("renew_life");
 275
 276     if (renew_life == NULL)
 277         renew_life = "6 months";
 278
 279     if (renew_life != NULL) {
 280         ccache->renew_life = parse_time(renew_life, "s");
 281         if (ccache->renew_life < 0) {
 282             kcm_release_ccache(kcm_context, ccache);
 283             return EINVAL;
 284         }
 285     }
 286
 287     if (ticket_life == NULL)
 288         ticket_life = kcm_system_config_get_string("ticket_life");
 289
 290     if (ticket_life != NULL) {
 291         ccache->tkt_life = parse_time(ticket_life, "s");
 292         if (ccache->tkt_life < 0) {
 293             kcm_release_ccache(kcm_context, ccache);
 294             return EINVAL;
 295         }
 296     }
 297
 298     if (system_perms == NULL)
 299         system_perms = kcm_system_config_get_string("mode");
 300
 301     if (system_perms != NULL) {
 302         int mode;
 303
 304         if (sscanf(system_perms, "%o", &mode) != 1)
 305             return EINVAL;
 306
 307         ccache->mode = mode;
 308     }
 309
 310     if (disallow_getting_krbtgt == -1) {
 311         disallow_getting_krbtgt =
 312             krb5_config_get_bool_default(kcm_context, NULL, FALSE, "kcm",
 313                                          "disallow-getting-krbtgt", NULL);
 314     }
 315
 316     /* enqueue default actions for credentials cache */
 317     ret = kcm_ccache_enqueue_default(kcm_context, ccache, NULL);
 318
 319     kcm_release_ccache(kcm_context, ccache); /* retained by event queue */
 320
 321     return ret;
 322 }
 323
 324 void
 325 kcm_configure(int argc, char **argv)
 326 {
 327     krb5_error_code ret;
 328     int optidx = 0;
 329     const char *p;
 330
 331     while (getarg(args, num_args, argc, argv, &optidx))
 332         warnx("error at argument `%s'", argv[optidx]);
 333
 334     if (help_flag)
 335         usage (0);
 336
 337     if (version_flag) {
 338         print_version(NULL);
 339         exit(0);
 340     }
 341
 342     argc -= optidx;
 343     argv += optidx;
 344
 345     if (argc != 0)
 346         usage(1);
 347
 348     {
 349         char **files;
 350
 351         if(config_file == NULL)
 352             config_file = _PATH_KCM_CONF;
 353
 354         ret = krb5_prepend_config_files_default(config_file, &files);
 355         if (ret)
 356             krb5_err(kcm_context, 1, ret, "getting configuration files");
 357
 358         ret = krb5_set_config_files(kcm_context, files);
 359         krb5_free_config_files(files);
 360         if(ret)
 361             krb5_err(kcm_context, 1, ret, "reading configuration files");
 362     }
 363
 364     if (max_request_str) {
 365         int64_t bytes;
 366
 367         if ((bytes = parse_bytes(max_request_str, NULL)) < 0)
 368             krb5_errx(kcm_context, 1,
 369                       "--max-request size must be non-negative");
 370         if (bytes > MAX_REQUEST_MAX)
 371             krb5_errx(kcm_context, 1, "--max-request size is too big "
 372                       "(must be smaller than %lld)", MAX_REQUEST_MAX);
 373
 374         max_request = bytes;
 375     }
 376
 377     if(max_request == 0){
 378         p = krb5_config_get_string (kcm_context,
 379                                     NULL,
 380                                     "kcm",
 381                                     "max-request",
 382                                     NULL);
 383         if (p) {
 384             int64_t bytes;
 385
 386             if ((bytes = parse_bytes(max_request_str, NULL)) < 0)
 387                 krb5_errx(kcm_context, 1,
 388                           "[kcm] max-request size must be non-negative");
 389             if (bytes > MAX_REQUEST_MAX)
 390                 krb5_errx(kcm_context, 1, "[kcm] max-request size is too big "
 391                           "(must be smaller than %lld)", MAX_REQUEST_MAX);
 392
 393             max_request = bytes;
 394         }
 395     }
 396
 397     if (system_principal == NULL) {
 398         system_principal = kcm_system_config_get_string("principal");
 399     }
 400
 401     if (system_principal != NULL) {
 402         ret = ccache_init_system();
 403         if (ret)
 404             krb5_err(kcm_context, 1, ret, "initializing system ccache");
 405     }
 406
 407     if(automatic_renewal == -1)
 408         automatic_renewal = krb5_config_get_bool_default(kcm_context, NULL,
 409                                                          TRUE,
 410                                                          "kcm",
 411                                                          "automatic_renewal",
 412                                                          NULL);
 413
 414     if(detach_from_console == -1)
 415         detach_from_console = krb5_config_get_bool_default(kcm_context, NULL,
 416                                                            FALSE,
 417                                                            "kcm",
 418                                                            "detach", NULL);
 419     kcm_openlog();
 420     if(max_request == 0)
 421         max_request = 64 * 1024;
 422 }
 423