usr/src/cmd/ptools/psecflags/psecflags.c

   1 /*
   2  * This file and its contents are supplied under the terms of the
   3  * Common Development and Distribution License ("CDDL"), version 1.0.
   4  * You may only use this file in accordance with the terms of version
   5  * 1.0 of the CDDL.
   6  *
   7  * A full copy of the text of the CDDL should have accompanied this
   8  * source.  A copy of the CDDL is also available via the Internet at
   9  * http://www.illumos.org/license/CDDL.
  10  */
  11
  12 /* Copyright 2015, Richard Lowe. */
  13
  14 #include <err.h>
  15 #include <errno.h>
  16 #include <grp.h>
  17 #include <libintl.h>
  18 #include <procfs.h>
  19 #include <project.h>
  20 #include <pwd.h>
  21 #include <stdio.h>
  22 #include <stdlib.h>
  23 #include <string.h>
  24 #include <sys/secflags.h>
  25 #include <sys/types.h>
  26
  27 #include <libproc.h>
  28 #include <libzonecfg.h>
  29
  30 extern const char *__progname;
  31
  32 static void
  33 print_flags(const char *set, secflagset_t flags)
  34 {
  35         char buf[1024];
  36
  37         secflags_to_str(flags, buf, sizeof (buf));
  38         (void) printf("\t%s:\t%s\n", set, buf);
  39 }
  40
  41 /*
  42  * Structure defining idtypes known to the priocntl command
  43  * along with the corresponding names.
  44  * The idtype values themselves are defined in <sys/procset.h>.
  45  */
  46 static struct idtypes {
  47         idtype_t        type;
  48         char            *name;
  49 } idtypes [] = {
  50         { P_ALL,        "all"           },
  51         { P_CTID,       "contract"      },
  52         { P_CTID,       "ctid"          },
  53         { P_GID,        "gid"           },
  54         { P_GID,        "group"         },
  55         { P_PGID,       "pgid"          },
  56         { P_PID,        "pid"           },
  57         { P_PPID,       "ppid"          },
  58         { P_PROJID,     "project"       },
  59         { P_PROJID,     "projid"        },
  60         { P_SID,        "session",      },
  61         { P_SID,        "sid"           },
  62         { P_SID,        "sid"           },
  63         { P_TASKID,     "taskid"        },
  64         { P_UID,        "uid"           },
  65         { P_UID,        "user"          },
  66         { P_ZONEID,     "zone"          },
  67         { P_ZONEID,     "zoneid"        },
  68         { 0,            NULL            }
  69 };
  70
  71 static int
  72 str2idtype(char *idtypnm, idtype_t *idtypep)
  73 {
  74         struct idtypes  *curp;
  75
  76         for (curp = idtypes; curp->name != NULL; curp++) {
  77                 if (strncasecmp(curp->name, idtypnm,
  78                     strlen(curp->name)) == 0) {
  79                         *idtypep = curp->type;
  80                         return (0);
  81                 }
  82         }
  83         return (-1);
  84 }
  85
  86 static id_t
  87 getid(idtype_t type, char *value)
  88 {
  89         struct passwd *pwd;
  90         struct group *grp;
  91         id_t ret;
  92         char *endp;
  93
  94         switch (type) {
  95         case P_UID:
  96                 if ((pwd = getpwnam(value)) != NULL)
  97                         return (pwd->pw_uid);
  98                 break;
  99         case P_GID:
 100                 if ((grp = getgrnam(value)) != NULL)
 101                         return (grp->gr_gid);
 102                 break;
 103         case P_PROJID:
 104                 if ((ret = getprojidbyname(value)) != (id_t)-1)
 105                         return (ret);
 106                 break;
 107         case P_ZONEID:
 108                 if (zone_get_id(value, &ret) == 0)
 109                         return (ret);
 110                 break;
 111         default:
 112                 break;
 113         }
 114
 115         errno = 0;
 116
 117         ret = (id_t)strtoul(value, &endp, 10);
 118
 119         if ((errno != 0) || (*endp != '\0'))
 120                 return ((id_t)-1);
 121
 122         return (ret);
 123 }
 124
 125 int
 126 main(int argc, char **argv)
 127 {
 128         secflagdelta_t act;
 129         psecflagwhich_t which = PSF_INHERIT;
 130         int ret = 0;
 131         int pgrab_flags = PGRAB_RDONLY;
 132         int opt;
 133         char *idtypename = NULL;
 134         idtype_t idtype = P_PID;
 135         boolean_t usage = B_FALSE;
 136         boolean_t e_flag = B_FALSE;
 137         boolean_t l_flag = B_FALSE;
 138         boolean_t s_flag = B_FALSE;
 139         int errc = 0;
 140
 141         while ((opt = getopt(argc, argv, "eFi:ls:")) != -1) {
 142                 switch (opt) {
 143                 case 'e':
 144                         e_flag = B_TRUE;
 145                         break;
 146                 case 'F':
 147                         pgrab_flags |= PGRAB_FORCE;
 148                         break;
 149                 case 'i':
 150                         idtypename = optarg;
 151                         break;
 152                 case 's':
 153                         s_flag = B_TRUE;
 154                         if ((strlen(optarg) >= 2) &&
 155                             ((optarg[1] == '='))) {
 156                                 switch (optarg[0]) {
 157                                 case 'L':
 158                                         which = PSF_LOWER;
 159                                         break;
 160                                 case 'U':
 161                                         which = PSF_UPPER;
 162                                         break;
 163                                 case 'I':
 164                                         which = PSF_INHERIT;
 165                                         break;
 166                                 case 'E':
 167                                         errx(1, "the effective flags cannot "
 168                                             "be changed", optarg[0]);
 169                                 default:
 170                                         errx(1, "unknown security flag "
 171                                             "set: '%c'", optarg[0]);
 172                                 }
 173
 174                                 optarg += 2;
 175                         }
 176
 177                         if (secflags_parse(NULL, optarg, &act) == -1)
 178                                 errx(1, "couldn't parse security flags: %s",
 179                                     optarg);
 180                         break;
 181                 case 'l':
 182                         l_flag = B_TRUE;
 183                         break;
 184                 default:
 185                         usage = B_TRUE;
 186                         break;
 187                 }
 188         }
 189
 190         argc -= optind;
 191         argv += optind;
 192
 193         if (l_flag && ((idtypename != NULL) || s_flag || (argc != 0)))
 194                 usage = B_TRUE;
 195         if ((idtypename != NULL) && !s_flag)
 196                 usage = B_TRUE;
 197         if (e_flag && !s_flag)
 198                 usage = B_TRUE;
 199         if (!l_flag && argc <= 0)
 200                 usage = B_TRUE;
 201
 202         if (usage) {
 203                 (void) fprintf(stderr,
 204                     gettext("usage:\t%s [-F] { pid | core } ...\n"),
 205                     __progname);
 206                 (void) fprintf(stderr,
 207                     gettext("\t%s -s spec [-i idtype] id ...\n"),
 208                     __progname);
 209                 (void) fprintf(stderr,
 210                     gettext("\t%s -s spec -e command [arg]...\n"),
 211                     __progname);
 212                 (void) fprintf(stderr, gettext("\t%s -l\n"), __progname);
 213                 return (2);
 214         }
 215
 216         if (l_flag) {
 217                 secflag_t i;
 218                 const char *name;
 219
 220                 for (i = 0; (name = secflag_to_str(i)) != NULL; i++)
 221                         (void) printf("%s\n", name);
 222                 return (0);
 223         } else if (s_flag && e_flag) {
 224                 /*
 225                  * Don't use the strerror() message for EPERM, "Not Owner"
 226                  * which is misleading.
 227                  */
 228                 errc = psecflags(P_PID, P_MYID, which, &act);
 229                 switch (errc) {
 230                 case 0:
 231                         break;
 232                 case EPERM:
 233                         errx(1, gettext("failed setting "
 234                             "security-flags: Permission denied"));
 235                         break;
 236                 default:
 237                         err(1, gettext("failed setting security-flags"));
 238                 }
 239
 240                 (void) execvp(argv[0], &argv[0]);
 241                 err(1, "%s", argv[0]);
 242         } else if (s_flag) {
 243                 int i;
 244                 id_t id;
 245
 246                 if (idtypename != NULL)
 247                         if (str2idtype(idtypename, &idtype) == -1)
 248                                 errx(1, gettext("No such id type: '%s'"),
 249                                     idtypename);
 250
 251                 for (i = 0; i < argc; i++) {
 252                         if ((id = getid(idtype, argv[i])) == (id_t)-1) {
 253                                 errx(1, gettext("invalid or non-existent "
 254                                     "identifier: '%s'"), argv[i]);
 255                         }
 256
 257                         /*
 258                          * Don't use the strerror() message for EPERM, "Not
 259                          * Owner" which is misleading.
 260                          */
 261                         if (psecflags(idtype, id, which, &act) != 0) {
 262                                 switch (errno) {
 263                                 case EPERM:
 264                                         errx(1, gettext("failed setting "
 265                                             "security-flags: "
 266                                             "Permission denied"));
 267                                         break;
 268                                 default:
 269                                         err(1, gettext("failed setting "
 270                                             "security-flags"));
 271                                 }
 272                         }
 273                 }
 274
 275                 return (0);
 276         }
 277
 278         /* Display the flags for the given pids */
 279         while (argc-- > 0) {
 280                 struct ps_prochandle *Pr;
 281                 const char *arg;
 282                 psinfo_t psinfo;
 283                 prsecflags_t *psf;
 284                 int gcode;
 285
 286                 if ((Pr = proc_arg_grab(arg = *argv++, PR_ARG_ANY,
 287                     pgrab_flags, &gcode)) == NULL) {
 288                         warnx(gettext("cannot examine %s: %s"),
 289                             arg, Pgrab_error(gcode));
 290                         ret = 1;
 291                         continue;
 292                 }
 293
 294                 (void) memcpy(&psinfo, Ppsinfo(Pr), sizeof (psinfo_t));
 295                 proc_unctrl_psinfo(&psinfo);
 296
 297                 if (Pstate(Pr) == PS_DEAD) {
 298                         (void) printf(gettext("core '%s' of %d:\t%.70s\n"),
 299                             arg, (int)psinfo.pr_pid, psinfo.pr_psargs);
 300                 } else {
 301                         (void) printf("%d:\t%.70s\n",
 302                             (int)psinfo.pr_pid, psinfo.pr_psargs);
 303                 }
 304
 305                 if (Psecflags(Pr, &psf) != 0)
 306                         err(1, gettext("cannot read secflags of %s"), arg);
 307
 308                 print_flags("E", psf->pr_effective);
 309                 print_flags("I", psf->pr_inherit);
 310                 print_flags("L", psf->pr_lower);
 311                 print_flags("U", psf->pr_upper);
 312
 313                 Psecflags_free(psf);
 314                 Prelease(Pr, 0);
 315         }
 316
 317         return (ret);
 318 }