client.c revision 178825
1178825Sdfr/* 2178825Sdfr * Copyright (c) 2005, PADL Software Pty Ltd. 3178825Sdfr * All rights reserved. 4178825Sdfr * 5178825Sdfr * Redistribution and use in source and binary forms, with or without 6178825Sdfr * modification, are permitted provided that the following conditions 7178825Sdfr * are met: 8178825Sdfr * 9178825Sdfr * 1. Redistributions of source code must retain the above copyright 10178825Sdfr * notice, this list of conditions and the following disclaimer. 11178825Sdfr * 12178825Sdfr * 2. Redistributions in binary form must reproduce the above copyright 13178825Sdfr * notice, this list of conditions and the following disclaimer in the 14178825Sdfr * documentation and/or other materials provided with the distribution. 15178825Sdfr * 16178825Sdfr * 3. Neither the name of PADL Software nor the names of its contributors 17178825Sdfr * may be used to endorse or promote products derived from this software 18178825Sdfr * without specific prior written permission. 19178825Sdfr * 20178825Sdfr * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 21178825Sdfr * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22178825Sdfr * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23178825Sdfr * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 24178825Sdfr * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25178825Sdfr * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26178825Sdfr * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27178825Sdfr * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28178825Sdfr * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29178825Sdfr * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30178825Sdfr * SUCH DAMAGE. 31178825Sdfr */ 32178825Sdfr 33178825Sdfr#include "kcm_locl.h" 34178825Sdfr#include <pwd.h> 35178825Sdfr 36178825SdfrRCSID("$Id: client.c 20487 2007-04-21 06:25:06Z lha $"); 37178825Sdfr 38178825Sdfrkrb5_error_code 39178825Sdfrkcm_ccache_resolve_client(krb5_context context, 40178825Sdfr kcm_client *client, 41178825Sdfr kcm_operation opcode, 42178825Sdfr const char *name, 43178825Sdfr kcm_ccache *ccache) 44178825Sdfr{ 45178825Sdfr krb5_error_code ret; 46178825Sdfr 47178825Sdfr ret = kcm_ccache_resolve(context, name, ccache); 48178825Sdfr if (ret) { 49178825Sdfr kcm_log(1, "Failed to resolve cache %s: %s", 50178825Sdfr name, krb5_get_err_text(context, ret)); 51178825Sdfr return ret; 52178825Sdfr } 53178825Sdfr 54178825Sdfr ret = kcm_access(context, client, opcode, *ccache); 55178825Sdfr if (ret) { 56178825Sdfr ret = KRB5_FCC_NOFILE; /* don't disclose */ 57178825Sdfr kcm_release_ccache(context, ccache); 58178825Sdfr } 59178825Sdfr 60178825Sdfr return ret; 61178825Sdfr} 62178825Sdfr 63178825Sdfrkrb5_error_code 64178825Sdfrkcm_ccache_destroy_client(krb5_context context, 65178825Sdfr kcm_client *client, 66178825Sdfr const char *name) 67178825Sdfr{ 68178825Sdfr krb5_error_code ret; 69178825Sdfr kcm_ccache ccache; 70178825Sdfr 71178825Sdfr ret = kcm_ccache_resolve(context, name, &ccache); 72178825Sdfr if (ret) { 73178825Sdfr kcm_log(1, "Failed to resolve cache %s: %s", 74178825Sdfr name, krb5_get_err_text(context, ret)); 75178825Sdfr return ret; 76178825Sdfr } 77178825Sdfr 78178825Sdfr ret = kcm_access(context, client, KCM_OP_DESTROY, ccache); 79178825Sdfr if (ret) { 80178825Sdfr kcm_release_ccache(context, &ccache); 81178825Sdfr return ret; 82178825Sdfr } 83178825Sdfr 84178825Sdfr ret = kcm_ccache_destroy(context, ccache->name); 85178825Sdfr if (ret == 0) { 86178825Sdfr /* don't leave any events dangling */ 87178825Sdfr kcm_cleanup_events(context, ccache); 88178825Sdfr } 89178825Sdfr 90178825Sdfr kcm_release_ccache(context, &ccache); 91178825Sdfr return ret; 92178825Sdfr} 93178825Sdfr 94178825Sdfrkrb5_error_code 95178825Sdfrkcm_ccache_new_client(krb5_context context, 96178825Sdfr kcm_client *client, 97178825Sdfr const char *name, 98178825Sdfr kcm_ccache *ccache_p) 99178825Sdfr{ 100178825Sdfr krb5_error_code ret; 101178825Sdfr kcm_ccache ccache; 102178825Sdfr 103178825Sdfr /* We insist the ccache name starts with UID or UID: */ 104178825Sdfr if (name_constraints != 0) { 105178825Sdfr char prefix[64]; 106178825Sdfr size_t prefix_len; 107178825Sdfr int bad = 1; 108178825Sdfr 109178825Sdfr snprintf(prefix, sizeof(prefix), "%ld:", (long)client->uid); 110178825Sdfr prefix_len = strlen(prefix); 111178825Sdfr 112178825Sdfr if (strncmp(name, prefix, prefix_len) == 0) 113178825Sdfr bad = 0; 114178825Sdfr else { 115178825Sdfr prefix[prefix_len - 1] = '\0'; 116178825Sdfr if (strcmp(name, prefix) == 0) 117178825Sdfr bad = 0; 118178825Sdfr } 119178825Sdfr 120178825Sdfr /* Allow root to create badly-named ccaches */ 121178825Sdfr if (bad && !CLIENT_IS_ROOT(client)) 122178825Sdfr return KRB5_CC_BADNAME; 123178825Sdfr } 124178825Sdfr 125178825Sdfr ret = kcm_ccache_resolve(context, name, &ccache); 126178825Sdfr if (ret == 0) { 127178825Sdfr if ((ccache->uid != client->uid || 128178825Sdfr ccache->gid != client->gid) && !CLIENT_IS_ROOT(client)) 129178825Sdfr return KRB5_FCC_PERM; 130178825Sdfr } else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) { 131178825Sdfr return ret; 132178825Sdfr } 133178825Sdfr 134178825Sdfr if (ret == KRB5_FCC_NOFILE) { 135178825Sdfr ret = kcm_ccache_new(context, name, &ccache); 136178825Sdfr if (ret) { 137178825Sdfr kcm_log(1, "Failed to initialize cache %s: %s", 138178825Sdfr name, krb5_get_err_text(context, ret)); 139178825Sdfr return ret; 140178825Sdfr } 141178825Sdfr 142178825Sdfr /* bind to current client */ 143178825Sdfr ccache->uid = client->uid; 144178825Sdfr ccache->gid = client->gid; 145178825Sdfr } else { 146178825Sdfr ret = kcm_zero_ccache_data(context, ccache); 147178825Sdfr if (ret) { 148178825Sdfr kcm_log(1, "Failed to empty cache %s: %s", 149178825Sdfr name, krb5_get_err_text(context, ret)); 150178825Sdfr kcm_release_ccache(context, &ccache); 151178825Sdfr return ret; 152178825Sdfr } 153178825Sdfr kcm_cleanup_events(context, ccache); 154178825Sdfr } 155178825Sdfr 156178825Sdfr ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache); 157178825Sdfr if (ret) { 158178825Sdfr kcm_release_ccache(context, &ccache); 159178825Sdfr kcm_ccache_destroy(context, name); 160178825Sdfr return ret; 161178825Sdfr } 162178825Sdfr 163178825Sdfr /* 164178825Sdfr * Finally, if the user is root and the cache was created under 165178825Sdfr * another user's name, chown the cache to that user and their 166178825Sdfr * default gid. 167178825Sdfr */ 168178825Sdfr if (CLIENT_IS_ROOT(client)) { 169178825Sdfr unsigned long uid; 170178825Sdfr int matches = sscanf(name,"%ld:",&uid); 171178825Sdfr if (matches == 0) 172178825Sdfr matches = sscanf(name,"%ld",&uid); 173178825Sdfr if (matches == 1) { 174178825Sdfr struct passwd *pwd = getpwuid(uid); 175178825Sdfr if (pwd != NULL) { 176178825Sdfr gid_t gid = pwd->pw_gid; 177178825Sdfr kcm_chown(context, client, ccache, uid, gid); 178178825Sdfr } 179178825Sdfr } 180178825Sdfr } 181178825Sdfr 182178825Sdfr *ccache_p = ccache; 183178825Sdfr return 0; 184178825Sdfr} 185178825Sdfr 186