config.c revision 178825
1178825Sdfr/* 2178825Sdfr * Copyright (c) 2005, PADL Software Pty Ltd. 3178825Sdfr * All rights reserved. 4178825Sdfr * 5178825Sdfr * Redistribution and use in source and binary forms, with or without 6178825Sdfr * modification, are permitted provided that the following conditions 7178825Sdfr * are met: 8178825Sdfr * 9178825Sdfr * 1. Redistributions of source code must retain the above copyright 10178825Sdfr * notice, this list of conditions and the following disclaimer. 11178825Sdfr * 12178825Sdfr * 2. Redistributions in binary form must reproduce the above copyright 13178825Sdfr * notice, this list of conditions and the following disclaimer in the 14178825Sdfr * documentation and/or other materials provided with the distribution. 15178825Sdfr * 16178825Sdfr * 3. Neither the name of PADL Software nor the names of its contributors 17178825Sdfr * may be used to endorse or promote products derived from this software 18178825Sdfr * without specific prior written permission. 19178825Sdfr * 20178825Sdfr * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 21178825Sdfr * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22178825Sdfr * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23178825Sdfr * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 24178825Sdfr * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25178825Sdfr * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26178825Sdfr * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27178825Sdfr * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28178825Sdfr * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29178825Sdfr * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30178825Sdfr * SUCH DAMAGE. 31178825Sdfr */ 32178825Sdfr 33178825Sdfr#include "kcm_locl.h" 34178825Sdfr#include <getarg.h> 35178825Sdfr#include <parse_bytes.h> 36178825Sdfr 37178825SdfrRCSID("$Id: config.c 15296 2005-05-30 10:17:43Z lha $"); 38178825Sdfr 39178825Sdfrstatic const char *config_file; /* location of kcm config file */ 40178825Sdfr 41178825Sdfrsize_t max_request = 0; /* maximal size of a request */ 42178825Sdfrchar *socket_path = NULL; 43178825Sdfrchar *door_path = NULL; 44178825Sdfr 45178825Sdfrstatic char *max_request_str; /* `max_request' as a string */ 46178825Sdfr 47178825Sdfrint detach_from_console = -1; 48178825Sdfr#define DETACH_IS_DEFAULT FALSE 49178825Sdfr 50178825Sdfrstatic const char *system_cache_name = NULL; 51178825Sdfrstatic const char *system_keytab = NULL; 52178825Sdfrstatic const char *system_principal = NULL; 53178825Sdfrstatic const char *system_server = NULL; 54178825Sdfrstatic const char *system_perms = NULL; 55178825Sdfrstatic const char *system_user = NULL; 56178825Sdfrstatic const char *system_group = NULL; 57178825Sdfr 58178825Sdfrstatic const char *renew_life = NULL; 59178825Sdfrstatic const char *ticket_life = NULL; 60178825Sdfr 61178825Sdfrint disallow_getting_krbtgt = -1; 62178825Sdfrint name_constraints = -1; 63178825Sdfr 64178825Sdfrstatic int help_flag; 65178825Sdfrstatic int version_flag; 66178825Sdfr 67178825Sdfrstatic struct getargs args[] = { 68178825Sdfr { 69178825Sdfr "cache-name", 0, arg_string, &system_cache_name, 70178825Sdfr "system cache name", "cachename" 71178825Sdfr }, 72178825Sdfr { 73178825Sdfr "config-file", 'c', arg_string, &config_file, 74178825Sdfr "location of config file", "file" 75178825Sdfr }, 76178825Sdfr { 77178825Sdfr "group", 'g', arg_string, &system_group, 78178825Sdfr "system cache group", "group" 79178825Sdfr }, 80178825Sdfr { 81178825Sdfr "max-request", 0, arg_string, &max_request, 82178825Sdfr "max size for a kcm-request", "size" 83178825Sdfr }, 84178825Sdfr#if DETACH_IS_DEFAULT 85178825Sdfr { 86178825Sdfr "detach", 'D', arg_negative_flag, &detach_from_console, 87178825Sdfr "don't detach from console" 88178825Sdfr }, 89178825Sdfr#else 90178825Sdfr { 91178825Sdfr "detach", 0 , arg_flag, &detach_from_console, 92178825Sdfr "detach from console" 93178825Sdfr }, 94178825Sdfr#endif 95178825Sdfr { "help", 'h', arg_flag, &help_flag }, 96178825Sdfr { 97178825Sdfr "system-principal", 'k', arg_string, &system_principal, 98178825Sdfr "system principal name", "principal" 99178825Sdfr }, 100178825Sdfr { 101178825Sdfr "lifetime", 'l', arg_string, &ticket_life, 102178825Sdfr "lifetime of system tickets", "time" 103178825Sdfr }, 104178825Sdfr { 105178825Sdfr "mode", 'm', arg_string, &system_perms, 106178825Sdfr "octal mode of system cache", "mode" 107178825Sdfr }, 108178825Sdfr { 109178825Sdfr "name-constraints", 'n', arg_negative_flag, &name_constraints, 110178825Sdfr "disable credentials cache name constraints" 111178825Sdfr }, 112178825Sdfr { 113178825Sdfr "disallow-getting-krbtgt", 0, arg_flag, &disallow_getting_krbtgt, 114178825Sdfr "disable fetching krbtgt from the cache" 115178825Sdfr }, 116178825Sdfr { 117178825Sdfr "renewable-life", 'r', arg_string, &renew_life, 118178825Sdfr "renewable lifetime of system tickets", "time" 119178825Sdfr }, 120178825Sdfr { 121178825Sdfr "socket-path", 's', arg_string, &socket_path, 122178825Sdfr "path to kcm domain socket", "path" 123178825Sdfr }, 124178825Sdfr#ifdef HAVE_DOOR_CREATE 125178825Sdfr { 126178825Sdfr "door-path", 's', arg_string, &door_path, 127178825Sdfr "path to kcm door", "path" 128178825Sdfr }, 129178825Sdfr#endif 130178825Sdfr { 131178825Sdfr "server", 'S', arg_string, &system_server, 132178825Sdfr "server to get system ticket for", "principal" 133178825Sdfr }, 134178825Sdfr { 135178825Sdfr "keytab", 't', arg_string, &system_keytab, 136178825Sdfr "system keytab name", "keytab" 137178825Sdfr }, 138178825Sdfr { 139178825Sdfr "user", 'u', arg_string, &system_user, 140178825Sdfr "system cache owner", "user" 141178825Sdfr }, 142178825Sdfr { "version", 'v', arg_flag, &version_flag } 143178825Sdfr}; 144178825Sdfr 145178825Sdfrstatic int num_args = sizeof(args) / sizeof(args[0]); 146178825Sdfr 147178825Sdfrstatic void 148178825Sdfrusage(int ret) 149178825Sdfr{ 150178825Sdfr arg_printusage (args, num_args, NULL, ""); 151178825Sdfr exit (ret); 152178825Sdfr} 153178825Sdfr 154178825Sdfrstatic int parse_owners(kcm_ccache ccache) 155178825Sdfr{ 156178825Sdfr uid_t uid = 0; 157178825Sdfr gid_t gid = 0; 158178825Sdfr struct passwd *pw; 159178825Sdfr struct group *gr; 160178825Sdfr int uid_p = 0; 161178825Sdfr int gid_p = 0; 162178825Sdfr 163178825Sdfr if (system_user != NULL) { 164178825Sdfr if (isdigit((unsigned char)system_user[0])) { 165178825Sdfr pw = getpwuid(atoi(system_user)); 166178825Sdfr } else { 167178825Sdfr pw = getpwnam(system_user); 168178825Sdfr } 169178825Sdfr if (pw == NULL) { 170178825Sdfr return errno; 171178825Sdfr } 172178825Sdfr 173178825Sdfr system_user = strdup(pw->pw_name); 174178825Sdfr if (system_user == NULL) { 175178825Sdfr return ENOMEM; 176178825Sdfr } 177178825Sdfr 178178825Sdfr uid = pw->pw_uid; uid_p = 1; 179178825Sdfr gid = pw->pw_gid; gid_p = 1; 180178825Sdfr } 181178825Sdfr 182178825Sdfr if (system_group != NULL) { 183178825Sdfr if (isdigit((unsigned char)system_group[0])) { 184178825Sdfr gr = getgrgid(atoi(system_group)); 185178825Sdfr } else { 186178825Sdfr gr = getgrnam(system_group); 187178825Sdfr } 188178825Sdfr if (gr == NULL) { 189178825Sdfr return errno; 190178825Sdfr } 191178825Sdfr 192178825Sdfr gid = gr->gr_gid; gid_p = 1; 193178825Sdfr } 194178825Sdfr 195178825Sdfr if (uid_p) 196178825Sdfr ccache->uid = uid; 197178825Sdfr else 198178825Sdfr ccache->uid = 0; /* geteuid() XXX */ 199178825Sdfr 200178825Sdfr if (gid_p) 201178825Sdfr ccache->gid = gid; 202178825Sdfr else 203178825Sdfr ccache->gid = 0; /* getegid() XXX */ 204178825Sdfr 205178825Sdfr return 0; 206178825Sdfr} 207178825Sdfr 208178825Sdfrstatic const char * 209178825Sdfrkcm_system_config_get_string(const char *string) 210178825Sdfr{ 211178825Sdfr return krb5_config_get_string(kcm_context, NULL, "kcm", 212178825Sdfr "system_ccache", string, NULL); 213178825Sdfr} 214178825Sdfr 215178825Sdfrstatic krb5_error_code 216178825Sdfrccache_init_system(void) 217178825Sdfr{ 218178825Sdfr kcm_ccache ccache; 219178825Sdfr krb5_error_code ret; 220178825Sdfr 221178825Sdfr if (system_cache_name == NULL) 222178825Sdfr system_cache_name = kcm_system_config_get_string("cc_name"); 223178825Sdfr 224178825Sdfr ret = kcm_ccache_new(kcm_context, 225178825Sdfr system_cache_name ? system_cache_name : "SYSTEM", 226178825Sdfr &ccache); 227178825Sdfr if (ret) 228178825Sdfr return ret; 229178825Sdfr 230178825Sdfr ccache->flags |= KCM_FLAGS_OWNER_IS_SYSTEM; 231178825Sdfr ccache->flags |= KCM_FLAGS_USE_KEYTAB; 232178825Sdfr 233178825Sdfr ret = parse_owners(ccache); 234178825Sdfr if (ret) 235178825Sdfr return ret; 236178825Sdfr 237178825Sdfr ret = krb5_parse_name(kcm_context, system_principal, &ccache->client); 238178825Sdfr if (ret) { 239178825Sdfr kcm_release_ccache(kcm_context, &ccache); 240178825Sdfr return ret; 241178825Sdfr } 242178825Sdfr 243178825Sdfr if (system_server == NULL) 244178825Sdfr system_server = kcm_system_config_get_string("server"); 245178825Sdfr 246178825Sdfr if (system_server != NULL) { 247178825Sdfr ret = krb5_parse_name(kcm_context, system_server, &ccache->server); 248178825Sdfr if (ret) { 249178825Sdfr kcm_release_ccache(kcm_context, &ccache); 250178825Sdfr return ret; 251178825Sdfr } 252178825Sdfr } 253178825Sdfr 254178825Sdfr if (system_keytab == NULL) 255178825Sdfr system_keytab = kcm_system_config_get_string("keytab_name"); 256178825Sdfr 257178825Sdfr if (system_keytab != NULL) { 258178825Sdfr ret = krb5_kt_resolve(kcm_context, system_keytab, &ccache->key.keytab); 259178825Sdfr } else { 260178825Sdfr ret = krb5_kt_default(kcm_context, &ccache->key.keytab); 261178825Sdfr } 262178825Sdfr if (ret) { 263178825Sdfr kcm_release_ccache(kcm_context, &ccache); 264178825Sdfr return ret; 265178825Sdfr } 266178825Sdfr 267178825Sdfr if (renew_life == NULL) 268178825Sdfr renew_life = kcm_system_config_get_string("renew_life"); 269178825Sdfr 270178825Sdfr if (renew_life == NULL) 271178825Sdfr renew_life = "1 month"; 272178825Sdfr 273178825Sdfr if (renew_life != NULL) { 274178825Sdfr ccache->renew_life = parse_time(renew_life, "s"); 275178825Sdfr if (ccache->renew_life < 0) { 276178825Sdfr kcm_release_ccache(kcm_context, &ccache); 277178825Sdfr return EINVAL; 278178825Sdfr } 279178825Sdfr } 280178825Sdfr 281178825Sdfr if (ticket_life == NULL) 282178825Sdfr ticket_life = kcm_system_config_get_string("ticket_life"); 283178825Sdfr 284178825Sdfr if (ticket_life != NULL) { 285178825Sdfr ccache->tkt_life = parse_time(ticket_life, "s"); 286178825Sdfr if (ccache->tkt_life < 0) { 287178825Sdfr kcm_release_ccache(kcm_context, &ccache); 288178825Sdfr return EINVAL; 289178825Sdfr } 290178825Sdfr } 291178825Sdfr 292178825Sdfr if (system_perms == NULL) 293178825Sdfr system_perms = kcm_system_config_get_string("mode"); 294178825Sdfr 295178825Sdfr if (system_perms != NULL) { 296178825Sdfr int mode; 297178825Sdfr 298178825Sdfr if (sscanf(system_perms, "%o", &mode) != 1) 299178825Sdfr return EINVAL; 300178825Sdfr 301178825Sdfr ccache->mode = mode; 302178825Sdfr } 303178825Sdfr 304178825Sdfr if (disallow_getting_krbtgt == -1) { 305178825Sdfr disallow_getting_krbtgt = 306178825Sdfr krb5_config_get_bool_default(kcm_context, NULL, FALSE, "kcm", 307178825Sdfr "disallow-getting-krbtgt", NULL); 308178825Sdfr } 309178825Sdfr 310178825Sdfr /* enqueue default actions for credentials cache */ 311178825Sdfr ret = kcm_ccache_enqueue_default(kcm_context, ccache, NULL); 312178825Sdfr 313178825Sdfr kcm_release_ccache(kcm_context, &ccache); /* retained by event queue */ 314178825Sdfr 315178825Sdfr return ret; 316178825Sdfr} 317178825Sdfr 318178825Sdfrvoid 319178825Sdfrkcm_configure(int argc, char **argv) 320178825Sdfr{ 321178825Sdfr krb5_error_code ret; 322178825Sdfr int optind = 0; 323178825Sdfr const char *p; 324178825Sdfr 325178825Sdfr while(getarg(args, num_args, argc, argv, &optind)) 326178825Sdfr warnx("error at argument `%s'", argv[optind]); 327178825Sdfr 328178825Sdfr if(help_flag) 329178825Sdfr usage (0); 330178825Sdfr 331178825Sdfr if (version_flag) { 332178825Sdfr print_version(NULL); 333178825Sdfr exit(0); 334178825Sdfr } 335178825Sdfr 336178825Sdfr argc -= optind; 337178825Sdfr argv += optind; 338178825Sdfr 339178825Sdfr if (argc != 0) 340178825Sdfr usage(1); 341178825Sdfr 342178825Sdfr { 343178825Sdfr char **files; 344178825Sdfr 345178825Sdfr if(config_file == NULL) 346178825Sdfr config_file = _PATH_KCM_CONF; 347178825Sdfr 348178825Sdfr ret = krb5_prepend_config_files_default(config_file, &files); 349178825Sdfr if (ret) 350178825Sdfr krb5_err(kcm_context, 1, ret, "getting configuration files"); 351178825Sdfr 352178825Sdfr ret = krb5_set_config_files(kcm_context, files); 353178825Sdfr krb5_free_config_files(files); 354178825Sdfr if(ret) 355178825Sdfr krb5_err(kcm_context, 1, ret, "reading configuration files"); 356178825Sdfr } 357178825Sdfr 358178825Sdfr if(max_request_str) 359178825Sdfr max_request = parse_bytes(max_request_str, NULL); 360178825Sdfr 361178825Sdfr if(max_request == 0){ 362178825Sdfr p = krb5_config_get_string (kcm_context, 363178825Sdfr NULL, 364178825Sdfr "kcm", 365178825Sdfr "max-request", 366178825Sdfr NULL); 367178825Sdfr if(p) 368178825Sdfr max_request = parse_bytes(p, NULL); 369178825Sdfr } 370178825Sdfr 371178825Sdfr if (system_principal == NULL) { 372178825Sdfr system_principal = kcm_system_config_get_string("principal"); 373178825Sdfr } 374178825Sdfr 375178825Sdfr if (system_principal != NULL) { 376178825Sdfr ret = ccache_init_system(); 377178825Sdfr if (ret) 378178825Sdfr krb5_err(kcm_context, 1, ret, "initializing system ccache"); 379178825Sdfr } 380178825Sdfr 381178825Sdfr if(detach_from_console == -1) 382178825Sdfr detach_from_console = krb5_config_get_bool_default(kcm_context, NULL, 383178825Sdfr DETACH_IS_DEFAULT, 384178825Sdfr "kcm", 385178825Sdfr "detach", NULL); 386178825Sdfr kcm_openlog(); 387178825Sdfr if(max_request == 0) 388178825Sdfr max_request = 64 * 1024; 389178825Sdfr} 390178825Sdfr 391