config.c revision 225736 
1/*
2 * Copyright (c) 2005, PADL Software Pty Ltd.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * 3. Neither the name of PADL Software nor the names of its contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#include "kcm_locl.h"
34#include <getarg.h>
35#include <parse_bytes.h>
36
37RCSID("$Id: config.c 15296 2005-05-30 10:17:43Z lha $");
38
39static const char *config_file;	/* location of kcm config file */
40
41size_t max_request = 0;		/* maximal size of a request */
42char *socket_path = NULL;
43char *door_path = NULL;
44
45static char *max_request_str;	/* `max_request' as a string */
46
47int detach_from_console = -1;
48#define DETACH_IS_DEFAULT FALSE
49
50static const char *system_cache_name = NULL;
51static const char *system_keytab = NULL;
52static const char *system_principal = NULL;
53static const char *system_server = NULL;
54static const char *system_perms = NULL;
55static const char *system_user = NULL;
56static const char *system_group = NULL;
57
58static const char *renew_life = NULL;
59static const char *ticket_life = NULL;
60
61int disallow_getting_krbtgt = -1;
62int name_constraints = -1;
63
64static int help_flag;
65static int version_flag;
66
67static struct getargs args[] = {
68    {
69	"cache-name",	0,	arg_string,	&system_cache_name,
70	"system cache name", "cachename"
71    },
72    {
73	"config-file",	'c',	arg_string,	&config_file,
74	"location of config file",	"file"
75    },
76    {
77	"group",	'g',	arg_string,	&system_group,
78	"system cache group",	"group"
79    },
80    {
81	"max-request",	0,	arg_string, &max_request,
82	"max size for a kcm-request", "size"
83    },
84#if DETACH_IS_DEFAULT
85    {
86	"detach",       'D',      arg_negative_flag, &detach_from_console,
87	"don't detach from console"
88    },
89#else
90    {
91	"detach",       0 ,      arg_flag, &detach_from_console,
92	"detach from console"
93    },
94#endif
95    {	"help",		'h',	arg_flag,   &help_flag },
96    {
97	"system-principal",	'k',	arg_string,	&system_principal,
98	"system principal name",	"principal"
99    },
100    {
101	"lifetime",	'l', arg_string, &ticket_life,
102	"lifetime of system tickets", "time"
103    },
104    {
105	"mode",		'm', arg_string, &system_perms,
106	"octal mode of system cache", "mode"
107    },
108    {
109	"name-constraints",	'n', arg_negative_flag, &name_constraints,
110	"disable credentials cache name constraints"
111    },
112    {
113	"disallow-getting-krbtgt", 0, arg_flag, &disallow_getting_krbtgt,
114	"disable fetching krbtgt from the cache"
115    },
116    {
117	"renewable-life",	'r', arg_string, &renew_life,
118    	"renewable lifetime of system tickets", "time"
119    },
120    {
121	"socket-path",		's', arg_string, &socket_path,
122    	"path to kcm domain socket", "path"
123    },
124#ifdef HAVE_DOOR_CREATE
125    {
126	"door-path",		's', arg_string, &door_path,
127    	"path to kcm door", "path"
128    },
129#endif
130    {
131	"server",		'S', arg_string, &system_server,
132    	"server to get system ticket for", "principal"
133    },
134    {
135	"keytab",	't',	arg_string,	&system_keytab,
136	"system keytab name",	"keytab"
137    },
138    {
139	"user",		'u',	arg_string,	&system_user,
140	"system cache owner",	"user"
141    },
142    {	"version",	'v',	arg_flag,   &version_flag }
143};
144
145static int num_args = sizeof(args) / sizeof(args[0]);
146
147static void
148usage(int ret)
149{
150    arg_printusage (args, num_args, NULL, "");
151    exit (ret);
152}
153
154static int parse_owners(kcm_ccache ccache)
155{
156    uid_t uid = 0;
157    gid_t gid = 0;
158    struct passwd *pw;
159    struct group *gr;
160    int uid_p = 0;
161    int gid_p = 0;
162
163    if (system_user != NULL) {
164	if (isdigit((unsigned char)system_user[0])) {
165	    pw = getpwuid(atoi(system_user));
166	} else {
167	    pw = getpwnam(system_user);
168	}
169	if (pw == NULL) {
170	    return errno;
171	}
172
173	system_user = strdup(pw->pw_name);
174	if (system_user == NULL) {
175	    return ENOMEM;
176	}
177
178	uid = pw->pw_uid; uid_p = 1;
179	gid = pw->pw_gid; gid_p = 1;
180    }
181
182    if (system_group != NULL) {
183	if (isdigit((unsigned char)system_group[0])) {
184	    gr = getgrgid(atoi(system_group));
185	} else {
186	    gr = getgrnam(system_group);
187	}
188	if (gr == NULL) {
189	    return errno;
190	}
191
192	gid = gr->gr_gid; gid_p = 1;
193    }
194
195    if (uid_p)
196	ccache->uid = uid;
197    else
198	ccache->uid = 0; /* geteuid() XXX */
199
200    if (gid_p)
201	ccache->gid = gid;
202    else
203	ccache->gid = 0; /* getegid() XXX */
204
205    return 0;
206}
207
208static const char *
209kcm_system_config_get_string(const char *string)
210{
211    return krb5_config_get_string(kcm_context, NULL, "kcm",
212				  "system_ccache", string, NULL);
213}
214
215static krb5_error_code
216ccache_init_system(void)
217{
218    kcm_ccache ccache;
219    krb5_error_code ret;
220
221    if (system_cache_name == NULL)
222	system_cache_name = kcm_system_config_get_string("cc_name");
223
224    ret = kcm_ccache_new(kcm_context,
225			 system_cache_name ? system_cache_name : "SYSTEM",
226			 &ccache);
227    if (ret)
228	return ret;
229
230    ccache->flags |= KCM_FLAGS_OWNER_IS_SYSTEM;
231    ccache->flags |= KCM_FLAGS_USE_KEYTAB;
232
233    ret = parse_owners(ccache);
234    if (ret)
235	return ret;
236
237    ret = krb5_parse_name(kcm_context, system_principal, &ccache->client);
238    if (ret) {
239	kcm_release_ccache(kcm_context, &ccache);
240	return ret;
241    }
242
243    if (system_server == NULL)
244	system_server = kcm_system_config_get_string("server");
245
246    if (system_server != NULL) {
247	ret = krb5_parse_name(kcm_context, system_server, &ccache->server);
248	if (ret) {
249	    kcm_release_ccache(kcm_context, &ccache);
250	    return ret;
251	}
252    }
253
254    if (system_keytab == NULL)
255	system_keytab = kcm_system_config_get_string("keytab_name");
256
257    if (system_keytab != NULL) {
258	ret = krb5_kt_resolve(kcm_context, system_keytab, &ccache->key.keytab);
259    } else {
260	ret = krb5_kt_default(kcm_context, &ccache->key.keytab);
261    }
262    if (ret) {
263	kcm_release_ccache(kcm_context, &ccache);
264	return ret;
265    }
266
267    if (renew_life == NULL)
268	renew_life = kcm_system_config_get_string("renew_life");
269
270    if (renew_life == NULL)
271	renew_life = "1 month";
272
273    if (renew_life != NULL) {
274	ccache->renew_life = parse_time(renew_life, "s");
275	if (ccache->renew_life < 0) {
276	    kcm_release_ccache(kcm_context, &ccache);
277	    return EINVAL;
278	}
279    }
280
281    if (ticket_life == NULL)
282	ticket_life = kcm_system_config_get_string("ticket_life");
283
284    if (ticket_life != NULL) {
285	ccache->tkt_life = parse_time(ticket_life, "s");
286	if (ccache->tkt_life < 0) {
287	    kcm_release_ccache(kcm_context, &ccache);
288	    return EINVAL;
289	}
290    }
291
292    if (system_perms == NULL)
293	system_perms = kcm_system_config_get_string("mode");
294
295    if (system_perms != NULL) {
296	int mode;
297
298	if (sscanf(system_perms, "%o", &mode) != 1)
299	    return EINVAL;
300
301	ccache->mode = mode;
302    }
303
304    if (disallow_getting_krbtgt == -1) {
305	disallow_getting_krbtgt =
306	    krb5_config_get_bool_default(kcm_context, NULL, FALSE, "kcm",
307					 "disallow-getting-krbtgt", NULL);
308    }
309
310    /* enqueue default actions for credentials cache */
311    ret = kcm_ccache_enqueue_default(kcm_context, ccache, NULL);
312
313    kcm_release_ccache(kcm_context, &ccache); /* retained by event queue */
314
315    return ret;
316}
317
318void
319kcm_configure(int argc, char **argv)
320{
321    krb5_error_code ret;
322    int optind = 0;
323    const char *p;
324
325    while(getarg(args, num_args, argc, argv, &optind))
326	warnx("error at argument `%s'", argv[optind]);
327
328    if(help_flag)
329	usage (0);
330
331    if (version_flag) {
332	print_version(NULL);
333	exit(0);
334    }
335
336    argc -= optind;
337    argv += optind;
338
339    if (argc != 0)
340	usage(1);
341
342    {
343	char **files;
344
345	if(config_file == NULL)
346	    config_file = _PATH_KCM_CONF;
347
348	ret = krb5_prepend_config_files_default(config_file, &files);
349	if (ret)
350	    krb5_err(kcm_context, 1, ret, "getting configuration files");
351
352	ret = krb5_set_config_files(kcm_context, files);
353	krb5_free_config_files(files);
354	if(ret)
355	    krb5_err(kcm_context, 1, ret, "reading configuration files");
356    }
357
358    if(max_request_str)
359	max_request = parse_bytes(max_request_str, NULL);
360
361    if(max_request == 0){
362	p = krb5_config_get_string (kcm_context,
363				    NULL,
364				    "kcm",
365				    "max-request",
366				    NULL);
367	if(p)
368	    max_request = parse_bytes(p, NULL);
369    }
370
371    if (system_principal == NULL) {
372	system_principal = kcm_system_config_get_string("principal");
373    }
374
375    if (system_principal != NULL) {
376	ret = ccache_init_system();
377	if (ret)
378	    krb5_err(kcm_context, 1, ret, "initializing system ccache");
379    }
380
381    if(detach_from_console == -1)
382	detach_from_console = krb5_config_get_bool_default(kcm_context, NULL,
383							   DETACH_IS_DEFAULT,
384							   "kcm",
385							   "detach", NULL);
386    kcm_openlog();
387    if(max_request == 0)
388	max_request = 64 * 1024;
389}
390
391