1 /* $NetBSD: config.c,v 1.1.1.1 2011/04/13 18:14:36 elric Exp $ */ 2 3 /* 4 * Copyright (c) 2005, PADL Software Pty Ltd. 5 * All rights reserved. 6 * 7 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * 3. Neither the name of PADL Software nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 */ 36 37 #include "kcm_locl.h" 38 #include <krb5/getarg.h> 39 #include <krb5/parse_bytes.h> 40 41 static const char *config_file; /* location of kcm config file */ 42 43 size_t max_request = 0; /* maximal size of a request */ 44 char *socket_path = NULL; 45 char *door_path = NULL; 46 47 static char *max_request_str; /* `max_request' as a string */ 48 49 #ifdef SUPPORT_DETACH 50 int detach_from_console = -1; 51 #define DETACH_IS_DEFAULT FALSE 52 #endif 53 54 static const char *system_cache_name = NULL; 55 static const char *system_keytab = NULL; 56 static const char *system_principal = NULL; 57 static const char *system_server = NULL; 58 static const char *system_perms = NULL; 59 static const char *system_user = NULL; 60 static const char *system_group = NULL; 61 62 static const char *renew_life = NULL; 63 static const char *ticket_life = NULL; 64 65 int launchd_flag = 0; 66 int disallow_getting_krbtgt = 0; 67 int name_constraints = -1; 68 69 static int help_flag; 70 static int version_flag; 71 72 static struct getargs args[] = { 73 { 74 "cache-name", 0, arg_string, &system_cache_name, 75 "system cache name", "cachename" 76 }, 77 { 78 "config-file", 'c', arg_string, &config_file, 79 "location of config file", "file" 80 }, 81 { 82 "group", 'g', arg_string, &system_group, 83 "system cache group", "group" 84 }, 85 { 86 "max-request", 0, arg_string, &max_request, 87 "max size for a kcm-request", "size" 88 }, 89 { 90 "launchd", 0, arg_flag, &launchd_flag, 91 "when in use by launchd" 92 }, 93 #ifdef SUPPORT_DETACH 94 #if DETACH_IS_DEFAULT 95 { 96 "detach", 'D', arg_negative_flag, &detach_from_console, 97 "don't detach from console" 98 }, 99 #else 100 { 101 "detach", 0 , arg_flag, &detach_from_console, 102 "detach from console" 103 }, 104 #endif 105 #endif 106 { "help", 'h', arg_flag, &help_flag }, 107 { 108 "system-principal", 'k', arg_string, &system_principal, 109 "system principal name", "principal" 110 }, 111 { 112 "lifetime", 'l', arg_string, &ticket_life, 113 "lifetime of system tickets", "time" 114 }, 115 { 116 "mode", 'm', arg_string, &system_perms, 117 "octal mode of system cache", "mode" 118 }, 119 { 120 "name-constraints", 'n', arg_negative_flag, &name_constraints, 121 "disable credentials cache name constraints" 122 }, 123 { 124 "disallow-getting-krbtgt", 0, arg_flag, &disallow_getting_krbtgt, 125 "disable fetching krbtgt from the cache" 126 }, 127 { 128 "renewable-life", 'r', arg_string, &renew_life, 129 "renewable lifetime of system tickets", "time" 130 }, 131 { 132 "socket-path", 's', arg_string, &socket_path, 133 "path to kcm domain socket", "path" 134 }, 135 #ifdef HAVE_DOOR_CREATE 136 { 137 "door-path", 's', arg_string, &door_path, 138 "path to kcm door", "path" 139 }, 140 #endif 141 { 142 "server", 'S', arg_string, &system_server, 143 "server to get system ticket for", "principal" 144 }, 145 { 146 "keytab", 't', arg_string, &system_keytab, 147 "system keytab name", "keytab" 148 }, 149 { 150 "user", 'u', arg_string, &system_user, 151 "system cache owner", "user" 152 }, 153 { "version", 'v', arg_flag, &version_flag } 154 }; 155 156 static int num_args = sizeof(args) / sizeof(args[0]); 157 158 static void 159 usage(int ret) 160 { 161 arg_printusage (args, num_args, NULL, ""); 162 exit (ret); 163 } 164 165 static int parse_owners(kcm_ccache ccache) 166 { 167 uid_t uid = 0; 168 gid_t gid = 0; 169 struct passwd *pw; 170 struct group *gr; 171 int uid_p = 0; 172 int gid_p = 0; 173 174 if (system_user != NULL) { 175 if (isdigit((unsigned char)system_user[0])) { 176 pw = getpwuid(atoi(system_user)); 177 } else { 178 pw = getpwnam(system_user); 179 } 180 if (pw == NULL) { 181 return errno; 182 } 183 184 system_user = strdup(pw->pw_name); 185 if (system_user == NULL) { 186 return ENOMEM; 187 } 188 189 uid = pw->pw_uid; uid_p = 1; 190 gid = pw->pw_gid; gid_p = 1; 191 } 192 193 if (system_group != NULL) { 194 if (isdigit((unsigned char)system_group[0])) { 195 gr = getgrgid(atoi(system_group)); 196 } else { 197 gr = getgrnam(system_group); 198 } 199 if (gr == NULL) { 200 return errno; 201 } 202 203 gid = gr->gr_gid; gid_p = 1; 204 } 205 206 if (uid_p) 207 ccache->uid = uid; 208 else 209 ccache->uid = 0; /* geteuid() XXX */ 210 211 if (gid_p) 212 ccache->gid = gid; 213 else 214 ccache->gid = 0; /* getegid() XXX */ 215 216 return 0; 217 } 218 219 static const char * 220 kcm_system_config_get_string(const char *string) 221 { 222 return krb5_config_get_string(kcm_context, NULL, "kcm", 223 "system_ccache", string, NULL); 224 } 225 226 static krb5_error_code 227 ccache_init_system(void) 228 { 229 kcm_ccache ccache; 230 krb5_error_code ret; 231 232 if (system_cache_name == NULL) 233 system_cache_name = kcm_system_config_get_string("cc_name"); 234 235 ret = kcm_ccache_new(kcm_context, 236 system_cache_name ? system_cache_name : "SYSTEM", 237 &ccache); 238 if (ret) 239 return ret; 240 241 ccache->flags |= KCM_FLAGS_OWNER_IS_SYSTEM; 242 ccache->flags |= KCM_FLAGS_USE_KEYTAB; 243 244 ret = parse_owners(ccache); 245 if (ret) 246 return ret; 247 248 ret = krb5_parse_name(kcm_context, system_principal, &ccache->client); 249 if (ret) { 250 kcm_release_ccache(kcm_context, ccache); 251 return ret; 252 } 253 254 if (system_server == NULL) 255 system_server = kcm_system_config_get_string("server"); 256 257 if (system_server != NULL) { 258 ret = krb5_parse_name(kcm_context, system_server, &ccache->server); 259 if (ret) { 260 kcm_release_ccache(kcm_context, ccache); 261 return ret; 262 } 263 } 264 265 if (system_keytab == NULL) 266 system_keytab = kcm_system_config_get_string("keytab_name"); 267 268 if (system_keytab != NULL) { 269 ret = krb5_kt_resolve(kcm_context, system_keytab, &ccache->key.keytab); 270 } else { 271 ret = krb5_kt_default(kcm_context, &ccache->key.keytab); 272 } 273 if (ret) { 274 kcm_release_ccache(kcm_context, ccache); 275 return ret; 276 } 277 278 if (renew_life == NULL) 279 renew_life = kcm_system_config_get_string("renew_life"); 280 281 if (renew_life == NULL) 282 renew_life = "1 month"; 283 284 if (renew_life != NULL) { 285 ccache->renew_life = parse_time(renew_life, "s"); 286 if (ccache->renew_life < 0) { 287 kcm_release_ccache(kcm_context, ccache); 288 return EINVAL; 289 } 290 } 291 292 if (ticket_life == NULL) 293 ticket_life = kcm_system_config_get_string("ticket_life"); 294 295 if (ticket_life != NULL) { 296 ccache->tkt_life = parse_time(ticket_life, "s"); 297 if (ccache->tkt_life < 0) { 298 kcm_release_ccache(kcm_context, ccache); 299 return EINVAL; 300 } 301 } 302 303 if (system_perms == NULL) 304 system_perms = kcm_system_config_get_string("mode"); 305 306 if (system_perms != NULL) { 307 int mode; 308 309 if (sscanf(system_perms, "%o", &mode) != 1) 310 return EINVAL; 311 312 ccache->mode = mode; 313 } 314 315 if (disallow_getting_krbtgt == -1) { 316 disallow_getting_krbtgt = 317 krb5_config_get_bool_default(kcm_context, NULL, FALSE, "kcm", 318 "disallow-getting-krbtgt", NULL); 319 } 320 321 /* enqueue default actions for credentials cache */ 322 ret = kcm_ccache_enqueue_default(kcm_context, ccache, NULL); 323 324 kcm_release_ccache(kcm_context, ccache); /* retained by event queue */ 325 326 return ret; 327 } 328 329 void 330 kcm_configure(int argc, char **argv) 331 { 332 krb5_error_code ret; 333 int optind = 0; 334 const char *p; 335 336 while(getarg(args, num_args, argc, argv, &optind)) 337 warnx("error at argument `%s'", argv[optind]); 338 339 if(help_flag) 340 usage (0); 341 342 if (version_flag) { 343 print_version(NULL); 344 exit(0); 345 } 346 347 argc -= optind; 348 argv += optind; 349 350 if (argc != 0) 351 usage(1); 352 353 { 354 char **files; 355 356 if(config_file == NULL) 357 config_file = _PATH_KCM_CONF; 358 359 ret = krb5_prepend_config_files_default(config_file, &files); 360 if (ret) 361 krb5_err(kcm_context, 1, ret, "getting configuration files"); 362 363 ret = krb5_set_config_files(kcm_context, files); 364 krb5_free_config_files(files); 365 if(ret) 366 krb5_err(kcm_context, 1, ret, "reading configuration files"); 367 } 368 369 if(max_request_str) 370 max_request = parse_bytes(max_request_str, NULL); 371 372 if(max_request == 0){ 373 p = krb5_config_get_string (kcm_context, 374 NULL, 375 "kcm", 376 "max-request", 377 NULL); 378 if(p) 379 max_request = parse_bytes(p, NULL); 380 } 381 382 if (system_principal == NULL) { 383 system_principal = kcm_system_config_get_string("principal"); 384 } 385 386 if (system_principal != NULL) { 387 ret = ccache_init_system(); 388 if (ret) 389 krb5_err(kcm_context, 1, ret, "initializing system ccache"); 390 } 391 392 #ifdef SUPPORT_DETACH 393 if(detach_from_console == -1) 394 detach_from_console = krb5_config_get_bool_default(kcm_context, NULL, 395 DETACH_IS_DEFAULT, 396 "kcm", 397 "detach", NULL); 398 #endif 399 kcm_openlog(); 400 if(max_request == 0) 401 max_request = 64 * 1024; 402 } 403 404