nscd/nscd.c

   1 /* Copyright (c) 1998-2003, 2004, 2005 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 /* nscd - Name Service Cache Daemon. Caches passwd, group, and hosts.  */
  21
  22 #include <argp.h>
  23 #include <assert.h>
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <error.h>
  27 #include <fcntl.h>
  28 #include <libintl.h>
  29 #include <locale.h>
  30 #include <paths.h>
  31 #include <pthread.h>
  32 #include <signal.h>
  33 #include <stdbool.h>
  34 #include <stdio.h>
  35 #include <stdlib.h>
  36 #include <string.h>
  37 #include <syslog.h>
  38 #include <unistd.h>
  39 #include <sys/mman.h>
  40 #include <sys/socket.h>
  41 #include <sys/stat.h>
  42 #include <sys/uio.h>
  43 #include <sys/un.h>
  44
  45 #include "dbg_log.h"
  46 #include "nscd.h"
  47 #include "selinux.h"
  48 #include "../nss/nsswitch.h"
  49 #include <device-nrs.h>
  50
  51 /* Get libc version number.  */
  52 #include <version.h>
  53
  54 #define PACKAGE _libc_intl_domainname
  55
  56 /* Structure used by main() thread to keep track of the number of
  57    active threads.  Used to limit how many threads it will create
  58    and under a shutdown condition to wait till all in-progress
  59    requests have finished before "turning off the lights".  */
  60
  61 typedef struct
  62 {
  63   int             num_active;
  64   pthread_cond_t  thread_exit_cv;
  65   pthread_mutex_t mutex;
  66 } thread_info_t;
  67
  68 thread_info_t thread_info;
  69
  70 int do_shutdown;
  71 int disabled_passwd;
  72 int disabled_group;
  73 int go_background = 1;
  74
  75 int secure_in_use;
  76 static const char *conffile = _PATH_NSCDCONF;
  77
  78 time_t start_time;
  79
  80 uintptr_t pagesize_m1;
  81
  82 int paranoia;
  83 time_t restart_time;
  84 time_t restart_interval = RESTART_INTERVAL;
  85 const char *oldcwd;
  86 uid_t old_uid;
  87 gid_t old_gid;
  88
  89 static int check_pid (const char *file);
  90 static int write_pid (const char *file);
  91
  92 /* Name and version of program.  */
  93 static void print_version (FILE *stream, struct argp_state *state);
  94 void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
  95
  96 /* Definitions of arguments for argp functions.  */
  97 static const struct argp_option options[] =
  98 {
  99   { "config-file", 'f', N_("NAME"), 0,
 100     N_("Read configuration data from NAME") },
 101   { "debug", 'd', NULL, 0,
 102     N_("Do not fork and display messages on the current tty") },
 103   { "nthreads", 't', N_("NUMBER"), 0, N_("Start NUMBER threads") },
 104   { "shutdown", 'K', NULL, 0, N_("Shut the server down") },
 105   { "statistic", 'g', NULL, 0, N_("Print current configuration statistic") },
 106   { "invalidate", 'i', N_("TABLE"), 0,
 107     N_("Invalidate the specified cache") },
 108   { "secure", 'S', N_("TABLE,yes"), OPTION_HIDDEN,
 109     N_("Use separate cache for each user")},
 110   { NULL, 0, NULL, 0, NULL }
 111 };
 112
 113 /* Short description of program.  */
 114 static const char doc[] = N_("Name Service Cache Daemon.");
 115
 116 /* Prototype for option handler.  */
 117 static error_t parse_opt (int key, char *arg, struct argp_state *state);
 118
 119 /* Data structure to communicate with argp functions.  */
 120 static struct argp argp =
 121 {
 122   options, parse_opt, NULL, doc,
 123 };
 124
 125 /* The SIGHUP handler is extern to this file */
 126 extern void sighup_handler(int signum);
 127
 128 /* True if only statistics are requested.  */
 129 static bool get_stats;
 130
 131 int
 132 main (int argc, char **argv)
 133 {
 134   int remaining;
 135
 136   /* Set locale via LC_ALL.  */
 137   setlocale (LC_ALL, "");
 138   /* Set the text message domain.  */
 139   textdomain (PACKAGE);
 140
 141   /* Determine if the kernel has SELinux support.  */
 142   nscd_selinux_enabled (&selinux_enabled);
 143
 144   /* Parse and process arguments.  */
 145   argp_parse (&argp, argc, argv, 0, &remaining, NULL);
 146
 147   if (remaining != argc)
 148     {
 149       error (0, 0, gettext ("wrong number of arguments"));
 150       argp_help (&argp, stdout, ARGP_HELP_SEE, program_invocation_short_name);
 151       exit (1);
 152     }
 153
 154   /* Read the configuration file.  */
 155   if (nscd_parse_file (conffile, dbs) != 0)
 156     {
 157       /* We couldn't read the configuration file.  We don't start the
 158          server.  */
 159       dbg_log (_("cannot read configuration file; this is fatal"));
 160       exit (1);
 161     }
 162
 163   /* Do we only get statistics?  */
 164   if (get_stats)
 165     /* Does not return.  */
 166     receive_print_stats ();
 167
 168   /* Check if we are already running. */
 169   if (check_pid (_PATH_NSCDPID))
 170     error (EXIT_FAILURE, 0, _("already running"));
 171
 172   /* Remember when we started.  */
 173   start_time = time (NULL);
 174
 175   /* Determine page size.  */
 176   pagesize_m1 = getpagesize () - 1;
 177
 178   /* Behave like a daemon.  */
 179   if (go_background)
 180     {
 181       int i;
 182
 183       pid_t pid = fork ();
 184       if (pid == -1)
 185         error (EXIT_FAILURE, errno, _("cannot fork"));
 186       if (pid != 0)
 187         exit (0);
 188
 189       int nullfd = open (_PATH_DEVNULL, O_RDWR);
 190       if (nullfd != -1)
 191         {
 192           struct stat64 st;
 193
 194           if (fstat64 (nullfd, &st) == 0 && S_ISCHR (st.st_mode) != 0
 195 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 196               && st.st_rdev == makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 197 #endif
 198               )
 199             {
 200               /* It is the /dev/null special device alright.  */
 201               (void) dup2 (nullfd, STDIN_FILENO);
 202               (void) dup2 (nullfd, STDOUT_FILENO);
 203               (void) dup2 (nullfd, STDERR_FILENO);
 204
 205               if (nullfd > 2)
 206                 close (nullfd);
 207             }
 208           else
 209             {
 210               /* Ugh, somebody is trying to play a trick on us.  */
 211               close (nullfd);
 212               nullfd = -1;
 213             }
 214         }
 215       int min_close_fd = nullfd == -1 ? 0 : STDERR_FILENO + 1;
 216
 217       DIR *d = opendir ("/proc/self/fd");
 218       if (d != NULL)
 219         {
 220           struct dirent64 *dirent;
 221           int dfdn = dirfd (d);
 222
 223           while ((dirent = readdir64 (d)) != NULL)
 224             {
 225               char *endp;
 226               long int fdn = strtol (dirent->d_name, &endp, 10);
 227
 228               if (*endp == '\0' && fdn != dfdn && fdn >= min_close_fd)
 229                 close ((int) fdn);
 230             }
 231
 232           closedir (d);
 233         }
 234       else
 235         for (i = min_close_fd; i < getdtablesize (); i++)
 236           close (i);
 237
 238       pid = fork ();
 239       if (pid == -1)
 240         error (EXIT_FAILURE, errno, _("cannot fork"));
 241       if (pid != 0)
 242         exit (0);
 243
 244       setsid ();
 245
 246       chdir ("/");
 247
 248       openlog ("nscd", LOG_CONS | LOG_ODELAY, LOG_DAEMON);
 249
 250       if (write_pid (_PATH_NSCDPID) < 0)
 251         dbg_log ("%s: %s", _PATH_NSCDPID, strerror (errno));
 252
 253       if (!init_logfile ())
 254         dbg_log (_("Could not create log file"));
 255
 256       /* Ignore job control signals.  */
 257       signal (SIGTTOU, SIG_IGN);
 258       signal (SIGTTIN, SIG_IGN);
 259       signal (SIGTSTP, SIG_IGN);
 260     }
 261   else
 262     /* In foreground mode we are not paranoid.  */
 263     paranoia = 0;
 264
 265   /* Start the SELinux AVC.  */
 266   if (selinux_enabled)
 267     nscd_avc_init ();
 268
 269   signal (SIGINT, termination_handler);
 270   signal (SIGQUIT, termination_handler);
 271   signal (SIGTERM, termination_handler);
 272   signal (SIGHUP, sighup_handler);
 273   signal (SIGPIPE, SIG_IGN);
 274
 275   /* Cleanup files created by a previous 'bind'.  */
 276   unlink (_PATH_NSCDSOCKET);
 277
 278   /* Make sure we do not get recursive calls.  */
 279   __nss_disable_nscd ();
 280
 281   /* Init databases.  */
 282   nscd_init ();
 283
 284   /* Handle incoming requests */
 285   start_threads ();
 286
 287   return 0;
 288 }
 289
 290
 291 /* Handle program arguments.  */
 292 static error_t
 293 parse_opt (int key, char *arg, struct argp_state *state)
 294 {
 295   switch (key)
 296     {
 297     case 'd':
 298       ++debug_level;
 299       go_background = 0;
 300       break;
 301
 302     case 'f':
 303       conffile = arg;
 304       break;
 305
 306     case 'K':
 307       if (getuid () != 0)
 308         error (4, 0, _("Only root is allowed to use this option!"));
 309       {
 310         int sock = nscd_open_socket ();
 311         request_header req;
 312         ssize_t nbytes;
 313
 314         if (sock == -1)
 315           exit (EXIT_FAILURE);
 316
 317         req.version = NSCD_VERSION;
 318         req.type = SHUTDOWN;
 319         req.key_len = 0;
 320         nbytes = TEMP_FAILURE_RETRY (write (sock, &req,
 321                                             sizeof (request_header)));
 322         close (sock);
 323         exit (nbytes != sizeof (request_header) ? EXIT_FAILURE : EXIT_SUCCESS);
 324       }
 325
 326     case 'g':
 327       get_stats = true;
 328       break;
 329
 330     case 'i':
 331       if (getuid () != 0)
 332         error (4, 0, _("Only root is allowed to use this option!"));
 333       else
 334         {
 335           int sock = nscd_open_socket ();
 336
 337           if (sock == -1)
 338             exit (EXIT_FAILURE);
 339
 340           request_header req;
 341           ssize_t nbytes;
 342           struct iovec iov[2];
 343
 344           if (strcmp (arg, "passwd") == 0)
 345             req.key_len = sizeof "passwd";
 346           else if (strcmp (arg, "group") == 0)
 347             req.key_len = sizeof "group";
 348           else if (strcmp (arg, "hosts") == 0)
 349             req.key_len = sizeof "hosts";
 350           else
 351             return ARGP_ERR_UNKNOWN;
 352
 353           req.version = NSCD_VERSION;
 354           req.type = INVALIDATE;
 355
 356           iov[0].iov_base = &req;
 357           iov[0].iov_len = sizeof (req);
 358           iov[1].iov_base = arg;
 359           iov[1].iov_len = req.key_len;
 360
 361           nbytes = TEMP_FAILURE_RETRY (writev (sock, iov, 2));
 362
 363           close (sock);
 364
 365           exit (nbytes != iov[0].iov_len + iov[1].iov_len
 366                 ? EXIT_FAILURE : EXIT_SUCCESS);
 367         }
 368
 369     case 't':
 370       nthreads = atol (arg);
 371       break;
 372
 373     case 'S':
 374 #if 0
 375       if (strcmp (arg, "passwd,yes") == 0)
 376         secure_in_use = dbs[pwddb].secure = 1;
 377       else if (strcmp (arg, "group,yes") == 0)
 378         secure_in_use = dbs[grpdb].secure = 1;
 379       else if (strcmp (arg, "hosts,yes") == 0)
 380         secure_in_use = dbs[hstdb].secure = 1;
 381 #else
 382       error (0, 0, _("secure services not implemented anymore"));
 383 #endif
 384       break;
 385
 386     default:
 387       return ARGP_ERR_UNKNOWN;
 388     }
 389
 390   return 0;
 391 }
 392
 393 /* Print the version information.  */
 394 static void
 395 print_version (FILE *stream, struct argp_state *state)
 396 {
 397   fprintf (stream, "nscd (GNU %s) %s\n", PACKAGE, VERSION);
 398   fprintf (stream, gettext ("\
 399 Copyright (C) %s Free Software Foundation, Inc.\n\
 400 This is free software; see the source for copying conditions.  There is NO\n\
 401 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\
 402 "), "2005");
 403   fprintf (stream, gettext ("Written by %s.\n"),
 404            "Thorsten Kukuk and Ulrich Drepper");
 405 }
 406
 407
 408 /* Create a socket connected to a name.  */
 409 int
 410 nscd_open_socket (void)
 411 {
 412   struct sockaddr_un addr;
 413   int sock;
 414
 415   sock = socket (PF_UNIX, SOCK_STREAM, 0);
 416   if (sock < 0)
 417     return -1;
 418
 419   addr.sun_family = AF_UNIX;
 420   assert (sizeof (addr.sun_path) >= sizeof (_PATH_NSCDSOCKET));
 421   strcpy (addr.sun_path, _PATH_NSCDSOCKET);
 422   if (connect (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
 423     {
 424       close (sock);
 425       return -1;
 426     }
 427
 428   return sock;
 429 }
 430
 431
 432 /* Cleanup.  */
 433 void
 434 termination_handler (int signum)
 435 {
 436   close_sockets ();
 437
 438   /* Clean up the file created by 'bind'.  */
 439   unlink (_PATH_NSCDSOCKET);
 440
 441   /* Clean up pid file.  */
 442   unlink (_PATH_NSCDPID);
 443
 444   // XXX Terminate threads.
 445
 446   /* Synchronize memory.  */
 447   for (int cnt = 0; cnt < lastdb; ++cnt)
 448     {
 449       if (!dbs[cnt].enabled)
 450         continue;
 451
 452       /* Make sure nobody keeps using the database.  */
 453       dbs[cnt].head->timestamp = 0;
 454
 455       if (dbs[cnt].persistent)
 456         // XXX async OK?
 457         msync (dbs[cnt].head, dbs[cnt].memsize, MS_ASYNC);
 458     }
 459
 460   /* Shutdown the SELinux AVC.  */
 461   if (selinux_enabled)
 462     nscd_avc_destroy ();
 463
 464   _exit (EXIT_SUCCESS);
 465 }
 466
 467 /* Returns 1 if the process in pid file FILE is running, 0 if not.  */
 468 static int
 469 check_pid (const char *file)
 470 {
 471   FILE *fp;
 472
 473   fp = fopen (file, "r");
 474   if (fp)
 475     {
 476       pid_t pid;
 477       int n;
 478
 479       n = fscanf (fp, "%d", &pid);
 480       fclose (fp);
 481
 482       /* If we cannot parse the file default to assuming nscd runs.
 483          If the PID is alive, assume it is running.  That all unless
 484          the PID is the same as the current process' since tha latter
 485          can mean we re-exec.  */
 486       if ((n != 1 || kill (pid, 0) == 0) && pid != getpid ())
 487         return 1;
 488     }
 489
 490   return 0;
 491 }
 492
 493 /* Write the current process id to the file FILE.
 494    Returns 0 if successful, -1 if not.  */
 495 static int
 496 write_pid (const char *file)
 497 {
 498   FILE *fp;
 499
 500   fp = fopen (file, "w");
 501   if (fp == NULL)
 502     return -1;
 503
 504   fprintf (fp, "%d\n", getpid ());
 505   if (fflush (fp) || ferror (fp))
 506     return -1;
 507
 508   fclose (fp);
 509
 510   return 0;
 511 }