nscd/nscd.c

   1 /* Copyright (c) 1998-2006, 2007 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published
   7    by the Free Software Foundation; version 2 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program; if not, write to the Free Software Foundation,
  17    Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
  18
  19 /* nscd - Name Service Cache Daemon. Caches passwd, group, and hosts.  */
  20
  21 #include <argp.h>
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <error.h>
  26 #include <fcntl.h>
  27 #include <libintl.h>
  28 #include <locale.h>
  29 #include <paths.h>
  30 #include <pthread.h>
  31 #include <signal.h>
  32 #include <stdbool.h>
  33 #include <stdio.h>
  34 #include <stdlib.h>
  35 #include <string.h>
  36 #include <syslog.h>
  37 #include <unistd.h>
  38 #include <sys/mman.h>
  39 #include <sys/socket.h>
  40 #include <sys/stat.h>
  41 #include <sys/uio.h>
  42 #include <sys/un.h>
  43
  44 #include "dbg_log.h"
  45 #include "nscd.h"
  46 #include "selinux.h"
  47 #include "../nss/nsswitch.h"
  48 #include <device-nrs.h>
  49
  50 /* Get libc version number.  */
  51 #include <version.h>
  52
  53 #define PACKAGE _libc_intl_domainname
  54
  55 /* Structure used by main() thread to keep track of the number of
  56    active threads.  Used to limit how many threads it will create
  57    and under a shutdown condition to wait till all in-progress
  58    requests have finished before "turning off the lights".  */
  59
  60 typedef struct
  61 {
  62   int             num_active;
  63   pthread_cond_t  thread_exit_cv;
  64   pthread_mutex_t mutex;
  65 } thread_info_t;
  66
  67 thread_info_t thread_info;
  68
  69 int do_shutdown;
  70 int disabled_passwd;
  71 int disabled_group;
  72 int go_background = 1;
  73
  74 static const char *conffile = _PATH_NSCDCONF;
  75
  76 time_t start_time;
  77
  78 uintptr_t pagesize_m1;
  79
  80 int paranoia;
  81 time_t restart_time;
  82 time_t restart_interval = RESTART_INTERVAL;
  83 const char *oldcwd;
  84 uid_t old_uid;
  85 gid_t old_gid;
  86
  87 static int check_pid (const char *file);
  88 static int write_pid (const char *file);
  89
  90 /* Name and version of program.  */
  91 static void print_version (FILE *stream, struct argp_state *state);
  92 void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
  93
  94 /* Definitions of arguments for argp functions.  */
  95 static const struct argp_option options[] =
  96 {
  97   { "config-file", 'f', N_("NAME"), 0,
  98     N_("Read configuration data from NAME") },
  99   { "debug", 'd', NULL, 0,
 100     N_("Do not fork and display messages on the current tty") },
 101   { "nthreads", 't', N_("NUMBER"), 0, N_("Start NUMBER threads") },
 102   { "shutdown", 'K', NULL, 0, N_("Shut the server down") },
 103   { "statistic", 'g', NULL, 0, N_("Print current configuration statistic") },
 104   { "invalidate", 'i', N_("TABLE"), 0,
 105     N_("Invalidate the specified cache") },
 106   { "secure", 'S', N_("TABLE,yes"), OPTION_HIDDEN,
 107     N_("Use separate cache for each user")},
 108   { NULL, 0, NULL, 0, NULL }
 109 };
 110
 111 /* Short description of program.  */
 112 static const char doc[] = N_("Name Service Cache Daemon.");
 113
 114 /* Prototype for option handler.  */
 115 static error_t parse_opt (int key, char *arg, struct argp_state *state);
 116
 117 /* Data structure to communicate with argp functions.  */
 118 static struct argp argp =
 119 {
 120   options, parse_opt, NULL, doc,
 121 };
 122
 123 /* The SIGHUP handler is extern to this file */
 124 extern void sighup_handler(int signum);
 125
 126 /* True if only statistics are requested.  */
 127 static bool get_stats;
 128
 129 int
 130 main (int argc, char **argv)
 131 {
 132   int remaining;
 133
 134   /* Set locale via LC_ALL.  */
 135   setlocale (LC_ALL, "");
 136   /* Set the text message domain.  */
 137   textdomain (PACKAGE);
 138
 139   /* Determine if the kernel has SELinux support.  */
 140   nscd_selinux_enabled (&selinux_enabled);
 141
 142   /* Parse and process arguments.  */
 143   argp_parse (&argp, argc, argv, 0, &remaining, NULL);
 144
 145   if (remaining != argc)
 146     {
 147       error (0, 0, gettext ("wrong number of arguments"));
 148       argp_help (&argp, stdout, ARGP_HELP_SEE, program_invocation_short_name);
 149       exit (1);
 150     }
 151
 152   /* Read the configuration file.  */
 153   if (nscd_parse_file (conffile, dbs) != 0)
 154     /* We couldn't read the configuration file.  We don't start the
 155        server.  */
 156     error (EXIT_FAILURE, 0,
 157            _("failure while reading configuration file; this is fatal"));
 158
 159   /* Do we only get statistics?  */
 160   if (get_stats)
 161     /* Does not return.  */
 162     receive_print_stats ();
 163
 164   /* Check if we are already running. */
 165   if (check_pid (_PATH_NSCDPID))
 166     error (EXIT_FAILURE, 0, _("already running"));
 167
 168   /* Remember when we started.  */
 169   start_time = time (NULL);
 170
 171   /* Determine page size.  */
 172   pagesize_m1 = getpagesize () - 1;
 173
 174   /* Behave like a daemon.  */
 175   if (go_background)
 176     {
 177       int i;
 178
 179       pid_t pid = fork ();
 180       if (pid == -1)
 181         error (EXIT_FAILURE, errno, _("cannot fork"));
 182       if (pid != 0)
 183         exit (0);
 184
 185       int nullfd = open (_PATH_DEVNULL, O_RDWR);
 186       if (nullfd != -1)
 187         {
 188           struct stat64 st;
 189
 190           if (fstat64 (nullfd, &st) == 0 && S_ISCHR (st.st_mode) != 0
 191 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 192               && st.st_rdev == makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 193 #endif
 194               )
 195             {
 196               /* It is the /dev/null special device alright.  */
 197               (void) dup2 (nullfd, STDIN_FILENO);
 198               (void) dup2 (nullfd, STDOUT_FILENO);
 199               (void) dup2 (nullfd, STDERR_FILENO);
 200
 201               if (nullfd > 2)
 202                 close (nullfd);
 203             }
 204           else
 205             {
 206               /* Ugh, somebody is trying to play a trick on us.  */
 207               close (nullfd);
 208               nullfd = -1;
 209             }
 210         }
 211       int min_close_fd = nullfd == -1 ? 0 : STDERR_FILENO + 1;
 212
 213       DIR *d = opendir ("/proc/self/fd");
 214       if (d != NULL)
 215         {
 216           struct dirent64 *dirent;
 217           int dfdn = dirfd (d);
 218
 219           while ((dirent = readdir64 (d)) != NULL)
 220             {
 221               char *endp;
 222               long int fdn = strtol (dirent->d_name, &endp, 10);
 223
 224               if (*endp == '\0' && fdn != dfdn && fdn >= min_close_fd)
 225                 close ((int) fdn);
 226             }
 227
 228           closedir (d);
 229         }
 230       else
 231         for (i = min_close_fd; i < getdtablesize (); i++)
 232           close (i);
 233
 234       pid = fork ();
 235       if (pid == -1)
 236         error (EXIT_FAILURE, errno, _("cannot fork"));
 237       if (pid != 0)
 238         exit (0);
 239
 240       setsid ();
 241
 242       if (chdir ("/") != 0)
 243         error (EXIT_FAILURE, errno,
 244                _("cannot change current working directory to \"/\""));
 245
 246       openlog ("nscd", LOG_CONS | LOG_ODELAY, LOG_DAEMON);
 247
 248       if (write_pid (_PATH_NSCDPID) < 0)
 249         dbg_log ("%s: %s", _PATH_NSCDPID, strerror (errno));
 250
 251       if (!init_logfile ())
 252         dbg_log (_("Could not create log file"));
 253
 254       /* Ignore job control signals.  */
 255       signal (SIGTTOU, SIG_IGN);
 256       signal (SIGTTIN, SIG_IGN);
 257       signal (SIGTSTP, SIG_IGN);
 258     }
 259   else
 260     /* In foreground mode we are not paranoid.  */
 261     paranoia = 0;
 262
 263   /* Start the SELinux AVC.  */
 264   if (selinux_enabled)
 265     nscd_avc_init ();
 266
 267   signal (SIGINT, termination_handler);
 268   signal (SIGQUIT, termination_handler);
 269   signal (SIGTERM, termination_handler);
 270   signal (SIGHUP, sighup_handler);
 271   signal (SIGPIPE, SIG_IGN);
 272
 273   /* Cleanup files created by a previous 'bind'.  */
 274   unlink (_PATH_NSCDSOCKET);
 275
 276   /* Make sure we do not get recursive calls.  */
 277   __nss_disable_nscd ();
 278
 279   /* Init databases.  */
 280   nscd_init ();
 281
 282   /* Handle incoming requests */
 283   start_threads ();
 284
 285   return 0;
 286 }
 287
 288
 289 /* Handle program arguments.  */
 290 static error_t
 291 parse_opt (int key, char *arg, struct argp_state *state)
 292 {
 293   switch (key)
 294     {
 295     case 'd':
 296       ++debug_level;
 297       go_background = 0;
 298       break;
 299
 300     case 'f':
 301       conffile = arg;
 302       break;
 303
 304     case 'K':
 305       if (getuid () != 0)
 306         error (4, 0, _("Only root is allowed to use this option!"));
 307       {
 308         int sock = nscd_open_socket ();
 309
 310         if (sock == -1)
 311           exit (EXIT_FAILURE);
 312
 313         request_header req;
 314         req.version = NSCD_VERSION;
 315         req.type = SHUTDOWN;
 316         req.key_len = 0;
 317
 318         ssize_t nbytes = TEMP_FAILURE_RETRY (send (sock, &req,
 319                                                    sizeof (request_header),
 320                                                    MSG_NOSIGNAL));
 321         close (sock);
 322         exit (nbytes != sizeof (request_header) ? EXIT_FAILURE : EXIT_SUCCESS);
 323       }
 324
 325     case 'g':
 326       get_stats = true;
 327       break;
 328
 329     case 'i':
 330       if (getuid () != 0)
 331         error (4, 0, _("Only root is allowed to use this option!"));
 332       else
 333         {
 334           int sock = nscd_open_socket ();
 335
 336           if (sock == -1)
 337             exit (EXIT_FAILURE);
 338
 339           dbtype cnt;
 340           for (cnt = pwddb; cnt < lastdb; ++cnt)
 341             if (strcmp (arg, dbnames[cnt]) == 0)
 342               break;
 343
 344           if (cnt == lastdb)
 345             return ARGP_ERR_UNKNOWN;
 346
 347           size_t arg_len = strlen (arg) + 1;
 348           struct
 349           {
 350             request_header req;
 351             char arg[arg_len];
 352           } reqdata;
 353
 354           reqdata.req.key_len = strlen (arg) + 1;
 355           reqdata.req.version = NSCD_VERSION;
 356           reqdata.req.type = INVALIDATE;
 357           memcpy (reqdata.arg, arg, arg_len);
 358
 359           ssize_t nbytes = TEMP_FAILURE_RETRY (send (sock, &reqdata,
 360                                                      sizeof (request_header)
 361                                                      + arg_len,
 362                                                      MSG_NOSIGNAL));
 363
 364           if (nbytes != sizeof (request_header) + arg_len)
 365             {
 366               int err = errno;
 367               close (sock);
 368               error (EXIT_FAILURE, err, _("write incomplete"));
 369             }
 370
 371           /* Wait for ack.  Older nscd just closed the socket when
 372              prune_cache finished, silently ignore that.  */
 373           int32_t resp = 0;
 374           nbytes = TEMP_FAILURE_RETRY (read (sock, &resp, sizeof (resp)));
 375           if (nbytes != 0 && nbytes != sizeof (resp))
 376             {
 377               int err = errno;
 378               close (sock);
 379               error (EXIT_FAILURE, err, _("cannot read invalidate ACK"));
 380             }
 381
 382           close (sock);
 383
 384           if (resp != 0)
 385             error (EXIT_FAILURE, resp, _("invalidation failed"));
 386
 387           exit (0);
 388         }
 389
 390     case 't':
 391       nthreads = atol (arg);
 392       break;
 393
 394     case 'S':
 395       error (0, 0, _("secure services not implemented anymore"));
 396       break;
 397
 398     default:
 399       return ARGP_ERR_UNKNOWN;
 400     }
 401
 402   return 0;
 403 }
 404
 405 /* Print the version information.  */
 406 static void
 407 print_version (FILE *stream, struct argp_state *state)
 408 {
 409   fprintf (stream, "nscd (GNU %s) %s\n", PACKAGE, VERSION);
 410   fprintf (stream, gettext ("\
 411 Copyright (C) %s Free Software Foundation, Inc.\n\
 412 This is free software; see the source for copying conditions.  There is NO\n\
 413 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\
 414 "), "2007");
 415   fprintf (stream, gettext ("Written by %s.\n"),
 416            "Thorsten Kukuk and Ulrich Drepper");
 417 }
 418
 419
 420 /* Create a socket connected to a name.  */
 421 int
 422 nscd_open_socket (void)
 423 {
 424   struct sockaddr_un addr;
 425   int sock;
 426
 427   sock = socket (PF_UNIX, SOCK_STREAM, 0);
 428   if (sock < 0)
 429     return -1;
 430
 431   addr.sun_family = AF_UNIX;
 432   assert (sizeof (addr.sun_path) >= sizeof (_PATH_NSCDSOCKET));
 433   strcpy (addr.sun_path, _PATH_NSCDSOCKET);
 434   if (connect (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
 435     {
 436       close (sock);
 437       return -1;
 438     }
 439
 440   return sock;
 441 }
 442
 443
 444 /* Cleanup.  */
 445 void
 446 termination_handler (int signum)
 447 {
 448   close_sockets ();
 449
 450   /* Clean up the file created by 'bind'.  */
 451   unlink (_PATH_NSCDSOCKET);
 452
 453   /* Clean up pid file.  */
 454   unlink (_PATH_NSCDPID);
 455
 456   // XXX Terminate threads.
 457
 458   /* Synchronize memory.  */
 459   for (int cnt = 0; cnt < lastdb; ++cnt)
 460     {
 461       if (!dbs[cnt].enabled)
 462         continue;
 463
 464       /* Make sure nobody keeps using the database.  */
 465       dbs[cnt].head->timestamp = 0;
 466
 467       if (dbs[cnt].persistent)
 468         // XXX async OK?
 469         msync (dbs[cnt].head, dbs[cnt].memsize, MS_ASYNC);
 470     }
 471
 472   /* Shutdown the SELinux AVC.  */
 473   if (selinux_enabled)
 474     nscd_avc_destroy ();
 475
 476   _exit (EXIT_SUCCESS);
 477 }
 478
 479 /* Returns 1 if the process in pid file FILE is running, 0 if not.  */
 480 static int
 481 check_pid (const char *file)
 482 {
 483   FILE *fp;
 484
 485   fp = fopen (file, "r");
 486   if (fp)
 487     {
 488       pid_t pid;
 489       int n;
 490
 491       n = fscanf (fp, "%d", &pid);
 492       fclose (fp);
 493
 494       /* If we cannot parse the file default to assuming nscd runs.
 495          If the PID is alive, assume it is running.  That all unless
 496          the PID is the same as the current process' since tha latter
 497          can mean we re-exec.  */
 498       if ((n != 1 || kill (pid, 0) == 0) && pid != getpid ())
 499         return 1;
 500     }
 501
 502   return 0;
 503 }
 504
 505 /* Write the current process id to the file FILE.
 506    Returns 0 if successful, -1 if not.  */
 507 static int
 508 write_pid (const char *file)
 509 {
 510   FILE *fp;
 511
 512   fp = fopen (file, "w");
 513   if (fp == NULL)
 514     return -1;
 515
 516   fprintf (fp, "%d\n", getpid ());
 517
 518   int result = fflush (fp) || ferror (fp) ? -1 : 0;
 519
 520   fclose (fp);
 521
 522   return result;
 523 }