nscd/nscd.c

   1 /* Copyright (c) 1998-2003, 2004 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 /* nscd - Name Service Cache Daemon. Caches passwd, group, and hosts.  */
  21
  22 #include <argp.h>
  23 #include <assert.h>
  24 #include <dirent.h>
  25 #include <errno.h>
  26 #include <error.h>
  27 #include <fcntl.h>
  28 #include <libintl.h>
  29 #include <locale.h>
  30 #include <paths.h>
  31 #include <pthread.h>
  32 #include <signal.h>
  33 #include <stdbool.h>
  34 #include <stdio.h>
  35 #include <stdlib.h>
  36 #include <string.h>
  37 #include <syslog.h>
  38 #include <unistd.h>
  39 #include <sys/mman.h>
  40 #include <sys/socket.h>
  41 #include <sys/stat.h>
  42 #include <sys/uio.h>
  43 #include <sys/un.h>
  44
  45 #include "dbg_log.h"
  46 #include "nscd.h"
  47 #include "selinux.h"
  48 #include "../nss/nsswitch.h"
  49 #include <device-nrs.h>
  50
  51 /* Get libc version number.  */
  52 #include <version.h>
  53
  54 #define PACKAGE _libc_intl_domainname
  55
  56 /* Structure used by main() thread to keep track of the number of
  57    active threads.  Used to limit how many threads it will create
  58    and under a shutdown condition to wait till all in-progress
  59    requests have finished before "turning off the lights".  */
  60
  61 typedef struct
  62 {
  63   int             num_active;
  64   pthread_cond_t  thread_exit_cv;
  65   pthread_mutex_t mutex;
  66 } thread_info_t;
  67
  68 thread_info_t thread_info;
  69
  70 int do_shutdown;
  71 int disabled_passwd;
  72 int disabled_group;
  73 int go_background = 1;
  74
  75 int secure_in_use;
  76 static const char *conffile = _PATH_NSCDCONF;
  77
  78 time_t start_time;
  79
  80 uintptr_t pagesize_m1;
  81
  82 int paranoia;
  83 time_t restart_time;
  84 time_t restart_interval = RESTART_INTERVAL;
  85 const char *oldcwd;
  86 uid_t old_uid;
  87 gid_t old_gid;
  88
  89 static int check_pid (const char *file);
  90 static int write_pid (const char *file);
  91
  92 /* Name and version of program.  */
  93 static void print_version (FILE *stream, struct argp_state *state);
  94 void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
  95
  96 /* Definitions of arguments for argp functions.  */
  97 static const struct argp_option options[] =
  98 {
  99   { "config-file", 'f', N_("NAME"), 0,
 100     N_("Read configuration data from NAME") },
 101   { "debug", 'd', NULL, 0,
 102     N_("Do not fork and display messages on the current tty") },
 103   { "nthreads", 't', N_("NUMBER"), 0, N_("Start NUMBER threads") },
 104   { "shutdown", 'K', NULL, 0, N_("Shut the server down") },
 105   { "statistic", 'g', NULL, 0, N_("Print current configuration statistic") },
 106   { "invalidate", 'i', N_("TABLE"), 0,
 107     N_("Invalidate the specified cache") },
 108   { "secure", 'S', N_("TABLE,yes"), OPTION_HIDDEN,
 109     N_("Use separate cache for each user")},
 110   { NULL, 0, NULL, 0, NULL }
 111 };
 112
 113 /* Short description of program.  */
 114 static const char doc[] = N_("Name Service Cache Daemon.");
 115
 116 /* Prototype for option handler.  */
 117 static error_t parse_opt (int key, char *arg, struct argp_state *state);
 118
 119 /* Data structure to communicate with argp functions.  */
 120 static struct argp argp =
 121 {
 122   options, parse_opt, NULL, doc,
 123 };
 124
 125 /* True if only statistics are requested.  */
 126 static bool get_stats;
 127
 128 int
 129 main (int argc, char **argv)
 130 {
 131   int remaining;
 132
 133   /* Set locale via LC_ALL.  */
 134   setlocale (LC_ALL, "");
 135   /* Set the text message domain.  */
 136   textdomain (PACKAGE);
 137
 138   /* Determine if the kernel has SELinux support.  */
 139   nscd_selinux_enabled (&selinux_enabled);
 140
 141   /* Parse and process arguments.  */
 142   argp_parse (&argp, argc, argv, 0, &remaining, NULL);
 143
 144   if (remaining != argc)
 145     {
 146       error (0, 0, gettext ("wrong number of arguments"));
 147       argp_help (&argp, stdout, ARGP_HELP_SEE, program_invocation_short_name);
 148       exit (EXIT_FAILURE);
 149     }
 150
 151   /* Read the configuration file.  */
 152   if (nscd_parse_file (conffile, dbs) != 0)
 153     {
 154       /* We couldn't read the configuration file.  We don't start the
 155          server.  */
 156       dbg_log (_("cannot read configuration file; this is fatal"));
 157       exit (1);
 158     }
 159
 160   /* Do we only get statistics?  */
 161   if (get_stats)
 162     /* Does not return.  */
 163     receive_print_stats ();
 164
 165   /* Check if we are already running. */
 166   if (check_pid (_PATH_NSCDPID))
 167     error (EXIT_FAILURE, 0, _("already running"));
 168
 169   /* Remember when we started.  */
 170   start_time = time (NULL);
 171
 172   /* Determine page size.  */
 173   pagesize_m1 = getpagesize () - 1;
 174
 175   /* Behave like a daemon.  */
 176   if (go_background)
 177     {
 178       int i;
 179
 180       pid_t pid = fork ();
 181       if (pid == -1)
 182         error (EXIT_FAILURE, errno, _("cannot fork"));
 183       if (pid != 0)
 184         exit (0);
 185
 186       int nullfd = open (_PATH_DEVNULL, O_RDWR);
 187       if (nullfd != -1)
 188         {
 189           struct stat64 st;
 190
 191           if (fstat64 (nullfd, &st) == 0 && S_ISCHR (st.st_mode) != 0
 192 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 193               && st.st_rdev == makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 194 #endif
 195               )
 196             {
 197               /* It is the /dev/null special device alright.  */
 198               (void) dup2 (nullfd, STDIN_FILENO);
 199               (void) dup2 (nullfd, STDOUT_FILENO);
 200               (void) dup2 (nullfd, STDERR_FILENO);
 201
 202               if (nullfd > 2)
 203                 close (nullfd);
 204             }
 205           else
 206             {
 207               /* Ugh, somebody is trying to play a trick on us.  */
 208               close (nullfd);
 209               nullfd = -1;
 210             }
 211         }
 212       int min_close_fd = nullfd == -1 ? 0 : STDERR_FILENO + 1;
 213
 214       DIR *d = opendir ("/proc/self/fd");
 215       if (d != NULL)
 216         {
 217           struct dirent64 *dirent;
 218           int dfdn = dirfd (d);
 219
 220           while ((dirent = readdir64 (d)) != NULL)
 221             {
 222               char *endp;
 223               long int fdn = strtol (dirent->d_name, &endp, 10);
 224
 225               if (*endp == '\0' && fdn != dfdn && fdn >= min_close_fd)
 226                 close ((int) fdn);
 227             }
 228
 229           closedir (d);
 230         }
 231       else
 232         for (i = min_close_fd; i < getdtablesize (); i++)
 233           close (i);
 234
 235       pid = fork ();
 236       if (pid == -1)
 237         error (EXIT_FAILURE, errno, _("cannot fork"));
 238       if (pid != 0)
 239         exit (0);
 240
 241       setsid ();
 242
 243       chdir ("/");
 244
 245       openlog ("nscd", LOG_CONS | LOG_ODELAY, LOG_DAEMON);
 246
 247       if (write_pid (_PATH_NSCDPID) < 0)
 248         dbg_log ("%s: %s", _PATH_NSCDPID, strerror (errno));
 249
 250       if (!init_logfile ())
 251         dbg_log (_("Could not create log file"));
 252
 253       /* Ignore job control signals.  */
 254       signal (SIGTTOU, SIG_IGN);
 255       signal (SIGTTIN, SIG_IGN);
 256       signal (SIGTSTP, SIG_IGN);
 257     }
 258   else
 259     /* In foreground mode we are not paranoid.  */
 260     paranoia = 0;
 261
 262   /* Start the SELinux AVC.  */
 263   if (selinux_enabled)
 264     nscd_avc_init ();
 265
 266   signal (SIGINT, termination_handler);
 267   signal (SIGQUIT, termination_handler);
 268   signal (SIGTERM, termination_handler);
 269   signal (SIGPIPE, SIG_IGN);
 270
 271   /* Cleanup files created by a previous 'bind'.  */
 272   unlink (_PATH_NSCDSOCKET);
 273
 274   /* Make sure we do not get recursive calls.  */
 275   __nss_disable_nscd ();
 276
 277   /* Init databases.  */
 278   nscd_init ();
 279
 280   /* Handle incoming requests */
 281   start_threads ();
 282
 283   return 0;
 284 }
 285
 286
 287 /* Handle program arguments.  */
 288 static error_t
 289 parse_opt (int key, char *arg, struct argp_state *state)
 290 {
 291   switch (key)
 292     {
 293     case 'd':
 294       ++debug_level;
 295       go_background = 0;
 296       break;
 297
 298     case 'f':
 299       conffile = arg;
 300       break;
 301
 302     case 'K':
 303       if (getuid () != 0)
 304         error (EXIT_FAILURE, 0, _("Only root is allowed to use this option!"));
 305       {
 306         int sock = nscd_open_socket ();
 307         request_header req;
 308         ssize_t nbytes;
 309
 310         if (sock == -1)
 311           exit (EXIT_FAILURE);
 312
 313         req.version = NSCD_VERSION;
 314         req.type = SHUTDOWN;
 315         req.key_len = 0;
 316         nbytes = TEMP_FAILURE_RETRY (write (sock, &req,
 317                                             sizeof (request_header)));
 318         close (sock);
 319         exit (nbytes != sizeof (request_header) ? EXIT_FAILURE : EXIT_SUCCESS);
 320       }
 321
 322     case 'g':
 323       get_stats = true;
 324       break;
 325
 326     case 'i':
 327       if (getuid () != 0)
 328         error (EXIT_FAILURE, 0, _("Only root is allowed to use this option!"));
 329       else
 330         {
 331           int sock = nscd_open_socket ();
 332
 333           if (sock == -1)
 334             exit (EXIT_FAILURE);
 335
 336           request_header req;
 337           ssize_t nbytes;
 338           struct iovec iov[2];
 339
 340           if (strcmp (arg, "passwd") == 0)
 341             req.key_len = sizeof "passwd";
 342           else if (strcmp (arg, "group") == 0)
 343             req.key_len = sizeof "group";
 344           else if (strcmp (arg, "hosts") == 0)
 345             req.key_len = sizeof "hosts";
 346           else
 347             return ARGP_ERR_UNKNOWN;
 348
 349           req.version = NSCD_VERSION;
 350           req.type = INVALIDATE;
 351
 352           iov[0].iov_base = &req;
 353           iov[0].iov_len = sizeof (req);
 354           iov[1].iov_base = arg;
 355           iov[1].iov_len = req.key_len;
 356
 357           nbytes = TEMP_FAILURE_RETRY (writev (sock, iov, 2));
 358
 359           close (sock);
 360
 361           exit (nbytes != iov[0].iov_len + iov[1].iov_len
 362                 ? EXIT_FAILURE : EXIT_SUCCESS);
 363         }
 364
 365     case 't':
 366       nthreads = atol (arg);
 367       break;
 368
 369     case 'S':
 370 #if 0
 371       if (strcmp (arg, "passwd,yes") == 0)
 372         secure_in_use = dbs[pwddb].secure = 1;
 373       else if (strcmp (arg, "group,yes") == 0)
 374         secure_in_use = dbs[grpdb].secure = 1;
 375       else if (strcmp (arg, "hosts,yes") == 0)
 376         secure_in_use = dbs[hstdb].secure = 1;
 377 #else
 378       error (0, 0, _("secure services not implemented anymore"));
 379 #endif
 380       break;
 381
 382     default:
 383       return ARGP_ERR_UNKNOWN;
 384     }
 385
 386   return 0;
 387 }
 388
 389 /* Print the version information.  */
 390 static void
 391 print_version (FILE *stream, struct argp_state *state)
 392 {
 393   fprintf (stream, "nscd (GNU %s) %s\n", PACKAGE, VERSION);
 394   fprintf (stream, gettext ("\
 395 Copyright (C) %s Free Software Foundation, Inc.\n\
 396 This is free software; see the source for copying conditions.  There is NO\n\
 397 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\
 398 "), "2004");
 399   fprintf (stream, gettext ("Written by %s.\n"),
 400            "Thorsten Kukuk and Ulrich Drepper");
 401 }
 402
 403
 404 /* Create a socket connected to a name.  */
 405 int
 406 nscd_open_socket (void)
 407 {
 408   struct sockaddr_un addr;
 409   int sock;
 410
 411   sock = socket (PF_UNIX, SOCK_STREAM, 0);
 412   if (sock < 0)
 413     return -1;
 414
 415   addr.sun_family = AF_UNIX;
 416   assert (sizeof (addr.sun_path) >= sizeof (_PATH_NSCDSOCKET));
 417   strcpy (addr.sun_path, _PATH_NSCDSOCKET);
 418   if (connect (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
 419     {
 420       close (sock);
 421       return -1;
 422     }
 423
 424   return sock;
 425 }
 426
 427
 428 /* Cleanup.  */
 429 void
 430 termination_handler (int signum)
 431 {
 432   close_sockets ();
 433
 434   /* Clean up the file created by 'bind'.  */
 435   unlink (_PATH_NSCDSOCKET);
 436
 437   /* Clean up pid file.  */
 438   unlink (_PATH_NSCDPID);
 439
 440   // XXX Terminate threads.
 441
 442   /* Synchronize memory.  */
 443   for (int cnt = 0; cnt < lastdb; ++cnt)
 444     {
 445       /* Make sure nobody keeps using the database.  */
 446       dbs[cnt].head->timestamp = 0;
 447
 448       if (dbs[cnt].persistent)
 449         // XXX async OK?
 450         msync (dbs[cnt].head, dbs[cnt].memsize, MS_ASYNC);
 451     }
 452
 453   /* Shutdown the SELinux AVC.  */
 454   if (selinux_enabled)
 455     nscd_avc_destroy ();
 456
 457   _exit (EXIT_SUCCESS);
 458 }
 459
 460 /* Returns 1 if the process in pid file FILE is running, 0 if not.  */
 461 static int
 462 check_pid (const char *file)
 463 {
 464   FILE *fp;
 465
 466   fp = fopen (file, "r");
 467   if (fp)
 468     {
 469       pid_t pid;
 470       int n;
 471
 472       n = fscanf (fp, "%d", &pid);
 473       fclose (fp);
 474
 475       /* If we cannot parse the file default to assuming nscd runs.
 476          If the PID is alive, assume it is running.  That all unless
 477          the PID is the same as the current process' since tha latter
 478          can mean we re-exec.  */
 479       if ((n != 1 || kill (pid, 0) == 0) && pid != getpid ())
 480         return 1;
 481     }
 482
 483   return 0;
 484 }
 485
 486 /* Write the current process id to the file FILE.
 487    Returns 0 if successful, -1 if not.  */
 488 static int
 489 write_pid (const char *file)
 490 {
 491   FILE *fp;
 492
 493   fp = fopen (file, "w");
 494   if (fp == NULL)
 495     return -1;
 496
 497   fprintf (fp, "%d\n", getpid ());
 498   if (fflush (fp) || ferror (fp))
 499     return -1;
 500
 501   fclose (fp);
 502
 503   return 0;
 504 }