2 * Unix SMB/CIFS implementation.
3 * Service Control API Implementation
5 * Copyright (C) Marcin Krzysztof Porwit 2005.
6 * Largely Rewritten by:
7 * Copyright (C) Gerald (Jerry) Carter 2005.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "services/services.h"
26 #include "registry/reg_api.h"
27 #include "registry/reg_api_util.h"
28 #include "../libcli/security/security.h"
30 struct rcinit_file_information
{
34 struct service_display_info
{
35 const char *servicename
;
38 const char *description
;
41 struct service_display_info builtin_svcs
[] = {
42 { "Spooler", "smbd", "Print Spooler", "Internal service for spooling files to print devices" },
43 { "NETLOGON", "smbd", "Net Logon", "File service providing access to policy and profile data (not remotely manageable)" },
44 { "RemoteRegistry", "smbd", "Remote Registry Service", "Internal service providing remote access to "
45 "the Samba registry" },
46 { "WINS", "nmbd", "Windows Internet Name Service (WINS)", "Internal service providing a "
47 "NetBIOS point-to-point name server (not remotely manageable)" },
48 { NULL
, NULL
, NULL
, NULL
}
51 struct service_display_info common_unix_svcs
[] = {
52 { "cups", NULL
, "Common Unix Printing System","Provides unified printing support for all operating systems" },
53 { "postfix", NULL
, "Internet Mail Service", "Provides support for sending and receiving electonic mail" },
54 { "sendmail", NULL
, "Internet Mail Service", "Provides support for sending and receiving electonic mail" },
55 { "portmap", NULL
, "TCP Port to RPC PortMapper",NULL
},
56 { "xinetd", NULL
, "Internet Meta-Daemon", NULL
},
57 { "inet", NULL
, "Internet Meta-Daemon", NULL
},
58 { "xntpd", NULL
, "Network Time Service", NULL
},
59 { "ntpd", NULL
, "Network Time Service", NULL
},
60 { "lpd", NULL
, "BSD Print Spooler", NULL
},
61 { "nfsserver", NULL
, "Network File Service", NULL
},
62 { "cron", NULL
, "Scheduling Service", NULL
},
63 { "at", NULL
, "Scheduling Service", NULL
},
64 { "nscd", NULL
, "Name Service Cache Daemon", NULL
},
65 { "slapd", NULL
, "LDAP Directory Service", NULL
},
66 { "ldap", NULL
, "LDAP DIrectory Service", NULL
},
67 { "ypbind", NULL
, "NIS Directory Service", NULL
},
68 { "courier-imap", NULL
, "IMAP4 Mail Service", NULL
},
69 { "courier-pop3", NULL
, "POP3 Mail Service", NULL
},
70 { "named", NULL
, "Domain Name Service", NULL
},
71 { "bind", NULL
, "Domain Name Service", NULL
},
72 { "httpd", NULL
, "HTTP Server", NULL
},
73 { "apache", NULL
, "HTTP Server", "Provides s highly scalable and flexible web server "
74 "capable of implementing various protocols incluing "
75 "but not limited to HTTP" },
76 { "autofs", NULL
, "Automounter", NULL
},
77 { "squid", NULL
, "Web Cache Proxy ", NULL
},
78 { "perfcountd", NULL
, "Performance Monitoring Daemon", NULL
},
79 { "pgsql", NULL
, "PgSQL Database Server", "Provides service for SQL database from Postgresql.org" },
80 { "arpwatch", NULL
, "ARP Tables watcher", "Provides service for monitoring ARP tables for changes" },
81 { "dhcpd", NULL
, "DHCP Server", "Provides service for dynamic host configuration and IP assignment" },
82 { "nwserv", NULL
, "NetWare Server Emulator", "Provides service for emulating Novell NetWare 3.12 server" },
83 { "proftpd", NULL
, "Professional FTP Server", "Provides high configurable service for FTP connection and "
84 "file transferring" },
85 { "ssh2", NULL
, "SSH Secure Shell", "Provides service for secure connection for remote administration" },
86 { "sshd", NULL
, "SSH Secure Shell", "Provides service for secure connection for remote administration" },
87 { NULL
, NULL
, NULL
, NULL
}
90 static WERROR
svcctl_set_secdesc_internal(struct registry_key
*key
,
91 struct security_descriptor
*sec_desc
);
93 /********************************************************************
94 ********************************************************************/
96 static struct security_descriptor
* construct_service_sd( TALLOC_CTX
*ctx
)
98 struct security_ace ace
[4];
100 struct security_descriptor
*sd
= NULL
;
101 struct security_acl
*theacl
= NULL
;
104 /* basic access for Everyone */
106 init_sec_ace(&ace
[i
++], &global_sid_World
,
107 SEC_ACE_TYPE_ACCESS_ALLOWED
, SERVICE_READ_ACCESS
, 0);
109 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Power_Users
,
110 SEC_ACE_TYPE_ACCESS_ALLOWED
, SERVICE_EXECUTE_ACCESS
, 0);
112 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Server_Operators
,
113 SEC_ACE_TYPE_ACCESS_ALLOWED
, SERVICE_ALL_ACCESS
, 0);
114 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Administrators
,
115 SEC_ACE_TYPE_ACCESS_ALLOWED
, SERVICE_ALL_ACCESS
, 0);
117 /* create the security descriptor */
119 theacl
= make_sec_acl(ctx
, NT4_ACL_REVISION
, i
, ace
);
120 if (theacl
== NULL
) {
124 sd
= make_sec_desc(ctx
, SECURITY_DESCRIPTOR_REVISION_1
,
125 SEC_DESC_SELF_RELATIVE
, NULL
, NULL
, NULL
,
134 /********************************************************************
135 This is where we do the dirty work of filling in things like the
136 Display name, Description, etc...
137 ********************************************************************/
139 static char *get_common_service_dispname(TALLOC_CTX
*mem_ctx
,
140 const char *servicename
)
144 for ( i
=0; common_unix_svcs
[i
].servicename
; i
++ ) {
145 if (strequal(servicename
, common_unix_svcs
[i
].servicename
)) {
147 dispname
= talloc_asprintf(mem_ctx
, "%s (%s)",
148 common_unix_svcs
[i
].dispname
,
149 common_unix_svcs
[i
].servicename
);
150 if (dispname
== NULL
) {
157 return talloc_strdup(mem_ctx
, servicename
);
160 /********************************************************************
161 ********************************************************************/
163 static char *cleanup_string( const char *string
)
167 TALLOC_CTX
*ctx
= talloc_tos();
169 clean
= talloc_strdup(ctx
, string
);
175 /* trim any beginning whilespace */
177 while (isspace(*begin
)) {
181 if (*begin
== '\0') {
185 /* trim any trailing whitespace or carriage returns.
186 Start at the end and move backwards */
188 end
= begin
+ strlen(begin
) - 1;
190 while ( isspace(*end
) || *end
=='\n' || *end
=='\r' ) {
198 /********************************************************************
199 ********************************************************************/
201 static bool read_init_file( const char *servicename
, struct rcinit_file_information
**service_info
)
203 struct rcinit_file_information
*info
= NULL
;
204 char *filepath
= NULL
;
209 info
= TALLOC_ZERO_P( NULL
, struct rcinit_file_information
);
214 /* attempt the file open */
216 filepath
= talloc_asprintf(info
, "%s/%s/%s", get_dyn_MODULESDIR(),
217 SVCCTL_SCRIPT_DIR
, servicename
);
222 f
= x_fopen( filepath
, O_RDONLY
, 0 );
224 DEBUG(0,("read_init_file: failed to open [%s]\n", filepath
));
229 while ( (x_fgets( str
, sizeof(str
)-1, f
)) != NULL
) {
230 /* ignore everything that is not a full line
231 comment starting with a '#' */
236 /* Look for a line like '^#.*Description:' */
238 p
= strstr( str
, "Description:" );
242 p
+= strlen( "Description:" ) + 1;
246 desc
= cleanup_string(p
);
248 info
->description
= talloc_strdup( info
, desc
);
254 if ( !info
->description
)
255 info
->description
= talloc_strdup( info
, "External Unix Service" );
257 *service_info
= info
;
258 TALLOC_FREE(filepath
);
263 /********************************************************************
264 This is where we do the dirty work of filling in things like the
265 Display name, Description, etc...
266 ********************************************************************/
268 static WERROR
svcctl_setvalue(struct registry_key
*key
,
270 struct registry_value
*value
)
273 struct registry_value
*existing
;
275 wresult
= reg_queryvalue(talloc_tos(), key
, name
, &existing
);
276 if (W_ERROR_IS_OK(wresult
)) {
279 exists
= ((value
->type
== existing
->type
) &&
280 (data_blob_cmp(&value
->data
, &existing
->data
) == 0));
282 TALLOC_FREE(existing
);
286 * Avoid an expensive write when not necessary
292 wresult
= reg_setvalue(key
, name
, value
);
293 if (!W_ERROR_IS_OK(wresult
)) {
294 DEBUG(0, ("reg_setvalue failed for %s in key %s: %s\n",
295 name
, key
->key
->name
, win_errstr(wresult
)));
301 static WERROR
svcctl_setvalue_dword(struct registry_key
*key
,
305 struct registry_value value
;
307 value
.type
= REG_DWORD
;
308 value
.data
.length
= sizeof(uint32_t);
309 value
.data
.data
= (uint8_t *)&dword
;
311 return svcctl_setvalue(key
, name
, &value
);
314 static WERROR
svcctl_setvalue_sz(struct registry_key
*key
,
318 struct registry_value value
;
320 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
322 if (!push_reg_sz(mem_ctx
, &value
.data
, sz
)) {
323 DEBUG(0, ("push_reg_sz failed\n"));
324 wresult
= WERR_NOMEM
;
329 wresult
= svcctl_setvalue(key
, name
, &value
);
331 talloc_free(mem_ctx
);
335 static void fill_service_values(struct registry_key
*key
)
337 char *dname
, *ipath
, *description
;
340 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
343 name
= strrchr(key
->key
->name
, '\\');
345 name
= key
->key
->name
;
350 /* These values are hardcoded in all QueryServiceConfig() replies.
351 I'm just storing them here for cosmetic purposes */
353 wresult
= svcctl_setvalue_dword(key
, "Start", SVCCTL_AUTO_START
);
354 if (!W_ERROR_IS_OK(wresult
)) {
358 wresult
= svcctl_setvalue_dword(key
, "Type", SERVICE_TYPE_WIN32_OWN_PROCESS
);
359 if (!W_ERROR_IS_OK(wresult
)) {
363 wresult
= svcctl_setvalue_dword(key
, "ErrorControl", SVCCTL_SVC_ERROR_NORMAL
);
364 if (!W_ERROR_IS_OK(wresult
)) {
368 /* everything runs as LocalSystem */
370 wresult
= svcctl_setvalue_sz(key
, "ObjectName", "LocalSystem");
371 if (!W_ERROR_IS_OK(wresult
)) {
375 /* special considerations for internal services and the DisplayName value */
377 for ( i
=0; builtin_svcs
[i
].servicename
; i
++ ) {
378 if ( strequal( name
, builtin_svcs
[i
].servicename
) ) {
379 ipath
= talloc_asprintf(mem_ctx
, "%s/%s/%s",
380 get_dyn_MODULESDIR(),
382 builtin_svcs
[i
].daemon
);
383 description
= talloc_strdup(mem_ctx
, builtin_svcs
[i
].description
);
384 dname
= talloc_strdup(mem_ctx
, builtin_svcs
[i
].dispname
);
389 /* default to an external service if we haven't found a match */
391 if ( builtin_svcs
[i
].servicename
== NULL
) {
392 char *dispname
= NULL
;
393 struct rcinit_file_information
*init_info
= NULL
;
395 ipath
= talloc_asprintf(mem_ctx
, "%s/%s/%s",
396 get_dyn_MODULESDIR(), SVCCTL_SCRIPT_DIR
,
399 /* lookup common unix display names */
400 dispname
= get_common_service_dispname(mem_ctx
, name
);
401 dname
= talloc_strdup(mem_ctx
, dispname
? dispname
: "");
403 /* get info from init file itself */
404 if ( read_init_file( name
, &init_info
) ) {
405 description
= talloc_strdup(mem_ctx
, init_info
->description
);
406 TALLOC_FREE( init_info
);
409 description
= talloc_strdup(mem_ctx
, "External Unix Service");
413 /* add the new values */
415 wresult
= svcctl_setvalue_sz(key
, "DisplayName", dname
);
416 if (!W_ERROR_IS_OK(wresult
)) {
420 wresult
= svcctl_setvalue_sz(key
, "ImagePath", ipath
);
421 if (!W_ERROR_IS_OK(wresult
)) {
425 wresult
= svcctl_setvalue_sz(key
, "Description", description
);
428 talloc_free(mem_ctx
);
432 /********************************************************************
433 ********************************************************************/
435 static void add_new_svc_name(struct registry_key
*key_parent
,
438 struct registry_key
*key_service
= NULL
, *key_secdesc
= NULL
;
440 struct security_descriptor
*sd
= NULL
;
441 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
442 enum winreg_CreateAction action
= REG_ACTION_NONE
;
444 wresult
= reg_createkey(mem_ctx
, key_parent
, name
, REG_KEY_ALL
,
445 &key_service
, &action
);
447 if (!W_ERROR_IS_OK(wresult
)) {
448 DEBUG(0, ("add_new_svc_name: reg_createkey failed for %s\\%s: "
449 "%s\n", key_parent
->key
->name
, name
,
450 win_errstr(wresult
)));
454 /* now for the service values */
456 fill_service_values(key_service
);
458 /* now add the security descriptor */
460 sd
= construct_service_sd(key_secdesc
);
462 DEBUG(0, ("add_new_svc_name: Failed to create default "
467 wresult
= svcctl_set_secdesc_internal(key_service
, sd
);
470 talloc_free(mem_ctx
);
474 /********************************************************************
475 ********************************************************************/
477 void svcctl_init_keys( void )
479 const char **service_list
= lp_svcctl_list();
481 struct registry_key
*key
= NULL
;
482 struct registry_key
*subkey
= NULL
;
484 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
486 /* bad mojo here if the lookup failed. Should not happen */
488 wresult
= reg_open_path(mem_ctx
, KEY_SERVICES
, REG_KEY_ALL
, get_root_nt_token(), &key
);
490 if ( !W_ERROR_IS_OK(wresult
) ) {
491 DEBUG(0,("svcctl_init_keys: key lookup failed! (%s)\n",
492 win_errstr(wresult
)));
496 /* the builtin services exist */
498 for ( i
=0; builtin_svcs
[i
].servicename
; i
++ )
499 add_new_svc_name(key
, builtin_svcs
[i
].servicename
);
501 for ( i
=0; service_list
&& service_list
[i
]; i
++ ) {
503 /* only add new services */
505 wresult
= reg_openkey(mem_ctx
, key
, service_list
[i
], REG_KEY_ALL
, &subkey
);
506 if (W_ERROR_IS_OK(wresult
)) {
510 /* Add the new service key and initialize the appropriate values */
512 add_new_svc_name(key
, service_list
[i
]);
515 /* initialize the control hooks */
517 init_service_op_table();
520 talloc_free(mem_ctx
);
524 /********************************************************************
525 This is where we do the dirty work of filling in things like the
526 Display name, Description, etc...Always return a default secdesc
527 in case of any failure.
528 ********************************************************************/
530 struct security_descriptor
*svcctl_get_secdesc( TALLOC_CTX
*ctx
, const char *name
, struct security_token
*token
)
532 struct registry_key
*key
= NULL
;
533 struct registry_value
*value
;
534 struct security_descriptor
*ret_sd
= NULL
;
538 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
540 path
= talloc_asprintf(mem_ctx
, "%s\\%s\\%s", KEY_SERVICES
, name
,
546 wresult
= reg_open_path(mem_ctx
, path
, REG_KEY_ALL
, token
, &key
);
547 if ( !W_ERROR_IS_OK(wresult
) ) {
548 DEBUG(0,("svcctl_get_secdesc: key lookup failed! [%s] (%s)\n",
549 path
, win_errstr(wresult
)));
553 wresult
= reg_queryvalue(mem_ctx
, key
, "Security", &value
);
554 if (W_ERROR_EQUAL(wresult
, WERR_BADFILE
)) {
555 goto fallback_to_default_sd
;
556 } else if (!W_ERROR_IS_OK(wresult
)) {
557 DEBUG(0, ("svcctl_get_secdesc: error getting value 'Security': "
558 "%s\n", win_errstr(wresult
)));
562 status
= unmarshall_sec_desc(ctx
, value
->data
.data
,
563 value
->data
.length
, &ret_sd
);
565 if (NT_STATUS_IS_OK(status
)) {
569 fallback_to_default_sd
:
570 DEBUG(6, ("svcctl_get_secdesc: constructing default secdesc for "
571 "service [%s]\n", name
));
572 ret_sd
= construct_service_sd(ctx
);
575 talloc_free(mem_ctx
);
579 /********************************************************************
580 Wrapper to make storing a Service sd easier
581 ********************************************************************/
583 static WERROR
svcctl_set_secdesc_internal(struct registry_key
*key
,
584 struct security_descriptor
*sec_desc
)
586 struct registry_key
*key_security
= NULL
;
588 struct registry_value value
;
590 enum winreg_CreateAction action
= REG_ACTION_NONE
;
591 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
593 wresult
= reg_createkey(mem_ctx
, key
, "Security", REG_KEY_ALL
, &key_security
, &action
);
594 if (!W_ERROR_IS_OK(wresult
)) {
595 DEBUG(0, ("svcctl_set_secdesc: reg_createkey failed: "
596 "[%s\\Security] (%s)\n", key
->key
->name
,
597 win_errstr(wresult
)));
601 status
= marshall_sec_desc(mem_ctx
, sec_desc
, &value
.data
.data
,
603 if (!NT_STATUS_IS_OK(status
)) {
604 DEBUG(0, ("svcctl_set_secdesc: marshall_sec_desc() failed: %s\n",
606 wresult
= ntstatus_to_werror(status
);
610 value
.type
= REG_BINARY
;
612 wresult
= reg_setvalue(key_security
, "Security", &value
);
613 if (!W_ERROR_IS_OK(wresult
)) {
614 DEBUG(0, ("svcctl_set_secdesc: reg_setvalue failed: %s\n",
615 win_errstr(wresult
)));
619 talloc_free(mem_ctx
);
623 bool svcctl_set_secdesc(const char *name
, struct security_descriptor
*sec_desc
,
624 struct security_token
*token
)
626 struct registry_key
*key
= NULL
;
630 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
632 path
= talloc_asprintf(mem_ctx
, "%s\\%s", KEY_SERVICES
, name
);
637 wresult
= reg_open_path(mem_ctx
, path
, REG_KEY_ALL
, token
, &key
);
638 if ( !W_ERROR_IS_OK(wresult
) ) {
639 DEBUG(0, ("svcctl_set_secdesc: key lookup failed! [%s] (%s)\n",
640 path
, win_errstr(wresult
)));
644 wresult
= svcctl_set_secdesc_internal(key
, sec_desc
);
646 ret
= W_ERROR_IS_OK(wresult
);
649 talloc_free(mem_ctx
);
653 const char *svcctl_get_string_value(TALLOC_CTX
*ctx
, const char *key_name
,
654 const char *value_name
,
655 struct security_token
*token
)
657 const char *result
= NULL
;
658 struct registry_key
*key
= NULL
;
659 struct registry_value
*value
= NULL
;
662 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
664 path
= talloc_asprintf(mem_ctx
, "%s\\%s", KEY_SERVICES
, key_name
);
669 wresult
= reg_open_path(mem_ctx
, path
, REG_KEY_READ
, token
, &key
);
670 if (!W_ERROR_IS_OK(wresult
)) {
671 DEBUG(0, ("svcctl_get_string_value: key lookup failed! "
672 "[%s] (%s)\n", path
, win_errstr(wresult
)));
676 wresult
= reg_queryvalue(mem_ctx
, key
, value_name
, &value
);
677 if (!W_ERROR_IS_OK(wresult
)) {
678 DEBUG(0, ("svcctl_get_string_value: error getting value "
679 "'%s': %s\n", value_name
, win_errstr(wresult
)));
683 if (value
->type
!= REG_SZ
) {
687 pull_reg_sz(ctx
, &value
->data
, &result
);
692 talloc_free(mem_ctx
);
696 /********************************************************************
697 ********************************************************************/
699 const char *svcctl_lookup_dispname(TALLOC_CTX
*ctx
, const char *name
, struct security_token
*token
)
701 const char *display_name
= NULL
;
703 display_name
= svcctl_get_string_value(ctx
, name
, "DisplayName", token
);
705 if (display_name
== NULL
) {
706 display_name
= talloc_strdup(ctx
, name
);
712 /********************************************************************
713 ********************************************************************/
715 const char *svcctl_lookup_description(TALLOC_CTX
*ctx
, const char *name
, struct security_token
*token
)
717 const char *description
= NULL
;
719 description
= svcctl_get_string_value(ctx
, name
, "Description", token
);
721 if (description
== NULL
) {
722 description
= talloc_strdup(ctx
, "Unix Service");