nscd/nscd.c

   1 /* Copyright (c) 1998-2003, 2004, 2005, 2006 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program; if not, write to the Free Software Foundation,
  16    Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
  17
  18 /* nscd - Name Service Cache Daemon. Caches passwd, group, and hosts.  */
  19
  20 #include <argp.h>
  21 #include <assert.h>
  22 #include <dirent.h>
  23 #include <errno.h>
  24 #include <error.h>
  25 #include <fcntl.h>
  26 #include <libintl.h>
  27 #include <locale.h>
  28 #include <paths.h>
  29 #include <pthread.h>
  30 #include <signal.h>
  31 #include <stdbool.h>
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include <syslog.h>
  36 #include <unistd.h>
  37 #include <sys/mman.h>
  38 #include <sys/socket.h>
  39 #include <sys/stat.h>
  40 #include <sys/uio.h>
  41 #include <sys/un.h>
  42
  43 #include "dbg_log.h"
  44 #include "nscd.h"
  45 #include "selinux.h"
  46 #include "../nss/nsswitch.h"
  47 #include <device-nrs.h>
  48
  49 /* Get libc version number.  */
  50 #include <version.h>
  51
  52 #define PACKAGE _libc_intl_domainname
  53
  54 /* Structure used by main() thread to keep track of the number of
  55    active threads.  Used to limit how many threads it will create
  56    and under a shutdown condition to wait till all in-progress
  57    requests have finished before "turning off the lights".  */
  58
  59 typedef struct
  60 {
  61   int             num_active;
  62   pthread_cond_t  thread_exit_cv;
  63   pthread_mutex_t mutex;
  64 } thread_info_t;
  65
  66 thread_info_t thread_info;
  67
  68 int do_shutdown;
  69 int disabled_passwd;
  70 int disabled_group;
  71 int go_background = 1;
  72
  73 static const char *conffile = _PATH_NSCDCONF;
  74
  75 time_t start_time;
  76
  77 uintptr_t pagesize_m1;
  78
  79 int paranoia;
  80 time_t restart_time;
  81 time_t restart_interval = RESTART_INTERVAL;
  82 const char *oldcwd;
  83 uid_t old_uid;
  84 gid_t old_gid;
  85
  86 static int check_pid (const char *file);
  87 static int write_pid (const char *file);
  88
  89 /* Name and version of program.  */
  90 static void print_version (FILE *stream, struct argp_state *state);
  91 void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
  92
  93 /* Definitions of arguments for argp functions.  */
  94 static const struct argp_option options[] =
  95 {
  96   { "config-file", 'f', N_("NAME"), 0,
  97     N_("Read configuration data from NAME") },
  98   { "debug", 'd', NULL, 0,
  99     N_("Do not fork and display messages on the current tty") },
 100   { "nthreads", 't', N_("NUMBER"), 0, N_("Start NUMBER threads") },
 101   { "shutdown", 'K', NULL, 0, N_("Shut the server down") },
 102   { "statistic", 'g', NULL, 0, N_("Print current configuration statistic") },
 103   { "invalidate", 'i', N_("TABLE"), 0,
 104     N_("Invalidate the specified cache") },
 105   { "secure", 'S', N_("TABLE,yes"), OPTION_HIDDEN,
 106     N_("Use separate cache for each user")},
 107   { NULL, 0, NULL, 0, NULL }
 108 };
 109
 110 /* Short description of program.  */
 111 static const char doc[] = N_("Name Service Cache Daemon.");
 112
 113 /* Prototype for option handler.  */
 114 static error_t parse_opt (int key, char *arg, struct argp_state *state);
 115
 116 /* Data structure to communicate with argp functions.  */
 117 static struct argp argp =
 118 {
 119   options, parse_opt, NULL, doc,
 120 };
 121
 122 /* The SIGHUP handler is extern to this file */
 123 extern void sighup_handler(int signum);
 124
 125 /* True if only statistics are requested.  */
 126 static bool get_stats;
 127
 128 int
 129 main (int argc, char **argv)
 130 {
 131   int remaining;
 132
 133   /* Set locale via LC_ALL.  */
 134   setlocale (LC_ALL, "");
 135   /* Set the text message domain.  */
 136   textdomain (PACKAGE);
 137
 138   /* Determine if the kernel has SELinux support.  */
 139   nscd_selinux_enabled (&selinux_enabled);
 140
 141   /* Parse and process arguments.  */
 142   argp_parse (&argp, argc, argv, 0, &remaining, NULL);
 143
 144   if (remaining != argc)
 145     {
 146       error (0, 0, gettext ("wrong number of arguments"));
 147       argp_help (&argp, stdout, ARGP_HELP_SEE, program_invocation_short_name);
 148       exit (1);
 149     }
 150
 151   /* Read the configuration file.  */
 152   if (nscd_parse_file (conffile, dbs) != 0)
 153     /* We couldn't read the configuration file.  We don't start the
 154        server.  */
 155     error (EXIT_FAILURE, 0,
 156            _("failure while reading configuration file; this is fatal"));
 157
 158   /* Do we only get statistics?  */
 159   if (get_stats)
 160     /* Does not return.  */
 161     receive_print_stats ();
 162
 163   /* Check if we are already running. */
 164   if (check_pid (_PATH_NSCDPID))
 165     error (EXIT_FAILURE, 0, _("already running"));
 166
 167   /* Remember when we started.  */
 168   start_time = time (NULL);
 169
 170   /* Determine page size.  */
 171   pagesize_m1 = getpagesize () - 1;
 172
 173   /* Behave like a daemon.  */
 174   if (go_background)
 175     {
 176       int i;
 177
 178       pid_t pid = fork ();
 179       if (pid == -1)
 180         error (EXIT_FAILURE, errno, _("cannot fork"));
 181       if (pid != 0)
 182         exit (0);
 183
 184       int nullfd = open (_PATH_DEVNULL, O_RDWR);
 185       if (nullfd != -1)
 186         {
 187           struct stat64 st;
 188
 189           if (fstat64 (nullfd, &st) == 0 && S_ISCHR (st.st_mode) != 0
 190 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 191               && st.st_rdev == makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 192 #endif
 193               )
 194             {
 195               /* It is the /dev/null special device alright.  */
 196               (void) dup2 (nullfd, STDIN_FILENO);
 197               (void) dup2 (nullfd, STDOUT_FILENO);
 198               (void) dup2 (nullfd, STDERR_FILENO);
 199
 200               if (nullfd > 2)
 201                 close (nullfd);
 202             }
 203           else
 204             {
 205               /* Ugh, somebody is trying to play a trick on us.  */
 206               close (nullfd);
 207               nullfd = -1;
 208             }
 209         }
 210       int min_close_fd = nullfd == -1 ? 0 : STDERR_FILENO + 1;
 211
 212       DIR *d = opendir ("/proc/self/fd");
 213       if (d != NULL)
 214         {
 215           struct dirent64 *dirent;
 216           int dfdn = dirfd (d);
 217
 218           while ((dirent = readdir64 (d)) != NULL)
 219             {
 220               char *endp;
 221               long int fdn = strtol (dirent->d_name, &endp, 10);
 222
 223               if (*endp == '\0' && fdn != dfdn && fdn >= min_close_fd)
 224                 close ((int) fdn);
 225             }
 226
 227           closedir (d);
 228         }
 229       else
 230         for (i = min_close_fd; i < getdtablesize (); i++)
 231           close (i);
 232
 233       pid = fork ();
 234       if (pid == -1)
 235         error (EXIT_FAILURE, errno, _("cannot fork"));
 236       if (pid != 0)
 237         exit (0);
 238
 239       setsid ();
 240
 241       if (chdir ("/") != 0)
 242         error (EXIT_FAILURE, errno,
 243                _("cannot change current working cirectory to \"/\""));
 244
 245       openlog ("nscd", LOG_CONS | LOG_ODELAY, LOG_DAEMON);
 246
 247       if (write_pid (_PATH_NSCDPID) < 0)
 248         dbg_log ("%s: %s", _PATH_NSCDPID, strerror (errno));
 249
 250       if (!init_logfile ())
 251         dbg_log (_("Could not create log file"));
 252
 253       /* Ignore job control signals.  */
 254       signal (SIGTTOU, SIG_IGN);
 255       signal (SIGTTIN, SIG_IGN);
 256       signal (SIGTSTP, SIG_IGN);
 257     }
 258   else
 259     /* In foreground mode we are not paranoid.  */
 260     paranoia = 0;
 261
 262   /* Start the SELinux AVC.  */
 263   if (selinux_enabled)
 264     nscd_avc_init ();
 265
 266   signal (SIGINT, termination_handler);
 267   signal (SIGQUIT, termination_handler);
 268   signal (SIGTERM, termination_handler);
 269   signal (SIGHUP, sighup_handler);
 270   signal (SIGPIPE, SIG_IGN);
 271
 272   /* Cleanup files created by a previous 'bind'.  */
 273   unlink (_PATH_NSCDSOCKET);
 274
 275   /* Make sure we do not get recursive calls.  */
 276   __nss_disable_nscd ();
 277
 278   /* Init databases.  */
 279   nscd_init ();
 280
 281   /* Handle incoming requests */
 282   start_threads ();
 283
 284   return 0;
 285 }
 286
 287
 288 /* Handle program arguments.  */
 289 static error_t
 290 parse_opt (int key, char *arg, struct argp_state *state)
 291 {
 292   switch (key)
 293     {
 294     case 'd':
 295       ++debug_level;
 296       go_background = 0;
 297       break;
 298
 299     case 'f':
 300       conffile = arg;
 301       break;
 302
 303     case 'K':
 304       if (getuid () != 0)
 305         error (4, 0, _("Only root is allowed to use this option!"));
 306       {
 307         int sock = nscd_open_socket ();
 308         request_header req;
 309         ssize_t nbytes;
 310
 311         if (sock == -1)
 312           exit (EXIT_FAILURE);
 313
 314         req.version = NSCD_VERSION;
 315         req.type = SHUTDOWN;
 316         req.key_len = 0;
 317         nbytes = TEMP_FAILURE_RETRY (send (sock, &req,
 318                                            sizeof (request_header),
 319                                            MSG_NOSIGNAL));
 320         close (sock);
 321         exit (nbytes != sizeof (request_header) ? EXIT_FAILURE : EXIT_SUCCESS);
 322       }
 323
 324     case 'g':
 325       get_stats = true;
 326       break;
 327
 328     case 'i':
 329       if (getuid () != 0)
 330         error (4, 0, _("Only root is allowed to use this option!"));
 331       else
 332         {
 333           int sock = nscd_open_socket ();
 334
 335           if (sock == -1)
 336             exit (EXIT_FAILURE);
 337
 338           request_header req;
 339           ssize_t nbytes;
 340           struct iovec iov[2];
 341
 342           if (strcmp (arg, "passwd") == 0)
 343             req.key_len = sizeof "passwd";
 344           else if (strcmp (arg, "group") == 0)
 345             req.key_len = sizeof "group";
 346           else if (strcmp (arg, "hosts") == 0)
 347             req.key_len = sizeof "hosts";
 348           else
 349             return ARGP_ERR_UNKNOWN;
 350
 351           req.version = NSCD_VERSION;
 352           req.type = INVALIDATE;
 353
 354           iov[0].iov_base = &req;
 355           iov[0].iov_len = sizeof (req);
 356           iov[1].iov_base = arg;
 357           iov[1].iov_len = req.key_len;
 358
 359           nbytes = TEMP_FAILURE_RETRY (writev (sock, iov, 2));
 360
 361           close (sock);
 362
 363           exit (nbytes != iov[0].iov_len + iov[1].iov_len
 364                 ? EXIT_FAILURE : EXIT_SUCCESS);
 365         }
 366
 367     case 't':
 368       nthreads = atol (arg);
 369       break;
 370
 371     case 'S':
 372       error (0, 0, _("secure services not implemented anymore"));
 373       break;
 374
 375     default:
 376       return ARGP_ERR_UNKNOWN;
 377     }
 378
 379   return 0;
 380 }
 381
 382 /* Print the version information.  */
 383 static void
 384 print_version (FILE *stream, struct argp_state *state)
 385 {
 386   fprintf (stream, "nscd (GNU %s) %s\n", PACKAGE, VERSION);
 387   fprintf (stream, gettext ("\
 388 Copyright (C) %s Free Software Foundation, Inc.\n\
 389 This is free software; see the source for copying conditions.  There is NO\n\
 390 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\
 391 "), "2006");
 392   fprintf (stream, gettext ("Written by %s.\n"),
 393            "Thorsten Kukuk and Ulrich Drepper");
 394 }
 395
 396
 397 /* Create a socket connected to a name.  */
 398 int
 399 nscd_open_socket (void)
 400 {
 401   struct sockaddr_un addr;
 402   int sock;
 403
 404   sock = socket (PF_UNIX, SOCK_STREAM, 0);
 405   if (sock < 0)
 406     return -1;
 407
 408   addr.sun_family = AF_UNIX;
 409   assert (sizeof (addr.sun_path) >= sizeof (_PATH_NSCDSOCKET));
 410   strcpy (addr.sun_path, _PATH_NSCDSOCKET);
 411   if (connect (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
 412     {
 413       close (sock);
 414       return -1;
 415     }
 416
 417   return sock;
 418 }
 419
 420
 421 /* Cleanup.  */
 422 void
 423 termination_handler (int signum)
 424 {
 425   close_sockets ();
 426
 427   /* Clean up the file created by 'bind'.  */
 428   unlink (_PATH_NSCDSOCKET);
 429
 430   /* Clean up pid file.  */
 431   unlink (_PATH_NSCDPID);
 432
 433   // XXX Terminate threads.
 434
 435   /* Synchronize memory.  */
 436   for (int cnt = 0; cnt < lastdb; ++cnt)
 437     {
 438       if (!dbs[cnt].enabled)
 439         continue;
 440
 441       /* Make sure nobody keeps using the database.  */
 442       dbs[cnt].head->timestamp = 0;
 443
 444       if (dbs[cnt].persistent)
 445         // XXX async OK?
 446         msync (dbs[cnt].head, dbs[cnt].memsize, MS_ASYNC);
 447     }
 448
 449   /* Shutdown the SELinux AVC.  */
 450   if (selinux_enabled)
 451     nscd_avc_destroy ();
 452
 453   _exit (EXIT_SUCCESS);
 454 }
 455
 456 /* Returns 1 if the process in pid file FILE is running, 0 if not.  */
 457 static int
 458 check_pid (const char *file)
 459 {
 460   FILE *fp;
 461
 462   fp = fopen (file, "r");
 463   if (fp)
 464     {
 465       pid_t pid;
 466       int n;
 467
 468       n = fscanf (fp, "%d", &pid);
 469       fclose (fp);
 470
 471       /* If we cannot parse the file default to assuming nscd runs.
 472          If the PID is alive, assume it is running.  That all unless
 473          the PID is the same as the current process' since tha latter
 474          can mean we re-exec.  */
 475       if ((n != 1 || kill (pid, 0) == 0) && pid != getpid ())
 476         return 1;
 477     }
 478
 479   return 0;
 480 }
 481
 482 /* Write the current process id to the file FILE.
 483    Returns 0 if successful, -1 if not.  */
 484 static int
 485 write_pid (const char *file)
 486 {
 487   FILE *fp;
 488
 489   fp = fopen (file, "w");
 490   if (fp == NULL)
 491     return -1;
 492
 493   fprintf (fp, "%d\n", getpid ());
 494   if (fflush (fp) || ferror (fp))
 495     return -1;
 496
 497   fclose (fp);
 498
 499   return 0;
 500 }