2 * Copyright (c) 2005, PADL Software Pty Ltd.
5 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of PADL Software nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 #include <parse_bytes.h>
39 static const char *config_file
; /* location of kcm config file */
41 size_t max_request
= 0; /* maximal size of a request */
42 char *socket_path
= NULL
;
44 static char *max_request_str
; /* `max_request' as a string */
46 int detach_from_console
= -1;
47 int daemon_child
= -1;
49 static const char *system_cache_name
= NULL
;
50 static const char *system_keytab
= NULL
;
51 static const char *system_principal
= NULL
;
52 static const char *system_server
= NULL
;
53 static const char *system_perms
= NULL
;
54 static const char *system_user
= NULL
;
55 static const char *system_group
= NULL
;
57 static const char *renew_life
= NULL
;
58 static const char *ticket_life
= NULL
;
61 int disallow_getting_krbtgt
= 0;
62 int name_constraints
= -1;
65 static int version_flag
;
67 static struct getargs args
[] = {
69 "cache-name", 0, arg_string
, &system_cache_name
,
70 "system cache name", "cachename"
73 "config-file", 'c', arg_string
, &config_file
,
74 "location of config file", "file"
77 "group", 'g', arg_string
, &system_group
,
78 "system cache group", "group"
81 "max-request", 0, arg_string
, &max_request
,
82 "max size for a kcm-request", "size"
85 "launchd", 0, arg_flag
, &launchd_flag
,
86 "when in use by launchd", NULL
89 "detach", 0 , arg_flag
, &detach_from_console
,
90 "detach from console", NULL
93 "daemon-child", 0 , arg_integer
, &daemon_child
,
94 "private argument, do not use", NULL
96 { "help", 'h', arg_flag
, &help_flag
, NULL
, NULL
},
98 "system-principal", 'k', arg_string
, &system_principal
,
99 "system principal name", "principal"
102 "lifetime", 'l', arg_string
, &ticket_life
,
103 "lifetime of system tickets", "time"
106 "mode", 'm', arg_string
, &system_perms
,
107 "octal mode of system cache", "mode"
110 "name-constraints", 'n', arg_negative_flag
, &name_constraints
,
111 "disable credentials cache name constraints", NULL
114 "disallow-getting-krbtgt", 0, arg_flag
, &disallow_getting_krbtgt
,
115 "disable fetching krbtgt from the cache", NULL
118 "renewable-life", 'r', arg_string
, &renew_life
,
119 "renewable lifetime of system tickets", "time"
122 "max-request", 'r', arg_integer
, &max_request_str
,
123 "max request size", "bytes"
126 "socket-path", 's', arg_string
, &socket_path
,
127 "path to kcm domain socket", "path"
130 "server", 'S', arg_string
, &system_server
,
131 "server to get system ticket for", "principal"
134 "keytab", 't', arg_string
, &system_keytab
,
135 "system keytab name", "keytab"
138 "user", 'u', arg_string
, &system_user
,
139 "system cache owner", "user"
141 { "version", 'v', arg_flag
, &version_flag
, NULL
, NULL
}
144 static int num_args
= sizeof(args
) / sizeof(args
[0]);
149 arg_printusage (args
, num_args
, NULL
, "");
153 static int parse_owners(kcm_ccache ccache
)
162 if (system_user
!= NULL
) {
163 if (isdigit((unsigned char)system_user
[0])) {
164 pw
= getpwuid(atoi(system_user
));
166 pw
= getpwnam(system_user
);
172 system_user
= strdup(pw
->pw_name
);
173 if (system_user
== NULL
) {
177 uid
= pw
->pw_uid
; uid_p
= 1;
178 gid
= pw
->pw_gid
; gid_p
= 1;
181 if (system_group
!= NULL
) {
182 if (isdigit((unsigned char)system_group
[0])) {
183 gr
= getgrgid(atoi(system_group
));
185 gr
= getgrnam(system_group
);
191 gid
= gr
->gr_gid
; gid_p
= 1;
197 ccache
->uid
= 0; /* geteuid() XXX */
202 ccache
->gid
= 0; /* getegid() XXX */
208 kcm_system_config_get_string(const char *string
)
210 return krb5_config_get_string(kcm_context
, NULL
, "kcm",
211 "system_ccache", string
, NULL
);
214 static krb5_error_code
215 ccache_init_system(void)
220 if (system_cache_name
== NULL
)
221 system_cache_name
= kcm_system_config_get_string("cc_name");
223 ret
= kcm_ccache_new(kcm_context
,
224 system_cache_name
? system_cache_name
: "SYSTEM",
229 ccache
->flags
|= KCM_FLAGS_OWNER_IS_SYSTEM
;
230 ccache
->flags
|= KCM_FLAGS_USE_KEYTAB
;
232 ret
= parse_owners(ccache
);
236 ret
= krb5_parse_name(kcm_context
, system_principal
, &ccache
->client
);
238 kcm_release_ccache(kcm_context
, ccache
);
242 if (system_server
== NULL
)
243 system_server
= kcm_system_config_get_string("server");
245 if (system_server
!= NULL
) {
246 ret
= krb5_parse_name(kcm_context
, system_server
, &ccache
->server
);
248 kcm_release_ccache(kcm_context
, ccache
);
253 if (system_keytab
== NULL
)
254 system_keytab
= kcm_system_config_get_string("keytab_name");
256 if (system_keytab
!= NULL
) {
257 ret
= krb5_kt_resolve(kcm_context
, system_keytab
, &ccache
->key
.keytab
);
259 ret
= krb5_kt_default(kcm_context
, &ccache
->key
.keytab
);
262 kcm_release_ccache(kcm_context
, ccache
);
266 if (renew_life
== NULL
)
267 renew_life
= kcm_system_config_get_string("renew_life");
269 if (renew_life
== NULL
)
270 renew_life
= "6 months";
272 if (renew_life
!= NULL
) {
273 ccache
->renew_life
= parse_time(renew_life
, "s");
274 if (ccache
->renew_life
< 0) {
275 kcm_release_ccache(kcm_context
, ccache
);
280 if (ticket_life
== NULL
)
281 ticket_life
= kcm_system_config_get_string("ticket_life");
283 if (ticket_life
!= NULL
) {
284 ccache
->tkt_life
= parse_time(ticket_life
, "s");
285 if (ccache
->tkt_life
< 0) {
286 kcm_release_ccache(kcm_context
, ccache
);
291 if (system_perms
== NULL
)
292 system_perms
= kcm_system_config_get_string("mode");
294 if (system_perms
!= NULL
) {
297 if (sscanf(system_perms
, "%o", &mode
) != 1)
303 if (disallow_getting_krbtgt
== -1) {
304 disallow_getting_krbtgt
=
305 krb5_config_get_bool_default(kcm_context
, NULL
, FALSE
, "kcm",
306 "disallow-getting-krbtgt", NULL
);
309 /* enqueue default actions for credentials cache */
310 ret
= kcm_ccache_enqueue_default(kcm_context
, ccache
, NULL
);
312 kcm_release_ccache(kcm_context
, ccache
); /* retained by event queue */
318 kcm_configure(int argc
, char **argv
)
324 while (getarg(args
, num_args
, argc
, argv
, &optidx
))
325 warnx("error at argument `%s'", argv
[optidx
]);
344 if(config_file
== NULL
)
345 config_file
= _PATH_KCM_CONF
;
347 ret
= krb5_prepend_config_files_default(config_file
, &files
);
349 krb5_err(kcm_context
, 1, ret
, "getting configuration files");
351 ret
= krb5_set_config_files(kcm_context
, files
);
352 krb5_free_config_files(files
);
354 krb5_err(kcm_context
, 1, ret
, "reading configuration files");
357 if (max_request_str
) {
360 if ((bytes
= parse_bytes(max_request_str
, NULL
)) < 0)
361 krb5_errx(kcm_context
, 1,
362 "--max-request size must be non-negative");
367 if(max_request
== 0){
368 p
= krb5_config_get_string (kcm_context
,
376 if ((bytes
= parse_bytes(max_request_str
, NULL
)) < 0)
377 krb5_errx(kcm_context
, 1,
378 "[kcm] max-request size must be non-negative");
383 if (system_principal
== NULL
) {
384 system_principal
= kcm_system_config_get_string("principal");
387 if (system_principal
!= NULL
) {
388 ret
= ccache_init_system();
390 krb5_err(kcm_context
, 1, ret
, "initializing system ccache");
393 if(detach_from_console
== -1)
394 detach_from_console
= krb5_config_get_bool_default(kcm_context
, NULL
,
400 max_request
= 64 * 1024;