Fix user2user principal (again)
[heimdal.git] / kcm / client.c
blob09c94b6e8ddd4caa808b9bf3bc5796b7a6219991
1 /*
2 * Copyright (c) 2005, PADL Software Pty Ltd.
3 * All rights reserved.
5 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of PADL Software nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
35 #include "kcm_locl.h"
36 #include <pwd.h>
38 krb5_error_code
39 kcm_ccache_resolve_client(krb5_context context,
40 kcm_client *client,
41 kcm_operation opcode,
42 const char *name,
43 kcm_ccache *ccache)
45 krb5_error_code ret;
46 const char *estr;
48 ret = kcm_ccache_resolve(context, name, ccache);
49 if (ret) {
50 estr = krb5_get_error_message(context, ret);
51 kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
52 krb5_free_error_message(context, estr);
53 return ret;
56 ret = kcm_access(context, client, opcode, *ccache);
57 if (ret) {
58 ret = KRB5_FCC_NOFILE; /* don't disclose */
59 kcm_release_ccache(context, *ccache);
62 return ret;
65 krb5_error_code
66 kcm_ccache_destroy_client(krb5_context context,
67 kcm_client *client,
68 const char *name)
70 krb5_error_code ret;
71 kcm_ccache ccache;
72 const char *estr;
74 ret = kcm_ccache_resolve(context, name, &ccache);
75 if (ret) {
76 estr = krb5_get_error_message(context, ret);
77 kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
78 krb5_free_error_message(context, estr);
79 return ret;
82 ret = kcm_access(context, client, KCM_OP_DESTROY, ccache);
83 kcm_cleanup_events(context, ccache);
84 kcm_release_ccache(context, ccache);
85 if (ret)
86 return ret;
88 return kcm_ccache_destroy(context, name);
91 krb5_error_code
92 kcm_ccache_new_client(krb5_context context,
93 kcm_client *client,
94 const char *name,
95 kcm_ccache *ccache_p)
97 krb5_error_code ret;
98 kcm_ccache ccache;
99 const char *estr;
101 /* We insist the ccache name starts with UID or UID: */
102 if (name_constraints != 0) {
103 char prefix[64];
104 size_t prefix_len;
105 int bad = 1;
107 snprintf(prefix, sizeof(prefix), "%ld:", (long)client->uid);
108 prefix_len = strlen(prefix);
110 if (strncmp(name, prefix, prefix_len) == 0)
111 bad = 0;
112 else {
113 prefix[prefix_len - 1] = '\0';
114 if (strcmp(name, prefix) == 0)
115 bad = 0;
118 /* Allow root to create badly-named ccaches */
119 if (bad && !CLIENT_IS_ROOT(client))
120 return KRB5_CC_BADNAME;
123 ret = kcm_ccache_resolve(context, name, &ccache);
124 if (ret == 0) {
125 if ((ccache->uid != client->uid ||
126 ccache->gid != client->gid) && !CLIENT_IS_ROOT(client))
127 return KRB5_FCC_PERM;
128 } else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) {
129 return ret;
132 if (ret == KRB5_FCC_NOFILE) {
133 ret = kcm_ccache_new(context, name, &ccache);
134 if (ret) {
135 estr = krb5_get_error_message(context, ret);
136 kcm_log(1, "Failed to initialize cache %s: %s", name, estr);
137 krb5_free_error_message(context, estr);
138 return ret;
141 /* bind to current client */
142 ccache->uid = client->uid;
143 ccache->gid = client->gid;
144 ccache->session = client->session;
145 } else {
146 ret = kcm_zero_ccache_data(context, ccache);
147 if (ret) {
148 estr = krb5_get_error_message(context, ret);
149 kcm_log(1, "Failed to empty cache %s: %s", name, estr);
150 krb5_free_error_message(context, estr);
151 kcm_release_ccache(context, ccache);
152 return ret;
154 kcm_cleanup_events(context, ccache);
157 ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache);
158 if (ret) {
159 kcm_release_ccache(context, ccache);
160 kcm_ccache_destroy(context, name);
161 return ret;
165 * Finally, if the user is root and the cache was created under
166 * another user's name, chown the cache to that user and their
167 * default gid.
169 if (CLIENT_IS_ROOT(client)) {
170 unsigned long uid;
171 int matches = sscanf(name,"%ld:",&uid);
172 if (matches == 0)
173 matches = sscanf(name,"%ld",&uid);
174 if (matches == 1) {
175 struct passwd *pwd = getpwuid(uid);
176 if (pwd != NULL) {
177 gid_t gid = pwd->pw_gid;
178 kcm_chown(context, client, ccache, uid, gid);
183 *ccache_p = ccache;
184 return 0;