kcm/client.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "kcm_locl.h"
  36 #include <pwd.h>
  37
  38 krb5_error_code
  39 kcm_ccache_resolve_client(krb5_context context,
  40                           kcm_client *client,
  41                           kcm_operation opcode,
  42                           const char *name,
  43                           kcm_ccache *ccache)
  44 {
  45     krb5_error_code ret;
  46     const char *estr;
  47
  48     ret = kcm_ccache_resolve(context, name, ccache);
  49     if (ret) {
  50         char *uid = NULL;
  51
  52         /*
  53          * Both MIT and Heimdal are unable to, in krb5_cc_default(), call to
  54          * KCM (or CCAPI, or LSA, or...) to get the user's default ccache name
  55          * in their collection.  Instead, the default ccache name is obtained
  56          * in a static way, and for KCM that's "%{UID}".  When we
  57          * krb5_cc_switch(), we simply maintain a pointer to the name of the
  58          * ccache that was made the default, but klist can't make use of this
  59          * because krb5_cc_default() can't.
  60          *
  61          * The solution here is to first try resolving the ccache name given by
  62          * the client, and if that fails but the name happens to be what would
  63          * be the library's default KCM ccache name for that user, then try
  64          * resolving it through the default ccache name pointer saved at switch
  65          * time.
  66          */
  67         if (asprintf(&uid, "%llu", (unsigned long long)client->uid) == -1 ||
  68             uid == NULL)
  69             return ENOMEM;
  70
  71         if (strcmp(name, uid) == 0) {
  72             struct kcm_default_cache *c;
  73
  74             for (c = default_caches; c != NULL; c = c->next) {
  75                 if (kcm_is_same_session(client, c->uid, c->session)) {
  76                     if (strcmp(c->name, name) != 0) {
  77                         ret = kcm_ccache_resolve(context, c->name, ccache);
  78                         break;
  79                     }
  80                 }
  81             }
  82         }
  83         free(uid);
  84     }
  85
  86     if (ret) {
  87         estr = krb5_get_error_message(context, ret);
  88         kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
  89         krb5_free_error_message(context, estr);
  90         return ret;
  91     }
  92
  93     ret = kcm_access(context, client, opcode, *ccache);
  94     if (ret) {
  95         ret = KRB5_FCC_NOFILE; /* don't disclose */
  96         kcm_release_ccache(context, *ccache);
  97     }
  98
  99     return ret;
 100 }
 101
 102 krb5_error_code
 103 kcm_ccache_destroy_client(krb5_context context,
 104                           kcm_client *client,
 105                           const char *name)
 106 {
 107     krb5_error_code ret;
 108     kcm_ccache ccache;
 109     const char *estr;
 110
 111     ret = kcm_ccache_resolve(context, name, &ccache);
 112     if (ret) {
 113         estr = krb5_get_error_message(context, ret);
 114         kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
 115         krb5_free_error_message(context, estr);
 116         return ret;
 117     }
 118
 119     ret = kcm_access(context, client, KCM_OP_DESTROY, ccache);
 120     kcm_cleanup_events(context, ccache);
 121     kcm_release_ccache(context, ccache);
 122     if (ret)
 123         return ret;
 124
 125     return kcm_ccache_destroy(context, name);
 126 }
 127
 128 krb5_error_code
 129 kcm_ccache_new_client(krb5_context context,
 130                       kcm_client *client,
 131                       const char *name,
 132                       kcm_ccache *ccache_p)
 133 {
 134     krb5_error_code ret;
 135     kcm_ccache ccache;
 136     const char *estr;
 137
 138     /* We insist the ccache name starts with UID or UID: */
 139     if (name_constraints != 0) {
 140         char prefix[64];
 141         size_t prefix_len;
 142         int bad = 1;
 143
 144         snprintf(prefix, sizeof(prefix), "%ld:", (long)client->uid);
 145         prefix_len = strlen(prefix);
 146
 147         if (strncmp(name, prefix, prefix_len) == 0)
 148             bad = 0;
 149         else {
 150             prefix[prefix_len - 1] = '\0';
 151             if (strcmp(name, prefix) == 0)
 152                 bad = 0;
 153         }
 154
 155         /* Allow root to create badly-named ccaches */
 156         if (bad && !CLIENT_IS_ROOT(client))
 157             return KRB5_CC_BADNAME;
 158     }
 159
 160     ret = kcm_ccache_resolve(context, name, &ccache);
 161     if (ret == 0) {
 162         if ((ccache->uid != client->uid ||
 163              ccache->gid != client->gid) && !CLIENT_IS_ROOT(client))
 164             return KRB5_FCC_PERM;
 165     } else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) {
 166                 return ret;
 167     }
 168
 169     if (ret == KRB5_FCC_NOFILE) {
 170         ret = kcm_ccache_new(context, name, &ccache);
 171         if (ret) {
 172             estr = krb5_get_error_message(context, ret);
 173             kcm_log(1, "Failed to initialize cache %s: %s", name, estr);
 174             krb5_free_error_message(context, estr);
 175             return ret;
 176         }
 177
 178         /* bind to current client */
 179         ccache->uid = client->uid;
 180         ccache->gid = client->gid;
 181         ccache->session = client->session;
 182     } else {
 183         ret = kcm_zero_ccache_data(context, ccache);
 184         if (ret) {
 185             estr = krb5_get_error_message(context, ret);
 186             kcm_log(1, "Failed to empty cache %s: %s", name, estr);
 187             krb5_free_error_message(context, estr);
 188             kcm_release_ccache(context, ccache);
 189             return ret;
 190         }
 191         kcm_cleanup_events(context, ccache);
 192     }
 193
 194     ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache);
 195     if (ret) {
 196         kcm_release_ccache(context, ccache);
 197         kcm_ccache_destroy(context, name);
 198         return ret;
 199     }
 200
 201     /*
 202      * Finally, if the user is root and the cache was created under
 203      * another user's name, chown the cache to that user and their
 204      * default gid.
 205      */
 206     if (CLIENT_IS_ROOT(client)) {
 207         unsigned long uid;
 208         int matches = sscanf(name,"%ld:",&uid);
 209         if (matches == 0)
 210             matches = sscanf(name,"%ld",&uid);
 211         if (matches == 1) {
 212             struct passwd *pwd = getpwuid(uid);
 213             if (pwd != NULL) {
 214                 gid_t gid = pwd->pw_gid;
 215                 kcm_chown(context, client, ccache, uid, gid);
 216             }
 217         }
 218     }
 219
 220     *ccache_p = ccache;
 221     return 0;
 222 }
 223