2 * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 sig_atomic_t exit_flag
= 0;
48 int detach_from_console
= -1;
58 * Allow dropping root bit, since heimdal reopens the database all the
59 * time the database needs to be owned by the user you are switched
60 * too. A better solution is to split the kdc in to more processes and
61 * run the network facing part with very low privilege.
65 switch_environment(void)
68 if ((runas_string
|| chroot_string
) && geteuid() != 0)
69 errx(1, "no running as root, can't switch user/chroot");
71 if (chroot_string
&& chroot(chroot_string
) != 0)
72 errx(1, "chroot(%s)", "chroot_string failed");
77 pw
= getpwnam(runas_string
);
79 errx(1, "unknown user %s", runas_string
);
81 if (initgroups(pw
->pw_name
, pw
->pw_gid
) < 0)
82 err(1, "initgroups failed");
84 if (setgid(pw
->pw_gid
) < 0)
85 err(1, "setgid(%s) failed", runas_string
);
87 if (setuid(pw
->pw_uid
) < 0)
88 err(1, "setuid(%s)", runas_string
);
95 main(int argc
, char **argv
)
99 krb5_kdc_configuration
*config
;
101 setprogname(argv
[0]);
103 ret
= krb5_init_context(&context
);
104 if (ret
== KRB5_CONFIG_BADFORMAT
)
105 errx (1, "krb5_init_context failed to parse configuration file");
107 errx (1, "krb5_init_context failed: %d", ret
);
109 ret
= krb5_kt_register(context
, &hdb_kt_ops
);
111 errx (1, "krb5_kt_register(HDB) failed: %d", ret
);
113 config
= configure(context
, argc
, argv
);
115 #ifdef HAVE_SIGACTION
120 sa
.sa_handler
= sigterm
;
121 sigemptyset(&sa
.sa_mask
);
123 sigaction(SIGINT
, &sa
, NULL
);
124 sigaction(SIGTERM
, &sa
, NULL
);
126 sigaction(SIGXCPU
, &sa
, NULL
);
129 sa
.sa_handler
= SIG_IGN
;
131 sigaction(SIGPIPE
, &sa
, NULL
);
135 signal(SIGINT
, sigterm
);
136 signal(SIGTERM
, sigterm
);
138 signal(SIGXCPU
, sigterm
);
141 signal(SIGPIPE
, SIG_IGN
);
144 #ifdef SUPPORT_DETACH
145 if (detach_from_console
)
149 bonjour_announce(context
, config
);
153 switch_environment();
155 loop(context
, config
);
156 krb5_free_context(context
);