kcm/client.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of PADL Software nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include "kcm_locl.h"
  34 #include <pwd.h>
  35
  36 RCSID("$Id$");
  37
  38 krb5_error_code
  39 kcm_ccache_resolve_client(krb5_context context,
  40                           kcm_client *client,
  41                           kcm_operation opcode,
  42                           const char *name,
  43                           kcm_ccache *ccache)
  44 {
  45     krb5_error_code ret;
  46
  47     ret = kcm_ccache_resolve(context, name, ccache);
  48     if (ret) {
  49         kcm_log(1, "Failed to resolve cache %s: %s",
  50                 name, krb5_get_err_text(context, ret));
  51         return ret;
  52     }
  53
  54     ret = kcm_access(context, client, opcode, *ccache);
  55     if (ret) {
  56         ret = KRB5_FCC_NOFILE; /* don't disclose */
  57         kcm_release_ccache(context, ccache);
  58     }
  59
  60     return ret;
  61 }
  62
  63 krb5_error_code
  64 kcm_ccache_destroy_client(krb5_context context,
  65                           kcm_client *client,
  66                           const char *name)
  67 {
  68     krb5_error_code ret;
  69     kcm_ccache ccache;
  70
  71     ret = kcm_ccache_resolve(context, name, &ccache);
  72     if (ret) {
  73         kcm_log(1, "Failed to resolve cache %s: %s",
  74                 name, krb5_get_err_text(context, ret));
  75         return ret;
  76     }
  77
  78     ret = kcm_access(context, client, KCM_OP_DESTROY, ccache);
  79     if (ret) {
  80         kcm_release_ccache(context, &ccache);
  81         return ret;
  82     }
  83
  84     ret = kcm_ccache_destroy(context, ccache->name);
  85     if (ret == 0) {
  86         /* don't leave any events dangling */
  87         kcm_cleanup_events(context, ccache);
  88     }
  89
  90     kcm_release_ccache(context, &ccache);
  91     return ret;
  92 }
  93
  94 krb5_error_code
  95 kcm_ccache_new_client(krb5_context context,
  96                       kcm_client *client,
  97                       const char *name,
  98                       kcm_ccache *ccache_p)
  99 {
 100     krb5_error_code ret;
 101     kcm_ccache ccache;
 102
 103     /* We insist the ccache name starts with UID or UID: */
 104     if (name_constraints != 0) {
 105         char prefix[64];
 106         size_t prefix_len;
 107         int bad = 1;
 108
 109         snprintf(prefix, sizeof(prefix), "%ld:", (long)client->uid);
 110         prefix_len = strlen(prefix);
 111
 112         if (strncmp(name, prefix, prefix_len) == 0)
 113             bad = 0;
 114         else {
 115             prefix[prefix_len - 1] = '\0';
 116             if (strcmp(name, prefix) == 0)
 117                 bad = 0;
 118         }
 119
 120         /* Allow root to create badly-named ccaches */
 121         if (bad && !CLIENT_IS_ROOT(client))
 122             return KRB5_CC_BADNAME;
 123     }
 124
 125     ret = kcm_ccache_resolve(context, name, &ccache);
 126     if (ret == 0) {
 127         if ((ccache->uid != client->uid ||
 128              ccache->gid != client->gid) && !CLIENT_IS_ROOT(client))
 129             return KRB5_FCC_PERM;
 130     } else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) {
 131                 return ret;
 132     }
 133
 134     if (ret == KRB5_FCC_NOFILE) {
 135         ret = kcm_ccache_new(context, name, &ccache);
 136         if (ret) {
 137             kcm_log(1, "Failed to initialize cache %s: %s",
 138                     name, krb5_get_err_text(context, ret));
 139             return ret;
 140         }
 141
 142         /* bind to current client */
 143         ccache->uid = client->uid;
 144         ccache->gid = client->gid;
 145     } else {
 146         ret = kcm_zero_ccache_data(context, ccache);
 147         if (ret) {
 148             kcm_log(1, "Failed to empty cache %s: %s",
 149                     name, krb5_get_err_text(context, ret));
 150             kcm_release_ccache(context, &ccache);
 151             return ret;
 152         }
 153         kcm_cleanup_events(context, ccache);
 154     }
 155
 156     ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache);
 157     if (ret) {
 158         kcm_release_ccache(context, &ccache);
 159         kcm_ccache_destroy(context, name);
 160         return ret;
 161     }
 162
 163     /*
 164      * Finally, if the user is root and the cache was created under
 165      * another user's name, chown the cache to that user and their
 166      * default gid.
 167      */
 168     if (CLIENT_IS_ROOT(client)) {
 169         unsigned long uid;
 170         int matches = sscanf(name,"%ld:",&uid);
 171         if (matches == 0)
 172             matches = sscanf(name,"%ld",&uid);
 173         if (matches == 1) {
 174             struct passwd *pwd = getpwuid(uid);
 175             if (pwd != NULL) {
 176                 gid_t gid = pwd->pw_gid;
 177                 kcm_chown(context, client, ccache, uid, gid);
 178             }
 179         }
 180     }
 181
 182     *ccache_p = ccache;
 183     return 0;
 184 }
 185