4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
27 * Copyright (c) 2012, Joyent, Inc. All rights reserved.
28 * Copyright (c) 2016 by Delphix. All rights reserved.
43 #include <stdio_ext.h>
47 #include <sys/corectl.h>
48 #include <sys/resource.h>
57 * This file manages the overall startup and shutdown of configd, as well
58 * as managing its door thread pool and per-thread datastructures.
60 * 1. Per-thread Datastructures
61 * -----------------------------
62 * Each configd thread has an associated thread_info_t which contains its
63 * current state. A pointer is kept to this in TSD, keyed by thread_info_key.
64 * The thread_info_ts for all threads in configd are kept on a single global
65 * list, thread_list. After creation, the state in the thread_info structure
66 * is only modified by the associated thread, so no locking is needed. A TSD
67 * destructor removes the thread_info from the global list and frees it at
68 * pthread_exit() time.
70 * Threads access their per-thread data using thread_self()
72 * The thread_list is protected by thread_lock, a leaf lock.
74 * 2. Door Thread Pool Management
75 * ------------------------------
76 * Whenever door_return(3door) returns from the kernel and there are no
77 * other configd threads waiting for requests, libdoor automatically
78 * invokes a function registered with door_server_create(), to request a new
79 * door server thread. The default function just creates a thread that calls
80 * door_return(3door). Unfortunately, since it can take a while for the new
81 * thread to *get* to door_return(3door), a stream of requests can cause a
82 * large number of threads to be created, even though they aren't all needed.
84 * In our callback, new_server_needed(), we limit ourself to two new threads
85 * at a time -- this logic is handled in reserve_new_thread(). This keeps
86 * us from creating an absurd number of threads in response to peaking load.
88 static pthread_key_t thread_info_key
;
89 static pthread_attr_t thread_attr
;
91 static pthread_mutex_t thread_lock
= PTHREAD_MUTEX_INITIALIZER
;
92 int num_started
; /* number actually running */
93 int num_servers
; /* number in-progress or running */
94 static uu_list_pool_t
*thread_pool
;
95 uu_list_t
*thread_list
;
97 static thread_info_t main_thread_info
;
101 static pid_t privileged_pid
= 0;
102 static int privileged_psinfo_fd
= -1;
104 static int privileged_user
= 0;
106 static priv_set_t
*privileged_privs
;
108 static int log_to_syslog
= 0;
110 int is_main_repository
= 1;
112 int max_repository_backups
= 4;
114 #define CONFIGD_MAX_FDS 262144
117 _umem_options_init(void)
120 * Like svc.startd, we set our UMEM_OPTIONS to indicate that we do not
121 * wish to have per-CPU magazines to reduce our memory footprint. And
122 * as with svc.startd, if svc.configd is so MT-hot that this becomes a
123 * scalability problem, there are deeper issues...
125 return ("nomagazines"); /* UMEM_OPTIONS setting */
132 abort_handler(int sig
, siginfo_t
*sip
, ucontext_t
*ucp
)
134 struct sigaction act
;
136 (void) sigemptyset(&act
.sa_mask
);
137 act
.sa_handler
= SIG_DFL
;
139 (void) sigaction(sig
, &act
, NULL
);
141 (void) printstack(2);
143 if (sip
!= NULL
&& SI_FROMUSER(sip
))
144 (void) pthread_kill(pthread_self(), sig
);
145 (void) sigfillset(&ucp
->uc_sigmask
);
146 (void) sigdelset(&ucp
->uc_sigmask
, sig
);
147 ucp
->uc_flags
|= UC_SIGMASK
;
148 (void) setcontext(ucp
);
152 * Don't want to have more than a couple thread creates outstanding
155 reserve_new_thread(void)
157 (void) pthread_mutex_lock(&thread_lock
);
158 assert(num_started
>= 0);
159 if (num_servers
> num_started
+ 1) {
160 (void) pthread_mutex_unlock(&thread_lock
);
164 (void) pthread_mutex_unlock(&thread_lock
);
169 thread_info_free(thread_info_t
*ti
)
171 uu_list_node_fini(ti
, &ti
->ti_node
, thread_pool
);
172 if (ti
->ti_ucred
!= NULL
)
173 uu_free(ti
->ti_ucred
);
178 thread_exiting(void *arg
)
180 thread_info_t
*ti
= arg
;
183 log_enter(&ti
->ti_log
);
185 (void) pthread_mutex_lock(&thread_lock
);
188 uu_list_remove(thread_list
, ti
);
190 assert(num_servers
> 0);
193 if (num_servers
== 0) {
194 configd_critical("no door server threads\n");
197 (void) pthread_mutex_unlock(&thread_lock
);
199 if (ti
!= NULL
&& ti
!= &main_thread_info
)
200 thread_info_free(ti
);
204 thread_newstate(thread_info_t
*ti
, thread_state_t newstate
)
206 ti
->ti_ucred_read
= 0; /* invalidate cached ucred */
207 if (newstate
!= ti
->ti_state
) {
208 ti
->ti_prev_state
= ti
->ti_state
;
209 ti
->ti_state
= newstate
;
210 ti
->ti_lastchange
= gethrtime();
217 return (pthread_getspecific(thread_info_key
));
221 * get_ucred() returns NULL if it was unable to get the credential
227 thread_info_t
*ti
= thread_self();
228 ucred_t
**ret
= &ti
->ti_ucred
;
230 if (ti
->ti_ucred_read
)
231 return (*ret
); /* cached value */
233 if (door_ucred(ret
) != 0)
235 ti
->ti_ucred_read
= 1;
241 ucred_is_privileged(ucred_t
*uc
)
243 const priv_set_t
*ps
;
245 if ((ps
= ucred_getprivset(uc
, PRIV_EFFECTIVE
)) != NULL
) {
246 if (priv_isfullset(ps
))
247 return (1); /* process has all privs */
249 if (privileged_privs
!= NULL
&&
250 priv_issubset(privileged_privs
, ps
))
251 return (1); /* process has zone privs */
258 thread_start(void *arg
)
260 thread_info_t
*ti
= arg
;
262 (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE
, NULL
);
264 (void) pthread_mutex_lock(&thread_lock
);
266 (void) uu_list_insert_after(thread_list
, uu_list_last(thread_list
),
268 (void) pthread_mutex_unlock(&thread_lock
);
269 (void) pthread_setspecific(thread_info_key
, ti
);
271 thread_newstate(ti
, TI_DOOR_RETURN
);
274 * Start handling door calls
276 (void) door_return(NULL
, 0, NULL
, 0);
281 new_thread_needed(door_info_t
*dip
)
289 if (!reserve_new_thread())
292 if ((ti
= uu_zalloc(sizeof (*ti
))) == NULL
)
295 uu_list_node_init(ti
, &ti
->ti_node
, thread_pool
);
296 ti
->ti_state
= TI_CREATED
;
297 ti
->ti_prev_state
= TI_CREATED
;
299 if ((ti
->ti_ucred
= uu_zalloc(ucred_size())) == NULL
)
302 (void) sigfillset(&new);
303 (void) pthread_sigmask(SIG_SETMASK
, &new, &old
);
304 if ((errno
= pthread_create(&ti
->ti_thread
, &thread_attr
, thread_start
,
306 (void) pthread_sigmask(SIG_SETMASK
, &old
, NULL
);
310 (void) pthread_sigmask(SIG_SETMASK
, &old
, NULL
);
315 * Since the thread_info structure was never linked onto the
316 * thread list, thread_exiting() can't handle the cleanup.
318 thread_exiting(NULL
);
320 thread_info_free(ti
);
324 create_connection(ucred_t
*uc
, repository_door_request_t
*rp
,
325 size_t rp_size
, int *out_fd
)
329 uint32_t debugflags
= 0;
332 if (privileged_pid
!= 0) {
334 * in privileged pid mode, we only allow connections from
335 * our original parent -- the psinfo read verifies that
336 * it is the same process which we started with.
338 if (ucred_getpid(uc
) != privileged_pid
||
339 read(privileged_psinfo_fd
, &info
, sizeof (info
)) !=
341 return (REPOSITORY_DOOR_FAIL_PERMISSION_DENIED
);
343 privileged
= 1; /* it gets full privileges */
344 } else if (privileged_user
!= 0) {
346 * in privileged user mode, only one particular user is
347 * allowed to connect to us, and they can do anything.
349 if (ucred_geteuid(uc
) != privileged_user
)
350 return (REPOSITORY_DOOR_FAIL_PERMISSION_DENIED
);
356 * Check that rp, of size rp_size, is large enough to
357 * contain field 'f'. If so, write the value into *out, and return 1.
358 * Otherwise, return 0.
360 #define GET_ARG(rp, rp_size, f, out) \
361 (((rp_size) >= offsetofend(repository_door_request_t, f)) ? \
362 ((*(out) = (rp)->f), 1) : 0)
364 if (!GET_ARG(rp
, rp_size
, rdr_flags
, &flags
))
365 return (REPOSITORY_DOOR_FAIL_BAD_REQUEST
);
367 #if (REPOSITORY_DOOR_FLAG_ALL != REPOSITORY_DOOR_FLAG_DEBUG)
368 #error Need to update flag checks
371 if (flags
& ~REPOSITORY_DOOR_FLAG_ALL
)
372 return (REPOSITORY_DOOR_FAIL_BAD_FLAG
);
374 if (flags
& REPOSITORY_DOOR_FLAG_DEBUG
)
375 if (!GET_ARG(rp
, rp_size
, rdr_debug
, &debugflags
))
376 return (REPOSITORY_DOOR_FAIL_BAD_REQUEST
);
379 return (create_client(ucred_getpid(uc
), debugflags
, privileged
,
384 configd_vlog(int severity
, const char *prefix
, const char *message
,
388 vsyslog(severity
, message
, args
);
392 (void) fprintf(stderr
, "%s", prefix
);
393 (void) vfprintf(stderr
, message
, args
);
394 if (message
[0] == 0 || message
[strlen(message
) - 1] != '\n')
395 (void) fprintf(stderr
, "\n");
401 configd_vcritical(const char *message
, va_list args
)
403 configd_vlog(LOG_CRIT
, "svc.configd: Fatal error: ", message
, args
);
407 configd_critical(const char *message
, ...)
410 va_start(args
, message
);
411 configd_vcritical(message
, args
);
416 configd_info(const char *message
, ...)
419 va_start(args
, message
);
420 configd_vlog(LOG_INFO
, "svc.configd: ", message
, args
);
425 usage(const char *prog
, int ret
)
427 (void) fprintf(stderr
,
428 "usage: %s [-np] [-d door_path] [-r repository_path]\n"
429 " [-t nonpersist_repository]\n", prog
);
435 handler(int sig
, siginfo_t
*info
, void *data
)
440 static int pipe_fd
= -1;
443 daemonize_start(void)
452 (void) dup2(2, 1); /* stderr only */
454 if (pipe(filedes
) < 0)
457 if ((pid
= fork1()) < 0)
464 struct sigaction act
;
466 act
.sa_sigaction
= SIG_DFL
;
467 (void) sigemptyset(&act
.sa_mask
);
470 (void) sigaction(SIGPIPE
, &act
, NULL
); /* ignore SIGPIPE */
472 (void) close(filedes
[1]);
473 if (read(filedes
[0], &data
, 1) == 1) {
474 /* presume success */
475 _exit(CONFIGD_EXIT_OKAY
);
479 (void) wait4(pid
, &status
, 0, NULL
);
480 if (WIFEXITED(status
))
481 _exit(WEXITSTATUS(status
));
489 pipe_fd
= filedes
[1];
490 (void) close(filedes
[0]);
502 daemonize_ready(void)
509 (void) write(pipe_fd
, &data
, 1);
510 (void) close(pipe_fd
);
514 regularize_path(const char *dir
, const char *base
, char *tmpbuf
)
521 if (snprintf(tmpbuf
, PATH_MAX
, "%s/%s", dir
, base
) >= PATH_MAX
) {
522 (void) fprintf(stderr
, "svc.configd: %s/%s: path too long\n",
524 exit(CONFIGD_EXIT_BAD_ARGS
);
531 main(int argc
, char *argv
[])
533 thread_info_t
*ti
= &main_thread_info
;
535 char pidpath
[sizeof ("/proc/" "/psinfo") + 10];
537 struct rlimit fd_new
;
545 char curdir
[PATH_MAX
];
546 char dbtmp
[PATH_MAX
];
547 char npdbtmp
[PATH_MAX
];
548 char doortmp
[PATH_MAX
];
550 const char *dbpath
= NULL
;
551 const char *npdbpath
= NULL
;
552 const char *doorpath
= REPOSITORY_DOOR_NAME
;
553 struct sigaction act
;
555 int daemonize
= 1; /* default to daemonizing */
558 closefrom(3); /* get rid of extraneous fds */
560 if (getcwd(curdir
, sizeof (curdir
)) == NULL
) {
561 (void) fprintf(stderr
,
562 "%s: unable to get current directory: %s\n",
563 argv
[0], strerror(errno
));
564 exit(CONFIGD_EXIT_INIT_FAILED
);
567 while ((c
= getopt(argc
, argv
, "Dnpd:r:t:")) != -1) {
573 doorpath
= regularize_path(curdir
, optarg
, doortmp
);
574 have_npdb
= 0; /* default to no non-persist */
577 log_to_syslog
= 0; /* don't use syslog */
580 * If our parent exits while we're opening its /proc
581 * psinfo, we're vulnerable to a pid wrapping. To
582 * protect against that, re-check our ppid after
585 privileged_pid
= getppid();
586 (void) snprintf(pidpath
, sizeof (pidpath
),
587 "/proc/%d/psinfo", privileged_pid
);
588 if ((fd
= open(pidpath
, O_RDONLY
)) < 0 ||
589 getppid() != privileged_pid
) {
590 (void) fprintf(stderr
,
591 "%s: unable to get parent info\n", argv
[0]);
592 exit(CONFIGD_EXIT_BAD_ARGS
);
594 privileged_psinfo_fd
= fd
;
597 dbpath
= regularize_path(curdir
, optarg
, dbtmp
);
598 is_main_repository
= 0;
601 npdbpath
= regularize_path(curdir
, optarg
, npdbtmp
);
602 is_main_repository
= 0;
605 usage(argv
[0], CONFIGD_EXIT_BAD_ARGS
);
611 * If we're not running as root, allow our euid full access, and
612 * everyone else no access.
614 if (privileged_pid
== 0 && geteuid() != 0) {
615 privileged_user
= geteuid();
618 privileged_privs
= priv_str_to_set("zone", "", &endptr
);
619 if (endptr
!= NULL
&& privileged_privs
!= NULL
) {
620 priv_freeset(privileged_privs
);
621 privileged_privs
= NULL
;
624 openlog("svc.configd", LOG_PID
| LOG_CONS
, LOG_DAEMON
);
625 (void) setlogmask(LOG_UPTO(LOG_NOTICE
));
628 * if a non-persist db is specified, always enable it
634 usage(argv
[0], CONFIGD_EXIT_BAD_ARGS
);
639 if (daemonize_start() < 0) {
640 (void) perror("unable to daemonize");
641 exit(CONFIGD_EXIT_INIT_FAILED
);
645 (void) core_set_process_path(CONFIGD_CORE
,
646 strlen(CONFIGD_CORE
) + 1, getpid());
649 * this should be enabled once we can drop privileges and still get
653 /* turn off basic privileges we do not need */
654 (void) priv_set(PRIV_OFF
, PRIV_PERMITTED
, PRIV_FILE_LINK_ANY
,
655 PRIV_PROC_EXEC
, PRIV_PROC_FORK
, PRIV_PROC_SESSION
, NULL
);
658 /* not that we can exec, but to be safe, shut them all off... */
659 (void) priv_set(PRIV_SET
, PRIV_INHERITABLE
, NULL
);
661 (void) sigfillset(&act
.sa_mask
);
663 /* signals to ignore */
664 act
.sa_sigaction
= SIG_IGN
;
666 (void) sigaction(SIGPIPE
, &act
, NULL
);
667 (void) sigaction(SIGALRM
, &act
, NULL
);
668 (void) sigaction(SIGUSR1
, &act
, NULL
);
669 (void) sigaction(SIGUSR2
, &act
, NULL
);
670 (void) sigaction(SIGPOLL
, &act
, NULL
);
672 /* signals to abort on */
673 act
.sa_sigaction
= (void (*)(int, siginfo_t
*, void *))&abort_handler
;
674 act
.sa_flags
= SA_SIGINFO
;
676 (void) sigaction(SIGABRT
, &act
, NULL
);
678 /* signals to handle */
679 act
.sa_sigaction
= &handler
;
680 act
.sa_flags
= SA_SIGINFO
;
682 (void) sigaction(SIGHUP
, &act
, NULL
);
683 (void) sigaction(SIGINT
, &act
, NULL
);
684 (void) sigaction(SIGTERM
, &act
, NULL
);
686 (void) sigemptyset(&myset
);
687 (void) sigaddset(&myset
, SIGHUP
);
688 (void) sigaddset(&myset
, SIGINT
);
689 (void) sigaddset(&myset
, SIGTERM
);
691 if ((errno
= pthread_attr_init(&thread_attr
)) != 0) {
692 (void) perror("initializing");
693 exit(CONFIGD_EXIT_INIT_FAILED
);
697 * Set the hard and soft limits to CONFIGD_MAX_FDS.
699 fd_new
.rlim_max
= fd_new
.rlim_cur
= CONFIGD_MAX_FDS
;
700 (void) setrlimit(RLIMIT_NOFILE
, &fd_new
);
702 if ((ret
= backend_init(dbpath
, npdbpath
, have_npdb
)) !=
707 exit(CONFIGD_EXIT_INIT_FAILED
);
710 exit(CONFIGD_EXIT_INIT_FAILED
);
712 (void) pthread_attr_setdetachstate(&thread_attr
,
713 PTHREAD_CREATE_DETACHED
);
714 (void) pthread_attr_setscope(&thread_attr
, PTHREAD_SCOPE_SYSTEM
);
716 if ((errno
= pthread_key_create(&thread_info_key
,
717 thread_exiting
)) != 0) {
718 perror("pthread_key_create");
719 exit(CONFIGD_EXIT_INIT_FAILED
);
722 if ((thread_pool
= uu_list_pool_create("thread_pool",
723 sizeof (thread_info_t
), offsetof(thread_info_t
, ti_node
),
724 NULL
, UU_LIST_POOL_DEBUG
)) == NULL
) {
725 configd_critical("uu_list_pool_create: %s\n",
726 uu_strerror(uu_error()));
727 exit(CONFIGD_EXIT_INIT_FAILED
);
730 if ((thread_list
= uu_list_create(thread_pool
, NULL
, 0)) == NULL
) {
731 configd_critical("uu_list_create: %s\n",
732 uu_strerror(uu_error()));
733 exit(CONFIGD_EXIT_INIT_FAILED
);
736 (void) memset(ti
, '\0', sizeof (*ti
));
737 uu_list_node_init(ti
, &ti
->ti_node
, thread_pool
);
738 (void) uu_list_insert_before(thread_list
, uu_list_first(thread_list
),
741 ti
->ti_thread
= pthread_self();
742 ti
->ti_state
= TI_SIGNAL_WAIT
;
743 ti
->ti_prev_state
= TI_SIGNAL_WAIT
;
745 (void) pthread_setspecific(thread_info_key
, ti
);
747 (void) door_server_create(new_thread_needed
);
749 if (!setup_main_door(doorpath
)) {
750 configd_critical("Setting up main door failed.\n");
751 exit(CONFIGD_EXIT_DOOR_INIT_FAILED
);
757 (void) pthread_sigmask(SIG_BLOCK
, &myset
, NULL
);
760 ret
= sigwait(&myset
, &sig
);
768 return (CONFIGD_EXIT_OKAY
);