api/src/gfapi.aliases


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131


_priv_glfs_loc_touchup _glfs_loc_touchup$GFAPI_PRIVATE_3.4.0
_priv_glfs_active_subvol _glfs_active_subvol$GFAPI_PRIVATE_3.4.0
_priv_glfs_subvol_done _glfs_subvol_done$GFAPI_PRIVATE_3.4.0
_priv_glfs_init_done _glfs_init_done$GFAPI_PRIVATE_3.4.0
_priv_glfs_resolve_at _glfs_resolve_at$GFAPI_PRIVATE_3.4.0

_pub_glfs_new _glfs_new$GFAPI_3.4.0
_pub_glfs_set_volfile _glfs_set_volfile$GFAPI_3.4.0
_pub_glfs_set_volfile_server _glfs_set_volfile_server$GFAPI_3.4.0
_pub_glfs_set_logging _glfs_set_logging$GFAPI_3.4.0
_pub_glfs_init _glfs_init$GFAPI_3.4.0
_pub_glfs_fini _glfs_fini$GFAPI_3.4.0
_pub_glfs_open _glfs_open$GFAPI_3.4.0
_pub_glfs_creat _glfs_creat$GFAPI_3.4.0
_pub_glfs_close _glfs_close$GFAPI_3.4.0
_pub_glfs_from_glfd _glfs_from_glfd$GFAPI_3.4.0
_pub_glfs_set_xlator_option _glfs_set_xlator_option$GFAPI_3.4.0
_pub_glfs_read _glfs_read$GFAPI_3.4.0
_pub_glfs_write _glfs_write$GFAPI_3.4.0
_pub_glfs_read_async _glfs_read_async$GFAPI_3.4.0
_pub_glfs_write_async _glfs_write_async$GFAPI_3.4.0
_pub_glfs_readv _glfs_readv$GFAPI_3.4.0
_pub_glfs_writev _glfs_writev$GFAPI_3.4.0
_pub_glfs_readv_async _glfs_readv_async$GFAPI_3.4.0
_pub_glfs_writev_async _glfs_writev_async$GFAPI_3.4.0
_pub_glfs_pread _glfs_pread$GFAPI_3.4.0
_pub_glfs_pwrite _glfs_pwrite$GFAPI_3.4.0
_pub_glfs_pread_async _glfs_pread_async$GFAPI_3.4.0
_pub_glfs_pwrite_async _glfs_pwrite_async$GFAPI_3.4.0
_pub_glfs_preadv _glfs_preadv$GFAPI_3.4.0
_pub_glfs_pwritev _glfs_pwritev$GFAPI_3.4.0
_pub_glfs_preadv_async _glfs_preadv_async$GFAPI_3.4.0
_pub_glfs_pwritev_async _glfs_pwritev_async$GFAPI_3.4.0
_pub_glfs_lseek _glfs_lseek$GFAPI_3.4.0
_pub_glfs_truncate _glfs_truncate$GFAPI_3.4.0
_pub_glfs_ftruncate _glfs_ftruncate$GFAPI_3.4.0
_pub_glfs_ftruncate_async _glfs_ftruncate_async$GFAPI_3.4.0
_pub_glfs_lstat _glfs_lstat$GFAPI_3.4.0
_pub_glfs_stat _glfs_stat$GFAPI_3.4.0
_pub_glfs_fstat _glfs_fstat$GFAPI_3.4.0
_pub_glfs_fsync _glfs_fsync$GFAPI_3.4.0
_pub_glfs_fsync_async _glfs_fsync_async$GFAPI_3.4.0
_pub_glfs_fdatasync _glfs_fdatasync$GFAPI_3.4.0
_pub_glfs_fdatasync_async _glfs_fdatasync_async$GFAPI_3.4.0
_pub_glfs_access _glfs_access$GFAPI_3.4.0
_pub_glfs_symlink _glfs_symlink$GFAPI_3.4.0
_pub_glfs_readlink _glfs_readlink$GFAPI_3.4.0
_pub_glfs_mknod _glfs_mknod$GFAPI_3.4.0
_pub_glfs_mkdir _glfs_mkdir$GFAPI_3.4.0
_pub_glfs_unlink _glfs_unlink$GFAPI_3.4.0
_pub_glfs_rmdir _glfs_rmdir$GFAPI_3.4.0
_pub_glfs_rename _glfs_rename$GFAPI_3.4.0
_pub_glfs_link _glfs_link$GFAPI_3.4.0
_pub_glfs_opendir _glfs_opendir$GFAPI_3.4.0
_pub_glfs_readdir_r _glfs_readdir_r$GFAPI_3.4.0
_pub_glfs_readdirplus_r _glfs_readdirplus_r$GFAPI_3.4.0
_pub_glfs_telldir _glfs_telldir$GFAPI_3.4.0
_pub_glfs_seekdir _glfs_seekdir$GFAPI_3.4.0
_pub_glfs_closedir _glfs_closedir$GFAPI_3.4.0
_pub_glfs_statvfs _glfs_statvfs$GFAPI_3.4.0
_pub_glfs_chmod _glfs_chmod$GFAPI_3.4.0
_pub_glfs_fchmod _glfs_fchmod$GFAPI_3.4.0
_pub_glfs_chown _glfs_chown$GFAPI_3.4.0
_pub_glfs_lchown _glfs_lchown$GFAPI_3.4.0
_pub_glfs_fchown _glfs_fchown$GFAPI_3.4.0
_pub_glfs_utimens _glfs_utimens$GFAPI_3.4.0
_pub_glfs_lutimens _glfs_lutimens$GFAPI_3.4.0
_pub_glfs_futimens _glfs_futimens$GFAPI_3.4.0
_pub_glfs_getxattr _glfs_getxattr$GFAPI_3.4.0
_pub_glfs_lgetxattr _glfs_lgetxattr$GFAPI_3.4.0
_pub_glfs_fgetxattr _glfs_fgetxattr$GFAPI_3.4.0
_pub_glfs_listxattr _glfs_listxattr$GFAPI_3.4.0
_pub_glfs_llistxattr _glfs_llistxattr$GFAPI_3.4.0
_pub_glfs_flistxattr _glfs_flistxattr$GFAPI_3.4.0
_pub_glfs_setxattr _glfs_setxattr$GFAPI_3.4.0
_pub_glfs_lsetxattr _glfs_lsetxattr$GFAPI_3.4.0
_pub_glfs_fsetxattr _glfs_fsetxattr$GFAPI_3.4.0
_pub_glfs_removexattr _glfs_removexattr$GFAPI_3.4.0
_pub_glfs_lremovexattr _glfs_lremovexattr$GFAPI_3.4.0
_pub_glfs_fremovexattr _glfs_fremovexattr$GFAPI_3.4.0
_pub_glfs_getcwd _glfs_getcwd$GFAPI_3.4.0
_pub_glfs_chdir _glfs_chdir$GFAPI_3.4.0
_pub_glfs_fchdir _glfs_fchdir$GFAPI_3.4.0
_pub_glfs_realpath _glfs_realpath$GFAPI_3.4.0
_pub_glfs_posix_lock _glfs_posix_lock$GFAPI_3.4.0
_pub_glfs_dup _glfs_dup$GFAPI_3.4.0

_pub_glfs_setfsuid _glfs_setfsuid$GFAPI_3.4.2
_pub_glfs_setfsgid _glfs_setfsgid$GFAPI_3.4.2
_pub_glfs_setfsgroups _glfs_setfsgroups$GFAPI_3.4.2
_pub_glfs_h_lookupat _glfs_h_lookupat$GFAPI_3.4.2
_pub_glfs_h_creat _glfs_h_creat$GFAPI_3.4.2
_pub_glfs_h_mkdir _glfs_h_mkdir$GFAPI_3.4.2
_pub_glfs_h_mknod _glfs_h_mknod$GFAPI_3.4.2
_pub_glfs_h_symlink _glfs_h_symlink$GFAPI_3.4.2
_pub_glfs_h_unlink _glfs_h_unlink$GFAPI_3.4.2
_pub_glfs_h_close _glfs_h_close$GFAPI_3.4.2
_pub_glfs_h_truncate _glfs_h_truncate$GFAPI_3.4.2
_pub_glfs_h_stat _glfs_h_stat$GFAPI_3.4.2
_pub_glfs_h_getattrs _glfs_h_getattrs$GFAPI_3.4.2
_pub_glfs_h_setattrs _glfs_h_setattrs$GFAPI_3.4.2
_pub_glfs_h_readlink _glfs_h_readlink$GFAPI_3.4.2
_pub_glfs_h_link _glfs_h_link$GFAPI_3.4.2
_pub_glfs_h_rename _glfs_h_rename$GFAPI_3.4.2
_pub_glfs_h_extract_handle _glfs_h_extract_handle$GFAPI_3.4.2
_pub_glfs_h_create_from_handle _glfs_h_create_from_handle$GFAPI_3.4.2
_pub_glfs_h_opendir _glfs_h_opendir$GFAPI_3.4.2
_pub_glfs_h_open _glfs_h_open$GFAPI_3.4.2

_pub_glfs_get_volumeid _glfs_get_volumeid$GFAPI_3.5.0
_pub_glfs_readdir _glfs_readdir$GFAPI_3.5.0
_pub_glfs_readdirplus _glfs_readdirplus$GFAPI_3.5.0
_pub_glfs_fallocate _glfs_fallocate$GFAPI_3.5.0
_pub_glfs_discard _glfs_discard$GFAPI_3.5.0
_pub_glfs_discard_async _glfs_discard_async$GFAPI_3.5.0
_pub_glfs_zerofill _glfs_zerofill$GFAPI_3.5.0
_pub_glfs_zerofill_async _glfs_zerofill_async$GFAPI_3.5.0
_pub_glfs_h_setxattrs _glfs_h_setxattrs$GFAPI_3.5.0

_pub_glfs_unset_volfile_server _glfs_unset_volfile_server$GFAPI_3.5.1
_pub_glfs_h_getxattrs _glfs_h_getxattrs$GFAPI_3.5.1
_pub_glfs_h_removexattrs _glfs_h_removexattrs$GFAPI_3.5.1

_pub_glfs_get_volfile _glfs_get_volfile$GFAPI_3.6.0
_pub_glfs_h_access _glfs_h_access$GFAPI_3.6.0

_priv_glfs_free_from_ctx _glfs_free_from_ctx$GFAPI_PRIVATE_3.7.0
_priv_glfs_new_from_ctx _glfs_new_from_ctx$GFAPI_PRIVATE_3.7.0
_priv_glfs_resolve _glfs_resolve$GFAPI_PRIVATE_3.7.0
/*
    SSSD

    LDAP Backend Module -- prime ccache with TGT in a child process

    Authors:
        Jakub Hrozek <jhrozek@redhat.com>

    Copyright (C) 2009 Red Hat

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <popt.h>

#include <security/pam_modules.h>

#include "util/util.h"
#include "util/sss_krb5.h"
#include "providers/child_common.h"
#include "providers/dp_backend.h"

static krb5_context krb5_error_ctx;

struct input_buffer {
    const char *realm_str;
    const char *princ_str;
    const char *keytab_name;
    krb5_deltat lifetime;
};

static errno_t unpack_buffer(uint8_t *buf, size_t size,
                             struct input_buffer *ibuf)
{
    size_t p = 0;
    uint32_t len;

    DEBUG(7, ("total buffer size: %d\n", size));

    /* realm_str size and length */
    SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);

    DEBUG(7, ("realm_str size: %d\n", len));
    if (len) {
        if ((p + len ) > size) return EINVAL;
        ibuf->realm_str = talloc_strndup(ibuf, (char *)(buf + p), len);
        DEBUG(7, ("got realm_str: %s\n", ibuf->realm_str));
        if (ibuf->realm_str == NULL) return ENOMEM;
        p += len;
    }

    /* princ_str size and length */
    SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);

    DEBUG(7, ("princ_str size: %d\n", len));
    if (len) {
        if ((p + len ) > size) return EINVAL;
        ibuf->princ_str = talloc_strndup(ibuf, (char *)(buf + p), len);
        DEBUG(7, ("got princ_str: %s\n", ibuf->princ_str));
        if (ibuf->princ_str == NULL) return ENOMEM;
        p += len;
    }

    /* keytab_name size and length */
    SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);

    DEBUG(7, ("keytab_name size: %d\n", len));
    if (len) {
        if ((p + len ) > size) return EINVAL;
        ibuf->keytab_name = talloc_strndup(ibuf, (char *)(buf + p), len);
        DEBUG(7, ("got keytab_name: %s\n", ibuf->keytab_name));
        if (ibuf->keytab_name == NULL) return ENOMEM;
        p += len;
    }

    /* ticket lifetime */
    SAFEALIGN_COPY_INT32_CHECK(&ibuf->lifetime, buf + p, size, &p);
    DEBUG(7, ("lifetime: %d\n", ibuf->lifetime));

    return EOK;
}

static int pack_buffer(struct response *r, int result, krb5_error_code krberr,
                       const char *msg, time_t expire_time)
{
    int len;
    size_t p = 0;

    len = strlen(msg);
    r->size = 2 * sizeof(uint32_t) + sizeof(krb5_error_code) +
              len + sizeof(time_t);

    r->buf = talloc_array(r, uint8_t, r->size);
    if(!r->buf) {
        return ENOMEM;
    }

    /* result */
    SAFEALIGN_SET_UINT32(&r->buf[p], result, &p);

    /* krb5 error code */
    safealign_memcpy(&r->buf[p], &krberr, sizeof(krberr), &p);

    /* message size */
    SAFEALIGN_SET_UINT32(&r->buf[p], len, &p);

    /* message itself */
    safealign_memcpy(&r->buf[p], msg, len, &p);

    /* ticket expiration time */
    safealign_memcpy(&r->buf[p], &expire_time, sizeof(expire_time), &p);

    return EOK;
}

static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
                                               const char *realm_str,
                                               const char *princ_str,
                                               const char *keytab_name,
                                               const krb5_deltat lifetime,
                                               const char **ccname_out,
                                               time_t *expire_time_out)
{
    char *ccname;
    char *realm_name = NULL;
    char *full_princ = NULL;
    char *default_realm = NULL;
    krb5_context context = NULL;
    krb5_keytab keytab = NULL;
    krb5_ccache ccache = NULL;
    krb5_principal kprinc;
    krb5_creds my_creds;
    krb5_get_init_creds_opt options;
    krb5_error_code krberr;
    krb5_timestamp kdc_time_offset;
    int kdc_time_offset_usec;
    int ret;

    krberr = krb5_init_context(&context);
    if (krberr) {
        DEBUG(2, ("Failed to init kerberos context\n"));
        return krberr;
    }

    if (!realm_str) {
        krberr = krb5_get_default_realm(context, &default_realm);
        if (krberr) {
            DEBUG(2, ("Failed to get default realm name: %s\n",
                      sss_krb5_get_error_message(context, krberr)));
            goto done;
        }

        realm_name = talloc_strdup(memctx, default_realm);
        krb5_free_default_realm(context, default_realm);
        if (!realm_name) {
            krberr = KRB5KRB_ERR_GENERIC;
            goto done;
        }

    } else {
        realm_name = talloc_strdup(memctx, realm_str);
        if (!realm_name) {
            krberr = KRB5KRB_ERR_GENERIC;
            goto done;
        }
    }

    if (princ_str) {
        if (!strchr(princ_str, '@')) {
            full_princ = talloc_asprintf(memctx, "%s@%s",
                                         princ_str, realm_name);
        } else {
            full_princ = talloc_strdup(memctx, princ_str);
        }
    } else {
        char hostname[512];

        ret = gethostname(hostname, 511);
        if (ret == -1) {
            krberr = KRB5KRB_ERR_GENERIC;
            goto done;
        }
        hostname[511] = '\0';

        ret = select_principal_from_keytab(memctx, hostname, realm_name,
                                           keytab_name, &full_princ, NULL, NULL);
        if (ret) goto done;
    }
    if (!full_princ) {
        krberr = KRB5KRB_ERR_GENERIC;
        goto done;
    }
    DEBUG(4, ("Principal name is: [%s]\n", full_princ));

    krberr = krb5_parse_name(context, full_princ, &kprinc);
    if (krberr) {
        DEBUG(2, ("Unable to build principal: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        goto done;
    }

    if (keytab_name) {
        krberr = krb5_kt_resolve(context, keytab_name, &keytab);
    } else {
        krberr = krb5_kt_default(context, &keytab);
    }
    if (krberr) {
        DEBUG(0, ("Failed to read keytab file: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        goto done;
    }

    /* Verify the keytab */
    ret = sss_krb5_verify_keytab_ex(full_princ, keytab_name, context, keytab);
    if (ret) {
        DEBUG(2, ("Unable to verify principal is present in the keytab\n"));
        krberr = KRB5_KT_IOERR;
        goto done;
    }

    ccname = talloc_asprintf(memctx, "FILE:%s/ccache_%s", DB_PATH, realm_name);
    if (!ccname) {
        krberr = KRB5KRB_ERR_GENERIC;
        goto done;
    }

    krberr = krb5_cc_resolve(context, ccname, &ccache);
    if (krberr) {
        DEBUG(2, ("Failed to set cache name: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        goto done;
    }

    memset(&my_creds, 0, sizeof(my_creds));
    memset(&options, 0, sizeof(options));

    krb5_get_init_creds_opt_set_address_list(&options, NULL);
    krb5_get_init_creds_opt_set_forwardable(&options, 0);
    krb5_get_init_creds_opt_set_proxiable(&options, 0);
    krb5_get_init_creds_opt_set_tkt_life(&options, lifetime);

    krberr = krb5_get_init_creds_keytab(context, &my_creds, kprinc,
                                        keytab, 0, NULL, &options);

    if (krberr) {
        DEBUG(0, ("Failed to init credentials: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        sss_log(SSS_LOG_ERR, "Failed to initialize credentials using keytab [%s]: %s. "
                             "Unable to create GSSAPI-encrypted LDAP connection.",
                             keytab_name, sss_krb5_get_error_message(context, krberr));
        goto done;
    }

    krberr = krb5_cc_initialize(context, ccache, kprinc);
    if (krberr) {
        DEBUG(2, ("Failed to init ccache: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        goto done;
    }

    krberr = krb5_cc_store_cred(context, ccache, &my_creds);
    if (krberr) {
        DEBUG(2, ("Failed to store creds: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        goto done;
    }

    krberr = krb5_get_time_offsets(context, &kdc_time_offset, &kdc_time_offset_usec);
    if (krberr) {
        DEBUG(2, ("Failed to get KDC time offset: %s\n",
                  sss_krb5_get_error_message(context, krberr)));
        kdc_time_offset = 0;
    } else {
        if (kdc_time_offset_usec > 0) {
            kdc_time_offset++;
        }
    }

    krberr = 0;
    *ccname_out = ccname;
    *expire_time_out = my_creds.times.endtime - kdc_time_offset;

done:
    if (keytab) krb5_kt_close(context, keytab);
    if (context) krb5_free_context(context);
    return krberr;
}

static int prepare_response(TALLOC_CTX *mem_ctx,
                            const char *ccname,
                            time_t expire_time,
                            krb5_error_code kerr,
                            struct response **rsp)
{
    int ret;
    struct response *r = NULL;
    const char *krb5_msg = NULL;

    r = talloc_zero(mem_ctx, struct response);
    if (!r) return ENOMEM;

    r->buf = NULL;
    r->size = 0;

    if (kerr == 0) {
        ret = pack_buffer(r, EOK, kerr, ccname, expire_time);
    } else {
        krb5_msg = sss_krb5_get_error_message(krb5_error_ctx, kerr);
        if (krb5_msg == NULL) {
            DEBUG(1, ("sss_krb5_get_error_message failed.\n"));
            return ENOMEM;
        }

        ret = pack_buffer(r, EFAULT, kerr, krb5_msg, 0);
        sss_krb5_free_error_message(krb5_error_ctx, krb5_msg);
    }

    if (ret != EOK) {
        DEBUG(1, ("pack_buffer failed\n"));
        return ret;
    }

    *rsp = r;
    return EOK;
}

int main(int argc, const char *argv[])
{
    int ret;
    int kerr;
    int opt;
    int debug_fd = -1;
    poptContext pc;
    TALLOC_CTX *main_ctx;
    uint8_t *buf = NULL;
    ssize_t len = 0;
    const char *ccname = NULL;
    time_t expire_time = 0;
    struct input_buffer *ibuf = NULL;
    struct response *resp = NULL;
    size_t written;

    struct poptOption long_options[] = {
        POPT_AUTOHELP
        {"debug-level", 'd', POPT_ARG_INT, &debug_level, 0,
         _("Debug level"), NULL},
        {"debug-timestamps", 0, POPT_ARG_INT, &debug_timestamps, 0,
         _("Add debug timestamps"), NULL},
        {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
         _("An open file descriptor for the debug logs"), NULL},
        POPT_TABLEEND
    };

    pc = poptGetContext(argv[0], argc, argv, long_options, 0);
    while((opt = poptGetNextOpt(pc)) != -1) {
        switch(opt) {
        default:
        fprintf(stderr, "\nInvalid option %s: %s\n\n",
                  poptBadOption(pc, 0), poptStrerror(opt));
            poptPrintUsage(pc, stderr, 0);
            _exit(-1);
        }
    }

    poptFreeContext(pc);

    DEBUG(7, ("ldap_child started.\n"));

    main_ctx = talloc_new(NULL);
    if (main_ctx == NULL) {
        DEBUG(1, ("talloc_new failed.\n"));
        _exit(-1);
    }

    debug_prg_name = talloc_asprintf(main_ctx, "[sssd[ldap_child[%d]]]", getpid());

    if (debug_fd != -1) {
        ret = set_debug_file_from_fd(debug_fd);
        if (ret != EOK) {
            DEBUG(1, ("set_debug_file_from_fd failed.\n"));
        }
    }

    buf = talloc_size(main_ctx, sizeof(uint8_t)*IN_BUF_SIZE);
    if (buf == NULL) {
        DEBUG(1, ("talloc_size failed.\n"));
        goto fail;
    }

    ibuf = talloc_zero(main_ctx, struct input_buffer);
    if (ibuf == NULL) {
        DEBUG(1, ("talloc_size failed.\n"));
        goto fail;
    }

    while ((ret = read(STDIN_FILENO, buf + len, IN_BUF_SIZE - len)) != 0) {
        if (ret == -1) {
            if (errno == EINTR || errno == EAGAIN) {
                continue;
            }
            DEBUG(1, ("read failed [%d][%s].\n", errno, strerror(errno)));
            goto fail;
        } else if (ret > 0) {
            len += ret;
            if (len > IN_BUF_SIZE) {