File: globus_k5.c

package info (click to toggle)
globus-gatekeeper 11.0-1
  • links: PTS, VCS
  • area: main
  • in suites: buster
  • size: 1,560 kB
  • sloc: sh: 11,518; ansic: 2,528; makefile: 131
file content (365 lines) | stat: -rw-r--r-- 9,500 bytes parent folder | download | duplicates (5)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
/*
 * Copyright 1999-2006 University of Chicago
 * 
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 * http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/******************************************************************************

globus_gram_k5.c

Description:
	globus to Kerberos simple authentication module. 

	When exec-ed by the gram_gatekeeper after 
	authentiicating the globus user, this routine 
	will attempt to issue a command for the user. 
	This may be as simple as a kinit with a password,
	or can use the NCSA krb525 command, or the
	sslk5 command to use the X509 user proxy.

	The args passed to this routine will not be used,
	but will be passed onto the job manager. The first parameter
	must be the path to the job manager. (Much like what wrapper
	or inetd does.)

	It is expected that the environment will contain the
	GLOBUSID=globusid of the user and USER=userid for the local 
	unix system.  This program is normaly run as root,
	and will seteuid before execing the other modules. 

	If not run as root, the user should have started the gatekeeper, 	
	and should already have gotten a K5 credential. 

	The parameters to use and the mapping for the
	globus to K5 user are located in the 
	.globuskmap file. 

	Format of the .globuskmap file:
		 "globus_user" <kinit command line >... including k5 principal
	The globus_user may be in "" if it has blanks, such as 
	a X509 name.
	This is designed to be a simple interface, and no attempt
	to parse or use the command info is made. 
	This allows for other commands to be used instead
	of kinit. Such as krb525 or sslk5

	This will only be attempted if the gatekeeper
	is run as root, as if the user has started 
	the gatekeeper, then he should have a K5 
	credentials already. 

CVS Information:
	$Source$
	$Date$
	$Revision$
	$Author$

******************************************************************************/
/*****************************************************************************
Include header files
******************************************************************************/
#include "globus_config.h"
#include "globus_gatekeeper_config.h"

#include "globus_common.h"

#include <stdio.h>
#include <stdlib.h>
#include <locale.h>
#include <pwd.h>
#include <string.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/stat.h>

#ifdef HAVE_MALLOC_H
#   include <malloc.h>
#endif

#include "globus_gatekeeper_utils.h"

/******************************************************************************
                               Type definitions
******************************************************************************/
#ifndef K5AFSLOGIN
#define K5AFSLOGIN "/krb5/sbin/k5afslogin"
#endif

#ifndef K5DCELOGIN
#define K5DCELOGIN "/krb5/sbin/k5dcelogin"
#if defined(sun)
#define K5DCELIB "/usr/lib/libdce.so"
#else
#define K5DCELIB "/usr/lib/libdce.a"
#endif
#endif

#ifdef DEBUG
#define DEEDEBUG(A) fprintf(stderrX,A)
#define DEEDEBUG2(A,B) fprintf(stderrX,A,B)
FILE *stderrX;
#else
#define DEEDEBUG(A)
#define DEEDEBUG2(A,B)
#endif


/******************************************************************************
                          Module specific prototypes
******************************************************************************/

/******************************************************************************
                       Define module specific variables
******************************************************************************/

/******************************************************************************
Function:   globus_gram_k5_kinit()
Description:
Parameters:
Returns:
******************************************************************************/
int
globus_gram_k5_kinit(char * globus_client, 
				struct passwd *pw, 
				char * user, 
				char ** errmsgp)
{

  int rc;
  int i;
  char ccname[100];
  char * command;
  char * args[100];
  struct stat stx;

  if ((rc = globus_gatekeeper_util_globusxmap(getenv("GLOBUSKMAP"),
			globus_client, &command)))
    return(rc); /* not found, or nothing to do */
 
  if (!command)
    return(0); /* no command */
  
  i = 100;
  if ((rc = globus_gatekeeper_util_tokenize( command, args, &i," \t\n")))
	return(rc);

  if (args[0] == NULL)
	return(0); /* no command */

  i = 0;
  do {
   sprintf(ccname,"FILE:/tmp/krb5cc_p%d.%d",getpid(),i++);
  }
  while(stat(ccname+5,&stx) == 0);

  globus_libc_setenv("KRB5CCNAME", ccname, 1);

DEEDEBUG2("calling UTIL_exec: user: %s ",user);
DEEDEBUG2("and uid %d\n",pw?pw->pw_uid:-111111);
	
  rc = globus_gatekeeper_util_exec(args, pw, user, errmsgp);

  /*
   * Make sure the creds cache is owned by the user. 
   */

  if (rc == 0 && getuid() == 0 && pw) {
	  (void) chown(ccname+5,pw->pw_uid, pw->pw_gid);
  }

  DEEDEBUG2("globus_gram_k5_exec rc = %d\n", rc);
  return(rc);
}

/******************************************************************************
Function:   main()
Description:
Parameters:
Returns:
******************************************************************************/
int
main(int argc, char *argv[])
{
    int i;
    int rc;
    char *ccname;
    char *globusid;
    char *user;
    char *newpath;
    char *cp;
    char **ap;
    char **newargv;
    struct stat stx;
    extern int optind;
    extern char *optarg;
    uid_t	 myuid;
    struct passwd *pw;
    char *errmsg = NULL;

#ifdef DEBUG
	stderrX = stderr;
 /* stderrX = fopen("/tmp/k5gram.debug","w"); */
#endif

	myuid = getuid();  /* get our uid, to see if we are root. */
    DEEDEBUG2("k5gram uid = %lu\n", myuid);

	user = getenv("USER");
	if (user == NULL)
	  exit(6); 
    DEEDEBUG2("USER = %s\n",user);

	pw = getpwnam(user);
	if (pw == NULL) 
	  exit(7);
	DEEDEBUG2("USERID = %lu\n",pw->pw_uid);

	/* if not root, must run as your self */
	if (myuid && (myuid != pw->pw_uid))
		exit(8);

	/* we will need to copy the args, and may add the k5declogin 
	 * and k5afslogin before. So get three extra. 
	 */

    if ((newargv = calloc(argc + 3, sizeof(argv[0]))) == NULL) {
        fprintf(stderr,"Unable to allocate new argv\n");
        exit(1);
    }
    ap = newargv;


#ifdef DEBUG
    {
      int i;
      fprintf(stderrX,"k5gram args: ");
      i = 0;
      while (argv[i]) {
        fprintf(stderrX,"%s ",argv[i]);
        i++;
      }
      fprintf(stderrX,"\n");
    }
#endif

    ccname = getenv("KRB5CCNAME");

    /* If there is a cache, then the user must have 
	 * started the gatekeeper on thier own.
	 * Or they were running the K5 GSSAPI. So
	 * don't try and get a K5 cache for them.  
     */

    if (ccname == NULL) {

	  globusid = getenv("GLOBUS_ID");
	  if (globusid == NULL)
		goto done;  /* Can't do globus-to-k5 without the globusid */
      DEEDEBUG2("GLOBUSID = %s\n",globusid);

	  if (globus_gram_k5_kinit(globusid, pw, user, &errmsg) == 0) {
	   ccname = getenv("KRB5CCNAME");
	  }

	  /* even if the above failed, we want to continue */
	
    }

	if (ccname) {
      DEEDEBUG2("KRB5CCNAME = %s\n",ccname);

      /* test if this machine has DCE and k5dcelogin is available.
       * if so put the k5dcelogin program on the list to call
       */

      if ((stat(K5DCELIB,&stx) == 0) &&
          (stat(K5DCELOGIN,&stx) == 0)) {
          *ap++ = K5DCELOGIN;
          DEEDEBUG2("Will try %s\n",K5DCELOGIN);
      }

      /* if this system has AFS and not a NFS/AFS translator
       * put it on the list too
       */


      if ((stat("/afs",&stx) == 0) &&
          (stat(K5AFSLOGIN,&stx) == 0) &&
          (stat("/usr/vice/etc/ThisCell",&stx) == 0)) {
          *ap++ = K5AFSLOGIN;

          DEEDEBUG2("Will try %s\n",K5AFSLOGIN);
      }
	}


 done:
    globus_libc_unsetenv("GLOBUSKMAP"); /* dont pass on */

	/* before continuing on, if we were run as root, 
	 * we will get to user state.
	 */

	if(globus_gatekeeper_util_trans_to_user(pw, user, &errmsg) != 0) {

		fprintf(stderr,"Failed to run %d as the user %s %s\n",
					rc, user, errmsg );
		exit(3); /* have to fail, since cant run as root */
	}

    /* copy over the rest of the argument list.
     * gram_gatekeeper will have placed the path to the job_manager
	 * as arg[1]. 
     */

    for (i = 1; i<argc; i++) {
        *ap++ = argv[i];
    }
    *ap = 0;   /* null as last */

    /* newargv[0] has the fully qualified name of the program to exec.
     * either it is K5DCELOGIN, K5AFSLOGIN, or the job_manager program
     * this was specified by the gatekeeper
     * We will parse to get the new argv[0] and the path.
     * we then exec the program with the rest of the parameters.
     */

    if (newargv[0] == NULL)
    {
        fprintf(stderr, "Missing command to execute\n");
        exit(EXIT_FAILURE);
    }
    newpath = strdup(newargv[0]);

    cp = strrchr(newpath, '/');
    if (cp)
      cp++;
    else
      cp = newpath;

    newargv[0] = cp;

    DEEDEBUG2("calling the program %s \n",newpath);

#ifdef DEBUG
	/* fclose(stderrX); */
#endif

      execv(newpath,newargv);

    /* only reachable if execl fails */

    fprintf(stderr, "Exec of %s failed: \n", newpath);
        exit(1);
}