1/* Copyright (c) 1998-2020 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Thorsten Kukuk <kukuk@suse.de>, 1998.
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published
7 by the Free Software Foundation; version 2 of the License, or
8 (at your option) any later version.
9
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
14
15 You should have received a copy of the GNU General Public License
16 along with this program; if not, see <https://www.gnu.org/licenses/>. */
17
18/* nscd - Name Service Cache Daemon. Caches passwd, group, and hosts. */
19
20#include <argp.h>
21#include <assert.h>
22#include <dirent.h>
23#include <errno.h>
24#include <error.h>
25#include <fcntl.h>
26#include <libintl.h>
27#include <locale.h>
28#include <paths.h>
29#include <pthread.h>
30#include <signal.h>
31#include <stdbool.h>
32#include <stdio.h>
33#include <stdlib.h>
34#include <string.h>
35#include <syslog.h>
36#include <unistd.h>
37#include <sys/mman.h>
38#include <sys/socket.h>
39#include <sys/stat.h>
40#include <sys/uio.h>
41#include <sys/un.h>
42#include <sys/wait.h>
43#include <stdarg.h>
44
45#include "dbg_log.h"
46#include "nscd.h"
47#include "selinux.h"
48#include "../nss/nsswitch.h"
49#include <device-nrs.h>
50#ifdef HAVE_INOTIFY
51# include <sys/inotify.h>
52#endif
53#include <kernel-features.h>
54
55/* Get libc version number. */
56#include <version.h>
57
58#define PACKAGE _libc_intl_domainname
59
60int do_shutdown;
61int disabled_passwd;
62int disabled_group;
63
64typedef enum
65{
66 /* Running in background as daemon. */
67 RUN_DAEMONIZE,
68 /* Running in foreground but otherwise behave like a daemon,
69 i.e., detach from terminal and use syslog. This allows
70 better integration with services like systemd. */
71 RUN_FOREGROUND,
72 /* Run in foreground in debug mode. */
73 RUN_DEBUG
74} run_modes;
75
76static run_modes run_mode = RUN_DAEMONIZE;
77
78static const char *conffile = _PATH_NSCDCONF;
79
80static const char *print_cache = NULL;
81
82time_t start_time;
83
84uintptr_t pagesize_m1;
85
86int paranoia;
87time_t restart_time;
88time_t restart_interval = RESTART_INTERVAL;
89const char *oldcwd;
90uid_t old_uid;
91gid_t old_gid;
92
93static int check_pid (const char *file);
94static int write_pid (const char *file);
95static int monitor_child (int fd);
96
97/* Name and version of program. */
98static void print_version (FILE *stream, struct argp_state *state);
99void (*argp_program_version_hook) (FILE *, struct argp_state *) = print_version;
100
101/* Function to print some extra text in the help message. */
102static char *more_help (int key, const char *text, void *input);
103
104/* Definitions of arguments for argp functions. */
105static const struct argp_option options[] =
106{
107 { "config-file", 'f', N_("NAME"), 0,
108 N_("Read configuration data from NAME") },
109 { "debug", 'd', NULL, 0,
110 N_("Do not fork and display messages on the current tty") },
111 { "print", 'p', N_("NAME"), 0,
112 N_("Print contents of the offline cache file NAME") },
113 { "foreground", 'F', NULL, 0,
114 N_("Do not fork, but otherwise behave like a daemon") },
115 { "nthreads", 't', N_("NUMBER"), 0, N_("Start NUMBER threads") },
116 { "shutdown", 'K', NULL, 0, N_("Shut the server down") },
117 { "statistics", 'g', NULL, 0, N_("Print current configuration statistics") },
118 { "invalidate", 'i', N_("TABLE"), 0,
119 N_("Invalidate the specified cache") },
120 { "secure", 'S', N_("TABLE,yes"), OPTION_HIDDEN,
121 N_("Use separate cache for each user")},
122 { NULL, 0, NULL, 0, NULL }
123};
124
125/* Short description of program. */
126static const char doc[] = N_("Name Service Cache Daemon.");
127
128/* Prototype for option handler. */
129static error_t parse_opt (int key, char *arg, struct argp_state *state);
130
131/* Data structure to communicate with argp functions. */
132static struct argp argp =
133{
134 options, parse_opt, NULL, doc, NULL, more_help
135};
136
137/* True if only statistics are requested. */
138static bool get_stats;
139static int parent_fd = -1;
140
141int
142main (int argc, char **argv)
143{
144 int remaining;
145
146 /* Set locale via LC_ALL. */
147 setlocale (LC_ALL, "");
148 /* Set the text message domain. */
149 textdomain (PACKAGE);
150
151 /* Determine if the kernel has SELinux support. */
152 nscd_selinux_enabled (&selinux_enabled);
153
154 /* Parse and process arguments. */
155 argp_parse (&argp, argc, argv, 0, &remaining, NULL);
156
157 if (remaining != argc)
158 {
159 error (0, 0, gettext ("wrong number of arguments"));
160 argp_help (&argp, stdout, ARGP_HELP_SEE, program_invocation_short_name);
161 exit (1);
162 }
163
164 /* Print the contents of the indicated cache file. */
165 if (print_cache != NULL)
166 /* Does not return. */
167 nscd_print_cache (print_cache);
168
169 /* Read the configuration file. */
170 if (nscd_parse_file (conffile, dbs) != 0)
171 /* We couldn't read the configuration file. We don't start the
172 server. */
173 error (EXIT_FAILURE, 0,
174 _("failure while reading configuration file; this is fatal"));
175
176 /* Do we only get statistics? */
177 if (get_stats)
178 /* Does not return. */
179 receive_print_stats ();
180
181 /* Check if we are already running. */
182 if (check_pid (_PATH_NSCDPID))
183 error (EXIT_FAILURE, 0, _("already running"));
184
185 /* Remember when we started. */
186 start_time = time (NULL);
187
188 /* Determine page size. */
189 pagesize_m1 = getpagesize () - 1;
190
191 if (run_mode == RUN_DAEMONIZE || run_mode == RUN_FOREGROUND)
192 {
193 int i;
194 pid_t pid;
195
196 /* Behave like a daemon. */
197 if (run_mode == RUN_DAEMONIZE)
198 {
199 int fd[2];
200
201 if (pipe (fd) != 0)
202 error (EXIT_FAILURE, errno,
203 _("cannot create a pipe to talk to the child"));
204
205 pid = fork ();
206 if (pid == -1)
207 error (EXIT_FAILURE, errno, _("cannot fork"));
208 if (pid != 0)
209 {
210 /* The parent only reads from the child. */
211 close (fd[1]);
212 exit (monitor_child (fd[0]));
213 }
214 else
215 {
216 /* The child only writes to the parent. */
217 close (fd[0]);
218 parent_fd = fd[1];
219 }
220 }
221
222 int nullfd = open (_PATH_DEVNULL, O_RDWR);
223 if (nullfd != -1)
224 {
225 struct stat64 st;
226
227 if (fstat64 (nullfd, &st) == 0 && S_ISCHR (st.st_mode) != 0
228#if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
229 && st.st_rdev == makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
230#endif
231 )
232 {
233 /* It is the /dev/null special device alright. */
234 (void) dup2 (nullfd, STDIN_FILENO);
235 (void) dup2 (nullfd, STDOUT_FILENO);
236 (void) dup2 (nullfd, STDERR_FILENO);
237
238 if (nullfd > 2)
239 close (nullfd);
240 }
241 else
242 {
243 /* Ugh, somebody is trying to play a trick on us. */
244 close (nullfd);
245 nullfd = -1;
246 }
247 }
248 int min_close_fd = nullfd == -1 ? 0 : STDERR_FILENO + 1;
249
250 DIR *d = opendir ("/proc/self/fd");
251 if (d != NULL)
252 {
253 struct dirent64 *dirent;
254 int dfdn = dirfd (d);
255
256 while ((dirent = readdir64 (d)) != NULL)
257 {
258 char *endp;
259 long int fdn = strtol (dirent->d_name, &endp, 10);
260
261 if (*endp == '\0' && fdn != dfdn && fdn >= min_close_fd
262 && fdn != parent_fd)
263 close ((int) fdn);
264 }
265
266 closedir (d);
267 }
268 else
269 for (i = min_close_fd; i < getdtablesize (); i++)
270 if (i != parent_fd)
271 close (i);
272
273 setsid ();
274
275 if (chdir ("/") != 0)
276 do_exit (EXIT_FAILURE, errno,
277 _("cannot change current working directory to \"/\""));
278
279 openlog ("nscd", LOG_CONS | LOG_ODELAY, LOG_DAEMON);
280
281 if (write_pid (_PATH_NSCDPID) < 0)
282 dbg_log ("%s: %s", _PATH_NSCDPID, strerror (errno));
283
284 if (!init_logfile ())
285 dbg_log (_("Could not create log file"));
286
287 /* Ignore job control signals. */
288 signal (SIGTTOU, SIG_IGN);
289 signal (SIGTTIN, SIG_IGN);
290 signal (SIGTSTP, SIG_IGN);
291 }
292 else
293 /* In debug mode we are not paranoid. */
294 paranoia = 0;
295
296 signal (SIGINT, termination_handler);
297 signal (SIGQUIT, termination_handler);
298 signal (SIGTERM, termination_handler);
299 signal (SIGPIPE, SIG_IGN);
300
301 /* Cleanup files created by a previous 'bind'. */
302 unlink (_PATH_NSCDSOCKET);
303
304#ifdef HAVE_INOTIFY
305 /* Use inotify to recognize changed files. */
306 inotify_fd = inotify_init1 (IN_NONBLOCK);
307# ifndef __ASSUME_IN_NONBLOCK
308 if (inotify_fd == -1 && errno == ENOSYS)
309 {
310 inotify_fd = inotify_init ();
311 if (inotify_fd != -1)
312 fcntl (inotify_fd, F_SETFL, O_RDONLY | O_NONBLOCK);
313 }
314# endif
315#endif
316
317#ifdef USE_NSCD
318 /* Make sure we do not get recursive calls. */
319 __nss_disable_nscd (register_traced_file);
320#endif
321
322 /* Init databases. */
323 nscd_init ();
324
325 /* Start the SELinux AVC. */
326 if (selinux_enabled)
327 nscd_avc_init ();
328
329 /* Handle incoming requests */
330 start_threads ();
331
332 return 0;
333}
334
335
336static void __attribute__ ((noreturn))
337invalidate_db (const char *dbname)
338{
339 int sock = nscd_open_socket ();
340
341 if (sock == -1)
342 exit (EXIT_FAILURE);
343
344 size_t dbname_len = strlen (dbname) + 1;
345 size_t reqlen = sizeof (request_header) + dbname_len;
346 struct
347 {
348 request_header req;
349 char dbname[];
350 } *reqdata = alloca (reqlen);
351
352 reqdata->req.key_len = dbname_len;
353 reqdata->req.version = NSCD_VERSION;
354 reqdata->req.type = INVALIDATE;
355 memcpy (reqdata->dbname, dbname, dbname_len);
356
357 ssize_t nbytes = TEMP_FAILURE_RETRY (send (sock, reqdata, reqlen,
358 MSG_NOSIGNAL));
359
360 if (nbytes != reqlen)
361 {
362 int err = errno;
363 close (sock);
364 error (EXIT_FAILURE, err, _("write incomplete"));
365 }
366
367 /* Wait for ack. Older nscd just closed the socket when
368 prune_cache finished, silently ignore that. */
369 int32_t resp = 0;
370 nbytes = TEMP_FAILURE_RETRY (read (sock, &resp, sizeof (resp)));
371 if (nbytes != 0 && nbytes != sizeof (resp))
372 {
373 int err = errno;
374 close (sock);
375 error (EXIT_FAILURE, err, _("cannot read invalidate ACK"));
376 }
377
378 close (sock);
379
380 if (resp != 0)
381 error (EXIT_FAILURE, resp, _("invalidation failed"));
382
383 exit (0);
384}
385
386static void __attribute__ ((noreturn))
387send_shutdown (void)
388{
389 int sock = nscd_open_socket ();
390
391 if (sock == -1)
392 exit (EXIT_FAILURE);
393
394 request_header req;
395 req.version = NSCD_VERSION;
396 req.type = SHUTDOWN;
397 req.key_len = 0;
398
399 ssize_t nbytes = TEMP_FAILURE_RETRY (send (sock, &req, sizeof req,
400 MSG_NOSIGNAL));
401 close (sock);
402 exit (nbytes != sizeof (request_header) ? EXIT_FAILURE : EXIT_SUCCESS);
403}
404
405/* Handle program arguments. */
406static error_t
407parse_opt (int key, char *arg, struct argp_state *state)
408{
409 switch (key)
410 {
411 case 'd':
412 ++debug_level;
413 run_mode = RUN_DEBUG;
414 break;
415
416 case 'p':
417 print_cache = arg;
418 break;
419
420 case 'F':
421 run_mode = RUN_FOREGROUND;
422 break;
423
424 case 'f':
425 conffile = arg;
426 break;
427
428 case 'K':
429 if (getuid () != 0)
430 error (4, 0, _("Only root is allowed to use this option!"));
431 else
432 send_shutdown ();
433 break;
434
435 case 'g':
436 get_stats = true;
437 break;
438
439 case 'i':
440 {
441 /* Validate the database name. */
442
443 dbtype cnt;
444 for (cnt = pwddb; cnt < lastdb; ++cnt)
445 if (strcmp (arg, dbnames[cnt]) == 0)
446 break;
447
448 if (cnt == lastdb)
449 {
450 argp_error (state, _("'%s' is not a known database"), arg);
451 return EINVAL;
452 }
453 }
454 if (getuid () != 0)
455 error (4, 0, _("Only root is allowed to use this option!"));
456 else
457 invalidate_db (arg);
458 break;
459
460 case 't':
461 nthreads = atol (arg);
462 break;
463
464 case 'S':
465 error (0, 0, _("secure services not implemented anymore"));
466 break;
467
468 default:
469 return ARGP_ERR_UNKNOWN;
470 }
471
472 return 0;
473}
474
475/* Print bug-reporting information in the help message. */
476static char *
477more_help (int key, const char *text, void *input)
478{
479 switch (key)
480 {
481 case ARGP_KEY_HELP_EXTRA:
482 {
483 /* We print some extra information. */
484
485 char *tables = xstrdup (dbnames[0]);
486 for (dbtype i = 1; i < lastdb; ++i)
487 {
488 char *more_tables;
489 if (asprintf (&more_tables, "%s %s", tables, dbnames[i]) < 0)
490 more_tables = NULL;
491 free (tables);
492 if (more_tables == NULL)
493 return NULL;
494 tables = more_tables;
495 }
496
497 char *tp;
498 if (asprintf (&tp, gettext ("\
499Supported tables:\n\
500%s\n\
501\n\
502For bug reporting instructions, please see:\n\
503%s.\n\
504"), tables, REPORT_BUGS_TO) < 0)
505 tp = NULL;
506 free (tables);
507 return tp;
508 }
509
510 default:
511 break;
512 }
513
514 return (char *) text;
515}
516
517/* Print the version information. */
518static void
519print_version (FILE *stream, struct argp_state *state)
520{
521 fprintf (stream, "nscd %s%s\n", PKGVERSION, VERSION);
522 fprintf (stream, gettext ("\
523Copyright (C) %s Free Software Foundation, Inc.\n\
524This is free software; see the source for copying conditions. There is NO\n\
525warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\
526"), "2020");
527 fprintf (stream, gettext ("Written by %s.\n"),
528 "Thorsten Kukuk and Ulrich Drepper");
529}
530
531
532/* Create a socket connected to a name. */
533int
534nscd_open_socket (void)
535{
536 struct sockaddr_un addr;
537 int sock;
538
539 sock = socket (PF_UNIX, SOCK_STREAM, 0);
540 if (sock < 0)
541 return -1;
542
543 addr.sun_family = AF_UNIX;
544 assert (sizeof (addr.sun_path) >= sizeof (_PATH_NSCDSOCKET));
545 strcpy (addr.sun_path, _PATH_NSCDSOCKET);
546 if (connect (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
547 {
548 close (sock);
549 return -1;
550 }
551
552 return sock;
553}
554
555
556/* Cleanup. */
557void
558termination_handler (int signum)
559{
560 close_sockets ();
561
562 /* Clean up the file created by 'bind'. */
563 unlink (_PATH_NSCDSOCKET);
564
565 /* Clean up pid file. */
566 unlink (_PATH_NSCDPID);
567
568 // XXX Terminate threads.
569
570 /* Synchronize memory. */
571 for (int cnt = 0; cnt < lastdb; ++cnt)
572 {
573 if (!dbs[cnt].enabled || dbs[cnt].head == NULL)
574 continue;
575
576 /* Make sure nobody keeps using the database. */
577 dbs[cnt].head->timestamp = 0;
578
579 if (dbs[cnt].persistent)
580 // XXX async OK?
581 msync (dbs[cnt].head, dbs[cnt].memsize, MS_ASYNC);
582 }
583
584 _exit (EXIT_SUCCESS);
585}
586
587/* Returns 1 if the process in pid file FILE is running, 0 if not. */
588static int
589check_pid (const char *file)
590{
591 FILE *fp;
592
593 fp = fopen (file, "r");
594 if (fp)
595 {
596 pid_t pid;
597 int n;
598
599 n = fscanf (fp, "%d", &pid);
600 fclose (fp);
601
602 /* If we cannot parse the file default to assuming nscd runs.
603 If the PID is alive, assume it is running. That all unless
604 the PID is the same as the current process' since tha latter
605 can mean we re-exec. */
606 if ((n != 1 || kill (pid, 0) == 0) && pid != getpid ())
607 return 1;
608 }
609
610 return 0;
611}
612
613/* Write the current process id to the file FILE.
614 Returns 0 if successful, -1 if not. */
615static int
616write_pid (const char *file)
617{
618 FILE *fp;
619
620 fp = fopen (file, "w");
621 if (fp == NULL)
622 return -1;
623
624 fprintf (fp, "%d\n", getpid ());
625
626 int result = fflush (fp) || ferror (fp) ? -1 : 0;
627
628 fclose (fp);
629
630 return result;
631}
632
633static int
634monitor_child (int fd)
635{
636 int child_ret = 0;
637 int ret = read (fd, &child_ret, sizeof (child_ret));
638
639 /* The child terminated with an error, either via exit or some other abnormal
640 method, like a segfault. */
641 if (ret <= 0 || child_ret != 0)
642 {
643 int status;
644 int err = wait (&status);
645
646 if (err < 0)
647 {
648 fprintf (stderr, _("'wait' failed\n"));
649 return 1;
650 }
651
652 if (WIFEXITED (status))
653 {
654 child_ret = WEXITSTATUS (status);
655 fprintf (stderr, _("child exited with status %d\n"), child_ret);
656 }
657 if (WIFSIGNALED (status))
658 {
659 child_ret = WTERMSIG (status);
660 fprintf (stderr, _("child terminated by signal %d\n"), child_ret);
661 }
662 }
663
664 /* We have the child status, so exit with that code. */
665 close (fd);
666
667 return child_ret;
668}
669
670void
671do_exit (int child_ret, int errnum, const char *format, ...)
672{
673 if (parent_fd != -1)
674 {
675 int ret __attribute__ ((unused));
676 ret = write (parent_fd, &child_ret, sizeof (child_ret));
677 assert (ret == sizeof (child_ret));
678 close (parent_fd);
679 }
680
681 if (format != NULL)
682 {
683 /* Emulate error() since we don't have a va_list variant for it. */
684 va_list argp;
685
686 fflush (stdout);
687
688 fprintf (stderr, "%s: ", program_invocation_name);
689
690 va_start (argp, format);
691 vfprintf (stderr, format, argp);
692 va_end (argp);
693
694 fprintf (stderr, ": %s\n", strerror (errnum));
695 fflush (stderr);
696 }
697
698 /* Finally, exit. */
699 exit (child_ret);
700}
701
702void
703notify_parent (int child_ret)
704{
705 if (parent_fd == -1)
706 return;
707
708 int ret __attribute__ ((unused));
709 ret = write (parent_fd, &child_ret, sizeof (child_ret));
710 assert (ret == sizeof (child_ret));
711 close (parent_fd);
712 parent_fd = -1;
713}
714