usr.sbin/gssd/gssd.c

   1 /*-
   2  * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
   3  * Authors: Doug Rabson <dfr@rabson.org>
   4  * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  */
  27
  28 #include <sys/cdefs.h>
  29 __FBSDID("$FreeBSD$");
  30
  31 #include <sys/param.h>
  32 #include <sys/stat.h>
  33 #include <sys/linker.h>
  34 #include <sys/module.h>
  35 #include <sys/queue.h>
  36 #include <sys/syslog.h>
  37 #include <ctype.h>
  38 #include <dirent.h>
  39 #include <err.h>
  40 #include <errno.h>
  41 #ifndef WITHOUT_KERBEROS
  42 #include <krb5.h>
  43 #endif
  44 #include <pwd.h>
  45 #include <signal.h>
  46 #include <stdarg.h>
  47 #include <stdio.h>
  48 #include <stdlib.h>
  49 #include <string.h>
  50 #include <unistd.h>
  51 #include <gssapi/gssapi.h>
  52 #include <rpc/rpc.h>
  53 #include <rpc/rpc_com.h>
  54
  55 #include "gssd.h"
  56
  57 #ifndef _PATH_GSS_MECH
  58 #define _PATH_GSS_MECH  "/etc/gss/mech"
  59 #endif
  60 #ifndef _PATH_GSSDSOCK
  61 #define _PATH_GSSDSOCK  "/var/run/gssd.sock"
  62 #endif
  63 #define GSSD_CREDENTIAL_CACHE_FILE      "/tmp/krb5cc_gssd"
  64
  65 struct gss_resource {
  66         LIST_ENTRY(gss_resource) gr_link;
  67         uint64_t        gr_id;  /* indentifier exported to kernel */
  68         void*           gr_res; /* GSS-API resource pointer */
  69 };
  70 LIST_HEAD(gss_resource_list, gss_resource) gss_resources;
  71 int gss_resource_count;
  72 uint32_t gss_next_id;
  73 uint32_t gss_start_time;
  74 int debug_level;
  75 static char ccfile_dirlist[PATH_MAX + 1], ccfile_substring[NAME_MAX + 1];
  76 static char pref_realm[1024];
  77 static int verbose;
  78 static int use_old_des;
  79 static int hostbased_initiator_cred;
  80 #ifndef WITHOUT_KERBEROS
  81 /* 1.2.752.43.13.14 */
  82 static gss_OID_desc gss_krb5_set_allowable_enctypes_x_desc =
  83 {6, (void *) "\x2a\x85\x70\x2b\x0d\x0e"};
  84 static gss_OID GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X =
  85     &gss_krb5_set_allowable_enctypes_x_desc;
  86 static gss_OID_desc gss_krb5_mech_oid_x_desc =
  87 {9, (void *) "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
  88 static gss_OID GSS_KRB5_MECH_OID_X =
  89     &gss_krb5_mech_oid_x_desc;
  90 #endif
  91
  92 static void gssd_load_mech(void);
  93 static int find_ccache_file(const char *, uid_t, char *);
  94 static int is_a_valid_tgt_cache(const char *, uid_t, int *, time_t *);
  95 static void gssd_verbose_out(const char *, ...);
  96 #ifndef WITHOUT_KERBEROS
  97 static krb5_error_code gssd_get_cc_from_keytab(const char *);
  98 static OM_uint32 gssd_get_user_cred(OM_uint32 *, uid_t, gss_cred_id_t *);
  99 #endif
 100 void gssd_terminate(int);
 101
 102 extern void gssd_1(struct svc_req *rqstp, SVCXPRT *transp);
 103 extern int gssd_syscall(char *path);
 104
 105 int
 106 main(int argc, char **argv)
 107 {
 108         /*
 109          * We provide an RPC service on a local-domain socket. The
 110          * kernel's GSS-API code will pass what it can't handle
 111          * directly to us.
 112          */
 113         struct sockaddr_un sun;
 114         int fd, oldmask, ch, debug;
 115         SVCXPRT *xprt;
 116
 117         /*
 118          * Initialize the credential cache file name substring and the
 119          * search directory list.
 120          */
 121         strlcpy(ccfile_substring, "krb5cc_", sizeof(ccfile_substring));
 122         ccfile_dirlist[0] = '\0';
 123         pref_realm[0] = '\0';
 124         debug = 0;
 125         verbose = 0;
 126         while ((ch = getopt(argc, argv, "dhovs:c:r:")) != -1) {
 127                 switch (ch) {
 128                 case 'd':
 129                         debug_level++;
 130                         break;
 131                 case 'h':
 132 #ifndef WITHOUT_KERBEROS
 133                         /*
 134                          * Enable use of a host based initiator credential
 135                          * in the default keytab file.
 136                          */
 137                         hostbased_initiator_cred = 1;
 138 #else
 139                         errx(1, "This option not available when built"
 140                             " without MK_KERBEROS\n");
 141 #endif
 142                         break;
 143                 case 'o':
 144 #ifndef WITHOUT_KERBEROS
 145                         /*
 146                          * Force use of DES and the old type of GSSAPI token.
 147                          */
 148                         use_old_des = 1;
 149 #else
 150                         errx(1, "This option not available when built"
 151                             " without MK_KERBEROS\n");
 152 #endif
 153                         break;
 154                 case 'v':
 155                         verbose = 1;
 156                         break;
 157                 case 's':
 158 #ifndef WITHOUT_KERBEROS
 159                         /*
 160                          * Set the directory search list. This enables use of
 161                          * find_ccache_file() to search the directories for a
 162                          * suitable credentials cache file.
 163                          */
 164                         strlcpy(ccfile_dirlist, optarg, sizeof(ccfile_dirlist));
 165 #else
 166                         errx(1, "This option not available when built"
 167                             " without MK_KERBEROS\n");
 168 #endif
 169                         break;
 170                 case 'c':
 171                         /*
 172                          * Specify a non-default credential cache file
 173                          * substring.
 174                          */
 175                         strlcpy(ccfile_substring, optarg,
 176                             sizeof(ccfile_substring));
 177                         break;
 178                 case 'r':
 179                         /*
 180                          * Set the preferred realm for the credential cache tgt.
 181                          */
 182                         strlcpy(pref_realm, optarg, sizeof(pref_realm));
 183                         break;
 184                 default:
 185                         fprintf(stderr,
 186                             "usage: %s [-d] [-s dir-list] [-c file-substring]"
 187                             " [-r preferred-realm]\n", argv[0]);
 188                         exit(1);
 189                         break;
 190                 }
 191         }
 192
 193         gssd_load_mech();
 194
 195         if (!debug_level) {
 196                 daemon(0, 0);
 197                 signal(SIGINT, SIG_IGN);
 198                 signal(SIGQUIT, SIG_IGN);
 199                 signal(SIGHUP, SIG_IGN);
 200         }
 201         signal(SIGTERM, gssd_terminate);
 202
 203         memset(&sun, 0, sizeof sun);
 204         sun.sun_family = AF_LOCAL;
 205         unlink(_PATH_GSSDSOCK);
 206         strcpy(sun.sun_path, _PATH_GSSDSOCK);
 207         sun.sun_len = SUN_LEN(&sun);
 208         fd = socket(AF_LOCAL, SOCK_STREAM, 0);
 209         if (!fd) {
 210                 if (debug_level == 0) {
 211                         syslog(LOG_ERR, "Can't create local gssd socket");
 212                         exit(1);
 213                 }
 214                 err(1, "Can't create local gssd socket");
 215         }
 216         oldmask = umask(S_IXUSR|S_IRWXG|S_IRWXO);
 217         if (bind(fd, (struct sockaddr *) &sun, sun.sun_len) < 0) {
 218                 if (debug_level == 0) {
 219                         syslog(LOG_ERR, "Can't bind local gssd socket");
 220                         exit(1);
 221                 }
 222                 err(1, "Can't bind local gssd socket");
 223         }
 224         umask(oldmask);
 225         if (listen(fd, SOMAXCONN) < 0) {
 226                 if (debug_level == 0) {
 227                         syslog(LOG_ERR, "Can't listen on local gssd socket");
 228                         exit(1);
 229                 }
 230                 err(1, "Can't listen on local gssd socket");
 231         }
 232         xprt = svc_vc_create(fd, RPC_MAXDATASIZE, RPC_MAXDATASIZE);
 233         if (!xprt) {
 234                 if (debug_level == 0) {
 235                         syslog(LOG_ERR,
 236                             "Can't create transport for local gssd socket");
 237                         exit(1);
 238                 }
 239                 err(1, "Can't create transport for local gssd socket");
 240         }
 241         if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) {
 242                 if (debug_level == 0) {
 243                         syslog(LOG_ERR,
 244                             "Can't register service for local gssd socket");
 245                         exit(1);
 246                 }
 247                 err(1, "Can't register service for local gssd socket");
 248         }
 249
 250         LIST_INIT(&gss_resources);
 251         gss_next_id = 1;
 252         gss_start_time = time(0);
 253
 254         gssd_syscall(_PATH_GSSDSOCK);
 255         svc_run();
 256         gssd_syscall("");
 257
 258         return (0);
 259 }
 260
 261 static void
 262 gssd_load_mech(void)
 263 {
 264         FILE            *fp;
 265         char            buf[256];
 266         char            *p;
 267         char            *name, *oid, *lib, *kobj;
 268
 269         fp = fopen(_PATH_GSS_MECH, "r");
 270         if (!fp)
 271                 return;
 272
 273         while (fgets(buf, sizeof(buf), fp)) {
 274                 if (*buf == '#')
 275                         continue;
 276                 p = buf;
 277                 name = strsep(&p, "\t\n ");
 278                 if (p) while (isspace(*p)) p++;
 279                 oid = strsep(&p, "\t\n ");
 280                 if (p) while (isspace(*p)) p++;
 281                 lib = strsep(&p, "\t\n ");
 282                 if (p) while (isspace(*p)) p++;
 283                 kobj = strsep(&p, "\t\n ");
 284                 if (!name || !oid || !lib || !kobj)
 285                         continue;
 286
 287                 if (strcmp(kobj, "-")) {
 288                         /*
 289                          * Attempt to load the kernel module if its
 290                          * not already present.
 291                          */
 292                         if (modfind(kobj) < 0) {
 293                                 if (kldload(kobj) < 0) {
 294                                         fprintf(stderr,
 295                         "%s: can't find or load kernel module %s for %s\n",
 296                                             getprogname(), kobj, name);
 297                                 }
 298                         }
 299                 }
 300         }
 301         fclose(fp);
 302 }
 303
 304 static void *
 305 gssd_find_resource(uint64_t id)
 306 {
 307         struct gss_resource *gr;
 308
 309         if (!id)
 310                 return (NULL);
 311
 312         LIST_FOREACH(gr, &gss_resources, gr_link)
 313                 if (gr->gr_id == id)
 314                         return (gr->gr_res);
 315
 316         return (NULL);
 317 }
 318
 319 static uint64_t
 320 gssd_make_resource(void *res)
 321 {
 322         struct gss_resource *gr;
 323
 324         if (!res)
 325                 return (0);
 326
 327         gr = malloc(sizeof(struct gss_resource));
 328         if (!gr)
 329                 return (0);
 330         gr->gr_id = (gss_next_id++) + ((uint64_t) gss_start_time << 32);
 331         gr->gr_res = res;
 332         LIST_INSERT_HEAD(&gss_resources, gr, gr_link);
 333         gss_resource_count++;
 334         if (debug_level > 1)
 335                 printf("%d resources allocated\n", gss_resource_count);
 336
 337         return (gr->gr_id);
 338 }
 339
 340 static void
 341 gssd_delete_resource(uint64_t id)
 342 {
 343         struct gss_resource *gr;
 344
 345         LIST_FOREACH(gr, &gss_resources, gr_link) {
 346                 if (gr->gr_id == id) {
 347                         LIST_REMOVE(gr, gr_link);
 348                         free(gr);
 349                         gss_resource_count--;
 350                         if (debug_level > 1)
 351                                 printf("%d resources allocated\n",
 352                                     gss_resource_count);
 353                         return;
 354                 }
 355         }
 356 }
 357
 358 static void
 359 gssd_verbose_out(const char *fmt, ...)
 360 {
 361         va_list ap;
 362
 363         if (verbose != 0) {
 364                 va_start(ap, fmt);
 365                 if (debug_level == 0)
 366                         vsyslog(LOG_INFO | LOG_DAEMON, fmt, ap);
 367                 else
 368                         vfprintf(stderr, fmt, ap);
 369                 va_end(ap);
 370         }
 371 }
 372
 373 bool_t
 374 gssd_null_1_svc(void *argp, void *result, struct svc_req *rqstp)
 375 {
 376
 377         gssd_verbose_out("gssd_null: done\n");
 378         return (TRUE);
 379 }
 380
 381 bool_t
 382 gssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *result, struct svc_req *rqstp)
 383 {
 384         gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
 385         gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
 386         gss_name_t name = GSS_C_NO_NAME;
 387         char ccname[PATH_MAX + 5 + 1], *cp, *cp2;
 388         int gotone, gotcred;
 389         OM_uint32 min_stat;
 390 #ifndef WITHOUT_KERBEROS
 391         gss_buffer_desc principal_desc;
 392         char enctype[sizeof(uint32_t)];
 393         int key_enctype;
 394         OM_uint32 maj_stat;
 395 #endif
 396
 397         memset(result, 0, sizeof(*result));
 398         if (hostbased_initiator_cred != 0 && argp->cred != 0 &&
 399             argp->uid == 0) {
 400                 /*
 401                  * These credentials are for a host based initiator name
 402                  * in a keytab file, which should now have credentials
 403                  * in /tmp/krb5cc_gssd, because gss_acquire_cred() did
 404                  * the equivalent of "kinit -k".
 405                  */
 406                 snprintf(ccname, sizeof(ccname), "FILE:%s",
 407                     GSSD_CREDENTIAL_CACHE_FILE);
 408         } else if (ccfile_dirlist[0] != '\0' && argp->cred == 0) {
 409                 /*
 410                  * For the "-s" case and no credentials provided as an
 411                  * argument, search the directory list for an appropriate
 412                  * credential cache file. If the search fails, return failure.
 413                  */
 414                 gotone = 0;
 415                 cp = ccfile_dirlist;
 416                 do {
 417                         cp2 = strchr(cp, ':');
 418                         if (cp2 != NULL)
 419                                 *cp2 = '\0';
 420                         gotone = find_ccache_file(cp, argp->uid, ccname);
 421                         if (gotone != 0)
 422                                 break;
 423                         if (cp2 != NULL)
 424                                 *cp2++ = ':';
 425                         cp = cp2;
 426                 } while (cp != NULL && *cp != '\0');
 427                 if (gotone == 0) {
 428                         result->major_status = GSS_S_CREDENTIALS_EXPIRED;
 429                         gssd_verbose_out("gssd_init_sec_context: -s no"
 430                             " credential cache file found for uid=%d\n",
 431                             (int)argp->uid);
 432                         return (TRUE);
 433                 }
 434         } else {
 435                 /*
 436                  * If there wasn't a "-s" option or the credentials have
 437                  * been provided as an argument, do it the old way.
 438                  * When credentials are provided, the uid should be root.
 439                  */
 440                 if (argp->cred != 0 && argp->uid != 0) {
 441                         if (debug_level == 0)
 442                                 syslog(LOG_ERR, "gss_init_sec_context:"
 443                                     " cred for non-root");
 444                         else
 445                                 fprintf(stderr, "gss_init_sec_context:"
 446                                     " cred for non-root\n");
 447                 }
 448                 snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d",
 449                     (int) argp->uid);
 450         }
 451         setenv("KRB5CCNAME", ccname, TRUE);
 452
 453         if (argp->cred) {
 454                 cred = gssd_find_resource(argp->cred);
 455                 if (!cred) {
 456                         result->major_status = GSS_S_CREDENTIALS_EXPIRED;
 457                         gssd_verbose_out("gssd_init_sec_context: cred"
 458                             " resource not found\n");
 459                         return (TRUE);
 460                 }
 461         }
 462         if (argp->ctx) {
 463                 ctx = gssd_find_resource(argp->ctx);
 464                 if (!ctx) {
 465                         result->major_status = GSS_S_CONTEXT_EXPIRED;
 466                         gssd_verbose_out("gssd_init_sec_context: context"
 467                             " resource not found\n");
 468                         return (TRUE);
 469                 }
 470         }
 471         if (argp->name) {
 472                 name = gssd_find_resource(argp->name);
 473                 if (!name) {
 474                         result->major_status = GSS_S_BAD_NAME;
 475                         gssd_verbose_out("gssd_init_sec_context: name"
 476                             " resource not found\n");
 477                         return (TRUE);
 478                 }
 479         }
 480         gotcred = 0;
 481
 482 #ifndef WITHOUT_KERBEROS
 483         if (use_old_des != 0) {
 484                 if (cred == GSS_C_NO_CREDENTIAL) {
 485                         /* Acquire a credential for the uid. */
 486                         maj_stat = gssd_get_user_cred(&min_stat, argp->uid,
 487                             &cred);
 488                         if (maj_stat == GSS_S_COMPLETE)
 489                                 gotcred = 1;
 490                         else
 491                                 gssd_verbose_out("gssd_init_sec_context: "
 492                                     "get user cred failed uid=%d major=0x%x "
 493                                     "minor=%d\n", (int)argp->uid,
 494                                     (unsigned int)maj_stat, (int)min_stat);
 495                 }
 496                 if (cred != GSS_C_NO_CREDENTIAL) {
 497                         key_enctype = ETYPE_DES_CBC_CRC;
 498                         enctype[0] = (key_enctype >> 24) & 0xff;
 499                         enctype[1] = (key_enctype >> 16) & 0xff;
 500                         enctype[2] = (key_enctype >> 8) & 0xff;
 501                         enctype[3] = key_enctype & 0xff;
 502                         principal_desc.length = sizeof(enctype);
 503                         principal_desc.value = enctype;
 504                         result->major_status = gss_set_cred_option(
 505                             &result->minor_status, &cred,
 506                             GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X,
 507                             &principal_desc);
 508                         gssd_verbose_out("gssd_init_sec_context: set allowable "
 509                             "enctype major=0x%x minor=%d\n",
 510                             (unsigned int)result->major_status,
 511                             (int)result->minor_status);
 512                         if (result->major_status != GSS_S_COMPLETE) {
 513                                 if (gotcred != 0)
 514                                         gss_release_cred(&min_stat, &cred);
 515                                 return (TRUE);
 516                         }
 517                 }
 518         }
 519 #endif
 520         result->major_status = gss_init_sec_context(&result->minor_status,
 521             cred, &ctx, name, argp->mech_type,
 522             argp->req_flags, argp->time_req, argp->input_chan_bindings,
 523             &argp->input_token, &result->actual_mech_type,
 524             &result->output_token, &result->ret_flags, &result->time_rec);
 525         gssd_verbose_out("gssd_init_sec_context: done major=0x%x minor=%d"
 526             " uid=%d\n", (unsigned int)result->major_status,
 527             (int)result->minor_status, (int)argp->uid);
 528         if (gotcred != 0)
 529                 gss_release_cred(&min_stat, &cred);
 530
 531         if (result->major_status == GSS_S_COMPLETE
 532             || result->major_status == GSS_S_CONTINUE_NEEDED) {
 533                 if (argp->ctx)
 534                         result->ctx = argp->ctx;
 535                 else
 536                         result->ctx = gssd_make_resource(ctx);
 537         }
 538
 539         return (TRUE);
 540 }
 541
 542 bool_t
 543 gssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_res *result, struct svc_req *rqstp)
 544 {
 545         gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
 546         gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
 547         gss_name_t src_name;
 548         gss_cred_id_t delegated_cred_handle;
 549
 550         memset(result, 0, sizeof(*result));
 551         if (argp->ctx) {
 552                 ctx = gssd_find_resource(argp->ctx);
 553                 if (!ctx) {
 554                         result->major_status = GSS_S_CONTEXT_EXPIRED;
 555                         gssd_verbose_out("gssd_accept_sec_context: ctx"
 556                             " resource not found\n");
 557                         return (TRUE);
 558                 }
 559         }
 560         if (argp->cred) {
 561                 cred = gssd_find_resource(argp->cred);
 562                 if (!cred) {
 563                         result->major_status = GSS_S_CREDENTIALS_EXPIRED;
 564                         gssd_verbose_out("gssd_accept_sec_context: cred"
 565                             " resource not found\n");
 566                         return (TRUE);
 567                 }
 568         }
 569
 570         memset(result, 0, sizeof(*result));
 571         result->major_status = gss_accept_sec_context(&result->minor_status,
 572             &ctx, cred, &argp->input_token, argp->input_chan_bindings,
 573             &src_name, &result->mech_type, &result->output_token,
 574             &result->ret_flags, &result->time_rec,
 575             &delegated_cred_handle);
 576         gssd_verbose_out("gssd_accept_sec_context: done major=0x%x minor=%d\n",
 577             (unsigned int)result->major_status, (int)result->minor_status);
 578
 579         if (result->major_status == GSS_S_COMPLETE
 580             || result->major_status == GSS_S_CONTINUE_NEEDED) {
 581                 if (argp->ctx)
 582                         result->ctx = argp->ctx;
 583                 else
 584                         result->ctx = gssd_make_resource(ctx);
 585                 result->src_name = gssd_make_resource(src_name);
 586                 result->delegated_cred_handle =
 587                         gssd_make_resource(delegated_cred_handle);
 588         }
 589
 590         return (TRUE);
 591 }
 592
 593 bool_t
 594 gssd_delete_sec_context_1_svc(delete_sec_context_args *argp, delete_sec_context_res *result, struct svc_req *rqstp)
 595 {
 596         gss_ctx_id_t ctx = gssd_find_resource(argp->ctx);
 597
 598         if (ctx) {
 599                 result->major_status = gss_delete_sec_context(
 600                         &result->minor_status, &ctx, &result->output_token);
 601                 gssd_delete_resource(argp->ctx);
 602         } else {
 603                 result->major_status = GSS_S_COMPLETE;
 604                 result->minor_status = 0;
 605         }
 606         gssd_verbose_out("gssd_delete_sec_context: done major=0x%x minor=%d\n",
 607             (unsigned int)result->major_status, (int)result->minor_status);
 608
 609         return (TRUE);
 610 }
 611
 612 bool_t
 613 gssd_export_sec_context_1_svc(export_sec_context_args *argp, export_sec_context_res *result, struct svc_req *rqstp)
 614 {
 615         gss_ctx_id_t ctx = gssd_find_resource(argp->ctx);
 616
 617         if (ctx) {
 618                 result->major_status = gss_export_sec_context(
 619                         &result->minor_status, &ctx,
 620                         &result->interprocess_token);
 621                 result->format = KGSS_HEIMDAL_1_1;
 622                 gssd_delete_resource(argp->ctx);
 623         } else {
 624                 result->major_status = GSS_S_FAILURE;
 625                 result->minor_status = 0;
 626                 result->interprocess_token.length = 0;
 627                 result->interprocess_token.value = NULL;
 628         }
 629         gssd_verbose_out("gssd_export_sec_context: done major=0x%x minor=%d\n",
 630             (unsigned int)result->major_status, (int)result->minor_status);
 631
 632         return (TRUE);
 633 }
 634
 635 bool_t
 636 gssd_import_name_1_svc(import_name_args *argp, import_name_res *result, struct svc_req *rqstp)
 637 {
 638         gss_name_t name;
 639
 640         result->major_status = gss_import_name(&result->minor_status,
 641             &argp->input_name_buffer, argp->input_name_type, &name);
 642         gssd_verbose_out("gssd_import_name: done major=0x%x minor=%d\n",
 643             (unsigned int)result->major_status, (int)result->minor_status);
 644
 645         if (result->major_status == GSS_S_COMPLETE)
 646                 result->output_name = gssd_make_resource(name);
 647         else
 648                 result->output_name = 0;
 649
 650         return (TRUE);
 651 }
 652
 653 bool_t
 654 gssd_canonicalize_name_1_svc(canonicalize_name_args *argp, canonicalize_name_res *result, struct svc_req *rqstp)
 655 {
 656         gss_name_t name = gssd_find_resource(argp->input_name);
 657         gss_name_t output_name;
 658
 659         memset(result, 0, sizeof(*result));
 660         if (!name) {
 661                 result->major_status = GSS_S_BAD_NAME;
 662                 return (TRUE);
 663         }
 664
 665         result->major_status = gss_canonicalize_name(&result->minor_status,
 666             name, argp->mech_type, &output_name);
 667         gssd_verbose_out("gssd_canonicalize_name: done major=0x%x minor=%d\n",
 668             (unsigned int)result->major_status, (int)result->minor_status);
 669
 670         if (result->major_status == GSS_S_COMPLETE)
 671                 result->output_name = gssd_make_resource(output_name);
 672         else
 673                 result->output_name = 0;
 674
 675         return (TRUE);
 676 }
 677
 678 bool_t
 679 gssd_export_name_1_svc(export_name_args *argp, export_name_res *result, struct svc_req *rqstp)
 680 {
 681         gss_name_t name = gssd_find_resource(argp->input_name);
 682
 683         memset(result, 0, sizeof(*result));
 684         if (!name) {
 685                 result->major_status = GSS_S_BAD_NAME;
 686                 gssd_verbose_out("gssd_export_name: name resource not found\n");
 687                 return (TRUE);
 688         }
 689
 690         result->major_status = gss_export_name(&result->minor_status,
 691             name, &result->exported_name);
 692         gssd_verbose_out("gssd_export_name: done major=0x%x minor=%d\n",
 693             (unsigned int)result->major_status, (int)result->minor_status);
 694
 695         return (TRUE);
 696 }
 697
 698 bool_t
 699 gssd_release_name_1_svc(release_name_args *argp, release_name_res *result, struct svc_req *rqstp)
 700 {
 701         gss_name_t name = gssd_find_resource(argp->input_name);
 702
 703         if (name) {
 704                 result->major_status = gss_release_name(&result->minor_status,
 705                     &name);
 706                 gssd_delete_resource(argp->input_name);
 707         } else {
 708                 result->major_status = GSS_S_COMPLETE;
 709                 result->minor_status = 0;
 710         }
 711         gssd_verbose_out("gssd_release_name: done major=0x%x minor=%d\n",
 712             (unsigned int)result->major_status, (int)result->minor_status);
 713
 714         return (TRUE);
 715 }
 716
 717 bool_t
 718 gssd_pname_to_uid_1_svc(pname_to_uid_args *argp, pname_to_uid_res *result, struct svc_req *rqstp)
 719 {
 720         gss_name_t name = gssd_find_resource(argp->pname);
 721         uid_t uid;
 722         char buf[1024], *bufp;
 723         struct passwd pwd, *pw;
 724         size_t buflen;
 725         int error;
 726         static size_t buflen_hint = 1024;
 727
 728         memset(result, 0, sizeof(*result));
 729         if (name) {
 730                 result->major_status =
 731                         gss_pname_to_uid(&result->minor_status,
 732                             name, argp->mech, &uid);
 733                 if (result->major_status == GSS_S_COMPLETE) {
 734                         result->uid = uid;
 735                         buflen = buflen_hint;
 736                         for (;;) {
 737                                 pw = NULL;
 738                                 bufp = buf;
 739                                 if (buflen > sizeof(buf))
 740                                         bufp = malloc(buflen);
 741                                 if (bufp == NULL)
 742                                         break;
 743                                 error = getpwuid_r(uid, &pwd, bufp, buflen,
 744                                     &pw);
 745                                 if (error != ERANGE)
 746                                         break;
 747                                 if (buflen > sizeof(buf))
 748                                         free(bufp);
 749                                 buflen += 1024;
 750                                 if (buflen > buflen_hint)
 751                                         buflen_hint = buflen;
 752                         }
 753                         if (pw) {
 754                                 int len = NGROUPS;
 755                                 int groups[NGROUPS];
 756                                 result->gid = pw->pw_gid;
 757                                 getgrouplist(pw->pw_name, pw->pw_gid,
 758                                     groups, &len);
 759                                 result->gidlist.gidlist_len = len;
 760                                 result->gidlist.gidlist_val =
 761                                         mem_alloc(len * sizeof(int));
 762                                 memcpy(result->gidlist.gidlist_val, groups,
 763                                     len * sizeof(int));
 764                                 gssd_verbose_out("gssd_pname_to_uid: mapped"
 765                                     " to uid=%d, gid=%d\n", (int)result->uid,
 766                                     (int)result->gid);
 767                         } else {
 768                                 result->gid = 65534;
 769                                 result->gidlist.gidlist_len = 0;
 770                                 result->gidlist.gidlist_val = NULL;
 771                                 gssd_verbose_out("gssd_pname_to_uid: mapped"
 772                                     " to uid=%d, but no groups\n",
 773                                     (int)result->uid);
 774                         }
 775                         if (bufp != NULL && buflen > sizeof(buf))
 776                                 free(bufp);
 777                 } else
 778                         gssd_verbose_out("gssd_pname_to_uid: failed major=0x%x"
 779                             " minor=%d\n", (unsigned int)result->major_status,
 780                             (int)result->minor_status);
 781         } else {
 782                 result->major_status = GSS_S_BAD_NAME;
 783                 result->minor_status = 0;
 784                 gssd_verbose_out("gssd_pname_to_uid: no name\n");
 785         }
 786
 787         return (TRUE);
 788 }
 789
 790 bool_t
 791 gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struct svc_req *rqstp)
 792 {
 793         gss_name_t desired_name = GSS_C_NO_NAME;
 794         gss_cred_id_t cred;
 795         char ccname[PATH_MAX + 5 + 1], *cp, *cp2;
 796         int gotone;
 797 #ifndef WITHOUT_KERBEROS
 798         gss_buffer_desc namebuf;
 799         uint32_t minstat;
 800         krb5_error_code kret;
 801 #endif
 802
 803         memset(result, 0, sizeof(*result));
 804         if (argp->desired_name) {
 805                 desired_name = gssd_find_resource(argp->desired_name);
 806                 if (!desired_name) {
 807                         result->major_status = GSS_S_BAD_NAME;
 808                         gssd_verbose_out("gssd_acquire_cred: no desired name"
 809                             " found\n");
 810                         return (TRUE);
 811                 }
 812         }
 813
 814 #ifndef WITHOUT_KERBEROS
 815         if (hostbased_initiator_cred != 0 && argp->desired_name != 0 &&
 816             argp->uid == 0 && argp->cred_usage == GSS_C_INITIATE) {
 817                 /* This is a host based initiator name in the keytab file. */
 818                 snprintf(ccname, sizeof(ccname), "FILE:%s",
 819                     GSSD_CREDENTIAL_CACHE_FILE);
 820                 setenv("KRB5CCNAME", ccname, TRUE);
 821                 result->major_status = gss_display_name(&result->minor_status,
 822                     desired_name, &namebuf, NULL);
 823                 gssd_verbose_out("gssd_acquire_cred: desired name for host "
 824                     "based initiator cred major=0x%x minor=%d\n",
 825                     (unsigned int)result->major_status,
 826                     (int)result->minor_status);
 827                 if (result->major_status != GSS_S_COMPLETE)
 828                         return (TRUE);
 829                 if (namebuf.length > PATH_MAX + 5) {
 830                         result->minor_status = 0;
 831                         result->major_status = GSS_S_FAILURE;
 832                         return (TRUE);
 833                 }
 834                 memcpy(ccname, namebuf.value, namebuf.length);
 835                 ccname[namebuf.length] = '\0';
 836                 if ((cp = strchr(ccname, '@')) != NULL)
 837                         *cp = '/';
 838                 kret = gssd_get_cc_from_keytab(ccname);
 839                 gssd_verbose_out("gssd_acquire_cred: using keytab entry for "
 840                     "%s, kerberos ret=%d\n", ccname, (int)kret);
 841                 gss_release_buffer(&minstat, &namebuf);
 842                 if (kret != 0) {
 843                         result->minor_status = kret;
 844                         result->major_status = GSS_S_FAILURE;
 845                         return (TRUE);
 846                 }
 847         } else
 848 #endif /* !WITHOUT_KERBEROS */
 849         if (ccfile_dirlist[0] != '\0' && argp->desired_name == 0) {
 850                 /*
 851                  * For the "-s" case and no name provided as an
 852                  * argument, search the directory list for an appropriate
 853                  * credential cache file. If the search fails, return failure.
 854                  */
 855                 gotone = 0;
 856                 cp = ccfile_dirlist;
 857                 do {
 858                         cp2 = strchr(cp, ':');
 859                         if (cp2 != NULL)
 860                                 *cp2 = '\0';
 861                         gotone = find_ccache_file(cp, argp->uid, ccname);
 862                         if (gotone != 0)
 863                                 break;
 864                         if (cp2 != NULL)
 865                                 *cp2++ = ':';
 866                         cp = cp2;
 867                 } while (cp != NULL && *cp != '\0');
 868                 if (gotone == 0) {
 869                         result->major_status = GSS_S_CREDENTIALS_EXPIRED;
 870                         gssd_verbose_out("gssd_acquire_cred: no cred cache"
 871                             " file found\n");
 872                         return (TRUE);
 873                 }
 874                 setenv("KRB5CCNAME", ccname, TRUE);
 875         } else {
 876                 /*
 877                  * If there wasn't a "-s" option or the name has
 878                  * been provided as an argument, do it the old way.
 879                  * When a name is provided, it will normally exist in the
 880                  * default keytab file and the uid will be root.
 881                  */
 882                 if (argp->desired_name != 0 && argp->uid != 0) {
 883                         if (debug_level == 0)
 884                                 syslog(LOG_ERR, "gss_acquire_cred:"
 885                                     " principal_name for non-root");
 886                         else
 887                                 fprintf(stderr, "gss_acquire_cred:"
 888                                     " principal_name for non-root\n");
 889                 }
 890                 snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d",
 891                     (int) argp->uid);
 892                 setenv("KRB5CCNAME", ccname, TRUE);
 893         }
 894
 895         result->major_status = gss_acquire_cred(&result->minor_status,
 896             desired_name, argp->time_req, argp->desired_mechs,
 897             argp->cred_usage, &cred, &result->actual_mechs, &result->time_rec);
 898         gssd_verbose_out("gssd_acquire_cred: done major=0x%x minor=%d\n",
 899             (unsigned int)result->major_status, (int)result->minor_status);
 900
 901         if (result->major_status == GSS_S_COMPLETE)
 902                 result->output_cred = gssd_make_resource(cred);
 903         else
 904                 result->output_cred = 0;
 905
 906         return (TRUE);
 907 }
 908
 909 bool_t
 910 gssd_set_cred_option_1_svc(set_cred_option_args *argp, set_cred_option_res *result, struct svc_req *rqstp)
 911 {
 912         gss_cred_id_t cred = gssd_find_resource(argp->cred);
 913
 914         memset(result, 0, sizeof(*result));
 915         if (!cred) {
 916                 result->major_status = GSS_S_CREDENTIALS_EXPIRED;
 917                 gssd_verbose_out("gssd_set_cred: no credentials\n");
 918                 return (TRUE);
 919         }
 920
 921         result->major_status = gss_set_cred_option(&result->minor_status,
 922             &cred, argp->option_name, &argp->option_value);
 923         gssd_verbose_out("gssd_set_cred: done major=0x%x minor=%d\n",
 924             (unsigned int)result->major_status, (int)result->minor_status);
 925
 926         return (TRUE);
 927 }
 928
 929 bool_t
 930 gssd_release_cred_1_svc(release_cred_args *argp, release_cred_res *result, struct svc_req *rqstp)
 931 {
 932         gss_cred_id_t cred = gssd_find_resource(argp->cred);
 933
 934         if (cred) {
 935                 result->major_status = gss_release_cred(&result->minor_status,
 936                     &cred);
 937                 gssd_delete_resource(argp->cred);
 938         } else {
 939                 result->major_status = GSS_S_COMPLETE;
 940                 result->minor_status = 0;
 941         }
 942         gssd_verbose_out("gssd_release_cred: done major=0x%x minor=%d\n",
 943             (unsigned int)result->major_status, (int)result->minor_status);
 944
 945         return (TRUE);
 946 }
 947
 948 bool_t
 949 gssd_display_status_1_svc(display_status_args *argp, display_status_res *result, struct svc_req *rqstp)
 950 {
 951
 952         result->message_context = argp->message_context;
 953         result->major_status = gss_display_status(&result->minor_status,
 954             argp->status_value, argp->status_type, argp->mech_type,
 955             &result->message_context, &result->status_string);
 956         gssd_verbose_out("gssd_display_status: done major=0x%x minor=%d\n",
 957             (unsigned int)result->major_status, (int)result->minor_status);
 958
 959         return (TRUE);
 960 }
 961
 962 int
 963 gssd_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, caddr_t result)
 964 {
 965         /*
 966          * We don't use XDR to free the results - anything which was
 967          * allocated came from GSS-API. We use xdr_result to figure
 968          * out what to do.
 969          */
 970         OM_uint32 junk;
 971
 972         if (xdr_result == (xdrproc_t) xdr_init_sec_context_res) {
 973                 init_sec_context_res *p = (init_sec_context_res *) result;
 974                 gss_release_buffer(&junk, &p->output_token);
 975         } else if (xdr_result == (xdrproc_t) xdr_accept_sec_context_res) {
 976                 accept_sec_context_res *p = (accept_sec_context_res *) result;
 977                 gss_release_buffer(&junk, &p->output_token);
 978         } else if (xdr_result == (xdrproc_t) xdr_delete_sec_context_res) {
 979                 delete_sec_context_res *p = (delete_sec_context_res *) result;
 980                 gss_release_buffer(&junk, &p->output_token);
 981         } else if (xdr_result == (xdrproc_t) xdr_export_sec_context_res) {
 982                 export_sec_context_res *p = (export_sec_context_res *) result;
 983                 if (p->interprocess_token.length)
 984                         memset(p->interprocess_token.value, 0,
 985                             p->interprocess_token.length);
 986                 gss_release_buffer(&junk, &p->interprocess_token);
 987         } else if (xdr_result == (xdrproc_t) xdr_export_name_res) {
 988                 export_name_res *p = (export_name_res *) result;
 989                 gss_release_buffer(&junk, &p->exported_name);
 990         } else if (xdr_result == (xdrproc_t) xdr_acquire_cred_res) {
 991                 acquire_cred_res *p = (acquire_cred_res *) result;
 992                 gss_release_oid_set(&junk, &p->actual_mechs);
 993         } else if (xdr_result == (xdrproc_t) xdr_pname_to_uid_res) {
 994                 pname_to_uid_res *p = (pname_to_uid_res *) result;
 995                 if (p->gidlist.gidlist_val)
 996                         free(p->gidlist.gidlist_val);
 997         } else if (xdr_result == (xdrproc_t) xdr_display_status_res) {
 998                 display_status_res *p = (display_status_res *) result;
 999                 gss_release_buffer(&junk, &p->status_string);
1000         }
1001
1002         return (TRUE);
1003 }
1004
1005 /*
1006  * Search a directory for the most likely candidate to be used as the
1007  * credential cache for a uid. If successful, return 1 and fill the
1008  * file's path id into "rpath". Otherwise, return 0.
1009  */
1010 static int
1011 find_ccache_file(const char *dirpath, uid_t uid, char *rpath)
1012 {
1013         DIR *dirp;
1014         struct dirent *dp;
1015         struct stat sb;
1016         time_t exptime, oexptime;
1017         int gotone, len, rating, orating;
1018         char namepath[PATH_MAX + 5 + 1];
1019         char retpath[PATH_MAX + 5 + 1];
1020
1021         dirp = opendir(dirpath);
1022         if (dirp == NULL)
1023                 return (0);
1024         gotone = 0;
1025         orating = 0;
1026         oexptime = 0;
1027         while ((dp = readdir(dirp)) != NULL) {
1028                 len = snprintf(namepath, sizeof(namepath), "%s/%s", dirpath,
1029                     dp->d_name);
1030                 if (len < sizeof(namepath) &&
1031                     (hostbased_initiator_cred == 0 || strcmp(namepath,
1032                      GSSD_CREDENTIAL_CACHE_FILE) != 0) &&
1033                     strstr(dp->d_name, ccfile_substring) != NULL &&
1034                     lstat(namepath, &sb) >= 0 &&
1035                     sb.st_uid == uid &&
1036                     S_ISREG(sb.st_mode)) {
1037                         len = snprintf(namepath, sizeof(namepath), "FILE:%s/%s",
1038                             dirpath, dp->d_name);
1039                         if (len < sizeof(namepath) &&
1040                             is_a_valid_tgt_cache(namepath, uid, &rating,
1041                             &exptime) != 0) {
1042                                 if (gotone == 0 || rating > orating ||
1043                                     (rating == orating && exptime > oexptime)) {
1044                                         orating = rating;
1045                                         oexptime = exptime;
1046                                         strcpy(retpath, namepath);
1047                                         gotone = 1;
1048                                 }
1049                         }
1050                 }
1051         }
1052         closedir(dirp);
1053         if (gotone != 0) {
1054                 strcpy(rpath, retpath);
1055                 return (1);
1056         }
1057         return (0);
1058 }
1059
1060 /*
1061  * Try to determine if the file is a valid tgt cache file.
1062  * Check that the file has a valid tgt for a principal.
1063  * If it does, return 1, otherwise return 0.
1064  * It also returns a "rating" and the expiry time for the TGT, when found.
1065  * This "rating" is higher based on heuristics that make it more
1066  * likely to be the correct credential cache file to use. It can
1067  * be used by the caller, along with expiry time, to select from
1068  * multiple credential cache files.
1069  */
1070 static int
1071 is_a_valid_tgt_cache(const char *filepath, uid_t uid, int *retrating,
1072     time_t *retexptime)
1073 {
1074 #ifndef WITHOUT_KERBEROS
1075         krb5_context context;
1076         krb5_principal princ;
1077         krb5_ccache ccache;
1078         krb5_error_code retval;
1079         krb5_cc_cursor curse;
1080         krb5_creds krbcred;
1081         int gotone, orating, rating, ret;
1082         struct passwd *pw;
1083         char *cp, *cp2, *pname;
1084         time_t exptime;
1085
1086         /* Find a likely name for the uid principal. */
1087         pw = getpwuid(uid);
1088
1089         /*
1090          * Do a bunch of krb5 library stuff to try and determine if
1091          * this file is a credentials cache with an appropriate TGT
1092          * in it.
1093          */
1094         retval = krb5_init_context(&context);
1095         if (retval != 0)
1096                 return (0);
1097         retval = krb5_cc_resolve(context, filepath, &ccache);
1098         if (retval != 0) {
1099                 krb5_free_context(context);
1100                 return (0);
1101         }
1102         ret = 0;
1103         orating = 0;
1104         exptime = 0;
1105         retval = krb5_cc_start_seq_get(context, ccache, &curse);
1106         if (retval == 0) {
1107                 while ((retval = krb5_cc_next_cred(context, ccache, &curse,
1108                     &krbcred)) == 0) {
1109                         gotone = 0;
1110                         rating = 0;
1111                         retval = krb5_unparse_name(context, krbcred.server,
1112                             &pname);
1113                         if (retval == 0) {
1114                                 cp = strchr(pname, '/');
1115                                 if (cp != NULL) {
1116                                         *cp++ = '\0';
1117                                         if (strcmp(pname, "krbtgt") == 0 &&
1118                                             krbcred.times.endtime > time(NULL)
1119                                             ) {
1120                                                 gotone = 1;
1121                                                 /*
1122                                                  * Test to see if this is a
1123                                                  * tgt for cross-realm auth.
1124                                                  * Rate it higher, if it is not.
1125                                                  */
1126                                                 cp2 = strchr(cp, '@');
1127                                                 if (cp2 != NULL) {
1128                                                         *cp2++ = '\0';
1129                                                         if (strcmp(cp, cp2) ==
1130                                                             0)
1131                                                                 rating++;
1132                                                 }
1133                                         }
1134                                 }
1135                                 free(pname);
1136                         }
1137                         if (gotone != 0) {
1138                                 retval = krb5_unparse_name(context,
1139                                     krbcred.client, &pname);
1140                                 if (retval == 0) {
1141                                         cp = strchr(pname, '@');
1142                                         if (cp != NULL) {
1143                                                 *cp++ = '\0';
1144                                                 if (pw != NULL && strcmp(pname,
1145                                                     pw->pw_name) == 0)
1146                                                         rating++;
1147                                                 if (strchr(pname, '/') == NULL)
1148                                                         rating++;
1149                                                 if (pref_realm[0] != '\0' &&
1150                                                     strcmp(cp, pref_realm) == 0)
1151                                                         rating++;
1152                                         }
1153                                 }
1154                                 free(pname);
1155                                 if (rating > orating) {
1156                                         orating = rating;
1157                                         exptime = krbcred.times.endtime;
1158                                 } else if (rating == orating &&
1159                                     krbcred.times.endtime > exptime)
1160                                         exptime = krbcred.times.endtime;
1161                                 ret = 1;
1162                         }
1163                         krb5_free_cred_contents(context, &krbcred);
1164                 }
1165                 krb5_cc_end_seq_get(context, ccache, &curse);
1166         }
1167         krb5_cc_close(context, ccache);
1168         krb5_free_context(context);
1169         if (ret != 0) {
1170                 *retrating = orating;
1171                 *retexptime = exptime;
1172         }
1173         return (ret);
1174 #else /* WITHOUT_KERBEROS */
1175         return (0);
1176 #endif /* !WITHOUT_KERBEROS */
1177 }
1178
1179 #ifndef WITHOUT_KERBEROS
1180 /*
1181  * This function attempts to do essentially a "kinit -k" for the principal
1182  * name provided as the argument, so that there will be a TGT in the
1183  * credential cache.
1184  */
1185 static krb5_error_code
1186 gssd_get_cc_from_keytab(const char *name)
1187 {
1188         krb5_error_code ret, opt_ret, princ_ret, cc_ret, kt_ret, cred_ret;
1189         krb5_context context;
1190         krb5_principal principal;
1191         krb5_keytab kt;
1192         krb5_creds cred;
1193         krb5_get_init_creds_opt *opt;
1194         krb5_deltat start_time = 0;
1195         krb5_ccache ccache;
1196
1197         ret = krb5_init_context(&context);
1198         if (ret != 0)
1199                 return (ret);
1200         opt_ret = cc_ret = kt_ret = cred_ret = 1;       /* anything non-zero */
1201         princ_ret = ret = krb5_parse_name(context, name, &principal);
1202         if (ret == 0)
1203                 opt_ret = ret = krb5_get_init_creds_opt_alloc(context, &opt);
1204         if (ret == 0)
1205                 cc_ret = ret = krb5_cc_default(context, &ccache);
1206         if (ret == 0)
1207                 ret = krb5_cc_initialize(context, ccache, principal);
1208         if (ret == 0) {
1209                 krb5_get_init_creds_opt_set_default_flags(context, "gssd",
1210                     krb5_principal_get_realm(context, principal), opt);
1211                 kt_ret = ret = krb5_kt_default(context, &kt);
1212         }
1213         if (ret == 0)
1214                 cred_ret = ret = krb5_get_init_creds_keytab(context, &cred,
1215                     principal, kt, start_time, NULL, opt);
1216         if (ret == 0)
1217                 ret = krb5_cc_store_cred(context, ccache, &cred);
1218         if (kt_ret == 0)
1219                 krb5_kt_close(context, kt);
1220         if (cc_ret == 0)
1221                 krb5_cc_close(context, ccache);
1222         if (opt_ret == 0)
1223                 krb5_get_init_creds_opt_free(context, opt);
1224         if (princ_ret == 0)
1225                 krb5_free_principal(context, principal);
1226         if (cred_ret == 0)
1227                 krb5_free_cred_contents(context, &cred);
1228         krb5_free_context(context);
1229         return (ret);
1230 }
1231
1232 /*
1233  * Acquire a gss credential for a uid.
1234  */
1235 static OM_uint32
1236 gssd_get_user_cred(OM_uint32 *min_statp, uid_t uid, gss_cred_id_t *credp)
1237 {
1238         gss_buffer_desc principal_desc;
1239         gss_name_t name;
1240         OM_uint32 maj_stat, min_stat;
1241         gss_OID_set mechlist;
1242         struct passwd *pw;
1243
1244         pw = getpwuid(uid);
1245         if (pw == NULL) {
1246                 *min_statp = 0;
1247                 return (GSS_S_FAILURE);
1248         }
1249
1250         /*
1251          * The mechanism must be set to KerberosV for acquisition
1252          * of credentials to work reliably.
1253          */
1254         maj_stat = gss_create_empty_oid_set(min_statp, &mechlist);
1255         if (maj_stat != GSS_S_COMPLETE)
1256                 return (maj_stat);
1257         maj_stat = gss_add_oid_set_member(min_statp, GSS_KRB5_MECH_OID_X,
1258             &mechlist);
1259         if (maj_stat != GSS_S_COMPLETE) {
1260                 gss_release_oid_set(&min_stat, &mechlist);
1261                 return (maj_stat);
1262         }
1263
1264         principal_desc.value = (void *)pw->pw_name;
1265         principal_desc.length = strlen(pw->pw_name);
1266         maj_stat = gss_import_name(min_statp, &principal_desc,
1267             GSS_C_NT_USER_NAME, &name);
1268         if (maj_stat != GSS_S_COMPLETE) {
1269                 gss_release_oid_set(&min_stat, &mechlist);
1270                 return (maj_stat);
1271         }
1272         /* Acquire the credentials. */
1273         maj_stat = gss_acquire_cred(min_statp, name, 0, mechlist,
1274             GSS_C_INITIATE, credp, NULL, NULL);
1275         gss_release_name(&min_stat, &name);
1276         gss_release_oid_set(&min_stat, &mechlist);
1277         return (maj_stat);
1278 }
1279 #endif /* !WITHOUT_KERBEROS */
1280
1281 void gssd_terminate(int sig __unused)
1282 {
1283
1284 #ifndef WITHOUT_KERBEROS
1285         if (hostbased_initiator_cred != 0)
1286                 unlink(GSSD_CREDENTIAL_CACHE_FILE);
1287 #endif
1288         gssd_syscall("");
1289         exit(0);
1290 }
1291