Print this page
5700 add zlogin -d option to allow graceful disconnect when zone is halted
Reviewed by: Andrew Gabriel <illumos@cucumber.demon.co.uk>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/cmd/zlogin/zlogin.c
+++ new/usr/src/cmd/zlogin/zlogin.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
|
↓ open down ↓ |
14 lines elided |
↑ open up ↑ |
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 23 * Copyright 2013 DEY Storage Systems, Inc.
24 24 * Copyright (c) 2014 Gary Mills
25 - * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
25 + * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
26 26 */
27 27
28 28 /*
29 29 * zlogin provides three types of login which allow users in the global
30 30 * zone to access non-global zones.
31 31 *
32 32 * - "interactive login" is similar to rlogin(1); for example, the user could
33 33 * issue 'zlogin my-zone' or 'zlogin -e ^ -l me my-zone'. The user is
34 34 * granted a new pty (which is then shoved into the zone), and an I/O
35 35 * loop between parent and child processes takes care of the interactive
36 36 * session. In this mode, login(1) (and its -c option, which means
37 37 * "already authenticated") is employed to take care of the initialization
38 38 * of the user's session.
39 39 *
40 40 * - "non-interactive login" is similar to su(1M); the user could issue
41 41 * 'zlogin my-zone ls -l' and the command would be run as specified.
42 42 * In this mode, zlogin sets up pipes as the communication channel, and
43 43 * 'su' is used to do the login setup work.
44 44 *
45 45 * - "console login" is the equivalent to accessing the tip line for a
46 46 * zone. For example, the user can issue 'zlogin -C my-zone'.
47 47 * In this mode, zlogin contacts the zoneadmd process via unix domain
48 48 * socket. If zoneadmd is not running, it starts it. This allows the
49 49 * console to be available anytime the zone is installed, regardless of
50 50 * whether it is running.
51 51 */
52 52
53 53 #include <sys/socket.h>
54 54 #include <sys/termios.h>
55 55 #include <sys/utsname.h>
56 56 #include <sys/stat.h>
57 57 #include <sys/types.h>
58 58 #include <sys/contract/process.h>
59 59 #include <sys/ctfs.h>
60 60 #include <sys/brand.h>
61 61 #include <sys/wait.h>
62 62 #include <alloca.h>
63 63 #include <assert.h>
64 64 #include <ctype.h>
65 65 #include <paths.h>
66 66 #include <door.h>
67 67 #include <errno.h>
68 68 #include <nss_dbdefs.h>
69 69 #include <poll.h>
70 70 #include <priv.h>
71 71 #include <pwd.h>
72 72 #include <unistd.h>
73 73 #include <utmpx.h>
74 74 #include <sac.h>
75 75 #include <signal.h>
76 76 #include <stdarg.h>
77 77 #include <stdio.h>
78 78 #include <stdlib.h>
79 79 #include <string.h>
80 80 #include <strings.h>
81 81 #include <stropts.h>
82 82 #include <wait.h>
83 83 #include <zone.h>
84 84 #include <fcntl.h>
85 85 #include <libdevinfo.h>
86 86 #include <libintl.h>
87 87 #include <locale.h>
88 88 #include <libzonecfg.h>
89 89 #include <libcontract.h>
90 90 #include <libbrand.h>
91 91 #include <auth_list.h>
92 92 #include <auth_attr.h>
93 93 #include <secdb.h>
94 94
95 95 static int masterfd;
96 96 static struct termios save_termios;
|
↓ open down ↓ |
61 lines elided |
↑ open up ↑ |
97 97 static struct termios effective_termios;
98 98 static int save_fd;
99 99 static struct winsize winsize;
100 100 static volatile int dead;
101 101 static volatile pid_t child_pid = -1;
102 102 static int interactive = 0;
103 103 static priv_set_t *dropprivs;
104 104
105 105 static int nocmdchar = 0;
106 106 static int failsafe = 0;
107 +static int disconnect = 0;
107 108 static char cmdchar = '~';
108 109 static int quiet = 0;
109 110
110 111 static int pollerr = 0;
111 112
112 113 static const char *pname;
113 114 static char *username;
114 115
115 116 /*
116 117 * When forced_login is true, the user is not prompted
117 118 * for an authentication password in the target zone.
118 119 */
119 120 static boolean_t forced_login = B_FALSE;
120 121
121 122 #if !defined(TEXT_DOMAIN) /* should be defined by cc -D */
122 123 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it wasn't */
123 124 #endif
124 125
125 126 #define SUPATH "/usr/bin/su"
126 127 #define FAILSAFESHELL "/sbin/sh"
127 128 #define DEFAULTSHELL "/sbin/sh"
128 129 #define DEF_PATH "/usr/sbin:/usr/bin"
129 130
130 131 #define CLUSTER_BRAND_NAME "cluster"
131 132
132 133 /*
133 134 * The ZLOGIN_BUFSIZ is larger than PIPE_BUF so we can be sure we're clearing
134 135 * out the pipe when the child is exiting. The ZLOGIN_RDBUFSIZ must be less
135 136 * than ZLOGIN_BUFSIZ (because we share the buffer in doio). This value is
136 137 * also chosen in conjunction with the HI_WATER setting to make sure we
137 138 * don't fill up the pipe. We can write FIFOHIWAT (16k) into the pipe before
138 139 * blocking. By having ZLOGIN_RDBUFSIZ set to 1k and HI_WATER set to 8k, we
139 140 * know we can always write a ZLOGIN_RDBUFSIZ chunk into the pipe when there
140 141 * is less than HI_WATER data already in the pipe.
141 142 */
142 143 #define ZLOGIN_BUFSIZ 8192
143 144 #define ZLOGIN_RDBUFSIZ 1024
144 145 #define HI_WATER 8192
|
↓ open down ↓ |
28 lines elided |
↑ open up ↑ |
145 146
146 147 /*
147 148 * See canonify() below. CANONIFY_LEN is the maximum length that a
148 149 * "canonical" sequence will expand to (backslash, three octal digits, NUL).
149 150 */
150 151 #define CANONIFY_LEN 5
151 152
152 153 static void
153 154 usage(void)
154 155 {
155 - (void) fprintf(stderr, gettext("usage: %s [ -nQCES ] [ -e cmdchar ] "
156 + (void) fprintf(stderr, gettext("usage: %s [ -dnQCES ] [ -e cmdchar ] "
156 157 "[-l user] zonename [command [args ...] ]\n"), pname);
157 158 exit(2);
158 159 }
159 160
160 161 static const char *
161 162 getpname(const char *arg0)
162 163 {
163 164 const char *p = strrchr(arg0, '/');
164 165
165 166 if (p == NULL)
166 167 p = arg0;
167 168 else
168 169 p++;
169 170
170 171 pname = p;
171 172 return (p);
172 173 }
173 174
174 175 static void
175 176 zerror(const char *fmt, ...)
176 177 {
177 178 va_list alist;
178 179
179 180 (void) fprintf(stderr, "%s: ", pname);
180 181 va_start(alist, fmt);
181 182 (void) vfprintf(stderr, fmt, alist);
182 183 va_end(alist);
183 184 (void) fprintf(stderr, "\n");
184 185 }
185 186
186 187 static void
187 188 zperror(const char *str)
188 189 {
189 190 const char *estr;
190 191
191 192 if ((estr = strerror(errno)) != NULL)
192 193 (void) fprintf(stderr, "%s: %s: %s\n", pname, str, estr);
193 194 else
194 195 (void) fprintf(stderr, "%s: %s: errno %d\n", pname, str, errno);
195 196 }
196 197
197 198 /*
198 199 * The first part of our privilege dropping scheme needs to be called before
199 200 * fork(), since we must have it for security; we don't want to be surprised
200 201 * later that we couldn't allocate the privset.
201 202 */
202 203 static int
203 204 prefork_dropprivs()
204 205 {
205 206 if ((dropprivs = priv_allocset()) == NULL)
206 207 return (1);
207 208
208 209 priv_basicset(dropprivs);
209 210 (void) priv_delset(dropprivs, PRIV_PROC_INFO);
210 211 (void) priv_delset(dropprivs, PRIV_PROC_FORK);
211 212 (void) priv_delset(dropprivs, PRIV_PROC_EXEC);
212 213 (void) priv_delset(dropprivs, PRIV_FILE_LINK_ANY);
213 214
214 215 /*
215 216 * We need to keep the basic privilege PROC_SESSION and all unknown
216 217 * basic privileges as well as the privileges PROC_ZONE and
217 218 * PROC_OWNER in order to query session information and
218 219 * send signals.
219 220 */
220 221 if (interactive == 0) {
221 222 (void) priv_addset(dropprivs, PRIV_PROC_ZONE);
222 223 (void) priv_addset(dropprivs, PRIV_PROC_OWNER);
223 224 } else {
224 225 (void) priv_delset(dropprivs, PRIV_PROC_SESSION);
225 226 }
226 227
227 228 return (0);
228 229 }
229 230
230 231 /*
231 232 * The second part of the privilege drop. We are paranoid about being attacked
232 233 * by the zone, so we drop all privileges. This should prevent a compromise
233 234 * which gets us to fork(), exec(), symlink(), etc.
234 235 */
235 236 static void
236 237 postfork_dropprivs()
237 238 {
238 239 if ((setppriv(PRIV_SET, PRIV_PERMITTED, dropprivs)) == -1) {
239 240 zperror(gettext("Warning: could not set permitted privileges"));
240 241 }
241 242 if ((setppriv(PRIV_SET, PRIV_LIMIT, dropprivs)) == -1) {
242 243 zperror(gettext("Warning: could not set limit privileges"));
243 244 }
244 245 if ((setppriv(PRIV_SET, PRIV_INHERITABLE, dropprivs)) == -1) {
245 246 zperror(gettext("Warning: could not set inheritable "
246 247 "privileges"));
247 248 }
248 249 }
249 250
250 251 /*
251 252 * Create the unix domain socket and call the zoneadmd server; handshake
252 253 * with it to determine whether it will allow us to connect.
253 254 */
254 255 static int
255 256 get_console_master(const char *zname)
256 257 {
257 258 int sockfd = -1;
258 259 struct sockaddr_un servaddr;
259 260 char clientid[MAXPATHLEN];
260 261 char handshake[MAXPATHLEN], c;
261 262 int msglen;
262 263 int i = 0, err = 0;
263 264
264 265 if ((sockfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
265 266 zperror(gettext("could not create socket"));
266 267 return (-1);
267 268 }
268 269
269 270 bzero(&servaddr, sizeof (servaddr));
270 271 servaddr.sun_family = AF_UNIX;
|
↓ open down ↓ |
105 lines elided |
↑ open up ↑ |
271 272 (void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path),
272 273 "%s/%s.console_sock", ZONES_TMPDIR, zname);
273 274
274 275 if (connect(sockfd, (struct sockaddr *)&servaddr,
275 276 sizeof (servaddr)) == -1) {
276 277 zperror(gettext("Could not connect to zone console"));
277 278 goto bad;
278 279 }
279 280 masterfd = sockfd;
280 281
281 - msglen = snprintf(clientid, sizeof (clientid), "IDENT %lu %s\n",
282 - getpid(), setlocale(LC_MESSAGES, NULL));
282 + msglen = snprintf(clientid, sizeof (clientid), "IDENT %lu %s %d\n",
283 + getpid(), setlocale(LC_MESSAGES, NULL), disconnect);
283 284
284 285 if (msglen >= sizeof (clientid) || msglen < 0) {
285 286 zerror("protocol error");
286 287 goto bad;
287 288 }
288 289
289 290 if (write(masterfd, clientid, msglen) != msglen) {
290 291 zerror("protocol error");
291 292 goto bad;
292 293 }
293 294
294 295 bzero(handshake, sizeof (handshake));
295 296
296 297 /*
297 298 * Take care not to accumulate more than our fill, and leave room for
298 299 * the NUL at the end.
299 300 */
300 301 while ((err = read(masterfd, &c, 1)) == 1) {
301 302 if (i >= (sizeof (handshake) - 1))
302 303 break;
303 304 if (c == '\n')
304 305 break;
305 306 handshake[i] = c;
306 307 i++;
307 308 }
308 309
309 310 /*
310 311 * If something went wrong during the handshake we bail; perhaps
311 312 * the server died off.
312 313 */
313 314 if (err == -1) {
314 315 zperror(gettext("Could not connect to zone console"));
315 316 goto bad;
316 317 }
317 318
318 319 if (strncmp(handshake, "OK", sizeof (handshake)) == 0)
319 320 return (0);
320 321
321 322 zerror(gettext("Console is already in use by process ID %s."),
322 323 handshake);
323 324 bad:
324 325 (void) close(sockfd);
325 326 masterfd = -1;
326 327 return (-1);
327 328 }
328 329
329 330
330 331 /*
331 332 * Routines to handle pty creation upon zone entry and to shuttle I/O back
332 333 * and forth between the two terminals. We also compute and store the
333 334 * name of the slave terminal associated with the master side.
334 335 */
335 336 static int
336 337 get_master_pty()
337 338 {
338 339 if ((masterfd = open("/dev/ptmx", O_RDWR|O_NONBLOCK)) < 0) {
339 340 zperror(gettext("failed to obtain a pseudo-tty"));
340 341 return (-1);
341 342 }
342 343 if (tcgetattr(STDIN_FILENO, &save_termios) == -1) {
343 344 zperror(gettext("failed to get terminal settings from stdin"));
344 345 return (-1);
345 346 }
346 347 (void) ioctl(STDIN_FILENO, TIOCGWINSZ, (char *)&winsize);
347 348
348 349 return (0);
349 350 }
350 351
351 352 /*
352 353 * This is a bit tricky; normally a pts device will belong to the zone it
353 354 * is granted to. But in the case of "entering" a zone, we need to establish
354 355 * the pty before entering the zone so that we can vector I/O to and from it
355 356 * from the global zone.
356 357 *
357 358 * We use the zonept() call to let the ptm driver know what we are up to;
358 359 * the only other hairy bit is the setting of zoneslavename (which happens
359 360 * above, in get_master_pty()).
360 361 */
361 362 static int
362 363 init_slave_pty(zoneid_t zoneid, char *devroot)
363 364 {
364 365 int slavefd = -1;
365 366 char *slavename, zoneslavename[MAXPATHLEN];
366 367
367 368 /*
368 369 * Set slave permissions, zone the pts, then unlock it.
369 370 */
370 371 if (grantpt(masterfd) != 0) {
371 372 zperror(gettext("grantpt failed"));
372 373 return (-1);
373 374 }
374 375
375 376 if (unlockpt(masterfd) != 0) {
376 377 zperror(gettext("unlockpt failed"));
377 378 return (-1);
378 379 }
379 380
380 381 /*
381 382 * We must open the slave side before zoning this pty; otherwise
382 383 * the kernel would refuse us the open-- zoning a pty makes it
383 384 * inaccessible to the global zone. Note we are trying to open
384 385 * the device node via the $ZONEROOT/dev path for this pty.
385 386 *
386 387 * Later we'll close the slave out when once we've opened it again
387 388 * from within the target zone. Blarg.
388 389 */
389 390 if ((slavename = ptsname(masterfd)) == NULL) {
390 391 zperror(gettext("failed to get name for pseudo-tty"));
391 392 return (-1);
392 393 }
393 394
394 395 (void) snprintf(zoneslavename, sizeof (zoneslavename), "%s%s",
395 396 devroot, slavename);
396 397
397 398 if ((slavefd = open(zoneslavename, O_RDWR)) < 0) {
398 399 zerror(gettext("failed to open %s: %s"), zoneslavename,
399 400 strerror(errno));
400 401 return (-1);
401 402 }
402 403
403 404 /*
404 405 * Push hardware emulation (ptem), line discipline (ldterm),
405 406 * and V7/4BSD/Xenix compatibility (ttcompat) modules.
406 407 */
407 408 if (ioctl(slavefd, I_PUSH, "ptem") == -1) {
408 409 zperror(gettext("failed to push ptem module"));
409 410 if (!failsafe)
410 411 goto bad;
411 412 }
412 413
413 414 /*
414 415 * Anchor the stream to prevent malicious I_POPs; we prefer to do
415 416 * this prior to entering the zone so that we can detect any errors
416 417 * early, and so that we can set the anchor from the global zone.
417 418 */
418 419 if (ioctl(slavefd, I_ANCHOR) == -1) {
419 420 zperror(gettext("failed to set stream anchor"));
420 421 if (!failsafe)
421 422 goto bad;
422 423 }
423 424
424 425 if (ioctl(slavefd, I_PUSH, "ldterm") == -1) {
425 426 zperror(gettext("failed to push ldterm module"));
426 427 if (!failsafe)
427 428 goto bad;
428 429 }
429 430 if (ioctl(slavefd, I_PUSH, "ttcompat") == -1) {
430 431 zperror(gettext("failed to push ttcompat module"));
431 432 if (!failsafe)
432 433 goto bad;
433 434 }
434 435
435 436 /*
436 437 * Propagate terminal settings from the external term to the new one.
437 438 */
438 439 if (tcsetattr(slavefd, TCSAFLUSH, &save_termios) == -1) {
439 440 zperror(gettext("failed to set terminal settings"));
440 441 if (!failsafe)
441 442 goto bad;
442 443 }
443 444 (void) ioctl(slavefd, TIOCSWINSZ, (char *)&winsize);
444 445
445 446 if (zonept(masterfd, zoneid) != 0) {
446 447 zperror(gettext("could not set zoneid of pty"));
447 448 goto bad;
448 449 }
449 450
450 451 return (slavefd);
451 452
452 453 bad:
453 454 (void) close(slavefd);
454 455 return (-1);
455 456 }
456 457
457 458 /*
458 459 * Place terminal into raw mode.
459 460 */
460 461 static int
461 462 set_tty_rawmode(int fd)
462 463 {
463 464 struct termios term;
464 465 if (tcgetattr(fd, &term) < 0) {
465 466 zperror(gettext("failed to get user terminal settings"));
466 467 return (-1);
467 468 }
468 469
469 470 /* Stash for later, so we can revert back to previous mode */
470 471 save_termios = term;
471 472 save_fd = fd;
472 473
473 474 /* disable 8->7 bit strip, start/stop, enable any char to restart */
474 475 term.c_iflag &= ~(ISTRIP|IXON|IXANY);
475 476 /* disable NL->CR, CR->NL, ignore CR, UPPER->lower */
476 477 term.c_iflag &= ~(INLCR|ICRNL|IGNCR|IUCLC);
477 478 /* disable output post-processing */
478 479 term.c_oflag &= ~OPOST;
479 480 /* disable canonical mode, signal chars, echo & extended functions */
480 481 term.c_lflag &= ~(ICANON|ISIG|ECHO|IEXTEN);
481 482
482 483 term.c_cc[VMIN] = 1; /* byte-at-a-time */
483 484 term.c_cc[VTIME] = 0;
484 485
485 486 if (tcsetattr(STDIN_FILENO, TCSAFLUSH, &term)) {
486 487 zperror(gettext("failed to set user terminal to raw mode"));
487 488 return (-1);
488 489 }
489 490
490 491 /*
491 492 * We need to know the value of VEOF so that we can properly process for
492 493 * client-side ~<EOF>. But we have obliterated VEOF in term,
493 494 * because VMIN overloads the same array slot in non-canonical mode.
494 495 * Stupid @&^%!
495 496 *
496 497 * So here we construct the "effective" termios from the current
497 498 * terminal settings, and the corrected VEOF and VEOL settings.
498 499 */
499 500 if (tcgetattr(STDIN_FILENO, &effective_termios) < 0) {
500 501 zperror(gettext("failed to get user terminal settings"));
501 502 return (-1);
502 503 }
503 504 effective_termios.c_cc[VEOF] = save_termios.c_cc[VEOF];
504 505 effective_termios.c_cc[VEOL] = save_termios.c_cc[VEOL];
505 506
506 507 return (0);
507 508 }
508 509
509 510 /*
510 511 * Copy terminal window size from our terminal to the pts.
511 512 */
512 513 /*ARGSUSED*/
513 514 static void
514 515 sigwinch(int s)
515 516 {
516 517 struct winsize ws;
517 518
518 519 if (ioctl(0, TIOCGWINSZ, &ws) == 0)
519 520 (void) ioctl(masterfd, TIOCSWINSZ, &ws);
520 521 }
521 522
522 523 static volatile int close_on_sig = -1;
523 524
524 525 static void
525 526 /*ARGSUSED*/
526 527 sigcld(int s)
527 528 {
528 529 int status;
529 530 pid_t pid;
530 531
531 532 /*
532 533 * Peek at the exit status. If this isn't the process we cared
533 534 * about, then just reap it.
534 535 */
535 536 if ((pid = waitpid(child_pid, &status, WNOHANG|WNOWAIT)) != -1) {
536 537 if (pid == child_pid &&
537 538 (WIFEXITED(status) || WIFSIGNALED(status))) {
538 539 dead = 1;
539 540 if (close_on_sig != -1) {
540 541 (void) write(close_on_sig, "a", 1);
541 542 (void) close(close_on_sig);
542 543 close_on_sig = -1;
543 544 }
544 545 } else {
545 546 (void) waitpid(pid, &status, WNOHANG);
546 547 }
547 548 }
548 549 }
549 550
550 551 /*
551 552 * Some signals (currently, SIGINT) must be forwarded on to the process
552 553 * group of the child process.
553 554 */
554 555 static void
555 556 sig_forward(int s)
556 557 {
557 558 if (child_pid != -1) {
558 559 (void) sigsend(P_PGID, child_pid, s);
559 560 }
560 561 }
561 562
562 563 /*
563 564 * reset terminal settings for global environment
564 565 */
565 566 static void
566 567 reset_tty()
567 568 {
568 569 (void) tcsetattr(save_fd, TCSADRAIN, &save_termios);
569 570 }
570 571
571 572 /*
572 573 * Convert character to printable representation, for display with locally
573 574 * echoed command characters (like when we need to display ~^D)
574 575 */
575 576 static void
576 577 canonify(char c, char *cc)
577 578 {
578 579 if (isprint(c)) {
579 580 cc[0] = c;
580 581 cc[1] = '\0';
581 582 } else if (c >= 0 && c <= 31) { /* ^@ through ^_ */
582 583 cc[0] = '^';
583 584 cc[1] = c + '@';
584 585 cc[2] = '\0';
585 586 } else {
586 587 cc[0] = '\\';
587 588 cc[1] = ((c >> 6) & 7) + '0';
588 589 cc[2] = ((c >> 3) & 7) + '0';
589 590 cc[3] = (c & 7) + '0';
590 591 cc[4] = '\0';
591 592 }
592 593 }
593 594
594 595 /*
595 596 * process_user_input watches the input stream for the escape sequence for
596 597 * 'quit' (by default, tilde-period). Because we might be fed just one
597 598 * keystroke at a time, state associated with the user input (are we at the
598 599 * beginning of the line? are we locally echoing the next character?) is
599 600 * maintained by beginning_of_line and local_echo across calls to the routine.
600 601 * If the write to outfd fails, we'll try to read from infd in an attempt
601 602 * to prevent deadlock between the two processes.
602 603 *
603 604 * This routine returns -1 when the 'quit' escape sequence has been issued,
604 605 * or an error is encountered, 1 if stdin is EOF, and 0 otherwise.
605 606 */
606 607 static int
607 608 process_user_input(int outfd, int infd)
608 609 {
609 610 static boolean_t beginning_of_line = B_TRUE;
610 611 static boolean_t local_echo = B_FALSE;
611 612 char ibuf[ZLOGIN_BUFSIZ];
612 613 int nbytes;
613 614 char *buf = ibuf;
614 615 char c = *buf;
615 616
616 617 nbytes = read(STDIN_FILENO, ibuf, ZLOGIN_RDBUFSIZ);
617 618 if (nbytes == -1 && (errno != EINTR || dead))
618 619 return (-1);
619 620
620 621 if (nbytes == -1) /* The read was interrupted. */
621 622 return (0);
622 623
623 624 /* 0 read means EOF, close the pipe to the child */
624 625 if (nbytes == 0)
625 626 return (1);
626 627
627 628 for (c = *buf; nbytes > 0; c = *buf, --nbytes) {
628 629 buf++;
629 630 if (beginning_of_line && !nocmdchar) {
630 631 beginning_of_line = B_FALSE;
631 632 if (c == cmdchar) {
632 633 local_echo = B_TRUE;
633 634 continue;
634 635 }
635 636 } else if (local_echo) {
636 637 local_echo = B_FALSE;
637 638 if (c == '.' || c == effective_termios.c_cc[VEOF]) {
638 639 char cc[CANONIFY_LEN];
639 640
640 641 canonify(c, cc);
641 642 (void) write(STDOUT_FILENO, &cmdchar, 1);
642 643 (void) write(STDOUT_FILENO, cc, strlen(cc));
643 644 return (-1);
644 645 }
645 646 }
646 647 retry:
647 648 if (write(outfd, &c, 1) <= 0) {
648 649 /*
649 650 * Since the fd we are writing to is opened with
650 651 * O_NONBLOCK it is possible to get EAGAIN if the
651 652 * pipe is full. One way this could happen is if we
652 653 * are writing a lot of data into the pipe in this loop
653 654 * and the application on the other end is echoing that
654 655 * data back out to its stdout. The output pipe can
655 656 * fill up since we are stuck here in this loop and not
656 657 * draining the other pipe. We can try to read some of
657 658 * the data to see if we can drain the pipe so that the
658 659 * application can continue to make progress. The read
659 660 * is non-blocking so we won't hang here. We also wait
660 661 * a bit before retrying since there could be other
661 662 * reasons why the pipe is full and we don't want to
662 663 * continuously retry.
663 664 */
664 665 if (errno == EAGAIN) {
665 666 struct timespec rqtp;
666 667 int ln;
667 668 char obuf[ZLOGIN_BUFSIZ];
668 669
669 670 if ((ln = read(infd, obuf, ZLOGIN_BUFSIZ)) > 0)
670 671 (void) write(STDOUT_FILENO, obuf, ln);
671 672
672 673 /* sleep for 10 milliseconds */
673 674 rqtp.tv_sec = 0;
674 675 rqtp.tv_nsec = MSEC2NSEC(10);
675 676 (void) nanosleep(&rqtp, NULL);
676 677 if (!dead)
677 678 goto retry;
678 679 }
679 680
680 681 return (-1);
681 682 }
682 683 beginning_of_line = (c == '\r' || c == '\n' ||
683 684 c == effective_termios.c_cc[VKILL] ||
684 685 c == effective_termios.c_cc[VEOL] ||
685 686 c == effective_termios.c_cc[VSUSP] ||
686 687 c == effective_termios.c_cc[VINTR]);
687 688 }
688 689 return (0);
689 690 }
690 691
691 692 /*
692 693 * This function prevents deadlock between zlogin and the application in the
693 694 * zone that it is talking to. This can happen when we read from zlogin's
694 695 * stdin and write the data down the pipe to the application. If the pipe
695 696 * is full, we'll block in the write. Because zlogin could be blocked in
696 697 * the write, it would never read the application's stdout/stderr so the
697 698 * application can then block on those writes (when the pipe fills up). If the
698 699 * the application gets blocked this way, it can never get around to reading
699 700 * its stdin so that zlogin can unblock from its write. Once in this state,
700 701 * the two processes are deadlocked.
701 702 *
702 703 * To prevent this, we want to verify that we can write into the pipe before we
703 704 * read from our stdin. If the pipe already is pretty full, we bypass the read
704 705 * for now. We'll circle back here again after the poll() so that we can
705 706 * try again. When this function is called, we already know there is data
706 707 * ready to read on STDIN_FILENO. We return -1 if there is a problem, 1 if
707 708 * stdin is EOF, and 0 if everything is ok (even though we might not have
708 709 * read/written any data into the pipe on this iteration).
709 710 */
710 711 static int
711 712 process_raw_input(int stdin_fd, int appin_fd)
712 713 {
713 714 int cc;
714 715 struct stat64 sb;
715 716 char ibuf[ZLOGIN_RDBUFSIZ];
716 717
717 718 /* Check how much data is already in the pipe */
718 719 if (fstat64(appin_fd, &sb) == -1) {
719 720 perror("stat failed");
720 721 return (-1);
721 722 }
722 723
723 724 if (dead)
724 725 return (-1);
725 726
726 727 /*
727 728 * The pipe already has a lot of data in it, don't write any more
728 729 * right now.
729 730 */
730 731 if (sb.st_size >= HI_WATER)
731 732 return (0);
732 733
733 734 cc = read(STDIN_FILENO, ibuf, ZLOGIN_RDBUFSIZ);
734 735 if (cc == -1 && (errno != EINTR || dead))
735 736 return (-1);
736 737
737 738 if (cc == -1) /* The read was interrupted. */
738 739 return (0);
739 740
740 741 /* 0 read means EOF, close the pipe to the child */
741 742 if (cc == 0)
742 743 return (1);
743 744
744 745 /*
745 746 * stdin_fd is stdin of the target; so, the thing we'll write the user
746 747 * data *to*.
747 748 */
748 749 if (write(stdin_fd, ibuf, cc) == -1)
749 750 return (-1);
750 751
751 752 return (0);
752 753 }
753 754
754 755 /*
755 756 * Write the output from the application running in the zone. We can get
756 757 * a signal during the write (usually it would be SIGCHLD when the application
757 758 * has exited) so we loop to make sure we have written all of the data we read.
758 759 */
759 760 static int
760 761 process_output(int in_fd, int out_fd)
761 762 {
762 763 int wrote = 0;
763 764 int cc;
764 765 char ibuf[ZLOGIN_BUFSIZ];
765 766
766 767 cc = read(in_fd, ibuf, ZLOGIN_BUFSIZ);
767 768 if (cc == -1 && (errno != EINTR || dead))
768 769 return (-1);
769 770 if (cc == 0) /* EOF */
770 771 return (-1);
771 772 if (cc == -1) /* The read was interrupted. */
772 773 return (0);
773 774
774 775 do {
775 776 int len;
776 777
777 778 len = write(out_fd, ibuf + wrote, cc - wrote);
778 779 if (len == -1 && errno != EINTR)
779 780 return (-1);
780 781 if (len != -1)
781 782 wrote += len;
782 783 } while (wrote < cc);
783 784
784 785 return (0);
785 786 }
786 787
787 788 /*
788 789 * This is the main I/O loop, and is shared across all zlogin modes.
789 790 * Parameters:
790 791 * stdin_fd: The fd representing 'stdin' for the slave side; input to
791 792 * the zone will be written here.
792 793 *
793 794 * appin_fd: The fd representing the other end of the 'stdin' pipe (when
794 795 * we're running non-interactive); used in process_raw_input
795 796 * to ensure we don't fill up the application's stdin pipe.
796 797 *
797 798 * stdout_fd: The fd representing 'stdout' for the slave side; output
798 799 * from the zone will arrive here.
799 800 *
800 801 * stderr_fd: The fd representing 'stderr' for the slave side; output
801 802 * from the zone will arrive here.
802 803 *
803 804 * raw_mode: If TRUE, then no processing (for example, for '~.') will
804 805 * be performed on the input coming from STDIN.
805 806 *
806 807 * stderr_fd may be specified as -1 if there is no stderr (only non-interactive
807 808 * mode supplies a stderr).
808 809 *
809 810 */
810 811 static void
811 812 doio(int stdin_fd, int appin_fd, int stdout_fd, int stderr_fd, int sig_fd,
812 813 boolean_t raw_mode)
813 814 {
814 815 struct pollfd pollfds[4];
815 816 char ibuf[ZLOGIN_BUFSIZ];
816 817 int cc, ret;
817 818
818 819 /* read from stdout of zone and write to stdout of global zone */
819 820 pollfds[0].fd = stdout_fd;
820 821 pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI;
821 822
822 823 /* read from stderr of zone and write to stderr of global zone */
823 824 pollfds[1].fd = stderr_fd;
824 825 pollfds[1].events = pollfds[0].events;
825 826
826 827 /* read from stdin of global zone and write to stdin of zone */
827 828 pollfds[2].fd = STDIN_FILENO;
828 829 pollfds[2].events = pollfds[0].events;
829 830
830 831 /* read from signalling pipe so we know when child dies */
831 832 pollfds[3].fd = sig_fd;
832 833 pollfds[3].events = pollfds[0].events;
833 834
834 835 for (;;) {
835 836 pollfds[0].revents = pollfds[1].revents =
836 837 pollfds[2].revents = pollfds[3].revents = 0;
837 838
838 839 if (dead)
839 840 break;
840 841
841 842 /*
842 843 * There is a race condition here where we can receive the
843 844 * child death signal, set the dead flag, but since we have
844 845 * passed the test above, we would go into poll and hang.
845 846 * To avoid this we use the sig_fd as an additional poll fd.
846 847 * The signal handler writes into the other end of this pipe
847 848 * when the child dies so that the poll will always see that
848 849 * input and proceed. We just loop around at that point and
849 850 * then notice the dead flag.
850 851 */
851 852
852 853 ret = poll(pollfds,
853 854 sizeof (pollfds) / sizeof (struct pollfd), -1);
854 855
855 856 if (ret == -1 && errno != EINTR) {
856 857 perror("poll failed");
857 858 break;
858 859 }
859 860
860 861 if (errno == EINTR && dead) {
861 862 break;
862 863 }
863 864
864 865 /* event from master side stdout */
865 866 if (pollfds[0].revents) {
866 867 if (pollfds[0].revents &
867 868 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
868 869 if (process_output(stdout_fd, STDOUT_FILENO)
869 870 != 0)
870 871 break;
871 872 } else {
872 873 pollerr = pollfds[0].revents;
873 874 break;
874 875 }
875 876 }
876 877
877 878 /* event from master side stderr */
878 879 if (pollfds[1].revents) {
879 880 if (pollfds[1].revents &
880 881 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
881 882 if (process_output(stderr_fd, STDERR_FILENO)
882 883 != 0)
883 884 break;
884 885 } else {
885 886 pollerr = pollfds[1].revents;
886 887 break;
887 888 }
888 889 }
889 890
890 891 /* event from user STDIN side */
891 892 if (pollfds[2].revents) {
892 893 if (pollfds[2].revents &
893 894 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
894 895 /*
895 896 * stdin fd is stdin of the target; so,
896 897 * the thing we'll write the user data *to*.
897 898 *
898 899 * Also, unlike on the output side, we
899 900 * close the pipe on a zero-length message.
900 901 */
901 902 int res;
902 903
903 904 if (raw_mode)
904 905 res = process_raw_input(stdin_fd,
905 906 appin_fd);
906 907 else
907 908 res = process_user_input(stdin_fd,
908 909 stdout_fd);
909 910
910 911 if (res < 0)
911 912 break;
912 913 if (res > 0) {
913 914 /* EOF (close) child's stdin_fd */
914 915 pollfds[2].fd = -1;
915 916 while ((res = close(stdin_fd)) != 0 &&
916 917 errno == EINTR)
917 918 ;
918 919 if (res != 0)
919 920 break;
920 921 }
921 922
922 923 } else if (raw_mode && pollfds[2].revents & POLLHUP) {
923 924 /*
924 925 * It's OK to get a POLLHUP on STDIN-- it
925 926 * always happens if you do:
926 927 *
927 928 * echo foo | zlogin <zone> <command>
928 929 *
929 930 * We reset fd to -1 in this case to clear
930 931 * the condition and close the pipe (EOF) to
931 932 * the other side in order to wrap things up.
932 933 */
933 934 int res;
934 935
935 936 pollfds[2].fd = -1;
936 937 while ((res = close(stdin_fd)) != 0 &&
937 938 errno == EINTR)
938 939 ;
939 940 if (res != 0)
940 941 break;
941 942 } else {
942 943 pollerr = pollfds[2].revents;
943 944 break;
944 945 }
945 946 }
946 947 }
947 948
948 949 /*
949 950 * We are in the midst of dying, but try to poll with a short
950 951 * timeout to see if we can catch the last bit of I/O from the
951 952 * children.
952 953 */
953 954 retry:
954 955 pollfds[0].revents = pollfds[1].revents = 0;
955 956 (void) poll(pollfds, 2, 100);
956 957 if (pollfds[0].revents &
957 958 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
958 959 if ((cc = read(stdout_fd, ibuf, ZLOGIN_BUFSIZ)) > 0) {
959 960 (void) write(STDOUT_FILENO, ibuf, cc);
960 961 goto retry;
961 962 }
962 963 }
963 964 if (pollfds[1].revents &
964 965 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
965 966 if ((cc = read(stderr_fd, ibuf, ZLOGIN_BUFSIZ)) > 0) {
966 967 (void) write(STDERR_FILENO, ibuf, cc);
967 968 goto retry;
968 969 }
969 970 }
970 971 }
971 972
972 973 /*
973 974 * Fetch the user_cmd brand hook for getting a user's passwd(4) entry.
974 975 */
975 976 static const char *
976 977 zone_get_user_cmd(brand_handle_t bh, const char *login, char *user_cmd,
977 978 size_t len)
978 979 {
979 980 bzero(user_cmd, sizeof (user_cmd));
980 981 if (brand_get_user_cmd(bh, login, user_cmd, len) != 0)
981 982 return (NULL);
982 983
983 984 return (user_cmd);
984 985 }
985 986
986 987 /* From libc */
987 988 extern int str2passwd(const char *, int, void *, char *, int);
988 989
989 990 /*
990 991 * exec() the user_cmd brand hook, and convert the output string to a
991 992 * struct passwd. This is to be called after zone_enter().
992 993 *
993 994 */
994 995 static struct passwd *
995 996 zone_get_user_pw(const char *user_cmd, struct passwd *pwent, char *pwbuf,
996 997 int pwbuflen)
997 998 {
998 999 char pwline[NSS_BUFLEN_PASSWD];
999 1000 char *cin = NULL;
1000 1001 FILE *fin;
1001 1002 int status;
1002 1003
1003 1004 assert(getzoneid() != GLOBAL_ZONEID);
1004 1005
1005 1006 if ((fin = popen(user_cmd, "r")) == NULL)
1006 1007 return (NULL);
1007 1008
1008 1009 while (cin == NULL && !feof(fin))
1009 1010 cin = fgets(pwline, sizeof (pwline), fin);
1010 1011
1011 1012 if (cin == NULL) {
1012 1013 (void) pclose(fin);
1013 1014 return (NULL);
1014 1015 }
1015 1016
1016 1017 status = pclose(fin);
1017 1018 if (!WIFEXITED(status))
1018 1019 return (NULL);
1019 1020 if (WEXITSTATUS(status) != 0)
1020 1021 return (NULL);
1021 1022
1022 1023 if (str2passwd(pwline, sizeof (pwline), pwent, pwbuf, pwbuflen) == 0)
1023 1024 return (pwent);
1024 1025 else
1025 1026 return (NULL);
1026 1027 }
1027 1028
1028 1029 static char **
1029 1030 zone_login_cmd(brand_handle_t bh, const char *login)
1030 1031 {
1031 1032 static char result_buf[ARG_MAX];
1032 1033 char **new_argv, *ptr, *lasts;
1033 1034 int n, a;
1034 1035
1035 1036 /* Get the login command for the target zone. */
1036 1037 bzero(result_buf, sizeof (result_buf));
1037 1038
1038 1039 if (forced_login) {
1039 1040 if (brand_get_forcedlogin_cmd(bh, login,
1040 1041 result_buf, sizeof (result_buf)) != 0)
1041 1042 return (NULL);
1042 1043 } else {
1043 1044 if (brand_get_login_cmd(bh, login,
1044 1045 result_buf, sizeof (result_buf)) != 0)
1045 1046 return (NULL);
1046 1047 }
1047 1048
1048 1049 /*
1049 1050 * We got back a string that we'd like to execute. But since
1050 1051 * we're not doing the execution via a shell we'll need to convert
1051 1052 * the exec string to an array of strings. We'll do that here
1052 1053 * but we're going to be very simplistic about it and break stuff
1053 1054 * up based on spaces. We're not even going to support any kind
1054 1055 * of quoting or escape characters. It's truly amazing that
1055 1056 * there is no library function in OpenSolaris to do this for us.
1056 1057 */
1057 1058
1058 1059 /*
1059 1060 * Be paranoid. Since we're deliniating based on spaces make
1060 1061 * sure there are no adjacent spaces.
1061 1062 */
1062 1063 if (strstr(result_buf, " ") != NULL)
1063 1064 return (NULL);
1064 1065
1065 1066 /* Remove any trailing whitespace. */
1066 1067 n = strlen(result_buf);
1067 1068 if (result_buf[n - 1] == ' ')
1068 1069 result_buf[n - 1] = '\0';
1069 1070
1070 1071 /* Count how many elements there are in the exec string. */
1071 1072 ptr = result_buf;
1072 1073 for (n = 2; ((ptr = strchr(ptr + 1, (int)' ')) != NULL); n++)
1073 1074 ;
1074 1075
1075 1076 /* Allocate the argv array that we're going to return. */
1076 1077 if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
1077 1078 return (NULL);
1078 1079
1079 1080 /* Tokenize the exec string and return. */
1080 1081 a = 0;
1081 1082 new_argv[a++] = result_buf;
1082 1083 if (n > 2) {
1083 1084 (void) strtok_r(result_buf, " ", &lasts);
1084 1085 while ((new_argv[a++] = strtok_r(NULL, " ", &lasts)) != NULL)
1085 1086 ;
1086 1087 } else {
1087 1088 new_argv[a++] = NULL;
1088 1089 }
1089 1090 assert(n == a);
1090 1091 return (new_argv);
1091 1092 }
1092 1093
1093 1094 /*
1094 1095 * Prepare argv array for exec'd process; if we're passing commands to the
1095 1096 * new process, then use su(1M) to do the invocation. Otherwise, use
1096 1097 * 'login -z <from_zonename> -f' (-z is an undocumented option which tells
1097 1098 * login that we're coming from another zone, and to disregard its CONSOLE
1098 1099 * checks).
1099 1100 */
1100 1101 static char **
1101 1102 prep_args(brand_handle_t bh, const char *login, char **argv)
1102 1103 {
1103 1104 int argc = 0, a = 0, i, n = -1;
1104 1105 char **new_argv;
1105 1106
1106 1107 if (argv != NULL) {
1107 1108 size_t subshell_len = 1;
1108 1109 char *subshell;
1109 1110
1110 1111 while (argv[argc] != NULL)
1111 1112 argc++;
1112 1113
1113 1114 for (i = 0; i < argc; i++) {
1114 1115 subshell_len += strlen(argv[i]) + 1;
1115 1116 }
1116 1117 if ((subshell = calloc(1, subshell_len)) == NULL)
1117 1118 return (NULL);
1118 1119
1119 1120 for (i = 0; i < argc; i++) {
1120 1121 (void) strcat(subshell, argv[i]);
1121 1122 (void) strcat(subshell, " ");
1122 1123 }
1123 1124
1124 1125 if (failsafe) {
1125 1126 n = 4;
1126 1127 if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
1127 1128 return (NULL);
1128 1129
1129 1130 new_argv[a++] = FAILSAFESHELL;
1130 1131 } else {
1131 1132 n = 5;
1132 1133 if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
1133 1134 return (NULL);
1134 1135
1135 1136 new_argv[a++] = SUPATH;
1136 1137 if (strcmp(login, "root") != 0) {
1137 1138 new_argv[a++] = "-";
1138 1139 n++;
1139 1140 }
1140 1141 new_argv[a++] = (char *)login;
1141 1142 }
1142 1143 new_argv[a++] = "-c";
1143 1144 new_argv[a++] = subshell;
1144 1145 new_argv[a++] = NULL;
1145 1146 assert(a == n);
1146 1147 } else {
1147 1148 if (failsafe) {
1148 1149 n = 2;
1149 1150 if ((new_argv = malloc(sizeof (char *) * n)) == NULL)
1150 1151 return (NULL);
1151 1152 new_argv[a++] = FAILSAFESHELL;
1152 1153 new_argv[a++] = NULL;
1153 1154 assert(n == a);
1154 1155 } else {
1155 1156 new_argv = zone_login_cmd(bh, login);
1156 1157 }
1157 1158 }
1158 1159
1159 1160 return (new_argv);
1160 1161 }
1161 1162
1162 1163 /*
1163 1164 * Helper routine for prep_env below.
1164 1165 */
1165 1166 static char *
1166 1167 add_env(char *name, char *value)
1167 1168 {
1168 1169 size_t sz = strlen(name) + strlen(value) + 2; /* name, =, value, NUL */
1169 1170 char *str;
1170 1171
1171 1172 if ((str = malloc(sz)) == NULL)
1172 1173 return (NULL);
1173 1174
1174 1175 (void) snprintf(str, sz, "%s=%s", name, value);
1175 1176 return (str);
1176 1177 }
1177 1178
1178 1179 /*
1179 1180 * Prepare envp array for exec'd process.
1180 1181 */
1181 1182 static char **
1182 1183 prep_env()
1183 1184 {
1184 1185 int e = 0, size = 1;
1185 1186 char **new_env, *estr;
1186 1187 char *term = getenv("TERM");
1187 1188
1188 1189 size++; /* for $PATH */
1189 1190 if (term != NULL)
1190 1191 size++;
1191 1192
1192 1193 /*
1193 1194 * In failsafe mode we set $HOME, since '-l' isn't valid in this mode.
1194 1195 * We also set $SHELL, since neither login nor su will be around to do
1195 1196 * it.
1196 1197 */
1197 1198 if (failsafe)
1198 1199 size += 2;
1199 1200
1200 1201 if ((new_env = malloc(sizeof (char *) * size)) == NULL)
1201 1202 return (NULL);
1202 1203
1203 1204 if ((estr = add_env("PATH", DEF_PATH)) == NULL)
1204 1205 return (NULL);
1205 1206 new_env[e++] = estr;
1206 1207
1207 1208 if (term != NULL) {
1208 1209 if ((estr = add_env("TERM", term)) == NULL)
1209 1210 return (NULL);
1210 1211 new_env[e++] = estr;
1211 1212 }
1212 1213
1213 1214 if (failsafe) {
1214 1215 if ((estr = add_env("HOME", "/")) == NULL)
1215 1216 return (NULL);
1216 1217 new_env[e++] = estr;
1217 1218
1218 1219 if ((estr = add_env("SHELL", FAILSAFESHELL)) == NULL)
1219 1220 return (NULL);
1220 1221 new_env[e++] = estr;
1221 1222 }
1222 1223
1223 1224 new_env[e++] = NULL;
1224 1225
1225 1226 assert(e == size);
1226 1227
1227 1228 return (new_env);
1228 1229 }
1229 1230
1230 1231 /*
1231 1232 * Finish the preparation of the envp array for exec'd non-interactive
1232 1233 * zlogins. This is called in the child process *after* we zone_enter(), since
1233 1234 * it derives things we can only know within the zone, such as $HOME, $SHELL,
1234 1235 * etc. We need only do this in the non-interactive, mode, since otherwise
1235 1236 * login(1) will do it. We don't do this in failsafe mode, since it presents
1236 1237 * additional ways in which the command could fail, and we'd prefer to avoid
1237 1238 * that.
1238 1239 */
1239 1240 static char **
1240 1241 prep_env_noninteractive(const char *user_cmd, char **env)
1241 1242 {
1242 1243 size_t size;
1243 1244 char **new_env;
1244 1245 int e, i;
1245 1246 char *estr;
1246 1247 char varmail[LOGNAME_MAX + 11]; /* strlen(/var/mail/) = 10, NUL */
1247 1248 char pwbuf[NSS_BUFLEN_PASSWD + 1];
1248 1249 struct passwd pwent;
1249 1250 struct passwd *pw = NULL;
1250 1251
1251 1252 assert(env != NULL);
1252 1253 assert(failsafe == 0);
1253 1254
1254 1255 /*
1255 1256 * Exec the "user_cmd" brand hook to get a pwent for the
1256 1257 * login user. If this fails, HOME will be set to "/", SHELL
1257 1258 * will be set to $DEFAULTSHELL, and we will continue to exec
1258 1259 * SUPATH <login> -c <cmd>.
1259 1260 */
1260 1261 pw = zone_get_user_pw(user_cmd, &pwent, pwbuf, sizeof (pwbuf));
1261 1262
1262 1263 /*
1263 1264 * Get existing envp size.
1264 1265 */
1265 1266 for (size = 0; env[size] != NULL; size++)
1266 1267 ;
1267 1268
1268 1269 e = size;
1269 1270
1270 1271 /*
1271 1272 * Finish filling out the environment; we duplicate the environment
1272 1273 * setup described in login(1), for lack of a better precedent.
1273 1274 */
1274 1275 if (pw != NULL)
1275 1276 size += 3; /* LOGNAME, HOME, MAIL */
1276 1277 else
1277 1278 size += 1; /* HOME */
1278 1279
1279 1280 size++; /* always fill in SHELL */
1280 1281 size++; /* terminating NULL */
1281 1282
1282 1283 if ((new_env = malloc(sizeof (char *) * size)) == NULL)
1283 1284 goto malloc_fail;
1284 1285
1285 1286 /*
1286 1287 * Copy existing elements of env into new_env.
1287 1288 */
1288 1289 for (i = 0; env[i] != NULL; i++) {
1289 1290 if ((new_env[i] = strdup(env[i])) == NULL)
1290 1291 goto malloc_fail;
1291 1292 }
1292 1293 assert(e == i);
1293 1294
1294 1295 if (pw != NULL) {
1295 1296 if ((estr = add_env("LOGNAME", pw->pw_name)) == NULL)
1296 1297 goto malloc_fail;
1297 1298 new_env[e++] = estr;
1298 1299
1299 1300 if ((estr = add_env("HOME", pw->pw_dir)) == NULL)
1300 1301 goto malloc_fail;
1301 1302 new_env[e++] = estr;
1302 1303
1303 1304 if (chdir(pw->pw_dir) != 0)
1304 1305 zerror(gettext("Could not chdir to home directory "
1305 1306 "%s: %s"), pw->pw_dir, strerror(errno));
1306 1307
1307 1308 (void) snprintf(varmail, sizeof (varmail), "/var/mail/%s",
1308 1309 pw->pw_name);
1309 1310 if ((estr = add_env("MAIL", varmail)) == NULL)
1310 1311 goto malloc_fail;
1311 1312 new_env[e++] = estr;
1312 1313 } else {
1313 1314 if ((estr = add_env("HOME", "/")) == NULL)
1314 1315 goto malloc_fail;
1315 1316 new_env[e++] = estr;
1316 1317 }
1317 1318
1318 1319 if (pw != NULL && strlen(pw->pw_shell) > 0) {
1319 1320 if ((estr = add_env("SHELL", pw->pw_shell)) == NULL)
1320 1321 goto malloc_fail;
1321 1322 new_env[e++] = estr;
1322 1323 } else {
1323 1324 if ((estr = add_env("SHELL", DEFAULTSHELL)) == NULL)
1324 1325 goto malloc_fail;
1325 1326 new_env[e++] = estr;
1326 1327 }
1327 1328
1328 1329 new_env[e++] = NULL; /* add terminating NULL */
1329 1330
1330 1331 assert(e == size);
1331 1332 return (new_env);
1332 1333
1333 1334 malloc_fail:
1334 1335 zperror(gettext("failed to allocate memory for process environment"));
1335 1336 return (NULL);
1336 1337 }
1337 1338
1338 1339 static int
1339 1340 close_func(void *slavefd, int fd)
1340 1341 {
1341 1342 if (fd != *(int *)slavefd)
1342 1343 (void) close(fd);
1343 1344 return (0);
1344 1345 }
1345 1346
1346 1347 static void
1347 1348 set_cmdchar(char *cmdcharstr)
1348 1349 {
1349 1350 char c;
1350 1351 long lc;
1351 1352
1352 1353 if ((c = *cmdcharstr) != '\\') {
1353 1354 cmdchar = c;
1354 1355 return;
1355 1356 }
1356 1357
1357 1358 c = cmdcharstr[1];
1358 1359 if (c == '\0' || c == '\\') {
1359 1360 cmdchar = '\\';
1360 1361 return;
1361 1362 }
1362 1363
1363 1364 if (c < '0' || c > '7') {
1364 1365 zerror(gettext("Unrecognized escape character option %s"),
1365 1366 cmdcharstr);
1366 1367 usage();
1367 1368 }
1368 1369
1369 1370 lc = strtol(cmdcharstr + 1, NULL, 8);
1370 1371 if (lc < 0 || lc > 255) {
1371 1372 zerror(gettext("Octal escape character '%s' too large"),
1372 1373 cmdcharstr);
1373 1374 usage();
1374 1375 }
1375 1376 cmdchar = (char)lc;
1376 1377 }
1377 1378
1378 1379 static int
1379 1380 setup_utmpx(char *slavename)
1380 1381 {
1381 1382 struct utmpx ut;
1382 1383
1383 1384 bzero(&ut, sizeof (ut));
1384 1385 (void) strncpy(ut.ut_user, ".zlogin", sizeof (ut.ut_user));
1385 1386 (void) strncpy(ut.ut_line, slavename, sizeof (ut.ut_line));
1386 1387 ut.ut_pid = getpid();
1387 1388 ut.ut_id[0] = 'z';
1388 1389 ut.ut_id[1] = ut.ut_id[2] = ut.ut_id[3] = (char)SC_WILDC;
1389 1390 ut.ut_type = LOGIN_PROCESS;
1390 1391 (void) time(&ut.ut_tv.tv_sec);
1391 1392
1392 1393 if (makeutx(&ut) == NULL) {
1393 1394 zerror(gettext("makeutx failed"));
1394 1395 return (-1);
1395 1396 }
1396 1397 return (0);
1397 1398 }
1398 1399
1399 1400 static void
1400 1401 release_lock_file(int lockfd)
1401 1402 {
1402 1403 (void) close(lockfd);
1403 1404 }
1404 1405
1405 1406 static int
1406 1407 grab_lock_file(const char *zone_name, int *lockfd)
1407 1408 {
1408 1409 char pathbuf[PATH_MAX];
1409 1410 struct flock flock;
1410 1411
1411 1412 if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) {
1412 1413 zerror(gettext("could not mkdir %s: %s"), ZONES_TMPDIR,
1413 1414 strerror(errno));
1414 1415 return (-1);
1415 1416 }
1416 1417 (void) chmod(ZONES_TMPDIR, S_IRWXU);
1417 1418 (void) snprintf(pathbuf, sizeof (pathbuf), "%s/%s.zoneadm.lock",
1418 1419 ZONES_TMPDIR, zone_name);
1419 1420
1420 1421 if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) {
1421 1422 zerror(gettext("could not open %s: %s"), pathbuf,
1422 1423 strerror(errno));
1423 1424 return (-1);
1424 1425 }
1425 1426 /*
1426 1427 * Lock the file to synchronize with other zoneadmds
1427 1428 */
1428 1429 flock.l_type = F_WRLCK;
1429 1430 flock.l_whence = SEEK_SET;
1430 1431 flock.l_start = (off_t)0;
1431 1432 flock.l_len = (off_t)0;
1432 1433 if (fcntl(*lockfd, F_SETLKW, &flock) < 0) {
1433 1434 zerror(gettext("unable to lock %s: %s"), pathbuf,
1434 1435 strerror(errno));
1435 1436 release_lock_file(*lockfd);
1436 1437 return (-1);
1437 1438 }
1438 1439 return (Z_OK);
1439 1440 }
1440 1441
1441 1442 static int
1442 1443 start_zoneadmd(const char *zone_name)
1443 1444 {
1444 1445 pid_t retval;
1445 1446 int pstatus = 0, error = -1, lockfd, doorfd;
1446 1447 struct door_info info;
1447 1448 char doorpath[MAXPATHLEN];
1448 1449
1449 1450 (void) snprintf(doorpath, sizeof (doorpath), ZONE_DOOR_PATH, zone_name);
1450 1451
1451 1452 if (grab_lock_file(zone_name, &lockfd) != Z_OK)
1452 1453 return (-1);
1453 1454 /*
1454 1455 * We must do the door check with the lock held. Otherwise, we
1455 1456 * might race against another zoneadm/zlogin process and wind
1456 1457 * up with two processes trying to start zoneadmd at the same
1457 1458 * time. zoneadmd will detect this, and fail, but we prefer this
1458 1459 * to be as seamless as is practical, from a user perspective.
1459 1460 */
1460 1461 if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
1461 1462 if (errno != ENOENT) {
1462 1463 zerror("failed to open %s: %s", doorpath,
1463 1464 strerror(errno));
1464 1465 goto out;
1465 1466 }
1466 1467 } else {
1467 1468 /*
1468 1469 * Seems to be working ok.
1469 1470 */
1470 1471 if (door_info(doorfd, &info) == 0 &&
1471 1472 ((info.di_attributes & DOOR_REVOKED) == 0)) {
1472 1473 error = 0;
1473 1474 goto out;
1474 1475 }
1475 1476 }
1476 1477
1477 1478 if ((child_pid = fork()) == -1) {
1478 1479 zperror(gettext("could not fork"));
1479 1480 goto out;
1480 1481 } else if (child_pid == 0) {
1481 1482 /* child process */
1482 1483 (void) execl("/usr/lib/zones/zoneadmd", "zoneadmd", "-z",
1483 1484 zone_name, NULL);
1484 1485 zperror(gettext("could not exec zoneadmd"));
1485 1486 _exit(1);
1486 1487 }
1487 1488
1488 1489 /* parent process */
1489 1490 do {
1490 1491 retval = waitpid(child_pid, &pstatus, 0);
1491 1492 } while (retval != child_pid);
1492 1493 if (WIFSIGNALED(pstatus) ||
1493 1494 (WIFEXITED(pstatus) && WEXITSTATUS(pstatus) != 0)) {
1494 1495 zerror(gettext("could not start %s"), "zoneadmd");
1495 1496 goto out;
1496 1497 }
1497 1498 error = 0;
1498 1499 out:
1499 1500 release_lock_file(lockfd);
1500 1501 (void) close(doorfd);
1501 1502 return (error);
1502 1503 }
1503 1504
1504 1505 static int
1505 1506 init_template(void)
1506 1507 {
1507 1508 int fd;
1508 1509 int err = 0;
1509 1510
1510 1511 fd = open64(CTFS_ROOT "/process/template", O_RDWR);
1511 1512 if (fd == -1)
1512 1513 return (-1);
1513 1514
1514 1515 /*
1515 1516 * zlogin doesn't do anything with the contract.
1516 1517 * Deliver no events, don't inherit, and allow it to be orphaned.
1517 1518 */
1518 1519 err |= ct_tmpl_set_critical(fd, 0);
1519 1520 err |= ct_tmpl_set_informative(fd, 0);
1520 1521 err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
1521 1522 err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
1522 1523 if (err || ct_tmpl_activate(fd)) {
1523 1524 (void) close(fd);
1524 1525 return (-1);
1525 1526 }
1526 1527
1527 1528 return (fd);
1528 1529 }
1529 1530
1530 1531 static int
1531 1532 noninteractive_login(char *zonename, const char *user_cmd, zoneid_t zoneid,
1532 1533 char **new_args, char **new_env)
1533 1534 {
1534 1535 pid_t retval;
1535 1536 int stdin_pipe[2], stdout_pipe[2], stderr_pipe[2], dead_child_pipe[2];
1536 1537 int child_status;
1537 1538 int tmpl_fd;
1538 1539 sigset_t block_cld;
1539 1540
1540 1541 if ((tmpl_fd = init_template()) == -1) {
1541 1542 reset_tty();
1542 1543 zperror(gettext("could not create contract"));
1543 1544 return (1);
1544 1545 }
1545 1546
1546 1547 if (pipe(stdin_pipe) != 0) {
1547 1548 zperror(gettext("could not create STDIN pipe"));
1548 1549 return (1);
1549 1550 }
1550 1551 /*
1551 1552 * When the user types ^D, we get a zero length message on STDIN.
1552 1553 * We need to echo that down the pipe to send it to the other side;
1553 1554 * but by default, pipes don't propagate zero-length messages. We
1554 1555 * toggle that behavior off using I_SWROPT. See streamio(7i).
1555 1556 */
1556 1557 if (ioctl(stdin_pipe[0], I_SWROPT, SNDZERO) != 0) {
1557 1558 zperror(gettext("could not configure STDIN pipe"));
1558 1559 return (1);
1559 1560
1560 1561 }
1561 1562 if (pipe(stdout_pipe) != 0) {
1562 1563 zperror(gettext("could not create STDOUT pipe"));
1563 1564 return (1);
1564 1565 }
1565 1566 if (pipe(stderr_pipe) != 0) {
1566 1567 zperror(gettext("could not create STDERR pipe"));
1567 1568 return (1);
1568 1569 }
1569 1570
1570 1571 if (pipe(dead_child_pipe) != 0) {
1571 1572 zperror(gettext("could not create signalling pipe"));
1572 1573 return (1);
1573 1574 }
1574 1575 close_on_sig = dead_child_pipe[0];
1575 1576
1576 1577 /*
1577 1578 * If any of the pipe FD's winds up being less than STDERR, then we
1578 1579 * have a mess on our hands-- and we are lacking some of the I/O
1579 1580 * streams we would expect anyway. So we bail.
1580 1581 */
1581 1582 if (stdin_pipe[0] <= STDERR_FILENO ||
1582 1583 stdin_pipe[1] <= STDERR_FILENO ||
1583 1584 stdout_pipe[0] <= STDERR_FILENO ||
1584 1585 stdout_pipe[1] <= STDERR_FILENO ||
1585 1586 stderr_pipe[0] <= STDERR_FILENO ||
1586 1587 stderr_pipe[1] <= STDERR_FILENO ||
1587 1588 dead_child_pipe[0] <= STDERR_FILENO ||
1588 1589 dead_child_pipe[1] <= STDERR_FILENO) {
1589 1590 zperror(gettext("process lacks valid STDIN, STDOUT, STDERR"));
1590 1591 return (1);
1591 1592 }
1592 1593
1593 1594 if (prefork_dropprivs() != 0) {
1594 1595 zperror(gettext("could not allocate privilege set"));
1595 1596 return (1);
1596 1597 }
1597 1598
1598 1599 (void) sigset(SIGCLD, sigcld);
1599 1600 (void) sigemptyset(&block_cld);
1600 1601 (void) sigaddset(&block_cld, SIGCLD);
1601 1602 (void) sigprocmask(SIG_BLOCK, &block_cld, NULL);
1602 1603
1603 1604 if ((child_pid = fork()) == -1) {
1604 1605 (void) ct_tmpl_clear(tmpl_fd);
1605 1606 (void) close(tmpl_fd);
1606 1607 zperror(gettext("could not fork"));
1607 1608 return (1);
1608 1609 } else if (child_pid == 0) { /* child process */
1609 1610 (void) ct_tmpl_clear(tmpl_fd);
1610 1611
1611 1612 /*
1612 1613 * Do a dance to get the pipes hooked up as FD's 0, 1 and 2.
1613 1614 */
1614 1615 (void) close(STDIN_FILENO);
1615 1616 (void) close(STDOUT_FILENO);
1616 1617 (void) close(STDERR_FILENO);
1617 1618 (void) dup2(stdin_pipe[1], STDIN_FILENO);
1618 1619 (void) dup2(stdout_pipe[1], STDOUT_FILENO);
1619 1620 (void) dup2(stderr_pipe[1], STDERR_FILENO);
1620 1621 (void) closefrom(STDERR_FILENO + 1);
1621 1622
1622 1623 (void) sigset(SIGCLD, SIG_DFL);
1623 1624 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
1624 1625 /*
1625 1626 * In case any of stdin, stdout or stderr are streams,
1626 1627 * anchor them to prevent malicious I_POPs.
1627 1628 */
1628 1629 (void) ioctl(STDIN_FILENO, I_ANCHOR);
1629 1630 (void) ioctl(STDOUT_FILENO, I_ANCHOR);
1630 1631 (void) ioctl(STDERR_FILENO, I_ANCHOR);
1631 1632
1632 1633 if (zone_enter(zoneid) == -1) {
1633 1634 zerror(gettext("could not enter zone %s: %s"),
1634 1635 zonename, strerror(errno));
1635 1636 _exit(1);
1636 1637 }
1637 1638
1638 1639 /*
1639 1640 * For non-native zones, tell libc where it can find locale
1640 1641 * specific getttext() messages.
1641 1642 */
1642 1643 if (access("/.SUNWnative/usr/lib/locale", R_OK) == 0)
1643 1644 (void) bindtextdomain(TEXT_DOMAIN,
1644 1645 "/.SUNWnative/usr/lib/locale");
1645 1646 else if (access("/native/usr/lib/locale", R_OK) == 0)
1646 1647 (void) bindtextdomain(TEXT_DOMAIN,
1647 1648 "/native/usr/lib/locale");
1648 1649
1649 1650 if (!failsafe)
1650 1651 new_env = prep_env_noninteractive(user_cmd, new_env);
1651 1652
1652 1653 if (new_env == NULL) {
1653 1654 _exit(1);
1654 1655 }
1655 1656
1656 1657 /*
1657 1658 * Move into a new process group; the zone_enter will have
1658 1659 * placed us into zsched's session, and we want to be in
1659 1660 * a unique process group.
1660 1661 */
1661 1662 (void) setpgid(getpid(), getpid());
1662 1663
1663 1664 /*
1664 1665 * The child needs to run as root to
1665 1666 * execute the su program.
1666 1667 */
1667 1668 if (setuid(0) == -1) {
1668 1669 zperror(gettext("insufficient privilege"));
1669 1670 return (1);
1670 1671 }
1671 1672
1672 1673 (void) execve(new_args[0], new_args, new_env);
1673 1674 zperror(gettext("exec failure"));
1674 1675 _exit(1);
1675 1676 }
1676 1677 /* parent */
1677 1678
1678 1679 /* close pipe sides written by child */
1679 1680 (void) close(stdout_pipe[1]);
1680 1681 (void) close(stderr_pipe[1]);
1681 1682
1682 1683 (void) sigset(SIGINT, sig_forward);
1683 1684
1684 1685 postfork_dropprivs();
1685 1686
1686 1687 (void) ct_tmpl_clear(tmpl_fd);
1687 1688 (void) close(tmpl_fd);
1688 1689
1689 1690 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
1690 1691 doio(stdin_pipe[0], stdin_pipe[1], stdout_pipe[0], stderr_pipe[0],
1691 1692 dead_child_pipe[1], B_TRUE);
1692 1693 do {
1693 1694 retval = waitpid(child_pid, &child_status, 0);
1694 1695 if (retval == -1) {
1695 1696 child_status = 0;
1696 1697 }
1697 1698 } while (retval != child_pid && errno != ECHILD);
1698 1699
1699 1700 return (WEXITSTATUS(child_status));
1700 1701 }
1701 1702
1702 1703 static char *
1703 1704 get_username()
1704 1705 {
1705 1706 uid_t uid;
1706 1707 struct passwd *nptr;
1707 1708
1708 1709 /*
1709 1710 * Authorizations are checked to restrict access based on the
1710 1711 * requested operation and zone name, It is assumed that the
1711 1712 * program is running with all privileges, but that the real
1712 1713 * user ID is that of the user or role on whose behalf we are
1713 1714 * operating. So we start by getting the username that will be
1714 1715 * used for subsequent authorization checks.
1715 1716 */
1716 1717
1717 1718 uid = getuid();
1718 1719 if ((nptr = getpwuid(uid)) == NULL) {
1719 1720 zerror(gettext("could not get user name."));
1720 1721 _exit(1);
1721 1722 }
1722 1723 return (nptr->pw_name);
1723 1724 }
1724 1725
1725 1726 int
1726 1727 main(int argc, char **argv)
1727 1728 {
1728 1729 int arg, console = 0;
1729 1730 zoneid_t zoneid;
1730 1731 zone_state_t st;
1731 1732 char *login = "root";
1732 1733 int lflag = 0;
1733 1734 int nflag = 0;
1734 1735 char *zonename = NULL;
1735 1736 char **proc_args = NULL;
1736 1737 char **new_args, **new_env;
1737 1738 sigset_t block_cld;
1738 1739 char devroot[MAXPATHLEN];
1739 1740 char *slavename, slaveshortname[MAXPATHLEN];
1740 1741 priv_set_t *privset;
1741 1742 int tmpl_fd;
1742 1743 char zonebrand[MAXNAMELEN];
1743 1744 char default_brand[MAXNAMELEN];
1744 1745 struct stat sb;
1745 1746 char kernzone[ZONENAME_MAX];
|
↓ open down ↓ |
1453 lines elided |
↑ open up ↑ |
1746 1747 brand_handle_t bh;
1747 1748 char user_cmd[MAXPATHLEN];
1748 1749 char authname[MAXAUTHS];
1749 1750
1750 1751 (void) setlocale(LC_ALL, "");
1751 1752 (void) textdomain(TEXT_DOMAIN);
1752 1753
1753 1754 (void) getpname(argv[0]);
1754 1755 username = get_username();
1755 1756
1756 - while ((arg = getopt(argc, argv, "nECR:Se:l:Q")) != EOF) {
1757 + while ((arg = getopt(argc, argv, "dnECR:Se:l:Q")) != EOF) {
1757 1758 switch (arg) {
1758 1759 case 'C':
1759 1760 console = 1;
1760 1761 break;
1761 1762 case 'E':
1762 1763 nocmdchar = 1;
1763 1764 break;
1764 1765 case 'R': /* undocumented */
1765 1766 if (*optarg != '/') {
1766 1767 zerror(gettext("root path must be absolute."));
1767 1768 exit(2);
1768 1769 }
1769 1770 if (stat(optarg, &sb) == -1 || !S_ISDIR(sb.st_mode)) {
1770 1771 zerror(
1771 1772 gettext("root path must be a directory."));
|
↓ open down ↓ |
5 lines elided |
↑ open up ↑ |
1772 1773 exit(2);
1773 1774 }
1774 1775 zonecfg_set_root(optarg);
1775 1776 break;
1776 1777 case 'Q':
1777 1778 quiet = 1;
1778 1779 break;
1779 1780 case 'S':
1780 1781 failsafe = 1;
1781 1782 break;
1783 + case 'd':
1784 + disconnect = 1;
1785 + break;
1782 1786 case 'e':
1783 1787 set_cmdchar(optarg);
1784 1788 break;
1785 1789 case 'l':
1786 1790 login = optarg;
1787 1791 lflag = 1;
1788 1792 break;
1789 1793 case 'n':
1790 1794 nflag = 1;
1791 1795 break;
1792 1796 default:
1793 1797 usage();
1794 1798 }
1795 1799 }
1796 1800
1797 1801 if (console != 0) {
1798 1802
1799 1803 if (lflag != 0) {
1800 1804 zerror(gettext(
1801 1805 "-l may not be specified for console login"));
1802 1806 usage();
1803 1807 }
1804 1808
1805 1809 if (nflag != 0) {
1806 1810 zerror(gettext(
1807 1811 "-n may not be specified for console login"));
1808 1812 usage();
1809 1813 }
1810 1814
1811 1815 if (failsafe != 0) {
1812 1816 zerror(gettext(
1813 1817 "-S may not be specified for console login"));
1814 1818 usage();
1815 1819 }
1816 1820
1817 1821 if (zonecfg_in_alt_root()) {
1818 1822 zerror(gettext(
|
↓ open down ↓ |
27 lines elided |
↑ open up ↑ |
1819 1823 "-R may not be specified for console login"));
1820 1824 exit(2);
1821 1825 }
1822 1826
1823 1827 }
1824 1828
1825 1829 if (failsafe != 0 && lflag != 0) {
1826 1830 zerror(gettext("-l may not be specified for failsafe login"));
1827 1831 usage();
1828 1832 }
1833 +
1834 + if (!console && disconnect != 0) {
1835 + zerror(gettext(
1836 + "-d may only be specified with console login"));
1837 + usage();
1838 + }
1829 1839
1830 1840 if (optind == (argc - 1)) {
1831 1841 /*
1832 1842 * zone name, no process name; this should be an interactive
1833 1843 * as long as STDIN is really a tty.
1834 1844 */
1835 1845 if (nflag != 0) {
1836 1846 zerror(gettext(
1837 1847 "-n may not be specified for interactive login"));
1838 1848 usage();
1839 1849 }
1840 1850 if (isatty(STDIN_FILENO))
1841 1851 interactive = 1;
1842 1852 zonename = argv[optind];
1843 1853 } else if (optind < (argc - 1)) {
1844 1854 if (console) {
1845 1855 zerror(gettext("Commands may not be specified for "
1846 1856 "console login."));
1847 1857 usage();
1848 1858 }
1849 1859 /* zone name and process name, and possibly some args */
1850 1860 zonename = argv[optind];
1851 1861 proc_args = &argv[optind + 1];
1852 1862 interactive = 0;
1853 1863 } else {
1854 1864 usage();
1855 1865 }
1856 1866
1857 1867 if (getzoneid() != GLOBAL_ZONEID) {
1858 1868 zerror(gettext("'%s' may only be used from the global zone"),
1859 1869 pname);
1860 1870 return (1);
1861 1871 }
1862 1872
1863 1873 if (strcmp(zonename, GLOBAL_ZONENAME) == 0) {
1864 1874 zerror(gettext("'%s' not applicable to the global zone"),
1865 1875 pname);
1866 1876 return (1);
1867 1877 }
1868 1878
1869 1879 if (zone_get_state(zonename, &st) != Z_OK) {
1870 1880 zerror(gettext("zone '%s' unknown"), zonename);
1871 1881 return (1);
1872 1882 }
1873 1883
1874 1884 if (st < ZONE_STATE_INSTALLED) {
1875 1885 zerror(gettext("cannot login to a zone which is '%s'"),
1876 1886 zone_state_str(st));
1877 1887 return (1);
1878 1888 }
1879 1889
1880 1890 /*
1881 1891 * In both console and non-console cases, we require all privs.
1882 1892 * In the console case, because we may need to startup zoneadmd.
1883 1893 * In the non-console case in order to do zone_enter(2), zonept()
1884 1894 * and other tasks.
1885 1895 */
1886 1896
1887 1897 if ((privset = priv_allocset()) == NULL) {
1888 1898 zperror(gettext("priv_allocset failed"));
1889 1899 return (1);
1890 1900 }
1891 1901
1892 1902 if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
1893 1903 zperror(gettext("getppriv failed"));
1894 1904 priv_freeset(privset);
1895 1905 return (1);
1896 1906 }
1897 1907
1898 1908 if (priv_isfullset(privset) == B_FALSE) {
1899 1909 zerror(gettext("You lack sufficient privilege to run "
1900 1910 "this command (all privs required)"));
1901 1911 priv_freeset(privset);
1902 1912 return (1);
1903 1913 }
1904 1914 priv_freeset(privset);
1905 1915
1906 1916 /*
1907 1917 * Check if user is authorized for requested usage of the zone
1908 1918 */
1909 1919
1910 1920 (void) snprintf(authname, MAXAUTHS, "%s%s%s",
1911 1921 ZONE_MANAGE_AUTH, KV_OBJECT, zonename);
1912 1922 if (chkauthattr(authname, username) == 0) {
1913 1923 if (console) {
1914 1924 zerror(gettext("%s is not authorized for console "
1915 1925 "access to %s zone."),
1916 1926 username, zonename);
1917 1927 return (1);
1918 1928 } else {
1919 1929 (void) snprintf(authname, MAXAUTHS, "%s%s%s",
1920 1930 ZONE_LOGIN_AUTH, KV_OBJECT, zonename);
1921 1931 if (failsafe || !interactive) {
1922 1932 zerror(gettext("%s is not authorized for "
1923 1933 "failsafe or non-interactive login "
1924 1934 "to %s zone."), username, zonename);
1925 1935 return (1);
1926 1936 } else if (chkauthattr(authname, username) == 0) {
1927 1937 zerror(gettext("%s is not authorized "
1928 1938 " to login to %s zone."),
1929 1939 username, zonename);
1930 1940 return (1);
1931 1941 }
1932 1942 }
1933 1943 } else {
1934 1944 forced_login = B_TRUE;
1935 1945 }
1936 1946
1937 1947 /*
1938 1948 * The console is a separate case from the rest of the code; handle
1939 1949 * it first.
1940 1950 */
1941 1951 if (console) {
1942 1952 /*
1943 1953 * Ensure that zoneadmd for this zone is running.
1944 1954 */
1945 1955 if (start_zoneadmd(zonename) == -1)
1946 1956 return (1);
1947 1957
1948 1958 /*
1949 1959 * Make contact with zoneadmd.
1950 1960 */
1951 1961 if (get_console_master(zonename) == -1)
1952 1962 return (1);
1953 1963
1954 1964 if (!quiet)
1955 1965 (void) printf(
1956 1966 gettext("[Connected to zone '%s' console]\n"),
1957 1967 zonename);
1958 1968
1959 1969 if (set_tty_rawmode(STDIN_FILENO) == -1) {
1960 1970 reset_tty();
1961 1971 zperror(gettext("failed to set stdin pty to raw mode"));
1962 1972 return (1);
1963 1973 }
1964 1974
1965 1975 (void) sigset(SIGWINCH, sigwinch);
1966 1976 (void) sigwinch(0);
1967 1977
1968 1978 /*
1969 1979 * Run the I/O loop until we get disconnected.
1970 1980 */
1971 1981 doio(masterfd, -1, masterfd, -1, -1, B_FALSE);
1972 1982 reset_tty();
1973 1983 if (!quiet)
1974 1984 (void) printf(
1975 1985 gettext("\n[Connection to zone '%s' console "
1976 1986 "closed]\n"), zonename);
1977 1987
1978 1988 return (0);
1979 1989 }
1980 1990
1981 1991 if (st != ZONE_STATE_RUNNING && st != ZONE_STATE_MOUNTED) {
1982 1992 zerror(gettext("login allowed only to running zones "
1983 1993 "(%s is '%s')."), zonename, zone_state_str(st));
1984 1994 return (1);
1985 1995 }
1986 1996
1987 1997 (void) strlcpy(kernzone, zonename, sizeof (kernzone));
1988 1998 if (zonecfg_in_alt_root()) {
1989 1999 FILE *fp = zonecfg_open_scratch("", B_FALSE);
1990 2000
1991 2001 if (fp == NULL || zonecfg_find_scratch(fp, zonename,
1992 2002 zonecfg_get_root(), kernzone, sizeof (kernzone)) == -1) {
1993 2003 zerror(gettext("cannot find scratch zone %s"),
1994 2004 zonename);
1995 2005 if (fp != NULL)
1996 2006 zonecfg_close_scratch(fp);
1997 2007 return (1);
1998 2008 }
1999 2009 zonecfg_close_scratch(fp);
2000 2010 }
2001 2011
2002 2012 if ((zoneid = getzoneidbyname(kernzone)) == -1) {
2003 2013 zerror(gettext("failed to get zoneid for zone '%s'"),
2004 2014 zonename);
2005 2015 return (1);
2006 2016 }
2007 2017
2008 2018 /*
2009 2019 * We need the zone root path only if we are setting up a pty.
2010 2020 */
2011 2021 if (zone_get_devroot(zonename, devroot, sizeof (devroot)) == -1) {
2012 2022 zerror(gettext("could not get dev path for zone %s"),
2013 2023 zonename);
2014 2024 return (1);
2015 2025 }
2016 2026
2017 2027 if (zone_get_brand(zonename, zonebrand, sizeof (zonebrand)) != Z_OK) {
2018 2028 zerror(gettext("could not get brand for zone %s"), zonename);
2019 2029 return (1);
2020 2030 }
2021 2031 /*
2022 2032 * In the alternate root environment, the only supported
2023 2033 * operations are mount and unmount. In this case, just treat
2024 2034 * the zone as native if it is cluster. Cluster zones can be
2025 2035 * native for the purpose of LU or upgrade, and the cluster
2026 2036 * brand may not exist in the miniroot (such as in net install
2027 2037 * upgrade).
2028 2038 */
2029 2039 if (zonecfg_default_brand(default_brand,
2030 2040 sizeof (default_brand)) != Z_OK) {
2031 2041 zerror(gettext("unable to determine default brand"));
2032 2042 return (1);
2033 2043 }
2034 2044 if (zonecfg_in_alt_root() &&
2035 2045 strcmp(zonebrand, CLUSTER_BRAND_NAME) == 0) {
2036 2046 (void) strlcpy(zonebrand, default_brand, sizeof (zonebrand));
2037 2047 }
2038 2048
2039 2049 if ((bh = brand_open(zonebrand)) == NULL) {
2040 2050 zerror(gettext("could not open brand for zone %s"), zonename);
2041 2051 return (1);
2042 2052 }
2043 2053
2044 2054 if ((new_args = prep_args(bh, login, proc_args)) == NULL) {
2045 2055 zperror(gettext("could not assemble new arguments"));
2046 2056 brand_close(bh);
2047 2057 return (1);
2048 2058 }
2049 2059 /*
2050 2060 * Get the brand specific user_cmd. This command is used to get
2051 2061 * a passwd(4) entry for login.
2052 2062 */
2053 2063 if (!interactive && !failsafe) {
2054 2064 if (zone_get_user_cmd(bh, login, user_cmd,
2055 2065 sizeof (user_cmd)) == NULL) {
2056 2066 zerror(gettext("could not get user_cmd for zone %s"),
2057 2067 zonename);
2058 2068 brand_close(bh);
2059 2069 return (1);
2060 2070 }
2061 2071 }
2062 2072 brand_close(bh);
2063 2073
2064 2074 if ((new_env = prep_env()) == NULL) {
2065 2075 zperror(gettext("could not assemble new environment"));
2066 2076 return (1);
2067 2077 }
2068 2078
2069 2079 if (!interactive) {
2070 2080 if (nflag) {
2071 2081 int nfd;
2072 2082
2073 2083 if ((nfd = open(_PATH_DEVNULL, O_RDONLY)) < 0) {
2074 2084 zperror(gettext("failed to open null device"));
2075 2085 return (1);
2076 2086 }
2077 2087 if (nfd != STDIN_FILENO) {
2078 2088 if (dup2(nfd, STDIN_FILENO) < 0) {
2079 2089 zperror(gettext(
2080 2090 "failed to dup2 null device"));
2081 2091 return (1);
2082 2092 }
2083 2093 (void) close(nfd);
2084 2094 }
2085 2095 /* /dev/null is now standard input */
2086 2096 }
2087 2097 return (noninteractive_login(zonename, user_cmd, zoneid,
2088 2098 new_args, new_env));
2089 2099 }
2090 2100
2091 2101 if (zonecfg_in_alt_root()) {
2092 2102 zerror(gettext("cannot use interactive login with scratch "
2093 2103 "zone"));
2094 2104 return (1);
2095 2105 }
2096 2106
2097 2107 /*
2098 2108 * Things are more complex in interactive mode; we get the
2099 2109 * master side of the pty, then place the user's terminal into
2100 2110 * raw mode.
2101 2111 */
2102 2112 if (get_master_pty() == -1) {
2103 2113 zerror(gettext("could not setup master pty device"));
2104 2114 return (1);
2105 2115 }
2106 2116
2107 2117 /*
2108 2118 * Compute the "short name" of the pts. /dev/pts/2 --> pts/2
2109 2119 */
2110 2120 if ((slavename = ptsname(masterfd)) == NULL) {
2111 2121 zperror(gettext("failed to get name for pseudo-tty"));
2112 2122 return (1);
2113 2123 }
2114 2124 if (strncmp(slavename, "/dev/", strlen("/dev/")) == 0)
2115 2125 (void) strlcpy(slaveshortname, slavename + strlen("/dev/"),
2116 2126 sizeof (slaveshortname));
2117 2127 else
2118 2128 (void) strlcpy(slaveshortname, slavename,
2119 2129 sizeof (slaveshortname));
2120 2130
2121 2131 if (!quiet)
2122 2132 (void) printf(gettext("[Connected to zone '%s' %s]\n"),
2123 2133 zonename, slaveshortname);
2124 2134
2125 2135 if (set_tty_rawmode(STDIN_FILENO) == -1) {
2126 2136 reset_tty();
2127 2137 zperror(gettext("failed to set stdin pty to raw mode"));
2128 2138 return (1);
2129 2139 }
2130 2140
2131 2141 if (prefork_dropprivs() != 0) {
2132 2142 reset_tty();
2133 2143 zperror(gettext("could not allocate privilege set"));
2134 2144 return (1);
2135 2145 }
2136 2146
2137 2147 /*
2138 2148 * We must mask SIGCLD until after we have coped with the fork
2139 2149 * sufficiently to deal with it; otherwise we can race and receive the
2140 2150 * signal before child_pid has been initialized (yes, this really
2141 2151 * happens).
2142 2152 */
2143 2153 (void) sigset(SIGCLD, sigcld);
2144 2154 (void) sigemptyset(&block_cld);
2145 2155 (void) sigaddset(&block_cld, SIGCLD);
2146 2156 (void) sigprocmask(SIG_BLOCK, &block_cld, NULL);
2147 2157
2148 2158 /*
2149 2159 * We activate the contract template at the last minute to
2150 2160 * avoid intermediate functions that could be using fork(2)
2151 2161 * internally.
2152 2162 */
2153 2163 if ((tmpl_fd = init_template()) == -1) {
2154 2164 reset_tty();
2155 2165 zperror(gettext("could not create contract"));
2156 2166 return (1);
2157 2167 }
2158 2168
2159 2169 if ((child_pid = fork()) == -1) {
2160 2170 (void) ct_tmpl_clear(tmpl_fd);
2161 2171 reset_tty();
2162 2172 zperror(gettext("could not fork"));
2163 2173 return (1);
2164 2174 } else if (child_pid == 0) { /* child process */
2165 2175 int slavefd, newslave;
2166 2176
2167 2177 (void) ct_tmpl_clear(tmpl_fd);
2168 2178 (void) close(tmpl_fd);
2169 2179
2170 2180 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
2171 2181
2172 2182 if ((slavefd = init_slave_pty(zoneid, devroot)) == -1)
2173 2183 return (1);
2174 2184
2175 2185 /*
2176 2186 * Close all fds except for the slave pty.
2177 2187 */
2178 2188 (void) fdwalk(close_func, &slavefd);
2179 2189
2180 2190 /*
2181 2191 * Temporarily dup slavefd to stderr; that way if we have
2182 2192 * to print out that zone_enter failed, the output will
2183 2193 * have somewhere to go.
2184 2194 */
2185 2195 if (slavefd != STDERR_FILENO)
2186 2196 (void) dup2(slavefd, STDERR_FILENO);
2187 2197
2188 2198 if (zone_enter(zoneid) == -1) {
2189 2199 zerror(gettext("could not enter zone %s: %s"),
2190 2200 zonename, strerror(errno));
2191 2201 return (1);
2192 2202 }
2193 2203
2194 2204 if (slavefd != STDERR_FILENO)
2195 2205 (void) close(STDERR_FILENO);
2196 2206
2197 2207 /*
2198 2208 * We take pains to get this process into a new process
2199 2209 * group, and subsequently a new session. In this way,
2200 2210 * we'll have a session which doesn't yet have a controlling
2201 2211 * terminal. When we open the slave, it will become the
2202 2212 * controlling terminal; no PIDs concerning pgrps or sids
2203 2213 * will leak inappropriately into the zone.
2204 2214 */
2205 2215 (void) setpgrp();
2206 2216
2207 2217 /*
2208 2218 * We need the slave pty to be referenced from the zone's
2209 2219 * /dev in order to ensure that the devt's, etc are all
2210 2220 * correct. Otherwise we break ttyname and the like.
2211 2221 */
2212 2222 if ((newslave = open(slavename, O_RDWR)) == -1) {
2213 2223 (void) close(slavefd);
2214 2224 return (1);
2215 2225 }
2216 2226 (void) close(slavefd);
2217 2227 slavefd = newslave;
2218 2228
2219 2229 /*
2220 2230 * dup the slave to the various FDs, so that when the
2221 2231 * spawned process does a write/read it maps to the slave
2222 2232 * pty.
2223 2233 */
2224 2234 (void) dup2(slavefd, STDIN_FILENO);
2225 2235 (void) dup2(slavefd, STDOUT_FILENO);
2226 2236 (void) dup2(slavefd, STDERR_FILENO);
2227 2237 if (slavefd != STDIN_FILENO && slavefd != STDOUT_FILENO &&
2228 2238 slavefd != STDERR_FILENO) {
2229 2239 (void) close(slavefd);
2230 2240 }
2231 2241
2232 2242 /*
2233 2243 * In failsafe mode, we don't use login(1), so don't try
2234 2244 * setting up a utmpx entry.
2235 2245 */
2236 2246 if (!failsafe)
2237 2247 if (setup_utmpx(slaveshortname) == -1)
2238 2248 return (1);
2239 2249
2240 2250 /*
2241 2251 * The child needs to run as root to
2242 2252 * execute the brand's login program.
2243 2253 */
2244 2254 if (setuid(0) == -1) {
2245 2255 zperror(gettext("insufficient privilege"));
2246 2256 return (1);
2247 2257 }
2248 2258
2249 2259 (void) execve(new_args[0], new_args, new_env);
2250 2260 zperror(gettext("exec failure"));
2251 2261 return (1);
2252 2262 }
2253 2263
2254 2264 (void) ct_tmpl_clear(tmpl_fd);
2255 2265 (void) close(tmpl_fd);
2256 2266
2257 2267 /*
2258 2268 * The rest is only for the parent process.
2259 2269 */
2260 2270 (void) sigset(SIGWINCH, sigwinch);
2261 2271
2262 2272 postfork_dropprivs();
2263 2273
2264 2274 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
2265 2275 doio(masterfd, -1, masterfd, -1, -1, B_FALSE);
2266 2276
2267 2277 reset_tty();
2268 2278 if (!quiet)
2269 2279 (void) fprintf(stderr,
2270 2280 gettext("\n[Connection to zone '%s' %s closed]\n"),
2271 2281 zonename, slaveshortname);
2272 2282
2273 2283 if (pollerr != 0) {
2274 2284 (void) fprintf(stderr, gettext("Error: connection closed due "
2275 2285 "to unexpected pollevents=0x%x.\n"), pollerr);
2276 2286 return (1);
2277 2287 }
2278 2288
2279 2289 return (0);
2280 2290 }
|
↓ open down ↓ |
442 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX