From 95bea503429c3f44654265486a07f1696b017e84 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 10 Jul 2015 12:10:53 +0200
Subject: [PATCH 31/37] Add NSS version of p11_child
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
---
Makefile.am | 25 +-
contrib/sssd.spec.in | 1 +
src/p11_child/p11_child_nss.c | 636 ++++++++++++++++++++++++++++++++++++++++++
3 files changed, 661 insertions(+), 1 deletion(-)
create mode 100644 src/p11_child/p11_child_nss.c
diff --git a/Makefile.am b/Makefile.am
index 277166ec66b3d67101e628990e68704c886b0c59..e4add9757058773915f1971786b8a9ad584ec51f 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -148,7 +148,9 @@ endif
if BUILD_SEMANAGE
sssdlibexec_PROGRAMS += selinux_child
endif
-
+if HAVE_NSS
+sssdlibexec_PROGRAMS += p11_child
+endif
if BUILD_PAC_RESPONDER
sssdlibexec_PROGRAMS += sssd_pac
@@ -3146,6 +3148,23 @@ proxy_child_LDADD = \
$(SSSD_LIBS) \
$(SSSD_INTERNAL_LTLIBS)
+p11_child_SOURCES = \
+ src/p11_child/p11_child_nss.c \
+ src/util/atomic_io.c \
+ $(NULL)
+p11_child_CFLAGS = \
+ $(AM_CFLAGS) \
+ $(POPT_CFLAGS) \
+ $(NSS_CFLAGS) \
+ $(NULL)
+p11_child_LDADD = \
+ libsss_debug.la \
+ $(TALLOC_LIBS) \
+ $(POPT_LIBS) \
+ $(NSS_LIBS) \
+ libsss_crypt.la \
+ $(NULL)
+
memberof_la_SOURCES = \
src/ldb_modules/memberof.c \
src/util/util.c
@@ -3541,6 +3560,10 @@ if BUILD_SEMANAGE
-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/selinux_child
chmod 4750 $(DESTDIR)$(sssdlibexecdir)/selinux_child
endif
+if HAVE_NSS
+ -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/p11_child
+ chmod 4750 $(DESTDIR)$(sssdlibexecdir)/p11_child
+endif
endif
install-data-hook:
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 54260e32e24ece372ed7130ab29d766bb1923f77..9ca9a8b4dce5c5d70fb4df268270bcfb0c9b17bb 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -684,6 +684,7 @@ rm -rf $RPM_BUILD_ROOT
%{_libexecdir}/%{servicename}/sssd_autofs
%{_libexecdir}/%{servicename}/sssd_ssh
%{_libexecdir}/%{servicename}/sssd_sudo
+%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/p11_child
%dir %{_libdir}/%{name}
%{_libdir}/%{name}/libsss_simple.so
diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
new file mode 100644
index 0000000000000000000000000000000000000000..6948c142aa7843cda5ff6d18f5853b10c387c224
--- /dev/null
+++ b/src/p11_child/p11_child_nss.c
@@ -0,0 +1,636 @@
+/*
+ SSSD
+
+ Helper child to commmunicate with SmartCard via NSS
+
+ Authors:
+ Sumit Bose <sbose@redhat.com>
+
+ Copyright (C) 2015 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <popt.h>
+
+#include "util/util.h"
+
+#include <nss.h>
+#include <base64.h>
+#include <cryptohi.h>
+#include <secmod.h>
+#include <cert.h>
+#include <keyhi.h>
+#include <pk11pub.h>
+#include <prerror.h>
+
+#include "util/child_common.h"
+#include "providers/dp_backend.h"
+#include "util/crypto/sss_crypto.h"
+
+enum op_mode {
+ OP_NONE,
+ OP_AUTH,
+ OP_PREAUTH
+};
+
+enum pin_mode {
+ PIN_NONE,
+ PIN_STDIN,
+ PIN_KEYPAD
+};
+
+static char *password_passthrough(PK11SlotInfo *slot, PRBool retry, void *arg)
+{
+ /* give up if 1) no password was supplied, or 2) the password has already
+ * been rejected once by this token. */
+ if (retry || (arg == NULL)) {
+ return NULL;
+ }
+ return PL_strdup((char *)arg);
+}
+
+
+
+int do_work(TALLOC_CTX *mem_ctx, const char *nss_db, const char *slot_name_in,
+ enum op_mode mode, const char *pin, char **cert,
+ char **token_name_out)
+{
+ int ret;
+ SECStatus rv;
+ NSSInitContext *nss_ctx;
+ SECMODModuleList *mod_list;
+ SECMODModuleList *mod_list_item;
+ const char *slot_name;
+ const char *token_name;
+ uint32_t flags = NSS_INIT_READONLY
+ | NSS_INIT_FORCEOPEN
+ | NSS_INIT_NOROOTINIT
+ | NSS_INIT_OPTIMIZESPACE
+ | NSS_INIT_PK11RELOAD;
+ NSSInitParameters parameters = { 0 };
+ parameters.length = sizeof (parameters);
+ PK11SlotInfo *slot = NULL;
+ CK_SLOT_ID slot_id;
+ SECMODModuleID module_id;
+ CERTCertList *cert_list = NULL;
+ CERTCertListNode *cert_list_node;
+ const PK11DefaultArrayEntry friendly_attr = { "Publicly-readable certs",
+ SECMOD_FRIENDLY_FLAG,
+ CKM_INVALID_MECHANISM };
+ CERTCertDBHandle *handle;
+ unsigned char random_value[128];
+ SECKEYPrivateKey *priv_key;
+ SECOidTag algtag;
+ SECItem signed_random_value = {0};
+ SECKEYPublicKey *pub_key;
+ CERTCertificate *found_cert = NULL;
+ PK11SlotList *list = NULL;
+ PK11SlotListElement *le;
+
+
+ nss_ctx = NSS_InitContext(nss_db, "", "", SECMOD_DB, ¶meters, flags);
+ if (nss_ctx == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "NSS_InitContext failed [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+
+ PK11_SetPasswordFunc(password_passthrough);
+
+ DEBUG(SSSDBG_TRACE_ALL, "Default Module List:\n");
+ mod_list = SECMOD_GetDefaultModuleList();
+ for (mod_list_item = mod_list; mod_list_item != NULL;
+ mod_list_item = mod_list_item->next) {
+ DEBUG(SSSDBG_TRACE_ALL, "common name: [%s].\n",
+ mod_list_item->module->commonName);
+ DEBUG(SSSDBG_TRACE_ALL, "dll name: [%s].\n",
+ mod_list_item->module->dllName);
+ }
+
+ DEBUG(SSSDBG_TRACE_ALL, "Dead Module List:\n");
+ mod_list = SECMOD_GetDeadModuleList();
+ for (mod_list_item = mod_list; mod_list_item != NULL;
+ mod_list_item = mod_list_item->next) {
+ DEBUG(SSSDBG_TRACE_ALL, "common name: [%s].\n",
+ mod_list_item->module->commonName);
+ DEBUG(SSSDBG_TRACE_ALL, "dll name: [%s].\n",
+ mod_list_item->module->dllName);
+ }
+
+ DEBUG(SSSDBG_TRACE_ALL, "DB Module List:\n");
+ mod_list = SECMOD_GetDBModuleList();
+ for (mod_list_item = mod_list; mod_list_item != NULL;
+ mod_list_item = mod_list_item->next) {
+ DEBUG(SSSDBG_TRACE_ALL, "common name: [%s].\n",
+ mod_list_item->module->commonName);
+ DEBUG(SSSDBG_TRACE_ALL, "dll name: [%s].\n",
+ mod_list_item->module->dllName);
+ }
+
+ if (slot_name_in != NULL) {
+ slot = PK11_FindSlotByName(slot_name_in);
+ if (slot == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_FindSlotByName failed for [%s]: [%d].\n",
+ slot_name_in, PR_GetError());
+ return EIO;
+ }
+ } else {
+
+ list = PK11_GetAllTokens(CKM_INVALID_MECHANISM, PR_FALSE, PR_TRUE,
+ NULL);
+ if (list == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_GetAllTokens failed.\n");
+ return EIO;
+ }
+
+ for (le = list->head; le; le = le->next) {
+ CK_SLOT_INFO slInfo;
+
+ slInfo.flags = 0;
+ rv = PK11_GetSlotInfo(le->slot, &slInfo);
+ DEBUG(SSSDBG_TRACE_ALL,
+ "Description [%s] Manufacturer [%s] flags [%lu].\n",
+ slInfo.slotDescription, slInfo.manufacturerID, slInfo.flags);
+ if (rv == SECSuccess && (slInfo.flags & CKF_REMOVABLE_DEVICE)) {
+ slot = PK11_ReferenceSlot(le->slot);
+ break;
+ }
+ }
+ PK11_FreeSlotList(list);
+ if (slot == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "No removable slots found.\n");
+ return EIO;
+ }
+ }
+
+
+ slot_id = PK11_GetSlotID(slot);
+ module_id = PK11_GetModuleID(slot);
+ slot_name = PK11_GetSlotName(slot);
+ token_name = PK11_GetTokenName(slot);
+ DEBUG(SSSDBG_TRACE_ALL, "Found [%s] in slot [%s][%d] of module [%d].\n",
+ token_name, slot_name, (int) slot_id, (int) module_id);
+
+ if (PK11_IsFriendly(slot)) {
+ DEBUG(SSSDBG_TRACE_ALL, "Token is friendly.\n");
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL,
+ "Token is NOT friendly.\n");
+ if (mode == OP_PREAUTH) {
+ DEBUG(SSSDBG_TRACE_ALL, "Trying to switch to friendly to read certificate.\n");
+ rv = PK11_UpdateSlotAttribute(slot, &friendly_attr, PR_TRUE);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "PK11_UpdateSlotAttribute failed, continue.\n");
+ }
+ }
+ }
+
+ /* TODO: check PK11_ProtectedAuthenticationPath() and return the result */
+ if (mode == OP_AUTH || PK11_NeedLogin(slot)) {
+ DEBUG(SSSDBG_TRACE_ALL, "Login required.\n");
+ if (pin != NULL) {
+ rv = PK11_Authenticate(slot, PR_FALSE, discard_const(pin));
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_Authenticate failed: [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+ } else {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Login required but no pin available, continue.\n");
+ }
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL, "Login NOT required.\n");
+ }
+
+ cert_list = PK11_ListCertsInSlot(slot);
+ if (cert_list == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_ListCertsInSlot failed: [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+
+ for (cert_list_node = CERT_LIST_HEAD(cert_list);
+ !CERT_LIST_END(cert_list_node, cert_list);
+ cert_list_node = CERT_LIST_NEXT(cert_list_node)) {
+ if (cert_list_node->cert) {
+ DEBUG(SSSDBG_TRACE_ALL, "found cert[%s][%s]\n",
+ cert_list_node->cert->nickname,
+ cert_list_node->cert->subjectName);
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL, "--- empty cert list node ---\n");
+ }
+ }
+
+ rv = CERT_FilterCertListByUsage(cert_list, certUsageSSLClient, PR_FALSE);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_FilterCertListByUsage failed: [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+
+ rv = CERT_FilterCertListForUserCerts(cert_list);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_FilterCertListForUserCerts failed: [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+
+
+ handle = CERT_GetDefaultCertDB();
+ if (handle == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_GetDefaultCertDB failed: [%d].\n",
+ PR_GetError());
+ return EIO;
+ }
+
+
+ found_cert = NULL;
+ DEBUG(SSSDBG_TRACE_ALL, "Filtered certificates:\n");
+ for (cert_list_node = CERT_LIST_HEAD(cert_list);
+ !CERT_LIST_END(cert_list_node, cert_list);
+ cert_list_node = CERT_LIST_NEXT(cert_list_node)) {
+ if (cert_list_node->cert) {
+ DEBUG(SSSDBG_TRACE_ALL, "found cert[%s][%s]\n",
+ cert_list_node->cert->nickname,
+ cert_list_node->cert->subjectName);
+
+ if (found_cert == NULL) {
+ found_cert = cert_list_node->cert;
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL, "More than one certificate found, " \
+ "using just the first one.\n");
+ }
+ } else {
+ DEBUG(SSSDBG_TRACE_ALL, "--- empty cert list node ---\n");
+ }
+ }
+
+ if (found_cert == NULL) {
+ DEBUG(SSSDBG_TRACE_ALL, "No certificate found.\n");
+ *cert = NULL;
+ *token_name_out = NULL;
+ ret = EOK;
+ goto done;
+ }
+
+ rv = CERT_VerifyCertificateNow(handle, found_cert, PR_TRUE,
+ certificateUsageSSLClient, NULL, NULL);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "CERT_VerifyCertificateNow failed [%d].\n",
+ PR_GetError());
+ ret = EIO;
+ goto done;
+ }
+
+ if (mode == OP_AUTH) {
+ rv = PK11_GenerateRandom(random_value, sizeof(random_value));
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "PK11_GenerateRandom failed [%d].\n", PR_GetError());
+ return EIO;
+ }
+
+ priv_key = PK11_FindPrivateKeyFromCert(slot, found_cert, NULL);
+ if (priv_key == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "PK11_FindPrivateKeyFromCert failed [%d]." \
+ "Maybe pin is missing.\n", PR_GetError());
+ ret = EIO;
+ goto done;
+ }
+
+ algtag = SEC_GetSignatureAlgorithmOidTag(priv_key->keyType,
+ SEC_OID_SHA1);
+ if (algtag == SEC_OID_UNKNOWN) {
+ SECKEY_DestroyPrivateKey(priv_key);
+ DEBUG(SSSDBG_OP_FAILURE,
+ "SEC_GetSignatureAlgorithmOidTag failed [%d].",
+ PR_GetError());
+ ret = EIO;
+ goto done;
+ }
+
+ rv = SEC_SignData(&signed_random_value,
+ random_value, sizeof(random_value),
+ priv_key, algtag);
+ SECKEY_DestroyPrivateKey(priv_key);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "SEC_SignData failed [%d].",
+ PR_GetError());
+ ret = EIO;
+ goto done;
+ }
+
+ pub_key = CERT_ExtractPublicKey(found_cert);
+ if (pub_key == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "CERT_ExtractPublicKey failed [%d].", PR_GetError());
+ ret = EIO;
+ goto done;
+ }
+
+ rv = VFY_VerifyData(random_value, sizeof(random_value),
+ pub_key, &signed_random_value, algtag,
+ NULL);
+ SECKEY_DestroyPublicKey(pub_key);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "VFY_VerifyData failed [%d].",
+ PR_GetError());
+ ret = EACCES;
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_ALL,
+ "Certificate verified and validated.\n");
+ }
+
+ *cert = sss_base64_encode(mem_ctx, found_cert->derCert.data,
+ found_cert->derCert.len);
+ if (*cert == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "sss_base64_encode failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+
+ *token_name_out = talloc_strdup(mem_ctx, token_name);
+ if (*token_name_out == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Failed to copy slot name.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ if (slot != NULL) {
+ PK11_FreeSlot(slot);
+ }
+
+ if (cert_list != NULL) {
+ CERT_DestroyCertList(cert_list);
+ }
+
+ PORT_Free(signed_random_value.data);
+
+ rv = NSS_ShutdownContext(nss_ctx);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE, "NSS_ShutdownContext failed [%d].\n",
+ PR_GetError());
+ }
+
+ return ret;
+}
+
+static errno_t p11c_recv_data(TALLOC_CTX *mem_ctx, int fd, char **pin)
+{
+ uint8_t buf[IN_BUF_SIZE];
+ ssize_t len;
+ errno_t ret;
+ char *str;
+
+ errno = 0;
+ len = sss_atomic_read_s(fd, buf, IN_BUF_SIZE);
+ if (len == -1) {
+ ret = errno;
+ ret = (ret == 0) ? EINVAL: ret;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "read failed [%d][%s].\n", ret, strerror(ret));
+ return ret;
+ }
+
+ if (len == 0 || *buf == '\0') {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Missing PIN.\n");
+ return EINVAL;
+ }
+
+ str = talloc_strndup(mem_ctx, (char *) buf, len);
+ if (str == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_strndup failed.\n");
+ return ENOMEM;
+ }
+
+ if (strlen(str) != len) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Input contains additional data, only PIN expected.\n");
+ talloc_free(str);
+ return EINVAL;
+ }
+
+ *pin = str;
+
+ return EOK;
+}
+
+int main(int argc, const char *argv[])
+{
+ int opt;
+ poptContext pc;
+ int debug_fd = -1;
+ errno_t ret;
+ TALLOC_CTX *main_ctx = NULL;
+ char *cert;
+ enum op_mode mode = OP_NONE;
+ enum pin_mode pin_mode = PIN_NONE;
+ char *pin = NULL;
+ char *slot_name_in = NULL;
+ char *token_name_out = NULL;
+ char *nss_db = NULL;
+
+ struct poptOption long_options[] = {
+ POPT_AUTOHELP
+ {"debug-level", 'd', POPT_ARG_INT, &debug_level, 0,
+ _("Debug level"), NULL},
+ {"debug-timestamps", 0, POPT_ARG_INT, &debug_timestamps, 0,
+ _("Add debug timestamps"), NULL},
+ {"debug-microseconds", 0, POPT_ARG_INT, &debug_microseconds, 0,
+ _("Show timestamps with microseconds"), NULL},
+ {"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
+ _("An open file descriptor for the debug logs"), NULL},
+ {"debug-to-stderr", 0, POPT_ARG_NONE | POPT_ARGFLAG_DOC_HIDDEN,
+ &debug_to_stderr, 0,
+ _("Send the debug output to stderr directly."), NULL },
+ {"auth", 0, POPT_ARG_NONE, NULL, 'a', _("Run in auth mode"), NULL},
+ {"pre", 0, POPT_ARG_NONE, NULL, 'p', _("Run in pre-auth mode"), NULL},
+ {"pin", 0, POPT_ARG_NONE, NULL, 'i', _("Expect PIN on stdin"), NULL},
+ {"keypad", 0, POPT_ARG_NONE, NULL, 'k', _("Expect PIN on keypad"),
+ NULL},
+ {"nssdb", 0, POPT_ARG_STRING, &nss_db, 0, _("NSS DB to use"),
+ NULL},
+ POPT_TABLEEND
+ };
+
+ /* Set debug level to invalid value so we can decide if -d 0 was used. */
+ debug_level = SSSDBG_INVALID;
+
+ pc = poptGetContext(argv[0], argc, argv, long_options, 0);
+ while ((opt = poptGetNextOpt(pc)) != -1) {
+ switch(opt) {
+ case 'a':
+ if (mode != OP_NONE) {
+ fprintf(stderr,
+ "\n--auth and --pre are mutually exclusive and " \
+ "should be only used once.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+ mode = OP_AUTH;
+ break;
+ case 'p':
+ if (mode != OP_NONE) {
+ fprintf(stderr,
+ "\n--auth and --pre are mutually exclusive and " \
+ "should be only used once.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+ mode = OP_PREAUTH;
+ break;
+ case 'i':
+ if (pin_mode != PIN_NONE) {
+ fprintf(stderr, "\n--pin and --keypad are mutually exclusive " \
+ "and should be only used once.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+ pin_mode = PIN_STDIN;
+ break;
+ case 'k':
+ if (pin_mode != PIN_NONE) {
+ fprintf(stderr, "\n--pin and --keypad are mutually exclusive " \
+ "and should be only used once.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+ pin_mode = PIN_KEYPAD;
+ break;
+ default:
+ fprintf(stderr, "\nInvalid option %s: %s\n\n",
+ poptBadOption(pc, 0), poptStrerror(opt));
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+ }
+
+ if (nss_db == NULL) {
+ fprintf(stderr, "\nMissing NSS DB --nssdb must be specified.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+
+ if (mode == OP_NONE) {
+ fprintf(stderr, "\nMissing operation mode, " \
+ "either --auth or --pre must be specified.\n\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ } else if (mode == OP_AUTH && pin_mode == PIN_NONE) {
+ fprintf(stderr, "\nMissing pin mode for authentication, " \
+ "either --pin or --keypad must be specified.\n");
+ poptPrintUsage(pc, stderr, 0);
+ _exit(-1);
+ }
+
+ poptFreeContext(pc);
+
+ DEBUG_INIT(debug_level);
+
+ debug_prg_name = talloc_asprintf(NULL, "[sssd[p11_child[%d]]]", getpid());
+ if (debug_prg_name == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
+ goto fail;
+ }
+
+ if (debug_fd != -1) {
+ ret = set_debug_file_from_fd(debug_fd);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "set_debug_file_from_fd failed.\n");
+ }
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, "p11_child started.\n");
+
+ DEBUG(SSSDBG_TRACE_INTERNAL, "Running in [%s] mode.\n",
+ mode == OP_AUTH ? "auth"
+ : (mode == OP_PREAUTH ? "pre-auth" : "unknown"));
+
+ DEBUG(SSSDBG_TRACE_INTERNAL,
+ "Running with effective IDs: [%"SPRIuid"][%"SPRIgid"].\n",
+ geteuid(), getegid());
+
+ if (getuid() != 0) {
+ ret = setuid(0);
+ if (ret == -1) {
+ ret = errno;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "setuid failed: %d, p11_child might not work!\n", ret);
+ }
+ }
+
+ if (getgid() != 0) {
+ ret = setgid(0);
+ if (ret == -1) {
+ ret = errno;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "setgid failed: %d, p11_child might not work!\n", ret);
+ }
+ }
+
+ DEBUG(SSSDBG_TRACE_INTERNAL,
+ "Running with real IDs [%"SPRIuid"][%"SPRIgid"].\n",
+ getuid(), getgid());
+
+ main_ctx = talloc_new(NULL);
+ if (main_ctx == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed.\n");
+ talloc_free(discard_const(debug_prg_name));
+ goto fail;
+ }
+ talloc_steal(main_ctx, debug_prg_name);
+
+
+ if (mode == OP_AUTH && pin_mode == PIN_STDIN) {
+ ret = p11c_recv_data(main_ctx, STDIN_FILENO, &pin);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_FATAL_FAILURE, "Failed to read pin.\n");
+ goto fail;
+ }
+ }
+
+ ret = do_work(main_ctx, nss_db, slot_name_in, mode, pin, &cert,
+ &token_name_out);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "do_work failed.\n");
+ goto fail;
+ }
+
+ if (cert != NULL) {
+ fprintf(stdout, "%s\n", token_name_out);
+ fprintf(stdout, "%s\n", cert);
+ }
+
+ talloc_free(main_ctx);
+ return EXIT_SUCCESS;
+fail:
+ DEBUG(SSSDBG_CRIT_FAILURE, "p11_child failed!\n");
+ close(STDOUT_FILENO);
+ talloc_free(main_ctx);
+ return EXIT_FAILURE;
+}
--
2.4.3