nfsidmap: Allow keys to be cleared from the keyring

[nfs-utils.git] / utils / nfsidmap / nfsidmap.c

diff --git a/utils/nfsidmap/nfsidmap.c b/utils/nfsidmap/nfsidmap.c
index 134d9bcc21904fcb0cebd4da9452507158678e49..cec2cb307e234092d80a8153414ca4ddac04a0cc 100644 (file)
--- a/utils/nfsidmap/nfsidmap.c
+++ b/utils/nfsidmap/nfsidmap.c
@@ -9,16 +9,22 @@
 #include <keyutils.h>
 #include <nfsidmap.h>
 
-#include <syslog.h>
+#include <unistd.h>
 #include "xlog.h"
 
-/* gcc nfsidmap.c -o nfsidmap -l nfsidmap -l keyutils */
+int verbose = 0;
+char *usage="Usage: %s [-v] [-c || [-t timeout] key desc]";
 
 #define MAX_ID_LEN   11
 #define IDMAP_NAMESZ 128
 #define USER  1
 #define GROUP 0
 
+#define PROCKEYS "/proc/keys"
+#ifndef DEFAULT_KEYRING
+#define DEFAULT_KEYRING "id_resolver"
+#endif
+
 
 /*
  * Find either a user or group id based on the name@domain string
@@ -87,16 +93,61 @@ int name_lookup(char *id, key_serial_t key, int type)
 out:
        return rc;
 }
+/*
+ * Clear all the keys on the given keyring
+ */
+static int keyring_clear(char *keyring)
+{
+       FILE *fp;
+       char buf[BUFSIZ];
+       key_serial_t key;
+
+       xlog_syslog(0);
+       if (keyring == NULL)
+               keyring = DEFAULT_KEYRING;
+
+       if ((fp = fopen(PROCKEYS, "r")) == NULL) {
+               xlog_err("fopen(%s) failed: %m", PROCKEYS);
+               return 1;
+       }
+
+       while(fgets(buf, BUFSIZ, fp) != NULL) {
+               if (strstr(buf, "keyring") == NULL)
+                       continue;
+               if (strstr(buf, keyring) == NULL)
+                       continue;
+               if (verbose) {
+                       *(strchr(buf, '\n')) = '\0';
+                       xlog_warn("clearing '%s'", buf);
+               }
+               /*
+                * The key is the first arugment in the string
+                */
+               *(strchr(buf, ' ')) = '\0';
+               sscanf(buf, "%x", &key);
+               if (keyctl_clear(key) < 0) {
+                       xlog_err("keyctl_clear(0x%x) failed: %m", key);
+                       fclose(fp);
+                       return 1;
+               }
+               fclose(fp);
+               return 0;
+       }
+       xlog_err("'%s' keyring was not found.", keyring);
+       fclose(fp);
+       return 1;
+}
 
 int main(int argc, char **argv)
 {
        char *arg;
        char *value;
        char *type;
-       int rc = 1;
+       int rc = 1, opt;
        int timeout = 600;
        key_serial_t key;
        char *progname;
+       int clearring;
 
        /* Set the basename */
        if ((progname = strrchr(argv[0], '/')) != NULL)
@@ -105,27 +156,54 @@ int main(int argc, char **argv)
                progname = argv[0];
 
        xlog_open(progname);
-       xlog_syslog(1);
-       xlog_stderr(0);
 
-       if (argc < 3) {
+       while ((opt = getopt(argc, argv, "ct:v")) != -1) {
+               switch (opt) {
+               case 'c':
+                       clearring++;
+                       break;
+               case 'v':
+                       verbose++;
+                       break;
+               case 't':
+                       timeout = atoi(optarg);
+                       break;
+               default:
+                       xlog_warn(usage, progname);
+                       break;
+               }
+       }
+
+       if (clearring) {
+               rc = keyring_clear(DEFAULT_KEYRING);
+               return rc;              
+       }
+
+       xlog_stderr(0);
+       if ((argc - optind) != 2) {
                xlog_err("Bad arg count. Check /etc/request-key.conf");
+               xlog_warn(usage, progname);
                return 1;
        }
 
-       arg = malloc(sizeof(char) * strlen(argv[2]) + 1);
-       strcpy(arg, argv[2]);
+       if (verbose)
+               nfs4_set_debug(verbose, NULL);
+
+       key = strtol(argv[optind++], NULL, 10);
+
+       arg = strdup(argv[optind]);
+       if (arg == NULL) {
+               xlog_err("strdup failed: %m");
+               return 1;
+       }
        type = strtok(arg, ":");
        value = strtok(NULL, ":");
 
-       if (argc == 4) {
-               timeout = atoi(argv[3]);
-               if (timeout < 0)
-                       timeout = 0;
+       if (verbose) {
+               xlog_warn("key: %ld type: %s value: %s timeout %ld",
+                       key, type, value, timeout);
        }
 
-       key = strtol(argv[1], NULL, 10);
-
        if (strcmp(type, "uid") == 0)
                rc = id_lookup(value, key, USER);
        else if (strcmp(type, "gid") == 0)
@@ -135,7 +213,7 @@ int main(int argc, char **argv)
        else if (strcmp(type, "group") == 0)
                rc = name_lookup(value, key, GROUP);
 
-       /* Set timeout to 5 (600 seconds) minutes */
+       /* Set timeout to 10 (600 seconds) minutes */
        if (rc == 0)
                keyctl_set_timeout(key, timeout);