Merge branch 'sid'

[nfs-utils.git] / utils / nfsidmap / nfsidmap.c

diff --git a/utils/nfsidmap/nfsidmap.c b/utils/nfsidmap/nfsidmap.c
index 6a09f38113b5adb6aab7ff481d4ec7873ec1e21d..e14543c85770d5dd9f167d55c4517486cde302ed 100644 (file)
--- a/utils/nfsidmap/nfsidmap.c
+++ b/utils/nfsidmap/nfsidmap.c
@@ -3,6 +3,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <errno.h>
 
 #include <pwd.h>
 #include <grp.h>
@@ -11,15 +12,30 @@
 
 #include <unistd.h>
 #include "xlog.h"
+#include "conffile.h"
 
 int verbose = 0;
-char *usage="Usage: %s [-v] [-t timeout] key desc";
+char *usage="Usage: %s [-v] [-c || [-u|-g|-r key] || [-t timeout] key desc]";
 
 #define MAX_ID_LEN   11
 #define IDMAP_NAMESZ 128
 #define USER  1
 #define GROUP 0
 
+#define PROCKEYS "/proc/keys"
+#ifndef DEFAULT_KEYRING
+#define DEFAULT_KEYRING "id_resolver"
+#endif
+
+#ifndef PATH_IDMAPDCONF
+#define PATH_IDMAPDCONF "/etc/idmapd.conf"
+#endif
+
+static int keyring_clear(char *keyring);
+
+#define UIDKEYS 0x1
+#define GIDKEYS 0x2
+
 /*
  * Find either a user or group id based on the name@domain string
  */
@@ -43,6 +59,22 @@ int id_lookup(char *name_at_domain, key_serial_t key, int type)
 
        if (rc == 0) {
                rc = keyctl_instantiate(key, id, strlen(id) + 1, 0);
+               if (rc < 0) {
+                       switch(rc) {
+                       case -EDQUOT:
+                       case -ENFILE:
+                       case -ENOMEM:
+                               /*
+                                * The keyring is full. Clear the keyring and try again
+                                */
+                               rc = keyring_clear(DEFAULT_KEYRING);
+                               if (rc == 0)
+                                       rc = keyctl_instantiate(key, id, strlen(id) + 1, 0);
+                               break;
+                       default:
+                               break;
+                       }
+               }
                if (rc < 0)
                        xlog_err("id_lookup: keyctl_instantiate failed: %m");
        }
@@ -87,6 +119,110 @@ int name_lookup(char *id, key_serial_t key, int type)
 out:
        return rc;
 }
+/*
+ * Clear all the keys on the given keyring
+ */
+static int keyring_clear(char *keyring)
+{
+       FILE *fp;
+       char buf[BUFSIZ];
+       key_serial_t key;
+
+       if (keyring == NULL)
+               keyring = DEFAULT_KEYRING;
+
+       if ((fp = fopen(PROCKEYS, "r")) == NULL) {
+               xlog_err("fopen(%s) failed: %m", PROCKEYS);
+               return 1;
+       }
+
+       while(fgets(buf, BUFSIZ, fp) != NULL) {
+               if (strstr(buf, "keyring") == NULL)
+                       continue;
+               if (strstr(buf, keyring) == NULL)
+                       continue;
+               if (verbose) {
+                       *(strchr(buf, '\n')) = '\0';
+                       xlog_warn("clearing '%s'", buf);
+               }
+               /*
+                * The key is the first arugment in the string
+                */
+               *(strchr(buf, ' ')) = '\0';
+               sscanf(buf, "%x", &key);
+               if (keyctl_clear(key) < 0) {
+                       xlog_err("keyctl_clear(0x%x) failed: %m", key);
+                       fclose(fp);
+                       return 1;
+               }
+               fclose(fp);
+               return 0;
+       }
+       xlog_err("'%s' keyring was not found.", keyring);
+       fclose(fp);
+       return 1;
+}
+/*
+ * Revoke a key 
+ */
+static int key_revoke(char *keystr, int keymask)
+{
+       FILE *fp;
+       char buf[BUFSIZ], *ptr;
+       key_serial_t key;
+       int mask;
+
+       xlog_syslog(0);
+
+       if ((fp = fopen(PROCKEYS, "r")) == NULL) {
+               xlog_err("fopen(%s) failed: %m", PROCKEYS);
+               return 1;
+       }
+
+       while(fgets(buf, BUFSIZ, fp) != NULL) {
+               if (strstr(buf, "keyring") != NULL)
+                       continue;
+
+               mask = 0;
+               if ((ptr = strstr(buf, "uid:")) != NULL)
+                       mask = UIDKEYS;
+               else if ((ptr = strstr(buf, "gid:")) != NULL)
+                       mask = GIDKEYS;
+               else 
+                       continue;
+
+               if ((keymask & mask) == 0)
+                       continue;
+
+               if (strncmp(ptr+4, keystr, strlen(keystr)) != 0)
+                       continue;
+
+               if (verbose) {
+                       *(strchr(buf, '\n')) = '\0';
+                       xlog_warn("revoking '%s'", buf);
+               }
+               /*
+                * The key is the first arugment in the string
+                */
+               *(strchr(buf, ' ')) = '\0';
+               sscanf(buf, "%x", &key);
+
+               if (keyctl_revoke(key) < 0) {
+                       xlog_err("keyctl_revoke(0x%x) failed: %m", key);
+                       fclose(fp);
+                       return 1;
+               }
+
+               keymask &= ~mask;
+               if (keymask == 0) {
+                       fclose(fp);
+                       return 0;
+               }
+       }
+       xlog_err("'%s' key was not found.", keystr);
+       fclose(fp);
+       return 1;
+}
 
 int main(int argc, char **argv)
 {
@@ -96,7 +232,8 @@ int main(int argc, char **argv)
        int rc = 1, opt;
        int timeout = 600;
        key_serial_t key;
-       char *progname;
+       char *progname, *keystr = NULL;
+       int clearing = 0, keymask = 0;
 
        /* Set the basename */
        if ((progname = strrchr(argv[0], '/')) != NULL)
@@ -105,11 +242,24 @@ int main(int argc, char **argv)
                progname = argv[0];
 
        xlog_open(progname);
-       xlog_syslog(1);
-       xlog_stderr(0);
 
-       while ((opt = getopt(argc, argv, "t:v")) != -1) {
+       while ((opt = getopt(argc, argv, "u:g:r:ct:v")) != -1) {
                switch (opt) {
+               case 'u':
+                       keymask = UIDKEYS;
+                       keystr = strdup(optarg);
+                       break;
+               case 'g':
+                       keymask = GIDKEYS;
+                       keystr = strdup(optarg);
+                       break;
+               case 'r':
+                       keymask = GIDKEYS|UIDKEYS;
+                       keystr = strdup(optarg);
+                       break;
+               case 'c':
+                       clearing++;
+                       break;
                case 'v':
                        verbose++;
                        break;
@@ -122,6 +272,24 @@ int main(int argc, char **argv)
                }
        }
 
+       if (nfs4_init_name_mapping(PATH_IDMAPDCONF))  {
+               xlog_err("Unable to create name to user id mappings.");
+               return 1;
+       }
+       if (!verbose)
+               verbose = conf_get_num("General", "Verbosity", 0);
+
+       if (keystr) {
+               rc = key_revoke(keystr, keymask);
+               return rc;              
+       }
+       if (clearing) {
+               xlog_syslog(0);
+               rc = keyring_clear(DEFAULT_KEYRING);
+               return rc;              
+       }
+
+       xlog_stderr(0);
        if ((argc - optind) != 2) {
                xlog_err("Bad arg count. Check /etc/request-key.conf");
                xlog_warn(usage, progname);
@@ -142,7 +310,7 @@ int main(int argc, char **argv)
        value = strtok(NULL, ":");
 
        if (verbose) {
-               xlog_warn("key: %ld type: %s value: %s timeout %ld",
+               xlog_warn("key: 0x%lx type: %s value: %s timeout %ld",
                        key, type, value, timeout);
        }