svc-labeld revision 269f47de02761bab3b7b28e2007a2bac34f629cc
2N/A#!/sbin/sh
2N/A#
2N/A# CDDL HEADER START
2N/A#
2N/A# The contents of this file are subject to the terms of the
2N/A# Common Development and Distribution License (the "License").
2N/A# You may not use this file except in compliance with the License.
2N/A#
2N/A# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A# or http://www.opensolaris.org/os/licensing.
2N/A# See the License for the specific language governing permissions
2N/A# and limitations under the License.
2N/A#
2N/A# When distributing Covered Code, include this CDDL HEADER in each
2N/A# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A# If applicable, add the following below this CDDL HEADER, with the
2N/A# fields enclosed by brackets "[]" replaced with your own identifying
2N/A# information: Portions Copyright [yyyy] [name of copyright owner]
2N/A#
2N/A# CDDL HEADER END
2N/A#
2N/A# Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
2N/A#
2N/A
2N/A. /lib/svc/share/smf_include.sh
2N/A
2N/AROOT_PATH=""
2N/Aif [ $# -gt 1 ]; then
2N/A if [ $# -ne 3 -o "$2" != "-R" ]; then
2N/A echo "$0: invalid syntax"
2N/A exit $SMF_EXIT_ERR_CONFIG
2N/A fi
2N/A if [ "$3" != "/" ]; then
2N/A ROOT_PATH=$3
2N/A fi
2N/Afi
2N/Aif [ -n "$ROOT_PATH" -a "$1" != "start" ]; then
2N/A echo "$0: invalid syntax: -R allowed for start method only"
2N/A exit $SMF_EXIT_ERR_CONFIG
2N/Afi
2N/Aif [ -n "$ROOT_PATH" -a ! -d "$ROOT_PATH" ]; then
2N/A echo "$0: invalid -R rootpath dir specified"
2N/A exit $SMF_EXIT_ERR_CONFIG
2N/Afi
2N/A
2N/Aif smf_is_nonglobalzone; then
2N/A echo "$0: not supported in a local zone"
2N/A exit $SMF_EXIT_ERR_CONFIG
2N/Afi
2N/A
2N/Arewrite_logindev()
2N/A{
2N/A from="$1"
2N/A to="$2"
2N/A # Comment out audio, usb, removable-media, and hotpluggable device
2N/A # entries in /etc/logindevperm.
2N/A LOGINDEVPERM=$ROOT_PATH/etc/logindevperm
2N/A if [ ! -f $LOGINDEVPERM ]; then
2N/A return
2N/A fi
2N/A for line in \
2N/A "/dev/sound/" \
2N/A "/dev/removable-media/" \
2N/A "/dev/hotpluggable/" \
2N/A "/dev/usb/\[0-9a-f\]" \
2N/A ; do
2N/A sed -e "s!^$from\([^# ]\{1,\}[ }\{1,\}[0-9]\{1,\}[ ]\{1,\}\)$line!$to\1$line!" \
2N/A $LOGINDEVPERM > /tmp/tmp.$$
2N/A cp /tmp/tmp.$$ $LOGINDEVPERM
2N/A done
2N/A rm -f /tmp/tmp.$$
2N/A}
2N/A
2N/Ado_logindev()
2N/A{
2N/A rewrite_logindev "" "#"
2N/A}
2N/A
2N/Ado_otherservices()
2N/A{
2N/A # Setup dependent services
2N/A cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__ENABLE_OTHERS
2N/A /usr/sbin/svcadm enable -s svc:/network/tnd:default
2N/A /usr/sbin/svcadm enable -s svc:/system/tsol-zones:default
2N/A /usr/sbin/svcadm enable svc:/network/rpc/rstat:default
2N/A__ENABLE_OTHERS
2N/A
2N/A}
2N/A
2N/Ado_audit_devalloc()
2N/A{
2N/A # Ensure auditing and device allocation are enabled by
2N/A # default with Trusted Extensions.
2N/A if [ "$ROOT_PATH" = "/" -o "$ROOT_PATH" = "" ]; then
2N/A /usr/sbin/svcadm enable -s svc:/system/device/allocate:default
2N/A echo "Starting auditd ..."
2N/A /usr/sbin/audit -s
2N/A else
2N/A cat >> $ROOT_PATH/var/svc/profile/upgrade <<\_ENABLE_AUDITD
2N/A /usr/sbin/audit -s
2N/A /usr/sbin/svcadm enable -s svc:/system/device/allocate:default
2N/A_ENABLE_AUDITD
2N/A fi
2N/A}
2N/A
2N/Ado_nscd()
2N/A{
2N/A# For Trusted Extensions, make nscd service transient in local zones.
2N/Acat >> $ROOT_PATH/var/svc/profile/upgrade <<\_DEL_LOCAL_NSCD
2N/A if [ `/sbin/zonename` != "global" ]; then
2N/A nscd="svc:/system/name-service-cache"
2N/A duration=""
2N/A if /bin/svcprop -q -c -p startd/duration $nscd ; then
2N/A duration=`/bin/svcprop -c -p startd/duration $nscd`
2N/A fi
2N/A if [ "$duration" != "transient" ]; then
2N/A /usr/sbin/svccfg -s $nscd addpg startd framework
2N/A /usr/sbin/svccfg -s $nscd setprop \
2N/A startd/duration = astring: transient
2N/A /usr/sbin/svccfg -s $nscd setprop stop/exec = :true
2N/A /usr/sbin/svcadm refresh $nscd
2N/A fi
2N/A fi
2N/A_DEL_LOCAL_NSCD
2N/A}
2N/A
2N/Ado_bootupd()
2N/A{
2N/A if [ -f $ROOT_PATH/platform/`/sbin/uname -m`/boot_archive ]; then
2N/A if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
2N/A /sbin/bootadm update-archive
2N/A else
2N/A /sbin/bootadm update-archive -R $ROOT_PATH
2N/A fi
2N/A fi
2N/A}
2N/A
2N/Asetup_tx_changes(){
2N/A#
2N/A# No comments or blanks lines allowed in entries below
2N/A#
2N/Acat > ${TX_ENTRIES} << EOF
2N/Adtlogin account requisite pam_roles.so.1
2N/Adtlogin account required pam_unix_account.so.1
2N/Adtsession account requisite pam_roles.so.1
2N/Adtsession account required pam_unix_account.so.1
2N/Agdm account requisite pam_roles.so.1
2N/Agdm account required pam_unix_account.so.1
2N/Axscreensaver account requisite pam_roles.so.1
2N/Axscreensaver account required pam_unix_account.so.1
2N/Apasswd account requisite pam_roles.so.1
2N/Apasswd account required pam_unix_account.so.1
2N/Adtpasswd account requisite pam_roles.so.1
2N/Adtpasswd account required pam_unix_account.so.1
2N/Atsoljds-tstripe account requisite pam_roles.so.1
2N/Atsoljds-tstripe account required pam_unix_account.so.1
2N/Aother account required pam_tsol_account.so.1
2N/AEOF
2N/A}
2N/A
2N/Ado_addpam()
2N/A{
2N/A PAM_TMP=/tmp/pam_conf.$$
2N/A TX_ENTRIES=$PAM_TMP/sct.$$
2N/A PAM_DEST=$ROOT_PATH/etc/pam.conf
2N/A
2N/A mkdir $PAM_TMP || exit $SMF_EXIT_ERR_FATAL
2N/A setup_tx_changes
2N/A
2N/A # verify that pam.conf file exists...
2N/A if [ ! -f ${PAM_DEST} ]; then
2N/A echo "$0: ${PAM_DEST} not found; aborting"
2N/A exit $SMF_EXIT_ERR_FATAL
2N/A fi
2N/A
2N/A #
2N/A # Update pam.conf to append Trusted Extensions entries if not
2N/A # already present.
2N/A #
2N/A rm -f /tmp/pamconf.$$
2N/A while read e1 e2 e3 e4 e5
2N/A do
2N/A # If this is the 'other' entry, add it unless it already
2N/A # exists.
2N/A if [ $e1 = "other" ]; then
2N/A grep \
2N/A"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
2N/A $PAM_DEST >/dev/null 2>&1
2N/A if [ $? = 1 ] ; then
2N/A # Doesn't exist, enter into pam.conf
2N/A echo "$e1\t$e2 $e3\t\t$e4 $e5" \
2N/A >> /tmp/pamconf.$$
2N/A fi
2N/A else
2N/A # Add other entries unless they already have a
2N/A # stack of their own.
2N/A grep "^[# ]*$e1[ ][ ]*$e2[ ]" \
2N/A $PAM_DEST >/dev/null 2>&1
2N/A if [ $? = 1 ] ; then
2N/A echo "$e1\t$e2 $e3\t\t$e4 $e5" \
2N/A >> /tmp/pamconf.$$
2N/A fi
2N/A fi
2N/A done < ${TX_ENTRIES}
2N/A # Append TX lines if any were not present already.
2N/A if [ -f /tmp/pamconf.$$ ] ; then
2N/A echo "# Entries for Trusted Extensions" >> $PAM_DEST
2N/A cat /tmp/pamconf.$$ >> $PAM_DEST
echo "$0: updating $PAM_DEST entries for Trusted Extensions;"
echo "$0: please examine/update any new entries"
rm -f /tmp/pamconf.$$
fi
rm -rf $PAM_TMP
}
do_pamremove()
{
PAM_TMP=/tmp/pam_conf.$$
TX_ENTRIES=$PAM_TMP/sct.$$
PAM_DEST=$ROOT_PATH/etc/pam.conf
TMPFILE=$PAM_TMP/pam.conf
mkdir $PAM_TMP || exit $SMF_EXIT_ERR_FATAL
# verify that pam.conf file exists...
if [ ! -f ${PAM_DEST} ]; then
echo "$0: ${PAM_DEST} not found; aborting"
exit $SMF_EXIT_ERR_FATAL
fi
grep '^[a-z].*pam_tsol_account' $PAM_DEST > /dev/null 2>&1
if [ $? -ne 0 ]; then
echo "$0: pam_tsol_account module not present,"
echo "$0: No changes were made to $PAM_DEST."
return
fi
grep -v pam_tsol_account $PAM_DEST > $TMPFILE
echo "$0: $PAM_DEST "tsol" entries removed"
cp $TMPFILE $PAM_DEST
rm -rf $PAM_TMP
}
do_commonstart()
{
echo "$0: Updating $ROOT_PATH/etc/system..."
if [ ! -f ${ROOT_PATH}/etc/system ]; then
touch ${ROOT_PATH}/etc/system
fi
# Set sys_labeling in etc/system
grep -v "sys_labeling=" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
echo "set sys_labeling=1" >> /tmp/etc.system.$$
mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
grep "set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
if [ $? -ne 0 ]; then
echo "$0: ERROR: cannot set sys_labeling in $ROOT_PATH/etc/system"
exit $SMF_EXIT_ERR_FATAL
fi
# Setup dependent services
do_otherservices
do_logindev
do_audit_devalloc
do_nscd
do_addpam
do_bootupd
}
do_servicetag_register()
{
ROOTDIR=$1
SOL_ARCH=`/sbin/uname -p`
SOL_VERS=`/sbin/uname -r`
TX_PROD_URN="urn:uuid:fc720df3-410f-11dc-9b8e-080020a9ed93"
if [ ! -x /usr/bin/stclient ]; then
return
fi
# if already registered then do nothing more here
inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null`
if [ -n "$inst" ]; then
# this instance id was saved in a SMF property
/usr/bin/stclient -g -i $inst -r $ROOTDIR >/dev/null 2>&1
if [ $? = 0 ]; then
# matching service tag found, so do nothing
return
else
# no match for instance id saved in SMF property
/usr/sbin/svccfg -s $SMF_FMRI delprop \
labeld/svctag_inst
/usr/sbin/svcadm refresh $SMF_FMRI
fi
fi
# fall through: no service tag, or does not match saved instance id
# determine the urn of the parent (Solaris)
SOL_PROD_URN=""
case $SOL_VERS in
5.11)
SOL_PROD_URN="-F urn:uuid:6df19e63-7ef5-11db-a4bd-080020a9ed93"
;;
5.10)
SOL_PROD_URN="-F urn:uuid:5005588c-36f3-11d6-9cec-fc96f718e113"
;;
esac
# add the service tag
RC=`/usr/bin/stclient -a -p "Solaris Trusted Extensions" \
-e $SOL_VERS -t $TX_PROD_URN -P Solaris $SOL_PROD_URN \
-m Sun -A $SOL_ARCH -z global -S $0 -r $ROOTDIR`
if [ $? = 0 ]; then
# save instance id in SMF property
inst=`echo "$RC" | grep -i urn|awk -F= '{print $2}'`
/usr/sbin/svccfg -s $SMF_FMRI setprop \
labeld/svctag_inst = astring: "$inst"
/usr/sbin/svcadm refresh $SMF_FMRI
fi
}
do_servicetag_delete()
{
if [ ! -x /usr/bin/stclient ]; then
return
fi
inst=`/usr/bin/svcprop -p labeld/svctag_inst $SMF_FMRI 2>/dev/null`
if [ -n "$inst" ]; then
# delete service tag
/usr/bin/stclient -d -i $inst
# delete saved instance id
/usr/sbin/svccfg -s $SMF_FMRI delprop labeld/svctag_inst
/usr/sbin/svcadm refresh $SMF_FMRI
fi
}
daemon_start()
{
# If a labeld door exists, check for a labeld process and exit
# if the daemon is already running.
if [ -r /var/tsol/doors/labeld ]; then
if /usr/bin/pgrep -x -u 0 -P 1 labeld >/dev/null 2>&1; then
echo "$0: labeld is already running"
exit $SMF_EXIT_ERR_FATAL
fi
fi
/usr/bin/rm -f /var/tsol/doors/labeld
/usr/lib/labeld
}
PATH=/usr/sbin:/usr/bin; export PATH
case "$1" in
'start')
if [ -z "$ROOT_PATH" -o "$ROOT_PATH" = "/" ]; then
# native
if [ -z "$SMF_FMRI" ]; then
echo "$0: this script can only be invoked by smf(5)"
exit $SMF_EXIT_ERR_NOSMF
fi
tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
if [ "$tx_enabled" = "false" ]; then
# A sign of trying temporary enablement...no-no
echo "$0: Temporarily enabling Trusted Extensions is not allowed."
exit $SMF_EXIT_ERR_CONFIG
fi
if (smf_is_system_labeled); then
do_servicetag_register /
daemon_start
exit $SMF_EXIT_OK
fi
# Make changes to enable Trusted Extensions
grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$0: already enabled. Exiting."
exit $SMF_EXIT_OK
fi
if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
echo "$0: Must remove zones before enabling Trusted Extensions."
exit $SMF_EXIT_ERR_CONFIG
fi
do_commonstart
do_servicetag_register /
# start daemon proccess so our service doesn't go into
# maintenance state
daemon_start
echo "$0: Started. Must reboot and configure Trusted Extensions."
else
# Support jumpstart etc
# Make changes to enable Trusted Extensions
grep "^set sys_labeling=1" ${ROOT_PATH}/etc/system > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$0: already enabled. Exiting."
exit $SMF_EXIT_OK
fi
# Setup dependent services
cat >> $ROOT_PATH/var/svc/profile/upgrade <<\__TRUSTED_ENABLE
/usr/sbin/svcadm enable -s svc:/system/labeld:default
__TRUSTED_ENABLE
do_commonstart
do_servicetag_register $ROOT_PATH
echo "$0: Started. Must configure Trusted Extensions before booting."
fi
;;
'stop')
tx_enabled=`/usr/bin/svcprop -c -p general/enabled $SMF_FMRI`
if [ "$tx_enabled" = "true" ]; then
/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
exit $SMF_EXIT_OK
fi
if [ "`/usr/sbin/zoneadm list -c`" != "global" ]; then
echo "$0: Must remove zones before disabling Trusted Extensions."
exit $SMF_EXIT_ERR_CONFIG
fi
# Stop Trusted services.
/usr/sbin/svcadm disable svc:/system/tsol-zones:default 2>/dev/null
/usr/sbin/svcadm disable svc:/network/tnd:default 2>/dev/null
# Uncomment audio, usb, removable-media, and hotpluggable device
# entries in /etc/logindevperm.
rewrite_logindev "#" ""
# Remove sys_labeling from /etc/system
grep -v "sys_labeling" ${ROOT_PATH}/etc/system > /tmp/etc.system.$$
mv /tmp/etc.system.$$ ${ROOT_PATH}/etc/system
grep "sys_labeling" ${ROOT_PATH}/etc/system > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "$0: ERROR: cannot remove sys_labeling in $ROOT_PATH/etc/system"
exit $SMF_EXIT_ERR_FATAL
fi
do_pamremove
do_servicetag_delete
do_bootupd
/usr/bin/pkill -x -u 0 -P 1 -z `smf_zonename` labeld
echo "$0: Stopped. Will take effect at next boot."
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
exit $SMF_EXIT_OK