src/tools/sss_userdel.c

	sss_userdel.c revision 83bf46f4066e3d5e838a32357c201de9bd6ecdfd
fdbad18e66c0e293f94694458d47df305f050c71Christian Maeder/*
fdbad18e66c0e293f94694458d47df305f050c71Christian Maeder   SSSD
fdbad18e66c0e293f94694458d47df305f050c71Christian Maeder
fdbad18e66c0e293f94694458d47df305f050c71Christian Maeder   sss_userdel
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder   Copyright (C) Jakub Hrozek <jhrozek@redhat.com>        2009
b96b500ba4430269d97a08f07de87838278e9c5dChristian Maeder
b96b500ba4430269d97a08f07de87838278e9c5dChristian Maeder   This program is free software; you can redistribute it and/or modify
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder   it under the terms of the GNU General Public License as published by
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder   the Free Software Foundation; either version 3 of the License, or
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder   (at your option) any later version.
5214cf3742dc626a7efc5ec851db09bf0ff1f579Christian Maeder
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include <nss.h>
#include <stdio.h>
#include <stdlib.h>
#include <talloc.h>
#include <popt.h>
#include <sys/types.h>
#include <sys/wait.h>

#include "db/sysdb.h"
#include "util/util.h"
#include "util/find_uid.h"
#include "tools/tools_util.h"
#include "tools/sss_sync_ops.h"

#ifndef KILL_CMD
#define KILL_CMD "killall"
#endif

#ifndef KILL_CMD_USER_FLAG
#define KILL_CMD_USER_FLAG "-u"
#endif

#ifndef KILL_CMD_SIGNAL_FLAG
#define KILL_CMD_SIGNAL_FLAG "-s"
#endif

#ifndef KILL_CMD_SIGNAL
#define KILL_CMD_SIGNAL "SIGKILL"
#endif

static int is_logged_in(TALLOC_CTX *mem_ctx, uid_t uid)
{
    int ret;
    hash_key_t key;
    hash_value_t value;
    hash_table_t *uid_table;

    ret = get_uid_table(mem_ctx, &uid_table);
    if (ret == ENOSYS) return ret;
    if (ret != EOK) {
        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot initialize hash table.\n");
        return ret;
    }

    key.type = HASH_KEY_ULONG;
    key.ul   = (unsigned long) uid;

    ret = hash_lookup(uid_table, &key, &value);
    talloc_zfree(uid_table);
    return ret == HASH_SUCCESS ? EOK : ENOENT;
}

static int kick_user(struct tools_ctx *tctx)
{
    int ret;
    int status;
    pid_t pid, child_pid;

    tctx->octx->lock = 1;

    ret = usermod(tctx, tctx->octx);
    if (ret != EOK) {
        return ret;
    }

    errno = 0;
    pid = fork();
    if (pid == 0) {
        /* child */
        execlp(KILL_CMD, KILL_CMD,
               KILL_CMD_USER_FLAG, tctx->octx->name,
               KILL_CMD_SIGNAL_FLAG, KILL_CMD_SIGNAL,
               (char *) NULL);
        exit(errno);
    } else {
        /* parent */
        if (pid == -1) {
            ret = errno;
            DEBUG(SSSDBG_CRIT_FAILURE,
                  "fork failed [%d]: %s\n", ret, strerror(ret));
            return ret;
        }

        while((child_pid = waitpid(pid, &status, 0)) > 0) {

            if (WIFEXITED(status)) {
                break;
            }
        }
        if (child_pid == -1) {
            DEBUG(SSSDBG_CRIT_FAILURE, "waitpid failed\n");
            return errno;
        }
    }

    return EOK;
}

int main(int argc, const char **argv)
{
    int ret = EXIT_SUCCESS;
    struct tools_ctx *tctx = NULL;
    const char *pc_username = NULL;

    int pc_debug = SSSDBG_DEFAULT;
    int pc_remove = 0;
    int pc_force = 0;
    int pc_kick = 0;
    poptContext pc = NULL;
    struct poptOption long_options[] = {
        POPT_AUTOHELP
        { "debug", '\0', POPT_ARG_INT | POPT_ARGFLAG_DOC_HIDDEN, &pc_debug,
                    0, _("The debug level to run with"), NULL },
        { "remove", 'r', POPT_ARG_NONE, NULL, 'r',
                    _("Remove home directory and mail spool"), NULL },
        { "no-remove", 'R', POPT_ARG_NONE, NULL, 'R',
                    _("Do not remove home directory and mail spool"), NULL },
        { "force", 'f', POPT_ARG_NONE, NULL, 'f',
                    _("Force removal of files not owned by the user"), NULL },
        { "kick", 'k', POPT_ARG_NONE, NULL, 'k',
                    _("Kill users' processes before removing him"), NULL },
        POPT_TABLEEND
    };

    debug_prg_name = argv[0];

    ret = set_locale();
    if (ret != EOK) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              "set_locale failed (%d): %s\n", ret, strerror(ret));
        ERROR("Error setting the locale\n");
        ret = EXIT_FAILURE;
        goto fini;
    }

    /* parse parameters */
    pc = poptGetContext(NULL, argc, argv, long_options, 0);
    poptSetOtherOptionHelp(pc, "USERNAME");
    while ((ret = poptGetNextOpt(pc)) > 0) {
        switch (ret) {
            case 'r':
                pc_remove = DO_REMOVE_HOME;
                break;

            case 'R':
                pc_remove = DO_NOT_REMOVE_HOME;
                break;

            case 'f':
                pc_force = DO_FORCE_REMOVAL;
                break;

            case 'k':
                pc_kick = 1;
                break;
        }
    }

    DEBUG_INIT(pc_debug);

    if (ret != -1) {
        BAD_POPT_PARAMS(pc, poptStrerror(ret), ret, fini);
    }

    pc_username = poptGetArg(pc);
    if (pc_username == NULL) {
        BAD_POPT_PARAMS(pc, _("Specify user to delete\n"), ret, fini);
    }

    CHECK_ROOT(ret, debug_prg_name);

    ret = init_sss_tools(&tctx);
    if (ret != EOK) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
        if (ret == ENOENT) {
            ERROR("Error initializing the tools - no local domain\n");
        } else {
            ERROR("Error initializing the tools\n");
        }
        ret = EXIT_FAILURE;
        goto fini;
    }

    /* if the domain was not given as part of FQDN, default to local domain */
    ret = parse_name_domain(tctx, pc_username);
    if (ret != EOK) {
        ERROR("Invalid domain specified in FQDN\n");
        ret = EXIT_FAILURE;
        goto fini;
    }

    /*
     * Fills in defaults for ops_ctx user did not specify.
     */
    ret = userdel_defaults(tctx, tctx->confdb, tctx->octx, pc_remove);
    if (ret != EOK) {
        ERROR("Cannot set default values\n");
        ret = EXIT_FAILURE;
        goto fini;
    }

    ret = sysdb_getpwnam_sync(tctx,
                              tctx->octx->name,
                              tctx->octx);
    if (ret != EOK) {
        /* Error message will be printed in the switch */
        goto done;
    }

    if ((tctx->octx->uid < tctx->local->id_min) ||
        (tctx->local->id_max && tctx->octx->uid > tctx->local->id_max)) {
        ERROR("User %1$s is outside the defined ID range for domain\n",
              tctx->octx->name);
        ret = EXIT_FAILURE;
        goto fini;
    }

    if (pc_kick) {
        ret = kick_user(tctx);
        if (ret != EOK) {
            tctx->error = ret;

            goto done;
        }
    }

    /* userdel */
    ret = userdel(tctx, tctx->sysdb, tctx->octx);
    if (ret != EOK) {
        goto done;
    }

    /* Set SELinux login context - must be done after transaction is done
     * b/c libselinux calls getpwnam */
    ret = del_seuser(tctx->octx->name);
    if (ret != EOK) {
        ERROR("Cannot reset SELinux login context\n");
        ret = EXIT_FAILURE;
        goto fini;
    }

    if (!pc_kick) {
        ret = is_logged_in(tctx, tctx->octx->uid);
        switch(ret) {
            case ENOENT:
                break;

            case EOK:
                ERROR("WARNING: The user (uid %1$lu) was still logged in when "
                      "deleted.\n", (unsigned long) tctx->octx->uid);
                break;

            case ENOSYS:
                ERROR("Cannot determine if the user was logged in on this "
                      "platform");
                break;

            default:
                ERROR("Error while checking if the user was logged in\n");
                break;
        }
    }

    ret = run_userdel_cmd(tctx);
    if (ret != EOK) {
        ERROR("The post-delete command failed: %1$s\n", strerror(ret));
        goto fini;
    }

    /* Delete user from memory cache */
    ret = sss_mc_refresh_user(pc_username);
    if (ret != EOK) {
        ERROR("NSS request failed (%1$d). Entry might remain in memory "
              "cache.\n", ret);
        /* Nothing we can do about it */
    }

    if (tctx->octx->remove_homedir) {
        ret = remove_homedir(tctx,
                             tctx->octx->home,
                             tctx->octx->maildir,
                             tctx->octx->name,
                             tctx->octx->uid,
                             pc_force);
        if (ret == EPERM) {
            ERROR("Not removing home dir - not owned by user\n");
        } else if (ret != EOK) {
            ERROR("Cannot remove homedir: %1$s\n", strerror(ret));
            ret = EXIT_FAILURE;
            goto fini;
        }
    }

    ret = EOK;

done:
    if (ret) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
        switch (ret) {
            case ENOENT:
                ERROR("No such user in local domain. "
                      "Removing users only allowed in local domain.\n");
                break;

            default:
                ERROR("Internal error. Could not remove user.\n");
                break;
        }
        ret = EXIT_FAILURE;
        goto fini;
    }

    ret = EXIT_SUCCESS;

fini:
    talloc_free(tctx);
    poptFreeContext(pc);
    exit(ret);
}