securityd/src/tokencache.cpp

   1 /*
   2  * Copyright (c) 2004-2006,2008 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 // tokencache - persistent (on-disk) hardware token directory
  27 //
  28 // Here's the basic disk layout, rooted at /var/db/TokenCache (or $TOKENCACHE):
  29 //  TBA
  30 //
  31 #include "tokencache.h"
  32 #include <security_utilities/unix++.h>
  33 #include <pwd.h>
  34 #include <grp.h>
  35
  36 using namespace UnixPlusPlus;
  37
  38
  39 //
  40 // Here are the uid/gid values we assign to token daemons and their cache files
  41 //
  42 #define TOKEND_UID                      "tokend"
  43 #define TOKEND_GID                      "tokend"
  44 #define TOKEND_UID_FALLBACK     uid_t(-2)
  45 #define TOKEND_GID_FALLBACK     gid_t(-2)
  46
  47
  48 //
  49 // Fixed relative file paths
  50 //
  51
  52 // relative to cache root (use cache->path())
  53 static const char configDir[] = "config";
  54 static const char lastSSIDFile[] = "config/lastSSID";
  55 static const char tokensDir[] = "tokens";
  56
  57 // relative to token directory (use token->path())
  58 static const char ssidFile[] = "SSID";
  59 static const char workDir[] = "work";
  60 static const char cacheDir[] = "cache";
  61
  62
  63 //
  64 // Internal file I/O helpers. These read/write entire files.
  65 // Note that the defaulted read functions do NOT write the default
  66 // to disk; they work fine in read-only disk areas.
  67 //
  68 static unsigned long getFile(const string &path, unsigned long defaultValue)
  69 {
  70         try {
  71                 AutoFileDesc fd(path, O_RDONLY, FileDesc::modeMissingOk);
  72                 if (fd) {
  73                         string s; fd.readAll(s);
  74                         unsigned long value; sscanf(s.c_str(), "%lu", &value);
  75                         return value;
  76                 }
  77         } catch (...) {
  78         }
  79         return defaultValue;
  80 }
  81
  82 static string getFile(const string &path, const string &defaultValue)
  83 {
  84         try {
  85                 AutoFileDesc fd(path, O_RDONLY, FileDesc::modeMissingOk);
  86                 if (fd) {
  87                         string s; fd.readAll(s);
  88                         return s;
  89                 }
  90         } catch (...) {
  91         }
  92         return defaultValue;
  93 }
  94
  95
  96 static void putFile(const string &path, uint32 value)
  97 {
  98         char buffer[64];
  99         snprintf(buffer, sizeof(buffer), "%ld\n", value);
 100         AutoFileDesc(path, O_WRONLY | O_CREAT | O_TRUNC).writeAll(buffer);
 101 }
 102
 103 static void putFile(const string &path, const string &value)
 104 {
 105         AutoFileDesc(path, O_WRONLY | O_CREAT | O_TRUNC).writeAll(value);
 106 }
 107
 108
 109 //
 110 // The "rooted tree" utility class
 111 //
 112 void Rooted::root(const string &r)
 113 {
 114         assert(mRoot.empty());  // can't re-set this
 115         mRoot = r;
 116 }
 117
 118 string Rooted::path(const char *sub) const
 119 {
 120         if (sub == NULL)
 121                 return mRoot;
 122         return mRoot + "/" + sub;
 123 }
 124
 125
 126 //
 127 // Open a TokenCache.
 128 // If the cache does not exist at the path given, initialize it.
 129 // If that fails, throw an exception.
 130 //
 131 TokenCache::TokenCache(const char *where)
 132         : Rooted(where), mLastSubservice(0)
 133 {
 134         makedir(root(), O_CREAT, 0711, securityd);
 135         makedir(path(configDir), O_CREAT, 0700, securityd);
 136         makedir(path(tokensDir), O_CREAT, 0711, securityd);
 137
 138         mLastSubservice = getFile(path(lastSSIDFile), 1);
 139
 140         // identify uid/gid for token daemons
 141         struct passwd *pw = getpwnam(TOKEND_UID);
 142         mTokendUid = pw ? pw->pw_uid : TOKEND_UID_FALLBACK;
 143         struct group *gr = getgrnam(TOKEND_GID);
 144         mTokendGid = gr ? gr->gr_gid : TOKEND_GID_FALLBACK;
 145
 146         secdebug("tokencache", "token cache rooted at %s (last ssid=%ld, uid/gid=%d/%d)",
 147                 root().c_str(), mLastSubservice, mTokendUid, mTokendGid);
 148 }
 149
 150 TokenCache::~TokenCache()
 151 {
 152 }
 153
 154
 155 //
 156 // Get a new, unused subservice id number.
 157 // Update the tracking file so we won't hand it out again (ever) within this cache.
 158 //
 159 uint32 TokenCache::allocateSubservice()
 160 {
 161         putFile(path(lastSSIDFile), ++mLastSubservice);
 162         return mLastSubservice;
 163 }
 164
 165
 166 //
 167 // A slightly souped-up UnixPlusPlus::makedir
 168 //
 169 void TokenCache::makedir(const char *path, int flags, mode_t mode, Owner owner)
 170 {
 171         UnixPlusPlus::makedir(path, flags, mode);
 172         switch(owner) {
 173         case securityd:
 174                 // leave it alone; we own it alrady
 175                 break;
 176         case tokend:
 177                 ::chown(path, tokendUid(), tokendGid());
 178                 break;
 179         }
 180 }
 181
 182
 183 //
 184 // Make a cache entry from a valid tokenUid.
 185 // This will locate an existing entry or make a new one.
 186 //
 187 TokenCache::Token::Token(TokenCache &c, const string &tokenUid)
 188         : Rooted(c.path(string(tokensDir) + "/" + tokenUid)), cache(c)
 189 {
 190         cache.makedir(root(), O_CREAT, 0711, securityd);
 191         if (mSubservice = getFile(path(ssidFile), 0)) {
 192                 secdebug("tokencache", "found token \"%s\" ssid=%ld", tokenUid.c_str(), mSubservice);
 193                 init(existing);
 194         } else {
 195                 mSubservice = cache.allocateSubservice();   // allocate new, unique ssid...
 196                 putFile(path(ssidFile), mSubservice);                   // ... and save it in cache
 197                 secdebug("tokencache", "new token \"%s\" ssid=%ld", tokenUid.c_str(), mSubservice);
 198                 init(created);
 199         }
 200 }
 201
 202
 203 //
 204 // Make a cache entry that is temporary and will never be reused.
 205 //
 206 TokenCache::Token::Token(TokenCache &c)
 207         : cache(c)
 208 {
 209         mSubservice = cache.allocateSubservice();       // new, unique id
 210         char rootForm[30]; snprintf(rootForm, sizeof(rootForm),
 211                 "%s/temporary:%ld", tokensDir, mSubservice);
 212         root(cache.path(rootForm));
 213         cache.makedir(root(), O_CREAT | O_EXCL, 0711, securityd);
 214         putFile(path(ssidFile), mSubservice);                   // ... and save it in cache
 215         secdebug("tokencache", "temporary token \"%s\" ssid=%ld", rootForm, mSubservice);
 216         init(temporary);
 217 }
 218
 219
 220 //
 221 // Common constructor setup code
 222 //
 223 void TokenCache::Token::init(Type type)
 224 {
 225         mType = type;
 226         cache.makedir(workPath(), O_CREAT, 0700, tokend);
 227         cache.makedir(cachePath(), O_CREAT, 0700, tokend);
 228 }
 229
 230
 231 //
 232 // The Token destructor might clean or preen a bit, but shouldn't take
 233 // too long (or too much effort).
 234 //
 235 TokenCache::Token::~Token()
 236 {
 237         if (type() == temporary)
 238                 secdebug("tokencache", "@@@ should delete the cache directory here...");
 239 }
 240
 241
 242 //
 243 // Attributes of TokenCache::Tokens
 244 //
 245 string TokenCache::Token::workPath() const
 246 {
 247         return path("Work");
 248 }
 249
 250 string TokenCache::Token::cachePath() const
 251 {
 252         return path("Cache");
 253 }
 254
 255
 256 string TokenCache::Token::printName() const
 257 {
 258         return getFile(path("PrintName"), "");
 259 }
 260
 261 void TokenCache::Token::printName(const string &name)
 262 {
 263         putFile(path("PrintName"), name);
 264 }