2 * "$Id: cert.c 10262 2012-02-12 05:48:09Z mike $"
4 * Authentication certificate routines for the CUPS scheduler.
6 * Copyright 2007-2011 by Apple Inc.
7 * Copyright 1997-2006 by Easy Software Products.
9 * These coded instructions, statements, and computer programs are the
10 * property of Apple Inc. and are protected by Federal copyright
11 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
12 * which should have been included with this file. If this file is
13 * file is missing or damaged, see the license at "http://www.cups.org/".
17 * cupsdAddCert() - Add a certificate.
18 * cupsdDeleteCert() - Delete a single certificate.
19 * cupsdDeleteAllCerts() - Delete all certificates...
20 * cupsdFindCert() - Find a certificate.
21 * cupsdInitCerts() - Initialize the certificate "system" and root
26 * Include necessary headers...
32 # ifdef HAVE_MEMBERSHIP_H
33 # include <membership.h>
34 # endif /* HAVE_MEMBERSHIP_H */
35 #endif /* HAVE_ACL_INIT */
39 * 'cupsdAddCert()' - Add a certificate.
43 cupsdAddCert(int pid, /* I - Process ID */
44 const char *username, /* I - Username */
45 void *ccache) /* I - Kerberos credentials or NULL */
47 int i; /* Looping var */
48 cupsd_cert_t *cert; /* Current certificate */
49 int fd; /* Certificate file */
50 char filename[1024]; /* Certificate filename */
51 static const char hex[] = "0123456789ABCDEF";
52 /* Hex constants... */
55 cupsdLogMessage(CUPSD_LOG_DEBUG2,
56 "cupsdAddCert: Adding certificate for PID %d", pid);
59 * Allocate memory for the certificate...
62 if ((cert = calloc(sizeof(cupsd_cert_t), 1)) == NULL)
66 * Fill in the certificate information...
70 strlcpy(cert->username, username, sizeof(cert->username));
72 for (i = 0; i < 32; i ++)
73 cert->certificate[i] = hex[CUPS_RAND() & 15];
76 * Save the certificate to a file readable only by the User and Group
77 * (or root and SystemGroup for PID == 0)...
80 snprintf(filename, sizeof(filename), "%s/certs/%d", StateDir, pid);
83 if ((fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0400)) < 0)
85 cupsdLogMessage(CUPSD_LOG_ERROR,
86 "Unable to create certificate file %s - %s",
87 filename, strerror(errno));
95 acl_t acl; /* ACL information */
96 acl_entry_t entry; /* ACL entry */
97 acl_permset_t permset; /* Permissions */
98 # ifdef HAVE_MBR_UID_TO_UUID
99 uuid_t group; /* Group ID */
100 # endif /* HAVE_MBR_UID_TO_UUID */
101 static int acls_not_supported = 0;
103 #endif /* HAVE_ACL_INIT */
107 * Root certificate...
111 fchown(fd, RunUser, SystemGroupIDs[0]);
113 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddCert: NumSystemGroups=%d",
117 if (NumSystemGroups > 1)
120 * Set POSIX ACLs for the root certificate so that all system
121 * groups can access it...
124 int j; /* Looping var */
126 # ifdef HAVE_MBR_UID_TO_UUID
128 * On MacOS X, ACLs use UUIDs instead of GIDs...
131 acl = acl_init(NumSystemGroups - 1);
133 for (i = 1; i < NumSystemGroups; i ++)
136 * Add each group ID to the ACL...
139 for (j = 0; j < i; j ++)
140 if (SystemGroupIDs[j] == SystemGroupIDs[i])
144 continue; /* Skip duplicate groups */
146 acl_create_entry(&acl, &entry);
147 acl_get_permset(entry, &permset);
148 acl_add_perm(permset, ACL_READ_DATA);
149 acl_set_tag_type(entry, ACL_EXTENDED_ALLOW);
150 mbr_gid_to_uuid((gid_t)SystemGroupIDs[i], group);
151 acl_set_qualifier(entry, &group);
152 acl_set_permset(entry, permset);
157 * POSIX ACLs need permissions for owner, group, other, and mask
158 * in addition to the rest of the system groups...
161 acl = acl_init(NumSystemGroups + 3);
164 acl_create_entry(&acl, &entry);
165 acl_get_permset(entry, &permset);
166 acl_add_perm(permset, ACL_READ);
167 acl_set_tag_type(entry, ACL_USER_OBJ);
168 acl_set_permset(entry, permset);
171 acl_create_entry(&acl, &entry);
172 acl_get_permset(entry, &permset);
173 acl_add_perm(permset, ACL_READ);
174 acl_set_tag_type(entry, ACL_GROUP_OBJ);
175 acl_set_permset(entry, permset);
178 acl_create_entry(&acl, &entry);
179 acl_get_permset(entry, &permset);
180 acl_add_perm(permset, 0);
181 acl_set_tag_type(entry, ACL_OTHER);
182 acl_set_permset(entry, permset);
185 acl_create_entry(&acl, &entry);
186 acl_get_permset(entry, &permset);
187 acl_add_perm(permset, ACL_READ);
188 acl_set_tag_type(entry, ACL_MASK);
189 acl_set_permset(entry, permset);
191 for (i = 1; i < NumSystemGroups; i ++)
194 * Add each group ID to the ACL...
197 for (j = 0; j < i; j ++)
198 if (SystemGroupIDs[j] == SystemGroupIDs[i])
202 continue; /* Skip duplicate groups */
204 acl_create_entry(&acl, &entry);
205 acl_get_permset(entry, &permset);
206 acl_add_perm(permset, ACL_READ);
207 acl_set_tag_type(entry, ACL_GROUP);
208 acl_set_qualifier(entry, SystemGroupIDs + i);
209 acl_set_permset(entry, permset);
214 char *text, *textptr; /* Temporary string */
216 cupsdLogMessage(CUPSD_LOG_ERROR, "ACL did not validate: %s",
218 text = acl_to_text(acl, NULL);
219 for (textptr = strchr(text, '\n');
221 textptr = strchr(textptr + 1, '\n'))
224 cupsdLogMessage(CUPSD_LOG_ERROR, "ACL: %s", text);
227 # endif /* HAVE_MBR_UID_TO_UUID */
229 if (acl_set_fd(fd, acl))
231 if (errno != EOPNOTSUPP || !acls_not_supported)
232 cupsdLogMessage(CUPSD_LOG_ERROR,
233 "Unable to set ACLs on root certificate \"%s\" - %s",
234 filename, strerror(errno));
236 if (errno == EOPNOTSUPP)
237 acls_not_supported = 1;
242 #endif /* HAVE_ACL_INIT */
244 RootCertTime = time(NULL);
253 fchown(fd, User, Group);
256 DEBUG_printf(("ADD pid=%d, username=%s, cert=%s\n", pid, username,
259 write(fd, cert->certificate, strlen(cert->certificate));
263 * Add Kerberos credentials as needed...
267 cert->ccache = (krb5_ccache)ccache;
270 #endif /* HAVE_GSSAPI */
273 * Insert the certificate at the front of the list...
282 * 'cupsdDeleteCert()' - Delete a single certificate.
286 cupsdDeleteCert(int pid) /* I - Process ID */
288 cupsd_cert_t *cert, /* Current certificate */
289 *prev; /* Previous certificate */
290 char filename[1024]; /* Certificate file */
293 for (prev = NULL, cert = Certs; cert != NULL; prev = cert, cert = cert->next)
294 if (cert->pid == pid)
297 * Remove this certificate from the list...
300 cupsdLogMessage(CUPSD_LOG_DEBUG2,
301 "cupsdDeleteCert: Removing certificate for PID %d", pid);
303 DEBUG_printf(("DELETE pid=%d, username=%s, cert=%s\n", cert->pid,
304 cert->username, cert->certificate));
309 prev->next = cert->next;
313 * Release Kerberos credentials as needed...
317 krb5_cc_destroy(KerberosContext, cert->ccache);
318 #endif /* HAVE_GSSAPI */
323 * Delete the file and return...
326 snprintf(filename, sizeof(filename), "%s/certs/%d", StateDir, pid);
327 if (unlink(filename))
328 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to remove %s!", filename);
336 * 'cupsdDeleteAllCerts()' - Delete all certificates...
340 cupsdDeleteAllCerts(void)
342 cupsd_cert_t *cert, /* Current certificate */
343 *next; /* Next certificate */
344 char filename[1024]; /* Certificate file */
348 * Loop through each certificate, deleting them...
351 for (cert = Certs; cert != NULL; cert = next)
357 snprintf(filename, sizeof(filename), "%s/certs/%d", StateDir, cert->pid);
358 if (unlink(filename))
359 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to remove %s!", filename);
375 * 'cupsdFindCert()' - Find a certificate.
378 cupsd_cert_t * /* O - Matching certificate or NULL */
379 cupsdFindCert(const char *certificate) /* I - Certificate */
381 cupsd_cert_t *cert; /* Current certificate */
384 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindCert(certificate=%s)",
386 for (cert = Certs; cert != NULL; cert = cert->next)
387 if (!_cups_strcasecmp(certificate, cert->certificate))
389 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindCert: Returning %s...",
394 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindCert: Certificate not found!");
401 * 'cupsdInitCerts()' - Initialize the certificate "system" and root
408 #ifndef HAVE_ARC4RANDOM
409 cups_file_t *fp; /* /dev/random file */
413 * Initialize the random number generator using the random device or
414 * the current time, as available...
417 if ((fp = cupsFileOpen("/dev/urandom", "rb")) == NULL)
419 struct timeval tod; /* Time of day */
422 * Get the time in usecs and use it as the initial seed...
425 gettimeofday(&tod, NULL);
427 CUPS_SRAND((unsigned)(tod.tv_sec + tod.tv_usec));
431 unsigned seed; /* Seed for random number generator */
434 * Read 4 random characters from the random device and use
435 * them as the seed...
438 seed = cupsFileGetChar(fp);
439 seed = (seed << 8) | cupsFileGetChar(fp);
440 seed = (seed << 8) | cupsFileGetChar(fp);
441 CUPS_SRAND((seed << 8) | cupsFileGetChar(fp));
445 #endif /* !HAVE_ARC4RANDOM */
448 * Create a root certificate and return...
452 cupsdAddCert(0, "root", NULL);
457 * End of "$Id: cert.c 10262 2012-02-12 05:48:09Z mike $".