src/server/security-server-main.c

   1 /*
   2  * security-server
   3  *
   4  *  Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd All Rights Reserved
   5  *
   6  *  Contact: Bumjin Im <bj.im@samsung.com>
   7  *
   8  *  Licensed under the Apache License, Version 2.0 (the "License");
   9  *  you may not use this file except in compliance with the License.
  10  *  You may obtain a copy of the License at
  11  *
  12  *      http://www.apache.org/licenses/LICENSE-2.0
  13  *
  14  *  Unless required by applicable law or agreed to in writing, software
  15  *  distributed under the License is distributed on an "AS IS" BASIS,
  16  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  17  *  See the License for the specific language governing permissions and
  18  *  limitations under the License
  19  *
  20  */
  21
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <unistd.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <sys/types.h>
  28 #include <errno.h>
  29 #include <signal.h>
  30 #include <pthread.h>
  31 #include <limits.h>
  32 #include <fcntl.h>
  33 #include <sys/smack.h>
  34 #include <sys/types.h>
  35 #include <sys/socket.h>
  36 #include <sys/wait.h>
  37
  38 #include "security-server-cookie.h"
  39 #include "security-server-common.h"
  40 #include "security-server-password.h"
  41 #include "security-server-comm.h"
  42
  43 /* Set cookie as a global variable */
  44 cookie_list *c_list;
  45 pthread_mutex_t cookie_mutex;
  46 int thread_status[SECURITY_SERVER_NUM_THREADS];
  47 struct security_server_thread_param {
  48         int client_sockfd;
  49         int server_sockfd;
  50         int thread_status;
  51 };
  52
  53 /************************************************************************************************/
  54 /* Just for test. This code must be removed on release */
  55 #include "security-server-util.h"
  56 /************************************************************************************************/
  57
  58 #if 0
  59 void printhex(unsigned char *data, int size)
  60 {
  61         int i;
  62         for(i=0;i<size;i++)
  63         {
  64                 if(data[i] < 0xF)
  65                         printf("0");
  66
  67                 printf("%X ", data[i]);
  68                 if(((i+1) % 16) == 0 && i != 0)
  69                         printf("\n");
  70         }
  71         printf("\n");
  72 }
  73
  74 void print_cookie(cookie_list *list)
  75 {
  76         int i;
  77         printf("%s", "cookie:\n");
  78         printhex(list->cookie, SECURITY_SERVER_COOKIE_LEN);
  79         printf("path_len: %d\n", list->path_len);
  80         printf("permission_len: %d\n", list->permission_len);
  81         printf("PID: %d\n", list->pid);
  82         printf("path: %s\n", list->path);
  83         printf("%s", "permissions: ");
  84         for(i=0;i<list->permission_len;i++)
  85         {
  86                 printf("%d ", list->permissions[i]);
  87         }
  88         printf("%s", "\n");
  89         printf("prev: %p\n", list->prev);
  90         printf("next: %p\n", list->next);
  91 }
  92 #endif
  93
  94 /* Object name is actually name of a Group ID *
  95  * This function opens /etc/group file and search group ID and
  96  * returns the string */
  97 int search_object_name(int gid, char *obj, int obj_size)
  98 {
  99         FILE *fp = NULL;
 100         char *linebuf = NULL, *token = NULL, *token2, *tempstr = NULL;
 101         int ret = 0, tmp_gid, bufsize;
 102         fp = fopen("/etc/group", "r");
 103         if(fp == NULL)
 104         {
 105                 /* cannot open /etc/group */
 106                 SEC_SVR_DBG("%s", "Cannot open /etc/group");
 107                 return SECURITY_SERVER_ERROR_FILE_OPERATION;
 108         }
 109
 110         linebuf = malloc(128);
 111         bufsize = 128;
 112         if(linebuf == NULL)
 113         {
 114                 ret = SECURITY_SERVER_ERROR_OUT_OF_MEMORY;
 115                 SEC_SVR_DBG("%s", "cannot malloc()");
 116                 goto error;
 117         }
 118
 119         bzero(linebuf, bufsize);
 120         ret = SECURITY_SERVER_ERROR_NO_SUCH_OBJECT;
 121         while(fgets(linebuf, bufsize, fp) != NULL)
 122         {
 123                 while(linebuf[bufsize -2] != 0)
 124                 {
 125                         linebuf[bufsize -1] = (char) fgetc(fp);
 126                         tempstr = realloc(linebuf, bufsize + 128);
 127                         if(tempstr == NULL)
 128                         {
 129                                 ret = SECURITY_SERVER_ERROR_OUT_OF_MEMORY;
 130                                 goto error;
 131                         }
 132                         linebuf = tempstr;
 133                         bzero(linebuf + bufsize, 128);
 134                         fgets(linebuf + bufsize, 128, fp);
 135                         bufsize += 128;
 136                 }
 137
 138                 token = strtok(linebuf, ":");   /* group name */
 139                 if(token == NULL)
 140                 {
 141                         SEC_SVR_DBG("/etc/group is not valid. cannot find gid: [%s]", linebuf);
 142                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 143                         goto error;
 144                 }
 145                 token2 = strtok(NULL, ":");     /* group password */
 146                 if(token2== NULL)
 147                 {
 148                         SEC_SVR_DBG("/etc/group is not valid. cannot find gid: [%s]", linebuf);
 149                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 150                         goto error;
 151                 }
 152                 token2 = strtok(NULL, ":");     /* gid */
 153                 if(token2 == NULL)
 154                 {
 155                         SEC_SVR_DBG("/etc/group is not valid. cannot find gid: [%s]", linebuf);
 156                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 157                         goto error;
 158                 }
 159
 160                 errno = 0;
 161                 tmp_gid = strtoul(token2, 0, 10);
 162                 if (errno != 0)
 163                 {
 164                         SEC_SVR_DBG("cannot change string to integer [%s]", token2);
 165                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 166                         goto error;
 167                 }
 168
 169                 if(tmp_gid == gid)
 170                 {
 171                         /* We found it */
 172                         if((int)strlen(token) > obj_size)
 173                         {
 174                                 ret = SECURITY_SERVER_ERROR_BUFFER_TOO_SMALL;
 175                                 SEC_SVR_DBG("buffer is too small. %d --> %d", obj_size, strlen(token));
 176                                 goto error;
 177                         }
 178                         strncpy(obj, token, strlen(token));
 179                         obj[strlen(token)] = 0;
 180                         ret = SECURITY_SERVER_SUCCESS;
 181                         break;
 182                 }
 183                 bzero(linebuf, bufsize);
 184         }
 185
 186 error:
 187         if(linebuf != NULL)
 188                 free(linebuf);
 189         if(fp != NULL)
 190                 fclose(fp);
 191         return ret;
 192 }
 193
 194 /* Search GID from group name *
 195  * This function opens /etc/group and search group name by given gid */
 196 int search_gid(const char *obj)
 197 {
 198         FILE *fp = NULL;
 199         char *linebuf = NULL, *token = NULL, *token2, *tempstr = NULL;
 200         int ret = SECURITY_SERVER_ERROR_NO_SUCH_OBJECT, tmp_gid, bufsize;
 201
 202         SEC_SVR_DBG("Searching for object %s", obj);
 203
 204         fp = fopen("/etc/group", "r");
 205         if(fp == NULL)
 206         {
 207                 /* cannot open /etc/group */
 208                 SEC_SVR_DBG("%s", "cannot open /etc/group");
 209                 return SECURITY_SERVER_ERROR_FILE_OPERATION;
 210         }
 211
 212         linebuf = malloc(128);
 213         bufsize = 128;
 214         if(linebuf == NULL)
 215         {
 216                 ret = SECURITY_SERVER_ERROR_OUT_OF_MEMORY;
 217                 SEC_SVR_DBG("%s", "Out Of Memory");
 218                 goto error;
 219         }
 220
 221         bzero(linebuf, bufsize);
 222         while(fgets(linebuf, bufsize, fp) != NULL)
 223         {
 224                 while(linebuf[bufsize -2] != 0 )
 225                 {
 226                         linebuf[bufsize -1] = (char) fgetc(fp);
 227                         tempstr = realloc(linebuf, bufsize + 128);
 228                         if(tempstr == NULL)
 229                         {
 230                                 ret = SECURITY_SERVER_ERROR_OUT_OF_MEMORY;
 231                                 goto error;
 232                         }
 233                         linebuf = tempstr;
 234                         bzero(linebuf + bufsize, 128);
 235                         fgets(linebuf + bufsize, 128, fp);
 236                         bufsize += 128;
 237                 }
 238
 239                 token = strtok(linebuf, ":");   /* group name */
 240                 token2 = strtok(NULL, ":");     /* group password */
 241                 token2 = strtok(NULL, ":");     /* gid */
 242                 if(token2 == NULL)
 243                 {
 244                         SEC_SVR_DBG("/etc/group is not valid. cannot find gid: [%s]", linebuf);
 245                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 246                         goto error;
 247                 }
 248                 errno = 0;
 249                 tmp_gid = strtoul(token2, 0, 10);
 250                 if ( errno != 0 )
 251                 {
 252                         SEC_SVR_DBG("cannot change string to integer [%s]", token2);
 253                         ret = SECURITY_SERVER_ERROR_SERVER_ERROR;
 254                         goto error;
 255                 }
 256
 257                 if(strcmp(obj, token) == 0)
 258                 {
 259                         /* We found it */
 260                         ret = tmp_gid;
 261                         SEC_SVR_DBG("GID of %s is found: %d", obj, ret);
 262                         break;
 263                 }
 264                 bzero(linebuf, bufsize);
 265         }
 266
 267 error:
 268         if(linebuf != NULL)
 269                 free(linebuf);
 270         if(fp != NULL)
 271                 fclose(fp);
 272         return ret;
 273 }
 274
 275 /* Signal handler for processes */
 276 static void security_server_sig_child(int signo, siginfo_t *info, void *data)
 277 {
 278     int status;
 279     pid_t child_pid;
 280     pid_t child_pgid;
 281
 282     (void)signo;
 283     (void)data;
 284
 285     child_pgid = getpgid(info->si_pid);
 286     SEC_SVR_DBG("Signal handler: dead_pid=%d, pgid=%d",info->si_pid,child_pgid);
 287
 288     while ((child_pid = waitpid(-1, &status, WNOHANG)) > 0) {
 289         if(child_pid == child_pgid)
 290             killpg(child_pgid,SIGKILL);
 291     }
 292
 293     return;
 294 }
 295
 296 /* Execute a debugging tool by fork() and execve() */
 297 int execute_debug_tool(int argc, char *const *argv, int server_sockfd, int client_sockfd)
 298 {
 299     int ret, i;
 300     SEC_SVR_DBG("%s", "Executing tool");
 301
 302     (void)argc;
 303
 304     ret = fork();
 305     if(ret == 0)
 306     {
 307         close(client_sockfd);
 308         close(server_sockfd);
 309         setsid();
 310
 311         for(i=0;i<_NSIG;i++)
 312             signal(i, SIG_DFL);
 313
 314         ret = execv(argv[0], argv);
 315         if(ret == -1)
 316         {
 317             SEC_SVR_DBG("Error:Failed to execute [%d]", errno);
 318             exit(-1);
 319         }
 320     }
 321     if(ret < 0)
 322     {
 323         SEC_SVR_DBG("Error: Failed to fork [%d]", errno);
 324         return SECURITY_SERVER_ERROR_SERVER_ERROR;
 325     }
 326     return SECURITY_SERVER_SUCCESS;
 327 }
 328
 329 int process_cookie_request(int sockfd)
 330 {
 331         int retval, client_pid, client_uid;
 332         cookie_list *created_cookie = NULL;
 333
 334         /* Authenticate client */
 335         retval = authenticate_client_application(sockfd, &client_pid, &client_uid);
 336         if(retval != SECURITY_SERVER_SUCCESS)
 337         {
 338                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 339                 retval = send_generic_response(sockfd,
 340                                 SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
 341                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 342                 if(retval != SECURITY_SERVER_SUCCESS)
 343                 {
 344                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 345                 }
 346                 goto error;
 347         }
 348         /* If client application is root process, just respond default cookie */
 349     /*
 350         if( client_uid == 0)
 351         {
 352                 SEC_SVR_DBG("%s", "Requested application is a root process");
 353                 created_cookie = c_list;
 354                 if(c_list == NULL)
 355                 {
 356                         SEC_SVR_DBG("%s", "Cannot read default cookie");
 357                         goto error;
 358                 }
 359         }
 360         else
 361         {
 362     */
 363         //TODO: Remove above code if there will be no crashes without it
 364         //All process should be treaded the same
 365                 /* Create a new cookie. or find existing one */
 366                 pthread_mutex_lock(&cookie_mutex);
 367                 created_cookie = create_cookie_item(client_pid, sockfd, c_list);
 368                 pthread_mutex_unlock(&cookie_mutex);
 369                 if(created_cookie == NULL)
 370                 {
 371                         SEC_SVR_DBG("%s","Cannot create a cookie");
 372                         goto error;
 373                 }
 374
 375     //let others know if this cookie belongs to root process
 376     if(client_uid == 0)
 377         created_cookie->is_roots_process = 1;
 378     else
 379         created_cookie->is_roots_process = 0;
 380
 381         //}
 382         /* send cookie as response */
 383         retval = send_cookie(sockfd, created_cookie->cookie);
 384         if(retval != SECURITY_SERVER_SUCCESS)
 385         {
 386                 SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 387         }
 388         SEC_SVR_DBG("Server: Cookie created for client PID %d LABEL >%s<",
 389                     created_cookie->pid,
 390                     (created_cookie->smack_label)?(created_cookie->smack_label):"NULL");
 391
 392         SEC_SVR_DBG("%s", "Server: Cookie has been sent to client");
 393
 394 error:
 395         return retval;
 396 }
 397
 398 int process_check_privilege_request(int sockfd)
 399 {
 400         /* Authenticate client */
 401         int retval, client_pid, requested_privilege;
 402     int privileges[1];
 403         unsigned char requested_cookie[SECURITY_SERVER_COOKIE_LEN];
 404         cookie_list *search_result = NULL;
 405
 406         retval = authenticate_client_middleware(sockfd, &client_pid);
 407         if(retval != SECURITY_SERVER_SUCCESS)
 408         {
 409                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 410                 retval = send_generic_response(sockfd,
 411                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_RESPONSE,
 412                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 413                 if(retval != SECURITY_SERVER_SUCCESS)
 414                 {
 415                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 416                 }
 417                 goto error;;
 418         }
 419
 420         retval = recv_check_privilege_request(sockfd,
 421                                 requested_cookie, &requested_privilege);
 422         if(retval == SECURITY_SERVER_ERROR_RECV_FAILED)
 423         {
 424                 SEC_SVR_DBG("%s", "Receiving request failed");
 425                 retval = send_generic_response(sockfd,
 426                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_RESPONSE,
 427                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 428                 if(retval != SECURITY_SERVER_SUCCESS)
 429                 {
 430                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 431                 }
 432                 goto error;;
 433         }
 434
 435         if(requested_privilege < 1)
 436         {
 437                 SEC_SVR_DBG("Requiring bad privilege [%d]", requested_privilege);
 438                 retval = send_generic_response(sockfd,
 439                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_RESPONSE,
 440                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 441                 if(retval != SECURITY_SERVER_SUCCESS)
 442                 {
 443                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 444                 }
 445                 goto error;
 446         }
 447
 448         /* Search cookie list */
 449         pthread_mutex_lock(&cookie_mutex);
 450     privileges[0] = requested_privilege;
 451         search_result = search_cookie(c_list, requested_cookie, privileges, 1);
 452         pthread_mutex_unlock(&cookie_mutex);
 453         if(search_result != NULL)
 454         {
 455                 /* We found */
 456                 SEC_SVR_DBG("We found the cookie with %d privilege and pid:%d", requested_privilege, client_pid);
 457                 SEC_SVR_DBG("%s", "Cookie comparison succeeded. Access granted.");
 458                 retval = send_generic_response(sockfd,
 459                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_RESPONSE,
 460                                 SECURITY_SERVER_RETURN_CODE_ACCESS_GRANTED);
 461                 if(retval != SECURITY_SERVER_SUCCESS)
 462                 {
 463                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 464                 }
 465         }
 466         else
 467         {
 468                 /* It's not exist */
 469                 SEC_SVR_DBG("Could not find the cookie with %d privilege", requested_privilege);
 470                 retval = send_generic_response(sockfd,
 471                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_RESPONSE,
 472                                 SECURITY_SERVER_RETURN_CODE_ACCESS_DENIED);
 473                 if(retval != SECURITY_SERVER_SUCCESS)
 474                 {
 475                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 476                 }
 477         }
 478 error:
 479         return retval;
 480 }
 481
 482 int process_check_privilege_new_request(int sockfd)
 483 {
 484         /* Authenticate client */
 485         int retval, client_pid, requested_privilege;
 486         unsigned char requested_cookie[SECURITY_SERVER_COOKIE_LEN];
 487         cookie_list *search_result = NULL;
 488         char object_label[MAX_OBJECT_LABEL_LEN+1];
 489         char access_rights[MAX_MODE_STR_LEN+1];
 490
 491         retval = authenticate_client_middleware(sockfd, &client_pid);
 492         if(retval != SECURITY_SERVER_SUCCESS)
 493         {
 494                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 495                 retval = send_generic_response(sockfd,
 496                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_NEW_RESPONSE,
 497                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 498                 if(retval != SECURITY_SERVER_SUCCESS)
 499                 {
 500                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 501                 }
 502                 goto error;;
 503         }
 504
 505         retval = recv_check_privilege_new_request(
 506                      sockfd, requested_cookie, object_label, access_rights);
 507         if(retval == SECURITY_SERVER_ERROR_RECV_FAILED)
 508         {
 509                 SEC_SVR_DBG("%s", "Receiving request failed");
 510                 retval = send_generic_response(sockfd,
 511                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_NEW_RESPONSE,
 512                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 513                 if(retval != SECURITY_SERVER_SUCCESS)
 514                 {
 515                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 516                 }
 517                 goto error;;
 518         }
 519
 520         /* Search cookie list */
 521         pthread_mutex_lock(&cookie_mutex);
 522         search_result = search_cookie_new(c_list, requested_cookie, object_label, access_rights);
 523         pthread_mutex_unlock(&cookie_mutex);
 524
 525         if(search_result != NULL)
 526     {
 527                 /* We found */
 528                 SEC_SVR_DBG("We found the cookie with %s rights and pid:%d", access_rights, client_pid);
 529                 SEC_SVR_DBG("%s", "Cookie comparison succeeded. Access granted.");
 530                 retval = send_generic_response(sockfd,
 531                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_NEW_RESPONSE,
 532                                 SECURITY_SERVER_RETURN_CODE_ACCESS_GRANTED);
 533                 if(retval != SECURITY_SERVER_SUCCESS)
 534                 {
 535                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 536                 }
 537         }
 538         else
 539         {
 540                 /* It's not exist */
 541                 SEC_SVR_DBG("Could not find the cookie with %s rights", access_rights);
 542                 retval = send_generic_response(sockfd,
 543                                 SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_NEW_RESPONSE,
 544                                 SECURITY_SERVER_RETURN_CODE_ACCESS_DENIED);
 545                 if(retval != SECURITY_SERVER_SUCCESS)
 546                 {
 547                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 548                 }
 549         }
 550 error:
 551         return retval;
 552
 553
 554 }
 555
 556 int process_object_name_request(int sockfd)
 557 {
 558         int retval, client_pid, requested_privilege;
 559         char object_name[SECURITY_SERVER_MAX_OBJ_NAME];
 560
 561         /* Authenticate client */
 562         retval = authenticate_client_middleware(sockfd, &client_pid);
 563         if(retval != SECURITY_SERVER_SUCCESS)
 564         {
 565                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 566                 retval = send_generic_response(sockfd,
 567                                 SECURITY_SERVER_MSG_TYPE_OBJECT_NAME_RESPONSE,
 568                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 569                 if(retval != SECURITY_SERVER_SUCCESS)
 570                 {
 571                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 572                 }
 573                 goto error;
 574         }
 575
 576         /* Receive GID */
 577         retval = read(sockfd, &requested_privilege, sizeof(requested_privilege));
 578         if (retval < (int)sizeof(requested_privilege))
 579         {
 580                 SEC_SVR_DBG("%s", "Receiving request failed");
 581                 retval = send_generic_response(sockfd,
 582                                 SECURITY_SERVER_MSG_TYPE_OBJECT_NAME_RESPONSE,
 583                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 584                 if(retval != SECURITY_SERVER_SUCCESS)
 585                 {
 586                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 587                 }
 588                 goto error;
 589         }
 590
 591         /* Search from /etc/group */
 592         retval = search_object_name(requested_privilege,
 593                         object_name,
 594                         SECURITY_SERVER_MAX_OBJ_NAME);
 595         if (retval == SECURITY_SERVER_ERROR_NO_SUCH_OBJECT)
 596         {
 597                 /* It's not exist */
 598                 SEC_SVR_DBG("There is no such object for gid [%d]", requested_privilege);
 599                 retval = send_generic_response(sockfd,
 600                                 SECURITY_SERVER_MSG_TYPE_OBJECT_NAME_RESPONSE,
 601                                 SECURITY_SERVER_RETURN_CODE_NO_SUCH_OBJECT);
 602                 if(retval != SECURITY_SERVER_SUCCESS)
 603                 {
 604                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 605                 }
 606                 goto error;
 607         }
 608         if(retval != SECURITY_SERVER_SUCCESS)
 609         {
 610                 /* Error occurred */
 611                 SEC_SVR_DBG("Error on searching object name [%d]", retval);
 612                 retval = send_generic_response(sockfd,
 613                                 SECURITY_SERVER_MSG_TYPE_OBJECT_NAME_RESPONSE,
 614                                 SECURITY_SERVER_RETURN_CODE_SERVER_ERROR);
 615                 if(retval != SECURITY_SERVER_SUCCESS)
 616                 {
 617                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 618                 }
 619                 goto error;
 620         }
 621
 622         /* We found */
 623         SEC_SVR_DBG("We found object: %s", object_name);
 624         retval = send_object_name(sockfd, object_name);
 625         if(retval != SECURITY_SERVER_SUCCESS)
 626         {
 627                 SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 628         }
 629
 630 error:
 631         return retval;
 632 }
 633
 634 int process_gid_request(int sockfd, int msg_len)
 635 {
 636         int retval, client_pid;
 637         char object_name[SECURITY_SERVER_MAX_OBJ_NAME];
 638         /* Authenticate client as middleware daemon */
 639         retval = authenticate_client_middleware(sockfd, &client_pid);
 640         if(retval != SECURITY_SERVER_SUCCESS)
 641         {
 642                 SEC_SVR_DBG("%s", "Client authentication failed");
 643                 retval = send_generic_response(sockfd,
 644                                 SECURITY_SERVER_MSG_TYPE_GID_RESPONSE,
 645                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 646                 if(retval != SECURITY_SERVER_SUCCESS)
 647                 {
 648                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 649                 }
 650                 goto error;
 651         }
 652
 653         if(msg_len >= SECURITY_SERVER_MAX_OBJ_NAME)
 654         {
 655                 /* Too big ojbect name */
 656                 SEC_SVR_DBG("%s", "Object name is too big");
 657                 retval = send_generic_response(sockfd,
 658                                 SECURITY_SERVER_MSG_TYPE_GID_RESPONSE,
 659                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 660                 if(retval != SECURITY_SERVER_SUCCESS)
 661                 {
 662                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 663                 }
 664                 goto error;
 665         }
 666
 667         /* Receive group name */
 668         retval = read(sockfd, object_name, msg_len);
 669         if (retval < msg_len )
 670         {
 671                 SEC_SVR_DBG("%s", "Failed to read object name");
 672                 retval = send_generic_response(sockfd,
 673                                 SECURITY_SERVER_MSG_TYPE_GID_RESPONSE,
 674                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 675                 if(retval != SECURITY_SERVER_SUCCESS)
 676                 {
 677                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 678                 }
 679                 goto error;
 680         }
 681         object_name[msg_len] = 0;
 682
 683         /* Search /etc/group for the given group name */
 684         retval = search_gid(object_name);
 685         if (retval == SECURITY_SERVER_ERROR_NO_SUCH_OBJECT)
 686         {
 687                 /* Not exist */
 688                 SEC_SVR_DBG("The object [%s] is not exist", object_name);
 689                 retval = send_generic_response(sockfd,
 690                                 SECURITY_SERVER_MSG_TYPE_GID_RESPONSE,
 691                                 SECURITY_SERVER_RETURN_CODE_NO_SUCH_OBJECT);
 692                 if(retval != SECURITY_SERVER_SUCCESS)
 693                 {
 694                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 695                 }
 696                 goto error;
 697         }
 698
 699         if(retval < 0)
 700         {
 701                 /* Error occurred */
 702                 SEC_SVR_DBG("Cannot send the response. %d", retval);
 703                 retval = send_generic_response(sockfd,
 704                                 SECURITY_SERVER_MSG_TYPE_GID_RESPONSE,
 705                                 SECURITY_SERVER_RETURN_CODE_SERVER_ERROR);
 706                 if(retval != SECURITY_SERVER_SUCCESS)
 707                 {
 708                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 709                 }
 710
 711                 goto error;
 712         }
 713         /* We found */
 714         retval = send_gid(sockfd, retval);
 715         if(retval != SECURITY_SERVER_SUCCESS)
 716         {
 717                 SEC_SVR_DBG("ERROR: Cannot gid response: %d", retval);
 718         }
 719 error:
 720         return retval;
 721 }
 722
 723 int process_pid_request(int sockfd)
 724 {
 725         int retval, client_pid;
 726         unsigned char requested_cookie[SECURITY_SERVER_COOKIE_LEN];
 727     int * privileges = NULL;
 728         cookie_list *search_result = NULL;
 729
 730         /* Authenticate client */
 731         retval = authenticate_client_middleware(sockfd, &client_pid);
 732         if(retval != SECURITY_SERVER_SUCCESS)
 733         {
 734                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 735                 retval = send_generic_response(sockfd,
 736                                 SECURITY_SERVER_MSG_TYPE_PID_RESPONSE,
 737                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 738                 if(retval != SECURITY_SERVER_SUCCESS)
 739                 {
 740                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 741                 }
 742                 goto error;
 743         }
 744
 745         retval = recv_pid_request(sockfd, requested_cookie);
 746         if(retval == SECURITY_SERVER_ERROR_RECV_FAILED)
 747         {
 748                 SEC_SVR_DBG("%s", "Receiving request failed");
 749                 retval = send_generic_response(sockfd,
 750                                 SECURITY_SERVER_MSG_TYPE_PID_RESPONSE,
 751                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 752                 if(retval != SECURITY_SERVER_SUCCESS)
 753                 {
 754                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 755                 }
 756                 goto error;
 757         }
 758
 759     retval = get_client_gid_list(sockfd, &privileges);
 760     if(retval < 0)
 761     {
 762         SEC_SVR_DBG("ERROR: Cannot get GID list");
 763         goto error;
 764     }
 765
 766     /* Search cookie list */
 767     pthread_mutex_lock(&cookie_mutex);
 768     search_result = search_cookie(c_list, requested_cookie, privileges, retval);
 769     pthread_mutex_unlock(&cookie_mutex);
 770
 771     free(privileges);
 772
 773         if(search_result != NULL)
 774         {
 775                 /* We found */
 776                 SEC_SVR_DBG("We found the cookie and pid:%d", search_result->pid);
 777                 SEC_SVR_DBG("%s", "Cookie comparison succeeded. Access granted.");
 778                 retval = send_pid(sockfd, search_result->pid);
 779
 780                 if(retval != SECURITY_SERVER_SUCCESS)
 781                 {
 782                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 783                 }
 784         }
 785         else
 786         {
 787                 /* It's not exist */
 788                 SEC_SVR_DBG("%s", "Could not find the cookie");
 789                 retval = send_generic_response(sockfd,
 790                                 SECURITY_SERVER_MSG_TYPE_PID_RESPONSE,
 791                                 SECURITY_SERVER_RETURN_CODE_NO_SUCH_COOKIE);
 792                 if(retval != SECURITY_SERVER_SUCCESS)
 793                 {
 794                         SEC_SVR_DBG("ERROR: Cannot send pid response: %d", retval);
 795                 }
 796         }
 797 error:
 798         return retval;
 799 }
 800
 801 int process_smack_request(int sockfd)
 802 {
 803     int retval, client_pid;
 804     int * privileges = NULL;
 805     unsigned char requested_cookie[SECURITY_SERVER_COOKIE_LEN];
 806     cookie_list *search_result = NULL;
 807     //handler for SMACK label
 808     char * label = NULL;
 809     //buffer for storing file path
 810     const int BUFFSIZE = 30;
 811     char path[BUFFSIZE];
 812     int fd;
 813
 814         /* Authenticate client */
 815         retval = authenticate_client_middleware(sockfd, &client_pid);
 816         if(retval != SECURITY_SERVER_SUCCESS)
 817         {
 818                 SEC_SVR_DBG("%s", "Client Authentication Failed");
 819                 retval = send_generic_response(sockfd,
 820                                 SECURITY_SERVER_MSG_TYPE_SMACK_RESPONSE,
 821                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 822                 if(retval != SECURITY_SERVER_SUCCESS)
 823                 {
 824                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 825                 }
 826                 goto error;
 827         }
 828
 829     retval = recv_smack_request(sockfd, requested_cookie);
 830     if(retval == SECURITY_SERVER_ERROR_RECV_FAILED)
 831     {
 832         SEC_SVR_DBG("%s", "Receiving request failed");
 833         retval = send_generic_response(sockfd,
 834             SECURITY_SERVER_MSG_TYPE_SMACK_RESPONSE,
 835             SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 836         if(retval != SECURITY_SERVER_SUCCESS)
 837         {
 838             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 839         }
 840         goto error;
 841     }
 842
 843     retval = get_client_gid_list(sockfd, &privileges);
 844     if(retval < 0)
 845     {
 846         SEC_SVR_DBG("ERROR: Cannot get GID list");
 847         goto error;
 848     }
 849
 850     /* Search cookie list */
 851     pthread_mutex_lock(&cookie_mutex);
 852     search_result = search_cookie(c_list, requested_cookie, privileges, retval);
 853     pthread_mutex_unlock(&cookie_mutex);
 854
 855     free(privileges);
 856
 857     if(search_result != NULL)
 858     {
 859         /* We found */
 860         SEC_SVR_DBG("We found the cookie and pid:%d", search_result->pid);
 861         SEC_SVR_DBG("%s", "Cookie comparison succeeded. Access granted.");
 862
 863         //clearing buffer
 864         memset(path, 0x00, BUFFSIZE);
 865
 866         //preparing file path
 867         snprintf(path, BUFFSIZE, "/proc/%d/attr/current", search_result->pid);
 868         SEC_SVR_DBG("Path to file: %s\n", path);
 869
 870         //allocation place for label
 871         label = calloc(SMACK_LABEL_LEN, 1);
 872         if(NULL == label)
 873         {
 874             SEC_SVR_DBG("Client ERROR: Memory allocation error");
 875             goto error;
 876         }
 877
 878         //clearing buffer for label
 879         memset(label, 0x00, SMACK_LABEL_LEN);
 880
 881         //opening file /proc/<pid>/attr/curent with SMACK label
 882         fd = open(path, O_RDONLY);
 883         if(fd < 0)
 884         {
 885             SEC_SVR_DBG("Client ERROR: Unable to open file in /proc");
 886             goto error;
 887         }
 888
 889         //reading label from file, it is NOT NULL TERMINATED
 890         retval = read(fd, label, SMACK_LABEL_LEN);
 891         close(fd);
 892         if(retval < 0)
 893         {
 894             SEC_SVR_DBG("Client ERROR: Unable to read from file");
 895             goto error;
 896         }
 897
 898         SEC_SVR_DBG("Readed label is: %s\n", label);
 899
 900                 retval = send_smack(sockfd, label);
 901
 902                 if(retval != SECURITY_SERVER_SUCCESS)
 903                 {
 904                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 905                 }
 906         }
 907         else
 908         {
 909                 /* It's not exist */
 910                 SEC_SVR_DBG("%s", "Could not find the cookie");
 911                 retval = send_generic_response(sockfd,
 912                                 SECURITY_SERVER_MSG_TYPE_SMACK_RESPONSE,
 913                                 SECURITY_SERVER_RETURN_CODE_NO_SUCH_COOKIE);
 914                 if(retval != SECURITY_SERVER_SUCCESS)
 915                 {
 916                         SEC_SVR_DBG("ERROR: Cannot send SMACK label response: %d", retval);
 917                 }
 918         }
 919 error:
 920     if(NULL != label)
 921         free(label);
 922
 923         return retval;
 924 }
 925
 926 int process_tool_request(int client_sockfd, int server_sockfd)
 927 {
 928     int retval, argcnum = 0;
 929     char **recved_argv = NULL;
 930
 931     /* Authenticate client */
 932     retval = authenticate_developer_shell(client_sockfd);
 933     if(retval != SECURITY_SERVER_SUCCESS)
 934     {
 935         SEC_SVR_DBG("%s", "Client Authentication Failed");
 936         retval = send_generic_response(client_sockfd,
 937                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
 938                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
 939         if(retval != SECURITY_SERVER_SUCCESS)
 940         {
 941             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 942         }
 943         goto error;
 944     }
 945
 946     /* Receive Total number of argv */
 947     retval = TEMP_FAILURE_RETRY(read(client_sockfd, &argcnum, sizeof(int)));
 948     if((retval < (int)sizeof(int)) || argcnum > (UINT_MAX/sizeof(char *))-2 || argcnum < 0)
 949     {
 950         SEC_SVR_DBG("Error: argc recieve failed: %d", retval);
 951         retval = send_generic_response(client_sockfd,
 952                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
 953                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 954         if(retval != SECURITY_SERVER_SUCCESS)
 955         {
 956             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 957         }
 958         goto error;
 959     }
 960     argcnum += 2;
 961     recved_argv = (char **)malloc(sizeof(char *) * argcnum);
 962     if(recved_argv == NULL)
 963     {
 964         SEC_SVR_DBG("Error: malloc() failed: %d", retval);
 965         retval = send_generic_response(client_sockfd,
 966                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
 967                 SECURITY_SERVER_RETURN_CODE_SERVER_ERROR);
 968         if(retval != SECURITY_SERVER_SUCCESS)
 969         {
 970             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 971         }
 972         goto error;
 973     }
 974     memset(recved_argv, 0, sizeof(char *) * argcnum);
 975
 976     retval = recv_launch_tool_request(client_sockfd, argcnum-1, recved_argv);
 977     if(retval == SECURITY_SERVER_ERROR_RECV_FAILED || retval == SECURITY_SERVER_ERROR_OUT_OF_MEMORY)
 978     {
 979         SEC_SVR_DBG("%s", "Receiving request failed");
 980         retval = send_generic_response(client_sockfd,
 981                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
 982                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 983         if(retval != SECURITY_SERVER_SUCCESS)
 984         {
 985             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 986         }
 987         goto error;
 988     }
 989     if(argcnum < 2)
 990     {
 991         SEC_SVR_DBG("Error: Too small number of argv [%d]", argcnum);
 992         retval = send_generic_response(client_sockfd,
 993                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
 994                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
 995         if(retval != SECURITY_SERVER_SUCCESS)
 996         {
 997             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
 998         }
 999         goto error;
1000     }
1001     /* Execute the command */
1002     retval = execute_debug_tool(argcnum, recved_argv, server_sockfd, client_sockfd);
1003     if(retval != SECURITY_SERVER_SUCCESS)
1004     {
1005         SEC_SVR_DBG("Error: Cannot execute debug tool [%d]", retval);
1006         retval = send_generic_response(client_sockfd,
1007                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
1008                 SECURITY_SERVER_RETURN_CODE_SERVER_ERROR);
1009         if(retval != SECURITY_SERVER_SUCCESS)
1010         {
1011             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1012         }
1013     }
1014     else
1015     {
1016         SEC_SVR_DBG("%s", "Tool has been executed");
1017         retval = send_generic_response(client_sockfd,
1018                 SECURITY_SERVER_MSG_TYPE_TOOL_RESPONSE,
1019                 SECURITY_SERVER_RETURN_CODE_SUCCESS);
1020         if(retval != SECURITY_SERVER_SUCCESS)
1021         {
1022             SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1023         }
1024     }
1025 error:
1026     free_argv(recved_argv, argcnum);
1027     return retval;
1028 }
1029
1030 void *security_server_thread(void *param)
1031 {
1032         int client_sockfd = -1, client_uid, client_pid;
1033         int server_sockfd, retval, argcnum;
1034         basic_header basic_hdr;
1035         struct security_server_thread_param *my_param;
1036
1037         my_param = (struct security_server_thread_param *) param;
1038         client_sockfd = my_param->client_sockfd;
1039         server_sockfd = my_param->server_sockfd;
1040
1041         /* Receive request header */
1042         retval = recv_hdr(client_sockfd, &basic_hdr);
1043         if(retval == SECURITY_SERVER_ERROR_TIMEOUT || retval == SECURITY_SERVER_ERROR_RECV_FAILED
1044                 || retval == SECURITY_SERVER_ERROR_SOCKET)
1045         {
1046                 SEC_SVR_DBG("Receiving header error [%d]",retval);
1047                 close(client_sockfd);
1048                 client_sockfd = -1;
1049                 goto error;;
1050         }
1051
1052         if(retval != SECURITY_SERVER_SUCCESS)
1053         {
1054                 /* Response */
1055                 SEC_SVR_DBG("Receiving header error [%d]",retval);
1056                 retval = send_generic_response(client_sockfd,
1057                                 SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
1058                                 SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
1059                 if(retval != SECURITY_SERVER_SUCCESS)
1060                 {
1061                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1062                         goto error;
1063                 }
1064                 safe_server_sock_close(client_sockfd);
1065                 client_sockfd = -1;
1066                 goto error;
1067         }
1068
1069         /* Act different for request message ID */
1070         switch(basic_hdr.msg_id)
1071         {
1072                 case SECURITY_SERVER_MSG_TYPE_COOKIE_REQUEST:
1073                         SEC_SVR_DBG("%s", "Cookie request received");
1074                         process_cookie_request(client_sockfd);
1075                         break;
1076
1077                 case SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_REQUEST:
1078                         SEC_SVR_DBG("%s", "Privilege check received");
1079                         process_check_privilege_request(client_sockfd);
1080                         break;
1081
1082                 case SECURITY_SERVER_MSG_TYPE_CHECK_PRIVILEGE_NEW_REQUEST:
1083                         SEC_SVR_DBG("%s", "Privilege check (new mode) received");
1084                         process_check_privilege_new_request(client_sockfd);
1085                         break;
1086
1087                 case SECURITY_SERVER_MSG_TYPE_OBJECT_NAME_REQUEST:
1088                         SEC_SVR_DBG("%s", "Get object name request received");
1089                         process_object_name_request(client_sockfd);
1090                         break;
1091
1092                 case SECURITY_SERVER_MSG_TYPE_GID_REQUEST:
1093                         SEC_SVR_DBG("%s", "Get GID received");
1094                         process_gid_request(client_sockfd, (int)basic_hdr.msg_len);
1095                         break;
1096
1097                 case SECURITY_SERVER_MSG_TYPE_PID_REQUEST:
1098                         SEC_SVR_DBG("%s", "pid request received");
1099                         process_pid_request(client_sockfd);
1100                         break;
1101
1102                 case SECURITY_SERVER_MSG_TYPE_SMACK_REQUEST:
1103                         SEC_SVR_DBG("%s", "SMACK label request received");
1104                         process_smack_request(client_sockfd);
1105                         break;
1106
1107                 case SECURITY_SERVER_MSG_TYPE_TOOL_REQUEST:
1108                         SEC_SVR_DBG("%s", "launch tool request received");
1109                         process_tool_request(client_sockfd, server_sockfd);
1110                         break;
1111
1112                 case SECURITY_SERVER_MSG_TYPE_VALID_PWD_REQUEST:
1113                         SEC_SVR_DBG("%s", "Server: validate password request received");
1114                         process_valid_pwd_request(client_sockfd);
1115                         break;
1116
1117                 case SECURITY_SERVER_MSG_TYPE_SET_PWD_REQUEST:
1118                         SEC_SVR_DBG("%s", "Server: set password request received");
1119                         process_set_pwd_request(client_sockfd);
1120                         break;
1121
1122                 case SECURITY_SERVER_MSG_TYPE_RESET_PWD_REQUEST:
1123                         SEC_SVR_DBG("%s", "Server: reset password request received");
1124                         process_reset_pwd_request(client_sockfd);
1125                         break;
1126
1127                 case SECURITY_SERVER_MSG_TYPE_CHK_PWD_REQUEST:
1128                         SEC_SVR_DBG("%s", "Server: check password request received");
1129                         process_chk_pwd_request(client_sockfd);
1130                         break;
1131
1132                 case SECURITY_SERVER_MSG_TYPE_SET_PWD_HISTORY_REQUEST:
1133                         SEC_SVR_DBG("%s", "Server: set password histroy request received");
1134                         process_set_pwd_history_request(client_sockfd);
1135                         break;
1136
1137                 case SECURITY_SERVER_MSG_TYPE_SET_PWD_MAX_CHALLENGE_REQUEST:
1138                     SEC_SVR_DBG("%s", "Server: set password max challenge request received");
1139                     process_set_pwd_max_challenge_request(client_sockfd);
1140                     break;
1141
1142         case SECURITY_SERVER_MSG_TYPE_SET_PWD_VALIDITY_REQUEST:
1143             SEC_SVR_DBG("%s", "Server: set password validity request received");
1144             process_set_pwd_validity_request(client_sockfd);
1145             break;
1146
1147 /************************************************************************************************/
1148 /* Just for test. This code must be removed on release */
1149                 case SECURITY_SERVER_MSG_TYPE_GET_ALL_COOKIES_REQUEST:
1150                         SEC_SVR_DBG("%s", "all cookie info request received -- NEED TO BE DELETED ON RELEASE");
1151                         retval = authenticate_client_application(client_sockfd, &client_pid, &client_uid);
1152                         if(retval != SECURITY_SERVER_SUCCESS)
1153                         {
1154                                 SEC_SVR_DBG("%s", "Client Authentication Failed");
1155                                 retval = send_generic_response(client_sockfd,
1156                                                 SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
1157                                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
1158                                 if(retval != SECURITY_SERVER_SUCCESS)
1159                                 {
1160                                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1161                                 }
1162                                 break;
1163                         }
1164                         retval = util_process_all_cookie(client_sockfd, c_list);
1165                         if(retval != SECURITY_SERVER_SUCCESS)
1166                         {
1167                                 SEC_SVR_DBG("ERROR: Cannot send all cookie info: %d", retval);
1168                         }
1169                         break;
1170
1171                 case SECURITY_SERVER_MSG_TYPE_GET_COOKIEINFO_FROM_PID_REQUEST:
1172                         SEC_SVR_DBG("%s", "cookie info from pid request received -- NEED TO BE DELETED ON RELEASE");
1173                         if(retval != SECURITY_SERVER_SUCCESS)
1174                         {
1175                                 SEC_SVR_DBG("%s", "Client Authentication Failed");
1176                                 retval = send_generic_response(client_sockfd,
1177                                                 SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
1178                                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
1179                                 if(retval != SECURITY_SERVER_SUCCESS)
1180                                 {
1181                                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1182                                 }
1183                                 break;
1184                         }
1185                         util_process_cookie_from_pid(client_sockfd, c_list);
1186                         break;
1187
1188                 case SECURITY_SERVER_MSG_TYPE_GET_COOKIEINFO_FROM_COOKIE_REQUEST:
1189                         SEC_SVR_DBG("%s", "cookie info from cookie request received -- NEED TO BE DELETED ON RELEASE");
1190                         if(retval != SECURITY_SERVER_SUCCESS)
1191                         {
1192                                 SEC_SVR_DBG("%s", "Client Authentication Failed");
1193                                 retval = send_generic_response(client_sockfd,
1194                                                 SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
1195                                                 SECURITY_SERVER_RETURN_CODE_AUTHENTICATION_FAILED);
1196                                 if(retval != SECURITY_SERVER_SUCCESS)
1197                                 {
1198                                         SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1199                                 }
1200                                 break;
1201                         }
1202                         util_process_cookie_from_cookie(client_sockfd, c_list);
1203                         break;
1204 /************************************************************************************************/
1205
1206
1207                 default:
1208                         SEC_SVR_DBG("Unknown msg ID :%d", basic_hdr.msg_id);
1209                         /* Unknown message ID */
1210                         retval = send_generic_response(client_sockfd,
1211                         SECURITY_SERVER_MSG_TYPE_GENERIC_RESPONSE,
1212                         SECURITY_SERVER_RETURN_CODE_BAD_REQUEST);
1213                         if(retval != SECURITY_SERVER_SUCCESS)
1214                         {
1215                                 SEC_SVR_DBG("ERROR: Cannot send generic response: %d", retval);
1216                         }
1217                         break;
1218         }
1219
1220         if(client_sockfd > 0)
1221         {
1222                 safe_server_sock_close(client_sockfd);
1223                 client_sockfd = -1;
1224         }
1225
1226 error:
1227         if(client_sockfd > 0)
1228                 close(client_sockfd);
1229         thread_status[my_param->thread_status] = 0;
1230         pthread_detach(pthread_self());
1231         pthread_exit(NULL);
1232 }
1233
1234 void *security_server_main_thread(void *data)
1235 {
1236     int server_sockfd = 0, retval, client_sockfd = -1, rc;
1237     struct sigaction act, dummy;
1238     pthread_t threads[SECURITY_SERVER_NUM_THREADS];
1239     struct security_server_thread_param param[SECURITY_SERVER_NUM_THREADS];
1240
1241     (void)data;
1242
1243     SEC_SVR_DBG("%s", "Starting Security Server main thread");
1244
1245     /* security server must be executed by root */
1246     if(getuid() != 0)
1247     {
1248         fprintf(stderr, "%s\n", "You are not root. exiting...");
1249         goto error;
1250     }
1251
1252     for(retval = 0 ; retval < SECURITY_SERVER_NUM_THREADS; retval++)
1253         thread_status[retval] = 0;
1254     initiate_try();
1255
1256     /* Create and bind a Unix domain socket */
1257     retval = create_new_socket(&server_sockfd);
1258     if(retval != SECURITY_SERVER_SUCCESS)
1259     {
1260         SEC_SVR_DBG("%s", "cannot create socket. exiting...");
1261         goto error;
1262     }
1263
1264     if(listen(server_sockfd, 5) < 0)
1265     {
1266         SEC_SVR_DBG("%s", "listen() failed. exiting...");
1267         goto error;
1268     }
1269
1270     /* Create a default cookie --> Cookie for root process */
1271     c_list = create_default_cookie();
1272     if(c_list == NULL)
1273     {
1274         SEC_SVR_DBG("%s", "cannot make a default cookie. exiting...");
1275         goto error;
1276     }
1277
1278     /* Init signal handler */
1279     act.sa_handler = NULL;
1280     act.sa_sigaction = security_server_sig_child;
1281     sigemptyset(&act.sa_mask);
1282     act.sa_flags = SA_NOCLDSTOP | SA_SIGINFO;
1283
1284     if (sigaction(SIGCHLD, &act, &dummy) < 0)
1285     {
1286         SEC_SVR_DBG("%s", "cannot change session");
1287     }
1288
1289     pthread_mutex_init(&cookie_mutex, NULL);
1290
1291     while(1)
1292     {
1293         /* Accept a new client */
1294         if(client_sockfd < 0)
1295             client_sockfd = accept_client(server_sockfd);
1296
1297         if(client_sockfd == SECURITY_SERVER_ERROR_TIMEOUT)
1298             continue;
1299         if(client_sockfd < 0)
1300             goto error;
1301         SEC_SVR_DBG("Server: new connection has been accepted: %d", client_sockfd);
1302         retval = 0;
1303         while(1)
1304         {
1305             if(thread_status[retval] == 0)
1306             {
1307                 thread_status[retval] = 1;
1308                 param[retval].client_sockfd = client_sockfd;
1309                 param[retval].server_sockfd = server_sockfd;
1310                 param[retval].thread_status= retval;
1311                 SEC_SVR_DBG("Server: Creating a new thread: %d", retval);
1312                 rc =pthread_create(&threads[retval], NULL, security_server_thread, (void *)&param[retval]);
1313                 if (rc)
1314                 {
1315                     SEC_SVR_DBG("Error: Server: Cannot create thread:%d", rc);
1316                     goto error;
1317                 }
1318                 break;
1319             }
1320             retval++;
1321             if(retval >= SECURITY_SERVER_NUM_THREADS)
1322                 retval = 0;
1323         }
1324         client_sockfd = -1;
1325     }
1326 error:
1327     if(server_sockfd > 0)
1328         close(server_sockfd);
1329
1330     pthread_detach(pthread_self());
1331     pthread_exit(NULL);
1332 }
1333
1334 int main(int argc, char* argv[])
1335 {
1336     int res;
1337     pthread_t main_thread;
1338
1339     (void)argc;
1340     (void)argv;
1341
1342     res = pthread_create(&main_thread, NULL, security_server_main_thread, NULL);
1343     if (res == 0)
1344     {
1345         while (1)
1346             sleep(60);
1347     }
1348     else
1349     {
1350         SEC_SVR_DBG("Error: Server: Cannot create main security server thread: %d", res);
1351     }
1352     pthread_exit(NULL);
1353     return 0;
1354 }
1355