pegasus/src/Pegasus/Common/Executor.cpp - diff

Return to Executor.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/Executor.cpp between version 1.1.2.16 and 1.7

version 1.1.2.16, 2007/01/17 18:48:54

version 1.7, 2007/06/13 21:21:53

Line 33

#include <cstdio>

#include <cstdlib>

#include <cstring>

#include <Pegasus/Common/Config.h>

#if defined(PEGASUS_OS_TYPE_WINDOWS)

# include <windows.h>

#else

# include <Executor/Socket.h>

# include <sys/types.h>

# include <sys/socket.h>

# include <unistd.h>

# include <fcntl.h>

# include <sys/wait.h>

# include <unistd.h>

# include <sys/types.h>

# include <sys/time.h>

# include <sys/resource.h>

#endif

#include "Constants.h"

#if defined(PEGASUS_HAS_SIGNALS)

#include "Executor.h"

# include <sys/wait.h>

#include "Mutex.h"

#endif

#include "FileSystem.h"

#include "String.h"

#include <Pegasus/Common/Constants.h>

#include <Pegasus/Common/Mutex.h>

#include <Pegasus/Common/Once.h>

#include <Pegasus/Common/FileSystem.h>

#include <Pegasus/Common/String.h>

#include <Pegasus/Common/Tracer.h>

#include <Pegasus/Common/System.h>

#include <Pegasus/Common/Executor.h>

#include <Executor/Strlcpy.h>

#include <Executor/Strlcat.h>

#if defined(PEGASUS_ENABLE_PRIVILEGE_SEPARATION)

# include <Executor/Socket.h>

# include <Executor/Messages.h>

#endif

Line 100

Line 104

const char* path) = 0;

virtual int startProviderAgent(

const SessionKey& sessionKey,

const char* module,

int uid,

const String& pegasusHome,

int gid,

const String& userName,

int& pid,

SessionKey& providerAgentSessionKey,

AnonymousPipe*& readPipe,

AnonymousPipe*& writePipe) = 0;

virtual int daemonizeExecutor() = 0;

virtual int reapProviderAgent(

const SessionKey& sessionKey,

int pid) = 0;

virtual int authenticatePassword(

const char* username,

const char* password,

const char* password) = 0;

SessionKey& sessionKey) = 0;

virtual int validateUser(

const char* username) = 0;

virtual int challengeLocal(

const char* username,

char challenge[EXECUTOR_BUFFER_SIZE],

char challengeFilePath[EXECUTOR_BUFFER_SIZE]) = 0;

SessionKey& sessionKey) = 0;

virtual int authenticateLocal(

const SessionKey& sessionKey,

const char* challengeFilePath,

const char* challengeResponse) = 0;

const char* response) = 0;

virtual int newSessionKey(

const char username[EXECUTOR_BUFFER_SIZE],

SessionKey& sessionKey) = 0;

virtual int deleteSessionKey(

const SessionKey& sessionKey) = 0;

virtual int refreshPolicy() = 0;

};

////////////////////////////////////////////////////////////////////////////////

Line 204

Line 194

virtual int startProviderAgent(

const SessionKey& sessionKey,

const char* module,

int uid,

const String& pegasusHome,

int gid,

const String& userName,

int& pid,

SessionKey& providerAgentSessionKey,

AnonymousPipe*& readPipe,

AnonymousPipe*& writePipe)

{

#if !defined(PEGASUS_ENABLE_PRIVILEGE_SEPARATION)

#if defined(PEGASUS_OS_TYPE_WINDOWS)

AutoMutex autoMutex(_mutex);

Line 225

Line 215

// Create pipes. Export handles to string.

AnonymousPipe* pipeFromAgent = new AnonymousPipe();

AutoPtr<AnonymousPipe> pipeFromAgent(new AnonymousPipe());

AnonymousPipe* pipeToAgent = new AnonymousPipe();

AutoPtr<AnonymousPipe> pipeToAgent(new AnonymousPipe());

char readHandle[32];

char writeHandle[32];

Line 246

Line 236

// Build full path of "cimprovagt" program.

String path;

String path = FileSystem::getAbsolutePath(

pegasusHome.getCString(), PEGASUS_PROVIDER_AGENT_PROC_NAME);

if (_getProviderAgentPath(path) != 0)

{

delete pipeToAgent;

delete pipeFromAgent;

return -1;

}

// Format command line.

Line 279

Line 263

&siStartInfo, // STARTUPINFO

&piProcInfo)) // PROCESS_INFORMATION

{

delete pipeToAgent;

delete pipeFromAgent;

return -1;

}

Line 292

Line 274

pipeToAgent->closeReadHandle();

pipeFromAgent->closeWriteHandle();

readPipe = pipeFromAgent;

readPipe = pipeFromAgent.release();

writePipe = pipeToAgent;

writePipe = pipeToAgent.release();

return 0;

#elif defined(PEGASUS_OS_OS400)

// ATTN: no implementation for OS400.

return -1;

#else /* POSIX CASE FOLLOWS */

AutoMutex autoMutex(_mutex);

// Initialize output parameters in case of error.

providerAgentSessionKey.clear();

pid = -1;

readPipe = 0;

writePipe = 0;

Line 322

Line 298

{

// Resolve full path of "cimprovagt".

String path;

String path = FileSystem::getAbsolutePath(

pegasusHome.getCString(), PEGASUS_PROVIDER_AGENT_PROC_NAME);

if (_getProviderAgentPath(path) != 0)

# if !defined(PEGASUS_DISABLE_PROV_USERCTXT)

PEGASUS_UID_T newUid = (PEGASUS_UID_T)-1;

PEGASUS_GID_T newGid = (PEGASUS_GID_T)-1;

if (userName != System::getEffectiveUserName())

{

if (!System::lookupUserId(

userName.getCString(), newUid, newGid))

{

PEG_TRACE((TRC_DISCARDED_DATA, Tracer::LEVEL2,

"System::lookupUserId(%s) failed.",

(const char*)userName.getCString()));

return -1;

}

# endif /* !defined(PEGASUS_DISABLE_PROV_USERCTXT) */

// Create "to-agent" pipe:

Line 339

Line 332

// Fork process:

#if !defined(PEGASUS_OS_VMS)

# if defined(PEGASUS_OS_VMS)

pid = (int)vfork();

#else

pid = (int)fork();

Line 352

Line 345

if (pid == 0)

{

# if !defined(PEGASUS_OS_VMS)

// Close unused pipe descriptors:

close(to[1]);

close(from[0]);

#if !defined(PEGASUS_OS_VMS)

// Close unused descriptors. Leave stdin, stdout, stderr,

// and the child's pipe descriptors open.

Line 375

Line 368

#endif /* !defined(PEGASUS_OS_VMS) */

// Set uid and gid for the new provider agent process.

# if !defined(PEGASUS_DISABLE_PROV_USERCTXT)

if (uid != -1 && gid != -1)

// Set uid and gid for the new provider agent process.

{

if ((int)getgid() != gid)

{

// ATTN: log failure!

setgid(gid);

}

if ((int)getuid() != uid)

if (newUid != (PEGASUS_UID_T)-1 && newGid != (PEGASUS_GID_T)-1)

{

if (!System::changeUserContext_SingleThreaded(

userName.getCString(), newUid, newGid))

{

// ATTN: log failure!

return -1;

setuid(uid);

}

Line 405

Line 392

{

CString cstr = path.getCString();

execl(cstr, cstr, arg1, arg2, module, (char*)0);

if (execl(cstr, cstr, arg1, arg2, module, (char*)0) == -1)

{

PEG_TRACE((TRC_DISCARDED_DATA, Tracer::LEVEL2,

"execl() failed. errno = %d.", errno));

_exit(1);

}

// ATTN: log failure!

}

while (0);

Line 437

Line 426

return 0;

#endif /* !defined(START_PROVIDER_AGENT) */

# endif /* POSIX CASE */

#else /* PEGASUS_ENABLE_PRIVILEGE_SEPARATION is defined */

// Out-of-Process providers are never started by the cimserver process

// when Privilege Separation is enabled.

return -1;

#endif

}

virtual int daemonizeExecutor()

Line 446

Line 443

}

virtual int reapProviderAgent(

const SessionKey& sessionKey,

int pid)

{

int status;

#if !defined(PEGASUS_ENABLE_PRIVILEGE_SEPARATION)

int status = 0;

# if defined(PEGASUS_HAS_SIGNALS)

while ((status = waitpid(pid, 0, 0)) == -1 && errno == EINTR)

;

# endif

return status;

#else /* PEGASUS_ENABLE_PRIVILEGE_SEPARATION is defined */

// Out-of-Process providers are never started by the cimserver process

// when Privilege Separation is enabled.

return -1;

#endif

}

virtual int authenticatePassword(

const char* username,

const char* password,

const char* password)

SessionKey& sessionKey)

{

sessionKey.clear();

#if defined(PEGASUS_PAM_AUTHENTICATION)

return PAMAuthenticate(username, password);

#else

// ATTN: not handled so don't call in this case.

sessionKey.clear();

return -1;

#endif

}

Line 486

Line 490

virtual int challengeLocal(

const char* username,

char challenge[EXECUTOR_BUFFER_SIZE],

char challengeFilePath[EXECUTOR_BUFFER_SIZE])

SessionKey& sessionKey)

{

// ATTN: not handled so don't call in this case.

sessionKey.clear();

return -1;

}

virtual int authenticateLocal(

const SessionKey& sessionKey,

const char* challengeFilePath,

const char* challengeResponse)

const char* response)

{

// ATTN: not handled so don't call in this case.

return -1;

}

virtual int newSessionKey(

const char username[EXECUTOR_BUFFER_SIZE],

SessionKey& sessionKey)

{

sessionKey.clear();

return -1;

}

virtual int deleteSessionKey(

const SessionKey& sessionKey)

{

return -1;

}

virtual int refreshPolicy()

{

return -1;

}

private:

static int _getProviderAgentPath(String& path)

{

path = PEGASUS_PROVIDER_AGENT_PROC_NAME;

if (path[0] != '/')

{

const char* env = getenv("PEGASUS_HOME");

if (!env)

return -1;

path = String(env) + String("/") + path;

}

return 0;

}

Mutex _mutex;

};

Line 717

Line 683

}

virtual int startProviderAgent(

const SessionKey& sessionKey,

const char* module,

int uid,

const String& pegasusHome,

int gid,

const String& userName,

int& pid,

SessionKey& providerAgentSessionKey,

AnonymousPipe*& readPipe,

AnonymousPipe*& writePipe)

{

AutoMutex autoMutex(_mutex);

providerAgentSessionKey.clear();

readPipe = 0;

writePipe = 0;

// Reject strings longer than EXECUTOR_BUFFER_SIZE.

size_t n = strlen(module);

size_t moduleNameLength = strlen(module);

if (moduleNameLength >= EXECUTOR_BUFFER_SIZE)

return -1;

CString userNameCString = userName.getCString();

size_t userNameLength = strlen(userNameCString);

if (n >= EXECUTOR_BUFFER_SIZE)

if (userNameLength >= EXECUTOR_BUFFER_SIZE)

return -1;

// _send request header:

Line 751

Line 720

ExecutorStartProviderAgentRequest request;

memset(&request, 0, sizeof(request));

Strlcpy(request.key, sessionKey.data(), sizeof(request.key));

memcpy(request.module, module, moduleNameLength);

memcpy(request.module, module, n);

memcpy(request.userName, userNameCString, userNameLength);

request.uid = uid;

request.gid = gid;

if (_send(_sock, &request, sizeof(request)) != sizeof(request))

return -1;

Line 766

Line 733

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

// Get the session key.

Strlcpy((char*)providerAgentSessionKey.data(),

response.key, providerAgentSessionKey.size());

// Check response status and pid.

if (response.status != 0)

Line 828

Line 790

}

virtual int reapProviderAgent(

const SessionKey& sessionKey,

int pid)

{

AutoMutex autoMutex(_mutex);

Line 845

Line 806

ExecutorReapProviderAgentRequest request;

memset(&request, 0, sizeof(request));

Strlcpy(request.key, sessionKey.data(), sizeof(request.key));

request.pid = pid;

if (_send(_sock, &request, sizeof(request)) != sizeof(request))

Line 863

Line 823

virtual int authenticatePassword(

const char* username,

const char* password,

const char* password)

SessionKey& sessionKey)

{

AutoMutex autoMutex(_mutex);

sessionKey.clear();

// _send request header:

ExecutorRequestHeader header;

Line 895

Line 852

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

Strlcpy((char*)sessionKey.data(), response.key, sessionKey.size());

return response.status;

}

Line 934

Line 889

virtual int challengeLocal(

const char* username,

char challenge[EXECUTOR_BUFFER_SIZE],

char challengeFilePath[EXECUTOR_BUFFER_SIZE])

SessionKey& sessionKey)

{

AutoMutex autoMutex(_mutex);

sessionKey.clear();

// _send request header:

ExecutorRequestHeader header;

Line 965

Line 917

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

Strlcpy((char*)sessionKey.data(), response.key, sessionKey.size());

Strlcpy(challengeFilePath, response.challenge, EXECUTOR_BUFFER_SIZE);

Strlcpy(challenge, response.challenge, EXECUTOR_BUFFER_SIZE);

return response.status;

}

virtual int authenticateLocal(

const SessionKey& sessionKey,

const char* challengeFilePath,

const char* challengeResponse)

const char* response)

{

AutoMutex autoMutex(_mutex);

Line 989

Line 940

ExecutorAuthenticateLocalRequest request;

memset(&request, 0, sizeof(request));

Strlcpy(request.key, (char*)sessionKey.data(), EXECUTOR_BUFFER_SIZE);

Strlcpy(request.challenge, challengeFilePath, EXECUTOR_BUFFER_SIZE);

Strlcpy(request.token, challengeResponse, EXECUTOR_BUFFER_SIZE);

Strlcpy(request.response, response, EXECUTOR_BUFFER_SIZE);

if (_send(_sock, &request, sizeof(request)) != sizeof(request))

return -1;

// Receive the response

ExecutorAuthenticateLocalResponse response;

ExecutorAuthenticateLocalResponse response_;

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

if (_recv(_sock, &response_, sizeof(response_)) != sizeof(response_))

return -1;

return response.status;

}

virtual int newSessionKey(

const char username[EXECUTOR_BUFFER_SIZE],

SessionKey& sessionKey)

{

AutoMutex autoMutex(_mutex);

sessionKey.clear();

// _send request header:

ExecutorRequestHeader header;

header.code = EXECUTOR_NEW_SESSION_KEY_MESSAGE;

if (_send(_sock, &header, sizeof(header)) != sizeof(header))

return -1;

// _send request body.

ExecutorNewSessionKeyRequest request;

memset(&request, 0, sizeof(request));

Strlcpy(request.username, username, sizeof(request.username));

if (_send(_sock, &request, sizeof(request)) != sizeof(request))

return -1;

// Receive the response

ExecutorNewSessionKeyResponse response;

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

Strlcpy((char*)sessionKey.data(), response.key, sessionKey.size());

return response.status;

}

virtual int deleteSessionKey(

const SessionKey& sessionKey)

{

AutoMutex autoMutex(_mutex);

// Send request header:

ExecutorRequestHeader header;

header.code = EXECUTOR_DELETE_SESSION_KEY_MESSAGE;

if (_send(_sock, &header, sizeof(header)) != sizeof(header))

return -1;

// Send request body.

ExecutorDeleteSessionKeyRequest request;

memset(&request, 0, sizeof(request));

Strlcpy(request.key, sessionKey.data(), sizeof(request.key));

if (_send(_sock, &request, sizeof(request)) != sizeof(request))

return -1;

// Receive the response

ExecutorDeleteSessionKeyResponse response;

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

return response.status;

return response_.status;

}

virtual int refreshPolicy()

{

AutoMutex autoMutex(_mutex);

// _send request header:

ExecutorRequestHeader header;

header.code = EXECUTOR_REFRESH_POLICY_MESSAGE;

if (_send(_sock, &header, sizeof(header)) != sizeof(header))

return -1;

// Receive the response

ExecutorRefreshPolicyResponse response;

if (_recv(_sock, &response, sizeof(response)) != sizeof(response))

return -1;

return response.status;

}

private:

Line 1160

Line 1020

////////////////////////////////////////////////////////////////////////////////

static int _sock = -1;

static int _executorSock = -1;

static ExecutorImpl* _impl = 0;

static AutoPtr<ExecutorImpl> _executorImpl;

static Mutex _mutex;

static Once _executorImplOnce = PEGASUS_ONCE_INITIALIZER;

static ExecutorImpl* _getImpl()

static void _initExecutorImpl()

{

// Use the double-checked locking technique to avoid the overhead of a lock

// on every call.

if (_impl == 0)

{

_mutex.lock();

if (_impl == 0)

{

#if defined(PEGASUS_ENABLE_PRIVILEGE_SEPARATION)

if (_sock == -1)

if (_executorSock == -1)

_impl = new ExecutorLoopbackImpl();

_executorImpl.reset(new ExecutorLoopbackImpl());

else

_impl = new ExecutorSocketImpl(_sock);

_executorImpl.reset(new ExecutorSocketImpl(_executorSock));

#else

_impl = new ExecutorLoopbackImpl();

_executorImpl.reset(new ExecutorLoopbackImpl());

#endif

}

_mutex.unlock();

}

return _impl;

}

void Executor::setSock(int sock)

{

_mutex.lock();

_executorSock = sock;

_sock = sock;

_mutex.unlock();

}

int Executor::detectExecutor()

{

return _getImpl()->detectExecutor();

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->detectExecutor();

}

int Executor::ping()

{

return _getImpl()->ping();

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->ping();

}

FILE* Executor::openFile(

const char* path,

int mode)

{

return _getImpl()->openFile(path, mode);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->openFile(path, mode);

}

int Executor::renameFile(

const char* oldPath,

const char* newPath)

{

return _getImpl()->renameFile(oldPath, newPath);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->renameFile(oldPath, newPath);

}

int Executor::removeFile(

const char* path)

{

return _getImpl()->removeFile(path);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->removeFile(path);

}

int Executor::startProviderAgent(

const SessionKey& sessionKey,

const char* module,

int uid,

const String& pegasusHome,

int gid,

const String& userName,

int& pid,

SessionKey& providerAgentSessionKey,

AnonymousPipe*& readPipe,

AnonymousPipe*& writePipe)

{

return _getImpl()->startProviderAgent(sessionKey, module,

once(&_executorImplOnce, _initExecutorImpl);

uid, gid, pid, providerAgentSessionKey, readPipe, writePipe);

return _executorImpl->startProviderAgent(

module, pegasusHome, userName, pid, readPipe, writePipe);

}

int Executor::daemonizeExecutor()

{

return _getImpl()->daemonizeExecutor();

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->daemonizeExecutor();

}

int Executor::reapProviderAgent(

const SessionKey& sessionKey,

int pid)

{

return _getImpl()->reapProviderAgent(sessionKey, pid);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->reapProviderAgent(pid);

}

int Executor::authenticatePassword(

const char* username,

const char* password,

const char* password)

SessionKey& sessionKey)

{

return _getImpl()->authenticatePassword(username, password, sessionKey);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->authenticatePassword(username, password);

}

int Executor::validateUser(

const char* username)

{

return _getImpl()->validateUser(username);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->validateUser(username);

}

int Executor::challengeLocal(

const char* user,

char path[EXECUTOR_BUFFER_SIZE],

char challengeFilePath[EXECUTOR_BUFFER_SIZE])

SessionKey& sessionKey)

{

return _getImpl()->challengeLocal(user, path, sessionKey);

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->challengeLocal(user, challengeFilePath);

}

int Executor::authenticateLocal(

const SessionKey& sessionKey,

const char* challengeFilePath,

const char* challengeResponse)

const char* response)

{

return _getImpl()->authenticateLocal(sessionKey, challengeResponse);

}

int Executor::newSessionKey(

const char username[EXECUTOR_BUFFER_SIZE],

SessionKey& sessionKey)

{

return _getImpl()->newSessionKey(username, sessionKey);

}

int Executor::deleteSessionKey(

const SessionKey& sessionKey)

{

return _getImpl()->deleteSessionKey(sessionKey);

}

int Executor::refreshPolicy()

{

return _getImpl()->refreshPolicy();

once(&_executorImplOnce, _initExecutorImpl);

return _executorImpl->authenticateLocal(challengeFilePath, response);

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.1.2.16
changed lines
	Added in v.1.7

No CVS admin address has been configured