./PaxHeaders.13361/globus_gatekeeper-10.10 0000644 0000000 0000000 00000000132 12510562675 015025 x ustar 00 30 mtime=1428350397.492851642
30 atime=1428350397.615851642
30 ctime=1428350397.492851642
globus_gatekeeper-10.10/ 0000775 0001750 0001750 00000000000 12510562675 015777 5 ustar 00fedora fedora 0000000 0000000 globus_gatekeeper-10.10/PaxHeaders.13361/manual.xml 0000644 0000000 0000000 00000000132 12510554047 016736 x ustar 00 30 mtime=1428346919.251851642
30 atime=1428346919.251851642
30 ctime=1428350397.339851642
globus_gatekeeper-10.10/manual.xml 0000664 0001750 0001750 00000002513 12510554047 017771 0 ustar 00fedora fedora 0000000 0000000
]
>
Globus Toolkit
globus_gatekeeper-10.10/PaxHeaders.13361/globus_gatekeeper_utils.c 0000644 0000000 0000000 00000000132 12510554047 022012 x ustar 00 30 mtime=1428346919.236851642
30 atime=1428346919.236851642
30 ctime=1428350397.310851642
globus_gatekeeper-10.10/globus_gatekeeper_utils.c 0000664 0001750 0001750 00000023170 12510554047 023047 0 ustar 00fedora fedora 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/******************************************************************************
globus_gatekeeper_utils.c
Description:
Some common routines used by globus_gatekeeper
and globus_gram_k5.c
CVS Information:
$Source$
$Date$
$Revision$
$Author$
******************************************************************************/
/*****************************************************************************
Include header files
******************************************************************************/
#include "globus_config.h"
#include "globus_gatekeeper_config.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
#ifdef HAVE_MALLOC_H
# include
#endif
#include "globus_gatekeeper_utils.h"
/******************************************************************************
Type definitions
******************************************************************************/
/******************************************************************************
Module specific prototypes
******************************************************************************/
static
char * fgetscont(char *line, int size, FILE* fd);
/******************************************************************************
Define module specific variables
******************************************************************************/
static
char * fgetscont(char * line, int size, FILE* fd)
{
int i;
int len;
char * cp;
i = 2;
len = size;
cp = line;
*cp = '\0';
while(fgets(cp, len, fd) &&
(i = strlen(line)) > 2 &&
line[i-1] == '\n' && line[i-2] == '\\') {
len = size - i - 2;
cp = line + i - 2;
}
if (*cp == '\0') {
return NULL;
}
return line;
}
/******************************************************************************
Function: globus_gatekeeper_util_globusxmap()
Description:
Given a index, find the command to be issued. For example
this could be a service name, or a globusID, or K5 principal
Parameters:
index
A pointer to a char *. will strdup with command
Returns:
******************************************************************************/
int
globus_gatekeeper_util_globusxmap( char * filename, char * index, char ** command)
{
FILE * fd;
int rc;
int i;
int offset;
char f_index[256];
char line[4096];
*command = NULL;
if ((fd = fopen(filename, "r")) != NULL) {
while(fgetscont(line, sizeof(line), fd)) {
i = strlen(line);
if (line[0] != '#') { /* comment line */
if (line[i - 1] == '\n') {
line[i - 1] = '\0';
}
if (!index)
{
*command = strdup(line);
fclose(fd);
return(0);
}
rc = sscanf(line, " \"%255[^\"]%*c%n %n",
f_index, &offset, &offset);
if (rc != 1) {
rc = sscanf(line, "%255s%n %n",
f_index, &offset, &offset);
}
if (rc == 1) {
if (!strcmp(index, f_index)) {
*command = strdup(&line[offset]);
fclose(fd);
return(0);
}
}
}
}
fclose(fd);
return(-1); /* not found */
}
return(-2); /* open failed */
}
/******************************************************************************
Function: globus_gatekeeper_util_tokenize()
Description:
Breakup the command in to args, pointing the args array
at the tokens. Replace white space at the end of each
token with a null. A token maybe in quotes.
Parameters:
The command line to be parsed.
A pointer to an array of pointers to be filled it
Size of the array, on input, and set to size used on output.
Returns:
0 on success.
-1 on to malloc
-2 on to many args
-3 on quote not matched
******************************************************************************/
int
globus_gatekeeper_util_tokenize(char * command,
char ** args,
int * n,
char * sep)
{
int i;
char * cp;
char * pp;
char * qp;
char ** arg;
arg = args;
i = *n - 1;
cp = command;
while (*cp)
{
/* skip leading sep characters */
while (*cp && strchr(sep, *cp))
{
cp++;
}
pp = NULL;
if (*cp == '\"')
{
cp++;
pp = cp;
if ((qp = strchr(cp,'\"')) == NULL)
{
return -3;
}
cp = qp + 1;
}
else if (*cp)
{
pp = cp;
if ((qp = strpbrk(cp,sep)) == NULL)
{
qp = strchr(cp,'\0');
}
cp = qp;
}
if (pp)
{
*arg = (char*)malloc((qp - pp) + 1);
if (*arg == NULL)
{
return -1;
}
memcpy(*arg,pp,qp - pp);
*(*arg + (qp - pp)) = '\0';
i--;
if (i == 0)
return(-2); /* to many args */
arg++;
}
}
*arg = (char *) 0;
*n = *n - i - 1;
return(0);
}
/******************************************************************************
Function: globus_gatekeeper_util_envsub()
Description:
Substitute from environment string like ${text}
into arg. arg will be freed and copied.
Recursion is allowed.
Parameters:
arg a pointer to the string pointer.
Returns:
0 on success.
-1 on malloc
-3 on env string not found
******************************************************************************/
int
globus_gatekeeper_util_envsub(char ** arg)
{
char * cp;
char * pp;
char * qp;
char * rp;
char * narg;
cp = *arg;
while ((pp = strstr(cp,"${"))) /* for editor matching } */
{
pp+=2;
/* for editor matching { */
if(!(qp = strstr(pp,"}")))
{
return -2; /* not terminated */
}
*(pp-2) = '\0'; /* term the prefix */
*qp = '\0'; /* term the env name */
qp++;
if (!(rp = getenv(pp)))
{
return -3;
}
if (!(narg = (char *)malloc(strlen(cp) +
strlen(rp) +
strlen(qp) + 1)))
{
return -1;
}
strcpy(narg,cp);
strcat(narg,rp);
strcat(narg,qp);
free(cp);
cp = narg;
*arg = cp;
}
return 0;
}
/******************************************************************************
Function: globus_gatekeeper_util_exec()
Description:
Parameters:
Returns:
******************************************************************************/
int
globus_gatekeeper_util_exec(char *args[],
struct passwd *pw,
char * user,
char **errmsgp)
{
int pid;
int err;
int rc;
char *path;
char * cp;
#define WAIT_USES_INT
#ifdef WAIT_USES_INT
int wait_status;
#else /* WAIT_USES_INT */
union wait wait_status;
#endif /* WAIT_USES_INT */
pid = fork();
if (pid <0)
return(-1);
if (pid == 0) { /* child process */
/* If need to run child as user */
if (pw != NULL) {
if ((rc = globus_gatekeeper_util_trans_to_user(pw, user, errmsgp)) != 0) {
/* child failed to transfer to user context */
fprintf(stderr,"Failed trying to run as user %s: %s\n",
user, *errmsgp);
exit(126);
}
}
path = strdup(args[0]);
cp = strrchr(path, '/');
if (cp)
cp++;
else
cp = path;
args[0] = cp;
#ifdef DEBUG
fprintf(stderr,"EXECING %s args=",path);
{
int n = 0;
while (args[n]) {
fprintf (stderr," %s \n",args[n]);
n++;
}
fprintf(stderr,"\n");
}
#endif
execv(path, args);
fprintf(stderr,"Failed to exec the child\n");
exit(127); /* in case execl fails */
}
/* parent, wait for child to finish */
wait_status = 0;
#ifdef HAVE_WAITPID
err = waitpid((pid_t) pid, &wait_status, 0);
#else /* HAVE_WAITPID */
err = wait4(pid, &wait_status, 0, (struct rusage *) NULL);
#endif /* HAVE_WAITPID */
/* if it worked or failed, continue on. */
return(wait_status);
}
/******************************************************************************
Function: globus_gatekeeper_util_trans_to_user()
Description:
Transition the process from root to the user,
doing all the operating system specific stuff.
Parameters:
Returns:
0 if OK
<0 if errno is set;
>0 if some other error.
1 if not root
DEE needs work
******************************************************************************/
int
globus_gatekeeper_util_trans_to_user(struct passwd * pw,
char * userid,
char ** errmsg)
{
uid_t myuid;
/* must be root to use this */
if ((myuid = getuid()) != 0)
{
if (myuid == pw->pw_uid)
return 0; /* already running as the user */
else
*errmsg = strdup("Can not run as another user");
return 1; /* can't run as another user */
}
/*
*DEE If we are root and want to run as root, should we continue
* here or just exit? Some logging might be usefull.
*/
setgid(pw->pw_gid);
initgroups(pw->pw_name, pw->pw_gid);
# if defined(__hpux)
{
if (setresuid(pw->pw_uid, pw->pw_uid, -1) != 0)
{
*errmsg = strdup("cannot setresuid");
return -2;
}
}
# elif defined(TARGET_ARCH_SOLARIS) || \
defined(TARGET_ARCH_BSD) || \
defined(TARGET_ARCH_CYGWIN)
{
if (setuid(pw->pw_uid) != 0)
{
*errmsg = strdup("cannot setuid");
return -3;
}
}
# else
{
if (seteuid(0) != 0)
{
*errmsg = strdup("cannot seteuid");
return -4;
}
if (setreuid(pw->pw_uid, pw->pw_uid) != 0)
{
*errmsg = strdup("cannot setreuid");
return -5;
}
}
# endif
return 0;
}
globus_gatekeeper-10.10/PaxHeaders.13361/globus-k5.8 0000644 0000000 0000000 00000000132 12510554047 016640 x ustar 00 30 mtime=1428346919.234851642
30 atime=1428346919.234851642
30 ctime=1428350397.328851642
globus_gatekeeper-10.10/globus-k5.8 0000664 0001750 0001750 00000005600 12510554047 017673 0 ustar 00fedora fedora 0000000 0000000 '\" t
.\" Title: globus-k5
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.75.2
.\" Date: 01/06/2012
.\" Manual: Globus Toolkit
.\" Source: University of Chicago
.\" Language: English
.\"
.TH "GLOBUS\-K5" "8" "01/06/2012" "University of Chicago" "Globus Toolkit"
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
globus-k5 \- Acquire Kerberos Credentials for use with Grid Services
.SH "SYNOPSIS"
.HP \w'\fBglobus\-k5\fR\ 'u
\fBglobus\-k5\fR \fISERVICE\-COMMAND\fR [\fISERVICE\-ARGS\fR...]
.SH "DESCRIPTION"
.PP
The
\fBglobus\-k5\fR
program is an authorization module used by the
\fBglobus\-gatekeeper\fR
program to acquire Kerberos 5 Credentials prior to executing a Grid Service\&. This may be accomplished by running
\fBkinit\fR
with a password stored in the
globuskmap
file, using the NCSA
\fBkrb525\fR
command, or the
\fBsslk5\fR
command to use the X509 user proxy\&.
.PP
The arguments passed to
\fBglobus\-k5\fR
will not be used by it, but will be passed onto the job manager\&. The first parameter must be the path to the Grid Service\&.
.PP
It is expected that the environment will contain the variables
\fBGLOBUSID\fR
and
\fBUSER\fR
for the Grid and local POSIX user identities\&. This program is normally run as root, and will call seteuid() prior to executing the Grid Service\&.
.PP
The parameters to use and the mapping for the globus to K5 user are located in the
globuskmap
file\&.
.SH "FORMAT OF THE GLOBUSKMAP FILE"
.PP
The globuskmap file is a line\-oriented file which each line containing a command to run to acquire Kerberos 5 credentials for a Grid identity\&. Each line consists of an optionally\-quoted
\fIGLOBUSID\fR
value followed by a command\-line for running a process to acquire a Kerberos credential\&. For example:
.sp
.if n \{\
.RS 4
.\}
.nf
"/O=Example/OU=Grid/CN=Joe User" /usr/afsws/bin/klog \-principal juser \-password mypasswd \-cell infn\&.it
.fi
.if n \{\
.RE
.\}
.sp
.SH "ENVIRONMENT"
.PP
If the following variables affect the execution of
\fBglobus\-k5\fR:
.PP
GLOBUSKMAP
.RS 4
Path to the globuskmap file\&.
.RE
.PP
USER
.RS 4
POSIX username that the service will run as\&.
.RE
.PP
KRB5CCNAME
.RS 4
Path to a Kerberos credential cache\&.
.RE
.PP
GLOBUS_ID
.RS 4
Grid identity to generate Kerberos credentials for\&.
.RE
.SH "FILES"
.PP
.PP
/etc/globuskmap
.RS 4
Default file mapping Grid identities to Kerberos 5 principals\&.
.RE
.SH "SEE ALSO"
.PP
\fBglobus-k5\fR(8),
\fBglobus-job-manager\fR(8)
globus_gatekeeper-10.10/PaxHeaders.13361/globus_gatekeeper_utils.h 0000644 0000000 0000000 00000000132 12510554047 022017 x ustar 00 30 mtime=1428346919.237851642
30 atime=1428346919.236851642
30 ctime=1428350397.307851642
globus_gatekeeper-10.10/globus_gatekeeper_utils.h 0000664 0001750 0001750 00000003040 12510554047 023046 0 ustar 00fedora fedora 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/******************************************************************************
globus_gatekeeper_utils.h
Description:
Header file for some common gatekeeper routines
CVS Information:
$Source$
$Date$
$Revision$
$Author$
******************************************************************************/
#ifndef GLOBUS_GATEKEEPER_UTILS_H
#define GLOBUS_GATEKEEPER_UTILS_H
int
globus_gatekeeper_util_globusxmap(
char * file,
char * index,
char ** params);
int
globus_gatekeeper_util_tokenize(
char * command,
char ** args,
int * n,
char * sep);
int
globus_gatekeeper_util_envsub(
char ** arg);
int
globus_gatekeeper_util_exec(
char * args[],
struct passwd * pw,
char * userid,
char ** errmsg);
int
globus_gatekeeper_util_trans_to_user(
struct passwd * pw,
char * userid,
char ** errmsg);
#endif /* GLOBUS_GATEKEEPER_UTILS_H */
globus_gatekeeper-10.10/PaxHeaders.13361/globus_k5.c 0000644 0000000 0000000 00000000132 12510554047 016775 x ustar 00 30 mtime=1428346919.251851642
30 atime=1428346919.237851642
30 ctime=1428350397.320851642
globus_gatekeeper-10.10/globus_k5.c 0000664 0001750 0001750 00000022434 12510554047 020034 0 ustar 00fedora fedora 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/******************************************************************************
globus_gram_k5.c
Description:
globus to Kerberos simple authentication module.
When exec-ed by the gram_gatekeeper after
authentiicating the globus user, this routine
will attempt to issue a command for the user.
This may be as simple as a kinit with a password,
or can use the NCSA krb525 command, or the
sslk5 command to use the X509 user proxy.
The args passed to this routine will not be used,
but will be passed onto the job manager. The first parameter
must be the path to the job manager. (Much like what wrapper
or inetd does.)
It is expected that the environment will contain the
GLOBUSID=globusid of the user and USER=userid for the local
unix system. This program is normaly run as root,
and will seteuid before execing the other modules.
If not run as root, the user should have started the gatekeeper,
and should already have gotten a K5 credential.
The parameters to use and the mapping for the
globus to K5 user are located in the
.globuskmap file.
Format of the .globuskmap file:
"globus_user" ... including k5 principal
The globus_user may be in "" if it has blanks, such as
a X509 name.
This is designed to be a simple interface, and no attempt
to parse or use the command info is made.
This allows for other commands to be used instead
of kinit. Such as krb525 or sslk5
This will only be attempted if the gatekeeper
is run as root, as if the user has started
the gatekeeper, then he should have a K5
credentials already.
CVS Information:
$Source$
$Date$
$Revision$
$Author$
******************************************************************************/
/*****************************************************************************
Include header files
******************************************************************************/
#include "globus_config.h"
#include "globus_gatekeeper_config.h"
#include "globus_common.h"
#include
#include
#include
#include
#include
#include
#include
#include
#ifdef HAVE_MALLOC_H
# include
#endif
#include "globus_gatekeeper_utils.h"
/******************************************************************************
Type definitions
******************************************************************************/
#ifndef K5AFSLOGIN
#define K5AFSLOGIN "/krb5/sbin/k5afslogin"
#endif
#ifndef K5DCELOGIN
#define K5DCELOGIN "/krb5/sbin/k5dcelogin"
#if defined(sun)
#define K5DCELIB "/usr/lib/libdce.so"
#else
#define K5DCELIB "/usr/lib/libdce.a"
#endif
#endif
#ifdef DEBUG
#define DEEDEBUG(A) fprintf(stderrX,A)
#define DEEDEBUG2(A,B) fprintf(stderrX,A,B)
FILE *stderrX;
#else
#define DEEDEBUG(A)
#define DEEDEBUG2(A,B)
#endif
/******************************************************************************
Module specific prototypes
******************************************************************************/
/******************************************************************************
Define module specific variables
******************************************************************************/
/******************************************************************************
Function: globus_gram_k5_kinit()
Description:
Parameters:
Returns:
******************************************************************************/
int
globus_gram_k5_kinit(char * globus_client,
struct passwd *pw,
char * user,
char ** errmsgp)
{
int rc;
int i;
char ccname[100];
char * command;
char * args[100];
struct stat stx;
if ((rc = globus_gatekeeper_util_globusxmap(getenv("GLOBUSKMAP"),
globus_client, &command)))
return(rc); /* not found, or nothing to do */
if (!command)
return(0); /* no command */
i = 100;
if ((rc = globus_gatekeeper_util_tokenize( command, args, &i," \t\n")))
return(rc);
if (args[0] == NULL)
return(0); /* no command */
i = 0;
do {
sprintf(ccname,"FILE:/tmp/krb5cc_p%d.%d",getpid(),i++);
}
while(stat(ccname+5,&stx) == 0);
globus_libc_setenv("KRB5CCNAME", ccname, 1);
DEEDEBUG2("calling UTIL_exec: user: %s ",user);
DEEDEBUG2("and uid %d\n",pw?pw->pw_uid:-111111);
rc = globus_gatekeeper_util_exec(args, pw, user, errmsgp);
/*
* Make sure the creds cache is owned by the user.
*/
if (rc == 0 && getuid() == 0 && pw) {
(void) chown(ccname+5,pw->pw_uid, pw->pw_gid);
}
DEEDEBUG2("globus_gram_k5_exec rc = %d\n", rc);
return(rc);
}
/******************************************************************************
Function: main()
Description:
Parameters:
Returns:
******************************************************************************/
int
main(int argc, char *argv[])
{
int i;
int rc;
char *ccname;
char *globusid;
char *user;
char *newpath;
char *cp;
char **ap;
char **newargv;
struct stat stx;
extern int optind;
extern char *optarg;
uid_t myuid;
struct passwd *pw;
char *errmsg = NULL;
#ifdef DEBUG
stderrX = stderr;
/* stderrX = fopen("/tmp/k5gram.debug","w"); */
#endif
myuid = getuid(); /* get our uid, to see if we are root. */
DEEDEBUG2("k5gram uid = %lu\n", myuid);
user = getenv("USER");
if (user == NULL)
exit(6);
DEEDEBUG2("USER = %s\n",user);
pw = getpwnam(user);
if (pw == NULL)
exit(7);
DEEDEBUG2("USERID = %lu\n",pw->pw_uid);
/* if not root, must run as your self */
if (myuid && (myuid != pw->pw_uid))
exit(8);
/* we will need to copy the args, and may add the k5declogin
* and k5afslogin before. So get three extra.
*/
if ((newargv = calloc(argc + 3, sizeof(argv[0]))) == NULL) {
fprintf(stderr,"Unable to allocate new argv\n");
exit(1);
}
ap = newargv;
#ifdef DEBUG
{
int i;
fprintf(stderrX,"k5gram args: ");
i = 0;
while (argv[i]) {
fprintf(stderrX,"%s ",argv[i]);
i++;
}
fprintf(stderrX,"\n");
}
#endif
ccname = getenv("KRB5CCNAME");
/* If there is a cache, then the user must have
* started the gatekeeper on thier own.
* Or they were running the K5 GSSAPI. So
* don't try and get a K5 cache for them.
*/
if (ccname == NULL) {
globusid = getenv("GLOBUS_ID");
if (globusid == NULL)
goto done; /* Can't do globus-to-k5 without the globusid */
DEEDEBUG2("GLOBUSID = %s\n",globusid);
if (globus_gram_k5_kinit(globusid, pw, user, &errmsg) == 0) {
ccname = getenv("KRB5CCNAME");
}
/* even if the above failed, we want to continue */
}
if (ccname) {
DEEDEBUG2("KRB5CCNAME = %s\n",ccname);
/* test if this machine has DCE and k5dcelogin is available.
* if so put the k5dcelogin program on the list to call
*/
if ((stat(K5DCELIB,&stx) == 0) &&
(stat(K5DCELOGIN,&stx) == 0)) {
*ap++ = K5DCELOGIN;
DEEDEBUG2("Will try %s\n",K5DCELOGIN);
}
/* if this system has AFS and not a NFS/AFS translator
* put it on the list too
*/
if ((stat("/afs",&stx) == 0) &&
(stat(K5AFSLOGIN,&stx) == 0) &&
(stat("/usr/vice/etc/ThisCell",&stx) == 0)) {
*ap++ = K5AFSLOGIN;
DEEDEBUG2("Will try %s\n",K5AFSLOGIN);
}
}
done:
globus_libc_unsetenv("GLOBUSKMAP"); /* dont pass on */
/* before continuing on, if we were run as root,
* we will get to user state.
*/
if(globus_gatekeeper_util_trans_to_user(pw, user, &errmsg) != 0) {
fprintf(stderr,"Failed to run %d as the user %s %s\n",
rc, user, errmsg );
exit(3); /* have to fail, since cant run as root */
}
/* copy over the rest of the argument list.
* gram_gatekeeper will have placed the path to the job_manager
* as arg[1].
*/
for (i = 1; i