blob: 0335eaae619b2b9091e9499b9b9f68c1ce662eb6 [file] [log] [blame]
Darren Tucker728d8372010-11-05 13:00:05 +11001/* $Id: platform.c,v 1.9 2010/11/05 02:00:05 dtucker Exp $ */
Damien Miller1b06dc32006-08-31 03:24:41 +10002
3/*
4 * Copyright (c) 2006 Darren Tucker. All rights reserved.
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include "config.h"
20#include "platform.h"
21
22#include "openbsd-compat/openbsd-compat.h"
23
Darren Tucker728d8372010-11-05 13:00:05 +110024extern int use_privsep;
25
Damien Miller1b06dc32006-08-31 03:24:41 +100026void
Darren Tuckerc8802aa2009-12-08 13:39:48 +110027platform_pre_listen(void)
28{
29#ifdef LINUX_OOM_ADJUST
30 /* Adjust out-of-memory killer so listening process is not killed */
31 oom_adjust_setup();
32#endif
33}
34
35void
Damien Miller1b06dc32006-08-31 03:24:41 +100036platform_pre_fork(void)
37{
38#ifdef USE_SOLARIS_PROCESS_CONTRACTS
39 solaris_contract_pre_fork();
40#endif
41}
42
43void
44platform_post_fork_parent(pid_t child_pid)
45{
46#ifdef USE_SOLARIS_PROCESS_CONTRACTS
47 solaris_contract_post_fork_parent(child_pid);
48#endif
49}
50
51void
52platform_post_fork_child(void)
53{
54#ifdef USE_SOLARIS_PROCESS_CONTRACTS
55 solaris_contract_post_fork_child();
56#endif
Darren Tuckerc8802aa2009-12-08 13:39:48 +110057#ifdef LINUX_OOM_ADJUST
58 oom_adjust_restore();
59#endif
Damien Miller1b06dc32006-08-31 03:24:41 +100060}
Darren Tucker1bf35032009-12-21 10:49:21 +110061
Darren Tucker920612e2010-11-05 12:36:15 +110062/*
63 * This gets called before switching UIDs, and is called even when sshd is
64 * not running as root.
65 */
Darren Tucker97528352010-11-05 12:03:05 +110066void
67platform_setusercontext(struct passwd *pw)
68{
Darren Tucker920612e2010-11-05 12:36:15 +110069#ifdef WITH_SELINUX
70 /* Cache selinux status for later use */
71 (void)ssh_selinux_enabled();
72#endif
73
Darren Tucker97528352010-11-05 12:03:05 +110074#ifdef USE_SOLARIS_PROJECTS
75 /* if solaris projects were detected, set the default now */
76 if (getuid() == 0 || geteuid() == 0)
77 solaris_set_default_project(pw);
78#endif
Darren Tucker44a97be2010-11-05 12:45:18 +110079
80#if defined(HAVE_LOGIN_CAP) && defined (__bsdi__)
Darren Tuckerfd4d8aa2010-11-05 12:50:41 +110081 if (getuid() == 0 || geteuid() == 0)
82 setpgid(0, 0);
Darren Tucker44a97be2010-11-05 12:45:18 +110083# endif
Darren Tucker728d8372010-11-05 13:00:05 +110084
85#if defined(HAVE_LOGIN_CAP) && defined(USE_PAM)
86 /*
87 * If we have both LOGIN_CAP and PAM, we want to establish creds
88 * before calling setusercontext (in session.c:do_setusercontext).
89 */
90 if (getuid() == 0 || geteuid() == 0) {
91 if (options.use_pam) {
92 do_pam_setcred(use_privsep);
93 }
94 }
95# endif /* USE_PAM */
Darren Tucker97528352010-11-05 12:03:05 +110096}
97
Darren Tucker920612e2010-11-05 12:36:15 +110098/*
99 * This gets called after we've established the user's groups, and is only
100 * called if sshd is running as root.
101 */
102void
103platform_setusercontext_post_groups(struct passwd *pw)
104{
Darren Tucker4db38072010-11-05 12:41:13 +1100105#ifdef HAVE_SETPCRED
106 /*
107 * If we have a chroot directory, we set all creds except real
108 * uid which we will need for chroot. If we don't have a
109 * chroot directory, we don't override anything.
110 */
111 {
112 char **creds = NULL, *chroot_creds[] =
113 { "REAL_USER=root", NULL };
114
115 if (options.chroot_directory != NULL &&
116 strcasecmp(options.chroot_directory, "none") != 0)
117 creds = chroot_creds;
118
119 if (setpcred(pw->pw_name, creds) == -1)
120 fatal("Failed to set process credentials");
121 }
122#endif /* HAVE_SETPCRED */
Darren Tucker920612e2010-11-05 12:36:15 +1100123#ifdef WITH_SELINUX
124 ssh_selinux_setup_exec_context(pw->pw_name);
125#endif
126}
127
Darren Tucker1bf35032009-12-21 10:49:21 +1100128char *
129platform_krb5_get_principal_name(const char *pw_name)
130{
131#ifdef USE_AIX_KRB_NAME
132 return aix_krb5_get_principal_name(pw_name);
133#else
134 return NULL;
135#endif
136}