lcmaps_posix.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*
 * Copyright (c) 2001 EU DataGrid.                                                                             
 * For license conditions see http://www.eu-datagrid.org/license.html                                          
 *
 * Copyright (c) 2001, 2002 by 
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/*****************************************************************************
                            Include header files
******************************************************************************/
#include "lcmaps_config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pwd.h>
#include <grp.h>
#include <ctype.h>
#include <unistd.h>
#include <sys/types.h>
#include <errno.h>

#include "lcmaps_modules.h"
#include "lcmaps_arguments.h"
#include "lcmaps_cred_data.h"
/******************************************************************************
                                Definitions
******************************************************************************/

#define MAX_UNDEFINED ((int)(-1))

#ifndef NGROUPS
    #ifdef NGROUPS_MAX
        #define NGROUPS NGROUPS_MAX
    #else
        #define NGROUPS 32 
    #endif
#endif

/* 
 * MAX_NGROUPS has also been used. I couldn't see in the source if it was
 * a self made define in the code or that it was OS specific.
 */

#ifndef MAX_LOG_BUFFER_SIZE
    #define MAX_LOG_BUFFER_SIZE 500
#endif

/******************************************************************************
                          Module specific prototypes
******************************************************************************/

static int log_cred (
    char  *dn, 
    uid_t *uid, 
    int    cntUid, 
    gid_t *priGid, 
    int    cntPriGid, 
    gid_t *secGid, 
    int    cntSecGid
);


/******************************************************************************
                       Define module specific variables
******************************************************************************/

static int maxuid  = MAX_UNDEFINED;
static int maxpgid = MAX_UNDEFINED;
static int maxsgid = MAX_UNDEFINED;
static int set_only_euid = 0;
static int set_only_egid = 0;



/******************************************************************************
Function:   log_cred
Description:
    Makes a log of the Enforceable credential data
Parameters:
    *dn        : Distinghuished Name
    *uid       : list of uid_t
    cntUid     : amount of uids (ussually only one)
    *priGid    : list of primary gid_t
    cntPriGid  : amount of primary gids (usually only one)
    *secGid    : list of secondary gid_t
    cntSecGid  : amount of secondary gids (0 to (NGROUPS || 32))

Returns:
    0: succes
    1: failure
******************************************************************************/
static int log_cred (char  *dn,
                     uid_t *uid,
                     int    cntUid,
                     gid_t *priGid,
                     int    cntPriGid,
                     gid_t *secGid,
                     int    cntSecGid)
{
    char * logstr = "    lcmaps_plugin_posix_enf-log_cred()";

    struct passwd *  user_info = NULL;
    struct group  *  grp_info = NULL;
  
    char *           logbuf = NULL;
    int              i;
    int              ngroups;
    gid_t *          list = NULL;

    char *           bufptr = NULL;
    int              buflen = 0;
    int              totalchars = 0;

    // Log Enforced Credential Data
    logbuf = malloc(MAX_LOG_BUFFER_SIZE * sizeof(char));

    bufptr=logbuf;
    buflen=MAX_LOG_BUFFER_SIZE;

    // First the uid
    totalchars=snprintf(bufptr,(size_t)buflen,"uid=");
    if ( (totalchars+1) > buflen )
    {
        lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
        lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
        return 1;
    }
    else if ( totalchars < 0 )
    {
        lcmaps_log(0,"%s: error in snprintf()\n",logstr);
        return 1;
    }
    else
    {
        bufptr+=totalchars;
        buflen-=totalchars;
    }
    uid_t found_uid=-1;

    if (set_only_euid)
        found_uid = geteuid();
    else
        found_uid = getuid();
    user_info = getpwuid(found_uid);

    if (user_info != NULL)
        totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_uid, user_info->pw_name);
    else
        totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_uid, "n\\a");
    if ( (totalchars+1) > buflen )
    {
        lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
        lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
        return 1;
    }
    else if ( totalchars < 0 )
    {
        lcmaps_log(0,"%s: error in snprintf()\n",logstr);
            return 1;
    }
    else
    {
        bufptr+=totalchars;
        buflen-=totalchars;
    }
 
    // Then the primary gid
    // Ok, we do something strange. If cntPriGid==1 then we fetch the gid from the process,
    // otherwise if e.g. cntPriGid>1 (should never happen) then we just print out the list of
    // primary gids.
    totalchars=snprintf(bufptr,(size_t)buflen,":pgid=");
    if ( (totalchars+1) > buflen )
    {
        lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
        lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
        return 1;
    }
    else if ( totalchars < 0 )
    {
        lcmaps_log(0,"%s: error in snprintf()\n",logstr);
        return 1;
    }
    else
    {
        bufptr+=totalchars;
        buflen-=totalchars;
    }
    if (cntPriGid == 1)
    {
        gid_t found_gid=-1;

        if (set_only_egid)
            found_gid = getegid();
        else
            found_gid = getgid();
        grp_info = getgrgid(found_gid);

        if (grp_info != NULL)
        {
            totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_gid, grp_info->gr_name);
        }
        else
        {
            totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_gid, "n\\a");
        }
        if ( (totalchars+1) > buflen )
        {
            lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
            lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
            return 1;
        }
        else if ( totalchars < 0 )
        {
            lcmaps_log(0,"%s: error in snprintf()\n",logstr);
            return 1;
        }
        else
        {
            bufptr+=totalchars;
            buflen-=totalchars;
        }    
    }
    else
    {
        for (i = 0; i < cntPriGid; i++)
        {
            gid_t found_gid=priGid[i];

            grp_info = getgrgid(found_gid);
            if (grp_info != NULL)
            {
                if (i == 0)
                    totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_gid, grp_info->gr_name);
                else
                    totalchars=snprintf(bufptr,(size_t)buflen,",%d(%s)", found_gid, grp_info->gr_name);
            }
            else
            {
                if (i == 0)
                    totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", found_gid, "n\\a");
                else
                    totalchars=snprintf(bufptr,(size_t)buflen,",%d(%s)", found_gid, "n\\a");
            }
            if ( (totalchars+1) > buflen )
            {
                lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
                lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
                return 1;
            }
            else if ( totalchars < 0 )
            {
                lcmaps_log(0,"%s: error in snprintf()\n",logstr);
                return 1;
            }
            else
            {
                bufptr+=totalchars;
                buflen-=totalchars;
            }    
        }
    }

    // Finally the secondary gids
    // Now we only print the groups from getgroups().
    // NOTE: These may contain also effective/real primary gids !
    if ((ngroups=getgroups(0, NULL)) > 0)
    {
        if (ngroups != cntSecGid)
        {
            lcmaps_log_debug(1,"%s: something strange going on, the number of sec. gids from getgroups() (%d)\n",logstr,ngroups);
            lcmaps_log_debug(1,"%s: differs from the number of gids set (cntSecGid=%d)\n",logstr,cntSecGid);
        }
        if (ngroups < 0)
        {
            lcmaps_log(0,"%s: error in getgroups() (failure)\n",logstr);
            return 1;
        }
        list = (gid_t *) malloc(ngroups * sizeof(gid_t));
        if (getgroups(ngroups, list) > 0)
        {
            totalchars=snprintf(bufptr,(size_t)buflen,":sgid=");
            if ( (totalchars+1) > buflen )
            {
                lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
                lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
                return 1;
            }
            else if ( totalchars < 0 )
            {
                lcmaps_log(0,"%s: error in snprintf()\n",logstr);
                return 1;
            }
            else
            {
                bufptr+=totalchars;
                buflen-=totalchars;
            }
            for (i = 0; i < ngroups; i++)
            {
                grp_info = getgrgid(list[i]);

                if (grp_info != NULL)
                {
                    if (i == 0)
                        totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", (list[i]), grp_info->gr_name);
                    else
                        totalchars=snprintf(bufptr,(size_t)buflen,",%d(%s)", (list[i]), grp_info->gr_name);
                }
                else
                {
                    if (i == 0)
                        totalchars=snprintf(bufptr,(size_t)buflen,"%d(%s)", (list[i]), "n\\a");
                    else
                        totalchars=snprintf(bufptr,(size_t)buflen,",%d(%s)", (list[i]), "n\\a");
                }
                if ( (totalchars+1) > buflen )
                {
                    lcmaps_log(0,"%s: could not write all characters into credential log string\n",logstr);
                    lcmaps_log(0,"%s: excess of characters: %d\n",logstr,totalchars+1-buflen);
                    return 1;
                }
                else if ( totalchars < 0 )
                {
                    lcmaps_log(0,"%s: error in snprintf()\n",logstr);
                    return 1;
                }
                else
                {
                    bufptr+=totalchars;
                    buflen-=totalchars;
                }
            }
        }
        if (list != NULL)
        {
            free(list);
            list = NULL;
        }
    }
    lcmaps_log_debug(5,"%s: At the end we still have %d spaces left in the buffer\n", logstr, buflen);

    lcmaps_log_time(LOG_INFO, "%s: %s\n", logstr, logbuf);

    // End Log Credential Data 

    if (logbuf != NULL)
    {
        free(logbuf);
        logbuf = NULL;
    }
    return 0;
}



/******************************************************************************
Function:   plugin_initialize
Description:
    Initialize plugin
Parameters:
    argc, argv
    argv[0]: the name of the plugin
Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
    LCMAPS_MOD_NOFILE  : db file not found (will halt LCMAPS initialization)
******************************************************************************/
int plugin_initialize(
        int argc,
        char ** argv
)
{
    int i, j;
    char * logstr = "\tlcmaps_plugin_posix_enf-plugin_initialize()";  

 
    lcmaps_log_debug(1,"%s: passed arguments:\n", logstr);
    for (i=0; i < argc; i++)
    {
       lcmaps_log_debug(2,"%s: arg %d is %s\n", logstr, i, argv[i]);
    }

    /*
     * Parse arguments, argv[0] = name of plugin, so start with i = 1
     */
    for (i = 1; i < argc; i++)
    {
        // setting maxuid parameter from init plugin arguments
        if ( (((strcmp(argv[i], "-maxuid") == 0) ||
             (strcmp(argv[i], "-MAXUID") == 0)) &&
             (maxuid == MAX_UNDEFINED))
             && (i + 1 < argc) )
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 lcmaps_log_debug(2,"%s: Checking if argument behind \"-maxuid\" is a number\n", logstr);
                 for (j = 0; j < strlen(argv[i + 1]); j++)
                 { 
                     if (!isdigit((argv[i + 1])[j]))
                     {
                         lcmaps_log(0,"%s\tError: maybe found some digits, but there is at least one char corrupting this parameter: %s\n", logstr, argv[i + 1]);
                         maxuid = -1;
                         goto fail_posix;
                     }
                 }
                 maxuid = atoi(argv[i + 1]);
            }
            else
            {
                lcmaps_log(0,"%s: no argument found for %s (failure)\n", logstr, argv[i]);
                goto fail_posix;
            }
            i++;
        }        

        // setting maxpgid parameter from init plugin arguments
        else if ( (((strcmp(argv[i], "-maxpgid") == 0) ||
             (strcmp(argv[i], "-MAXPGID") == 0)) &&
             (maxpgid == MAX_UNDEFINED))
             && (i + 1 < argc) )
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 lcmaps_log_debug(2,"%s: Checking if argument behind \"-maxpgid\" is a number\n", logstr);
                 for (j = 0; j < strlen(argv[i + 1]); j++)
                 {
                     if (!isdigit((argv[i + 1])[j]))
                     {
                         lcmaps_log(0,"%s\tError: maybe found some digits, but there is at least one char corrupting this parameter: %s\n", logstr, argv[i + 1]);
                         maxpgid = -1;
                         goto fail_posix;
                     }
                 }
                 maxpgid = atoi(argv[i + 1]);
            }
            else
            {
                lcmaps_log(0,"%s: no argument found for %s (failure)\n", logstr, argv[i]);
                goto fail_posix;
            }
            i++;
        }

        // setting maxsgid parameter from init plugin arguments
        else if  ( (((strcmp(argv[i], "-maxsgid") == 0) ||
             (strcmp(argv[i], "-MAXSGID") == 0)) &&
             (maxsgid == MAX_UNDEFINED))
             && (i + 1 < argc) )
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 lcmaps_log_debug(2,"%s: Checking if argument behind \"-maxsgid\" is a number\n", logstr);
                 for (j = 0; j < strlen(argv[i + 1]); j++)
                 {
                     if (!isdigit((argv[i + 1])[j]))
                     {
                         lcmaps_log(0,"%s\tError: maybe found some digits, but there is atleast one char corrupting this parameter: %s\n", logstr, argv[i + 1]);
                         maxsgid = -1;
                         goto fail_posix;
                     }
                 }
                 maxsgid = atoi(argv[i + 1]);
            }
            else
            {
                lcmaps_log(0,"%s: no argument found for %s (failure)\n", logstr, argv[i]);
                goto fail_posix;
            }
            i++;
        }
        else if  ( (strcmp(argv[i], "-set_only_euid") == 0)
             && (i + 1 < argc) )
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 if (strcmp(argv[i+1],"yes") == 0)
                 {
                     set_only_euid = 1;
                 }
                 else if (strcmp(argv[i+1],"no") == 0)
                 {
                     set_only_euid = 0;
                 }
                 else
                 {
                     lcmaps_log(0,"%s: use \"yes\" or \"no\" for option %s\n", logstr, argv[i]);
                     goto fail_posix;
                 }
            }
            else
            {
                lcmaps_log(0,"%s: no argument found for %s (failure)\n", logstr, argv[i]);
                goto fail_posix;
            }
            i++;
        }
        else if  ( (strcmp(argv[i], "-set_only_egid") == 0)
             && (i + 1 < argc) )
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 if (strcmp(argv[i+1],"yes") == 0)
                 {
                     set_only_egid = 1;
                 }
                 else if (strcmp(argv[i+1],"no") == 0)
                 {
                     set_only_egid = 0;
                 }
                 else
                 {
                     lcmaps_log(0,"%s: use \"yes\" or \"no\" for option %s\n", logstr, argv[i]);
                     goto fail_posix;
                 }
            }
            else
            {
                lcmaps_log(0,"%s: no argument found for %s (failure)\n", logstr, argv[i]);
                goto fail_posix;
            }
            i++;
        }
    }

    if (maxsgid > NGROUPS)
    {
        lcmaps_log(0,"%s\tError: The prefered set maximum of %d Secondary Gid's exceeds the system maximum of NGROUPS witch is set to %d on this system\n", logstr, maxsgid, NGROUPS);
        goto fail_posix;
    }
    else if (maxsgid == MAX_UNDEFINED)
    {
        lcmaps_log(0,"%s\tAuto set maximum Secondary Gid's to system maximum of NGROUPS witch is set to %d on this system\n", logstr, NGROUPS);
    }


    lcmaps_log_debug(2,"%s: Summary init maxuid  : %d\n", logstr, maxuid);
    lcmaps_log_debug(2,"%s: Summary init maxpgid : %d\n", logstr, maxpgid);
    lcmaps_log_debug(2,"%s: Summary init maxsgid : %d\n", logstr, maxsgid);

    return LCMAPS_MOD_SUCCESS;


 fail_posix:
    return LCMAPS_MOD_FAIL; 
} 

/******************************************************************************
Function:   plugin_introspect
Description:
    return list of required arguments
Parameters:

Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
******************************************************************************/
int plugin_introspect(
        int * argc,
        lcmaps_argument_t ** argv
)
{
    char * logstr = "\tlcmaps_plugin_posix_enf-plugin_introspect()";  

    static lcmaps_argument_t argList[] = {
        {NULL           ,       NULL            , -1,   NULL}
    };

    lcmaps_log_debug(1,"%s: introspecting\n", logstr);

    *argv = argList;
    *argc = lcmaps_cntArgs(argList);
    lcmaps_log_debug(1,"%s: address first argument: 0x%x\n", logstr, argList);

    return LCMAPS_MOD_SUCCESS;
}


/******************************************************************************
Function:   plugin_run
Description:
    Gather credentials for LCMAPS
Parameters:
    argc: number of arguments
    argv: list of arguments
Returns:
    LCMAPS_MOD_SUCCESS: authorization succeeded
    LCMAPS_MOD_FAIL   : authorization failed
******************************************************************************/
int plugin_run(
        int argc,
        lcmaps_argument_t * argv
)
{
    char * logstr = "\tlcmaps_plugin_posix_enf-plugin_run()";  
    int                 i, t; 
    gid_t *             list        = NULL;
    int                 ngroups     = 0;
 
    char  *             dn          = NULL;
    uid_t *             uid         = NULL;
    int                 cntUid;
    gid_t *             priGid      = NULL;
    int                 cntPriGid;
    gid_t *             secGid      = NULL;
    int                 cntSecGid;
    struct passwd *     root_info   = NULL;

    /*
     * The beginning
     */
    lcmaps_log_debug(1,"%s\n", logstr);

    uid    = getCredentialData(UID,     &cntUid);
    priGid = getCredentialData(PRI_GID, &cntPriGid);
    secGid = getCredentialData(SEC_GID, &cntSecGid);
    lcmaps_log_debug(2,"%s: number of uids: %d, priGids: %d, secGids: %d\n", logstr, cntUid,cntPriGid,cntSecGid);
    
    // Check amount of uid's, pri-gid's and sec-gid's with the set maximum
    if (maxuid != MAX_UNDEFINED)
    {
        lcmaps_log_debug(2,"%s: max number of uids: %d\n", logstr, maxuid);
        if (cntUid > maxuid)
        {
            lcmaps_log(0, "%s:\tError: The set amount of uid's gathered exceeds the maximum of %d uid('s) by %d\n", logstr, maxuid, (cntUid - maxuid));
            goto fail_posix;
        }
    }
    if (maxpgid != MAX_UNDEFINED)
    {
        lcmaps_log_debug(2,"%s: max number of primary gid('s): %d\n", logstr, maxpgid);
        if (cntPriGid > maxpgid)
        {
            lcmaps_log(0, "%s:\tError: The set amount of primary gid's gathered exceeds the maximum of %d primary gid('s) by %d\n", logstr, maxpgid, (cntPriGid - maxpgid));
            goto fail_posix;
        }
    }
    if (maxsgid != MAX_UNDEFINED)
    {
        lcmaps_log_debug(2,"%s: max number of secondary gid's: %d\n", logstr, maxsgid);
        if (cntSecGid > maxsgid)
        {
            lcmaps_log(0, "%s:\tError: The set amount of secondary gid's gathered exceeds the maximum of %d secunadary gid's by %d\n", logstr, maxsgid, (cntSecGid - maxsgid));
            goto fail_posix;
        }
    }


    // Je moet ROOT zijn
    if (getuid() != 0)
    {
        lcmaps_log(0, "%s: The service did not initialize with Root! -> %d\n", logstr, getuid());
        goto fail_posix;
    }

    // Only done to get name of root (normally "root")
    if ((root_info=getpwuid(0)) == NULL)
    {
        lcmaps_log(0, "%s: cannot get passwd info for root\n", logstr);
        if (errno==ENOMEM)
            lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }
    lcmaps_log_debug(3,"%s: Name of root: %s\n", logstr, root_info->pw_name);
    lcmaps_log_debug(3,"%s: Je real      GID  was  -> %d\n", logstr, getgid());
    lcmaps_log_debug(3,"%s: Je effective GID  was  -> %d\n", logstr, getegid());

    // Set new primary group ID
    if (cntPriGid > 0)
    {
        if (set_only_egid)
            if (setregid(-1, priGid[0]) != 0)
            {
                lcmaps_log(0, "%s: cannot set effective gid by setregid()\n", logstr);
                lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
            }
            else
            {
                lcmaps_log_debug(1,"%s: Setting only effective primary gid to %d\n", logstr, (int) priGid[0]);
            }
        else
            if (setregid(priGid[0], priGid[0]) != 0)
            {
                lcmaps_log(0, "%s: cannot set real and effective setregid()\n", logstr);
                lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
            }
    }
    else
    {
        lcmaps_log(0, "%s: No primary group IDs found, need at least 1 !\n", logstr);
        goto fail_posix;
    }
        
    lcmaps_log_debug(3,"%s: Je real      GID is nu -> %d\n", logstr, getgid());
    lcmaps_log_debug(3,"%s: Je effective GID is nu -> %d\n", logstr, getegid());

    // Initialize group access list for root
    if (initgroups(root_info->pw_name, root_info->pw_gid)!=0)
    {
        lcmaps_log(0, "%s: error in initgroups() call\n", logstr);
        lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }

    // Get the number of secondary group IDs for root
    if ((ngroups=getgroups(0, NULL)) < 0)
    {
        lcmaps_log(0, "%s: error in getgroups() call\n", logstr);
        lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }
    lcmaps_log_debug(3,"%s: found %d sec group IDs initially\n", logstr, ngroups);
    list = (gid_t *) malloc(ngroups * sizeof(gid_t));

    // Get the secondary group IDs for root
    if (getgroups(ngroups, list) < 0)
    {
        lcmaps_log(0, "%s: error in getgroups() call\n", logstr);
        lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }
    for (t = 0; t < ngroups; t++)
    {
        lcmaps_log_debug(3,"%s: Je Sec. Gids waren     -> %d\n", logstr, list[t]);
    }
    if (list) free(list);
    list=(gid_t *) NULL;

    // Set the new secondary group IDs
    if (setgroups(cntSecGid, secGid)!=0)
    {
        switch (errno)
        {
            case EFAULT :
                {
                    lcmaps_log_debug(1, "%s: Not that fatal but serious error\n", logstr);
                    lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
                    goto fail_posix;
                    break;
                }
            case EPERM :
                {
                    lcmaps_log_debug(1, "%s: You are not ROOT\n", logstr);
                    lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
                    goto fail_posix;
                    break;
                }
            case EINVAL :
                {
                    for (i = 0; i < cntSecGid; i++)
                    {
                        lcmaps_log_debug(1,"%s: > i = %d met %d\n", logstr, i, secGid[i]);
                    }
                    lcmaps_log_debug(1, "%s: Invalid GID list\n", logstr);
                    lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
                    goto fail_posix;
                    break;
                }
            default :
                {
                    lcmaps_log_debug(1, "%s: Unspecified error in setgroups()\n", logstr);
                    goto fail_posix;
                }
        }
    }
    // Get the new number of secondary group IDs
    if ((ngroups=getgroups(0, NULL)) < 0)
    {
        lcmaps_log(0, "%s: error in getgroups() call\n", logstr);
        lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }
    lcmaps_log_debug(1,"%s: found %d sec gids after setgroups(), cntSecGid=%d\n", logstr, ngroups,cntSecGid);
    list = (gid_t *) malloc(ngroups * sizeof(gid_t));

    // Get the new secondary group IDs
    if (getgroups(ngroups, list) < 0)
    {
        lcmaps_log(0, "%s: error in getgroups() call\n", logstr);
        lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_posix;
    }
    for (t = 0; t < ngroups; t++)
    {
        lcmaps_log_debug(2,"%s: Je Sec. Gid s zijn nu  -> %d\n", logstr, list[t]);
    }

    lcmaps_log_debug(2,"%s: Je was user            -> %d\n", logstr, getuid());

    // Set the new user ID
    if (cntUid > 0)
    {
        if (set_only_euid)
            if (setreuid(-1, uid[0]) != 0)
            {
                lcmaps_log(0, "%s: cannot set effective uid by setreuid()\n", logstr);
                lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
            }
            else
            {
                lcmaps_log_debug(1,"%s: Setting only effective uid to %d\n", logstr, (int) uid[0]);
            }
        else
            if (setreuid(uid[0], uid[0]) != 0)
            {
                lcmaps_log(0, "%s: cannot setreuid()\n", logstr);
                lcmaps_log(0, "%s: %s\n", logstr, strerror(errno));
            }
    }
    else
    {
        lcmaps_log(0, "%s: No user IDs found, need at least 1 !\n", logstr);
        goto fail_posix;
    }

    lcmaps_log_debug(2,"%s: Je bent nu geworden    -> %d\n", logstr, getuid());
    lcmaps_log_debug(1,"%s: Je real      UID  is   -> %d\n", logstr, getuid());
    lcmaps_log_debug(1,"%s: Je effective UID  is   -> %d\n", logstr, geteuid());


    /* We should set the appropriate environment variables here (see globus gatekeeper)
     * (or before all setuid/setgid calls ?)
     */


    /*
     * Do Not End This POSIX Enforment with ROOT privileges
     * (depending on the set_only_euid and set_only_egid options)
     */
    if ( (!set_only_euid) && ((getuid() == 0) || (geteuid() == 0)) )
    {
        lcmaps_log(0, "%s: real and or effective uid == 0, which is not allowed at this stage\n", logstr);
        goto fail_posix;
    }
    else if (geteuid() == 0)
    {
        lcmaps_log(0, "%s: effective uid == 0, which is not allowed at this stage\n", logstr);
        goto fail_posix;
    }
        
    if ( (!set_only_egid) && ((getgid() == 0) || (getegid() == 0)) )
    {
        lcmaps_log(0, "%s: real and or effective gid == 0, which is not allowed at this stage\n", logstr);
        goto fail_posix;
    }
    else if (getegid() == 0)
    {
        lcmaps_log(0, "%s: effective gid == 0, which is not allowed at this stage\n", logstr);
        goto fail_posix;
    }
        
//    if ((getuid() == 0) || (getgid() == 0))
//    {
//        goto fail_posix;
//    }


    // Log Enforced Credential Data
    if (log_cred(dn, uid, cntUid, priGid, cntPriGid, secGid, cntSecGid) != 0)
    {
        lcmaps_log(0, "%s: Something wrong in printing the logged credentials (failure)\n", logstr);
        goto fail_posix;
    }


    /* succes */
 success_posix:
    if (list) free(list);
    lcmaps_log_time(0,"%s: posix_enf plugin succeeded\n", logstr);
    return LCMAPS_MOD_SUCCESS;

 fail_posix:
    if (list) free(list);
    lcmaps_log_time(0,"%s: posix_enf plugin failed\n", logstr);
    return LCMAPS_MOD_FAIL;
}

/******************************************************************************
Function:   plugin_terminate
Description:
    Terminate plugin
Parameters:

Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
******************************************************************************/
int plugin_terminate()
{
    char * logstr = "\tlcmaps_plugin_posix_enf-plugin_introspect()";

    lcmaps_log_debug(1,"%s: terminating\n", logstr);
    
    return LCMAPS_MOD_SUCCESS;
}

/******************************************************************************
CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcmaps-plugins-basic/src/posix_enf/lcmaps_posix.c,v $
    $Date: 2005/02/27 01:30:41 $
    $Revision: 1.4 $
    $Author: msteenba $
******************************************************************************/

---