src/slurmrestd/plugins/auth/local/local.c - SchedMD/slurm - Git at Google

 /*****************************************************************************\
  *  local.c - Slurm REST auth local plugin
  *****************************************************************************
  *  Copyright (C) SchedMD LLC.
  *
  *  This file is part of Slurm, a resource management program.
  *  For details, see <https://slurm.schedmd.com/>.
  *  Please also read the included file: DISCLAIMER.
  *
  *  Slurm is free software; you can redistribute it and/or modify it under
  *  the terms of the GNU General Public License as published by the Free
  *  Software Foundation; either version 2 of the License, or (at your option)
  *  any later version.
  *
  *  In addition, as a special exception, the copyright holders give permission
  *  to link the code of portions of this program with the OpenSSL library under
  *  certain conditions as described in each individual source file, and
  *  distribute linked combinations including the two. You must obey the GNU
  *  General Public License in all respects for all of the code used other than
  *  OpenSSL. If you modify file(s) with this exception, you may extend this
  *  exception to your version of the file(s), but you are not obligated to do
  *  so. If you do not wish to do so, delete this exception statement from your
  *  version.  If you delete this exception statement from all source files in
  *  the program, then also delete it here.
  *
  *  Slurm is distributed in the hope that it will be useful, but WITHOUT ANY
  *  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  *  FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  *  details.
  *
  *  You should have received a copy of the GNU General Public License along
  *  with Slurm; if not, write to the Free Software Foundation, Inc.,
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA.
 \*****************************************************************************/

 #include "config.h"

 #define _GNU_SOURCE /* needed for SO_PEERCRED */

 #include <grp.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>

 #if defined(__APPLE__) || defined(__FreeBSD__) || defined(__NetBSD__)
 #include <sys/param.h>
 #include <sys/ucred.h>
 #include <sys/un.h>
 #endif

 #include "slurm/slurm.h"
 #include "slurm/slurmdb.h"

 #include "src/common/data.h"
 #include "src/common/log.h"
 #include "src/interfaces/auth.h"
 #include "src/common/uid.h"
 #include "src/common/xassert.h"
 #include "src/common/xmalloc.h"
 #include "src/common/xstring.h"

 #include "src/slurmrestd/rest_auth.h"

 /*
  * These variables are required by the generic plugin interface.  If they
  * are not found in the plugin, the plugin loader will ignore it.
  *
  * plugin_name - a string giving a human-readable description of the
  * plugin.  There is no maximum length, but the symbol must refer to
  * a valid string.
  *
  * plugin_type - a string suggesting the type of the plugin or its
  * applicability to a particular form of data or method of data handling.
  * If the low-level plugin API is used, the contents of this string are
  * unimportant and may be anything.  Slurm uses the higher-level plugin
  * interface which requires this string to be of the form
  *
  *	<application>/<method>
  *
  * where <application> is a description of the intended application of
  * the plugin (e.g., "select" for Slurm node selection) and <method>
  * is a description of how this plugin satisfies that application.  Slurm will
  * only load select plugins if the plugin_type string has a
  * prefix of "select/".
  *
  * plugin_version - an unsigned 32-bit integer containing the Slurm version
  * (major.minor.micro combined into a single number).
  */
 const char plugin_name[] = "REST auth/local";
 const char plugin_type[] = "rest_auth/local";
 const uint32_t plugin_id = 101;
 const uint32_t plugin_version = SLURM_VERSION_NUMBER;

 extern int slurm_rest_auth_p_apply(rest_auth_context_t *context);

 static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
 /* protected by lock */
 static bool become_user = false;

 #define MAGIC 0xd11abee2
 typedef struct {
 	int magic;
 	void *db_conn;
 } plugin_data_t;

 extern void *slurm_rest_auth_p_get_db_conn(rest_auth_context_t *context)
 {
 	plugin_data_t *data = context->plugin_data;
 	xassert(data->magic == MAGIC);
 	xassert(context->plugin_id == plugin_id);

 	if (slurm_rest_auth_p_apply(context))
 		return NULL;

 	if (data->db_conn)
 		return data->db_conn;

 	errno = 0;
 	data->db_conn = slurmdb_connection_get(NULL);

 	if (!errno && data->db_conn)
 		return data->db_conn;

 	error("%s: unable to connect to slurmdbd: %m",
 	      __func__);
 	data->db_conn = NULL;

 	return NULL;
 }

 static int _auth_socket(on_http_request_args_t *args,
 			rest_auth_context_t *ctxt,
 			const char *header_user_name)
 {
 	int rc;
 	const char *name = conmgr_fd_get_name(args->context->con);
 	uid_t cred_uid;
 	gid_t cred_gid;
 	pid_t cred_pid;

 	xassert(!ctxt->user_name);

 	if ((rc = conmgr_get_fd_auth_creds(args->context->con, &cred_uid,
 					   &cred_gid, &cred_pid))) {
 		/* socket may be remote, local auth doesn't apply */
 		debug("%s: [%s] unable to get socket ownership: %s",
 		      __func__, name, slurm_strerror(rc));
 		return ESLURM_AUTH_CRED_INVALID;
 	}

 	if((cred_uid == -1) || (cred_gid == -1) || !cred_pid) {
 		/* *_PEERCRED failed silently */
 		error("%s: [%s] rejecting socket connection with invalid SO_PEERCRED response",
 		      __func__, name);
 		return ESLURM_AUTH_CRED_INVALID;
 	} else if ((cred_uid == SLURM_AUTH_NOBODY) ||
 		   (cred_gid == SLURM_AUTH_NOBODY)) {
 		error("%s: [%s] rejecting connection from nobody",
 		      __func__, name);
 		return ESLURM_AUTH_CRED_INVALID;
 	} else if (!cred_uid) {
 		/* requesting socket is root */
 		info("%s: [%s] accepted root socket connection with uid:%u gid:%u pid:%ld",
 		     __func__, name, cred_uid, cred_gid, (long) cred_pid);

 		/*
 		 * root can be any user if they want - default to
 		 * running user.
 		 */
 		if (header_user_name)
 			ctxt->user_name = xstrdup(header_user_name);
 		else
 			ctxt->user_name = uid_to_string_or_null(getuid());
 	} else if (getuid() == cred_uid) {
 		info("%s: [%s] accepted user socket connection with uid:%u gid:%u pid:%ld",
 		     __func__, name, cred_uid, cred_gid, (long) cred_pid);

 		ctxt->user_name = uid_to_string_or_null(cred_uid);
 	} else {
 		/*
 		 * Use lock to ensure there are no race conditions for different
 		 * users trying to connect
 		 */
 		slurm_mutex_lock(&lock);
 		if (become_user) {
 			info("%s: [%s] accepted user proxy socket connection with uid:%u gid:%u pid:%ld",
 			     __func__, name, cred_uid, cred_gid,
 			     (long) cred_pid);

 			if (getuid() || getgid())
 				fatal("%s: user proxy mode requires running as root",
 				      __func__);

 			ctxt->user_name = uid_to_string_or_null(cred_uid);

 			if (!ctxt->user_name)
 				fatal("%s: [%s] unable to resolve user uid %u",
 				      __func__, name, cred_uid);

 			if (setgroups(0, NULL))
 				fatal("Unable to drop supplementary groups: %m");

 			if (setuid(cred_uid))
 				fatal("%s: [%s] unable to switch to user uid %u: %m",
 				      __func__, name, cred_uid);

 			if ((getgid() != cred_gid) && setgid(cred_gid))
 				fatal("%s: [%s] unable to switch to user gid %u: %m",
 				      __func__, name, cred_gid);

 			if ((getuid() != cred_uid) || (getgid() != cred_gid))
 				fatal("%s: [%s] user switch sanity check failed",
 				      __func__, name);

 			/*
 			 * Only allow user change once to ensure against replay
 			 * attacks. Next attempt to connect will be forced to be
 			 * the same user.
 			 */
 			become_user = false;
 			slurm_mutex_unlock(&lock);
 		} else {
 			slurm_mutex_unlock(&lock);
 			/* another user -> REJECT */
 			error("%s: [%s] rejecting socket connection with uid:%u gid:%u pid:%ld",
 			      __func__, name, cred_uid, cred_gid,
 			      (long) cred_pid);
 			return ESLURM_AUTH_CRED_INVALID;
 		}
 	}

 	if (ctxt->user_name) {
 		plugin_data_t *data = xmalloc(sizeof(*data));
 		data->magic = MAGIC;
 		ctxt->plugin_data = data;
 		return SLURM_SUCCESS;
 	} else
 		return ESLURM_USER_ID_MISSING;
 }

 extern int slurm_rest_auth_p_authenticate(on_http_request_args_t *args,
 					  rest_auth_context_t *ctxt)
 {
 	struct stat status = { 0 };
 	const char *header_user_name = find_http_header(args->headers,
 							HTTP_HEADER_USER_NAME);
 	const conmgr_fd_status_t cstatus =
 		conmgr_fd_get_status(args->context->con);
 	const int input_fd = conmgr_fd_get_input_fd(args->context->con);
 	const int output_fd = conmgr_fd_get_output_fd(args->context->con);
 	const char *name = conmgr_fd_get_name(args->context->con);

 	xassert(!ctxt->user_name);

 	if ((input_fd < 0) || (output_fd < 0)) {
 		/* local auth requires there to be a valid fd */
 		debug3("%s: skipping auth local with invalid input_fd:%u output_fd:%u",
 		       __func__, input_fd, output_fd);
 		return ESLURM_AUTH_SKIP;
 	}

 	if (cstatus.is_socket && !cstatus.unix_socket) {
 		/*
 		 * SO_PEERCRED only works on unix sockets
 		 */
 		debug("%s: [%s] socket authentication only supported on UNIX sockets",
 		      __func__, name);
 		return ESLURM_AUTH_SKIP;
 	} else if (cstatus.is_socket && cstatus.unix_socket) {
 		return _auth_socket(args, ctxt, header_user_name);
 	} else if (fstat(input_fd, &status)) {
 		error("%s: [%s] unable to stat fd %d: %m",
 		      __func__, name, input_fd);
 		return ESLURM_AUTH_CRED_INVALID;
 	} else if (S_ISCHR(status.st_mode) || S_ISFIFO(status.st_mode) ||
 		   S_ISREG(status.st_mode)) {
 		bool reject_proxy = false;

 		slurm_mutex_lock(&lock);
 		if (become_user)
 			reject_proxy = true;
 		slurm_mutex_unlock(&lock);

 		if (reject_proxy) {
 			error("%s: [%s] rejecting PIPE connection in become user mode",
 			      __func__, name);
 			return ESLURM_AUTH_CRED_INVALID;
 		}

 		if (status.st_mode & (S_ISUID | S_ISGID)) {
 			/* FIFO has sticky bits -> REJECT */
 			error("%s: [%s] rejecting PIPE connection sticky bits permissions: %07o",
 			      __func__, name, status.st_mode);
 			return ESLURM_AUTH_CRED_INVALID;
 		} else if (status.st_mode & S_IRWXO) {
 			/* FIFO has other read/write -> REJECT */
 			error("%s: [%s] rejecting PIPE connection other read or write bits permissions: %07o",
 			      __func__, name, status.st_mode);
 			return ESLURM_AUTH_CRED_INVALID;
 		} else if (status.st_uid == getuid()) {
 			/* FIFO is owned by same user */
 			ctxt->user_name = uid_to_string_or_null(status.st_uid);

 			if (ctxt->user_name) {
 				plugin_data_t *data = xmalloc(sizeof(*data));
 				data->magic = MAGIC;
 				ctxt->plugin_data = data;

 				info("[%s] accepted connection from user: %s[%u]",
 				     name, ctxt->user_name, status.st_uid);
 				return SLURM_SUCCESS;
 			} else {
 				error("[%s] rejecting connection from unresolvable uid:%u",
 				      name, status.st_uid);
 				return ESLURM_USER_ID_MISSING;
 			}
 		}

 		return ESLURM_AUTH_CRED_INVALID;
 	} else {
 		error("%s: [%s] rejecting unknown file type with mode:%07o blk:%u char:%u dir:%u fifo:%u reg:%u link:%u",
 		      __func__, name, status.st_mode, S_ISBLK(status.st_mode),
 		      S_ISCHR(status.st_mode), S_ISDIR(status.st_mode),
 		      S_ISFIFO(status.st_mode), S_ISREG(status.st_mode),
 		      S_ISLNK(status.st_mode));
 		return ESLURM_AUTH_CRED_INVALID;
 	}
 }

 extern int slurm_rest_auth_p_apply(rest_auth_context_t *context)
 {
 	int rc;

 	xassert(((plugin_data_t *) context->plugin_data)->magic == MAGIC);
 	xassert(context->plugin_id == plugin_id);

 	rc = auth_g_thread_config(NULL, context->user_name);

 	return rc;
 }

 extern void slurm_rest_auth_p_free(rest_auth_context_t *context)
 {
 	plugin_data_t *data = context->plugin_data;
 	xassert(data->magic == MAGIC);
 	xassert(context->plugin_id == plugin_id);
 	data->magic = ~MAGIC;

 	if (data->db_conn)
 		slurmdb_connection_close(&data->db_conn);

 	xfree(context->plugin_data);
 }

 extern void slurm_rest_auth_p_init(bool bu)
 {
 	if (!bu) {
 		debug3("%s: REST local auth activated", __func__);
 	} else if (!getuid()) {
 		slurm_mutex_lock(&lock);
 		if (become_user)
 			fatal("duplicate call to %s", __func__);

 		become_user = true;
 		slurm_mutex_unlock(&lock);

 		debug3("%s: REST local auth with become user mode active",
 		       __func__);
 	} else {
 		fatal("%s: become user mode requires running as root", __func__);
 	}
 }

 extern void slurm_rest_auth_p_fini(void)
 {
 	debug5("%s: REST local auth deactivated", __func__);
 }
	/*****************************************************************************\
	* local.c - Slurm REST auth local plugin
	*****************************************************************************
	* Copyright (C) SchedMD LLC.
	*
	* This file is part of Slurm, a resource management program.
	* For details, see <https://slurm.schedmd.com/>.
	* Please also read the included file: DISCLAIMER.
	*
	* Slurm is free software; you can redistribute it and/or modify it under
	* the terms of the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at your option)
	* any later version.
	*
	* In addition, as a special exception, the copyright holders give permission
	* to link the code of portions of this program with the OpenSSL library under
	* certain conditions as described in each individual source file, and
	* distribute linked combinations including the two. You must obey the GNU
	* General Public License in all respects for all of the code used other than
	* OpenSSL. If you modify file(s) with this exception, you may extend this
	* exception to your version of the file(s), but you are not obligated to do
	* so. If you do not wish to do so, delete this exception statement from your
	* version. If you delete this exception statement from all source files in
	* the program, then also delete it here.
	*
	* Slurm is distributed in the hope that it will be useful, but WITHOUT ANY
	* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
	* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
	* details.
	*
	* You should have received a copy of the GNU General Public License along
	* with Slurm; if not, write to the Free Software Foundation, Inc.,
	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
	\*****************************************************************************/

	#include "config.h"

	#define _GNU_SOURCE /* needed for SO_PEERCRED */

	#include <grp.h>
	#include <sys/socket.h>
	#include <sys/stat.h>
	#include <sys/types.h>
	#include <unistd.h>

	#if defined(__APPLE__) \|\| defined(__FreeBSD__) \|\| defined(__NetBSD__)
	#include <sys/param.h>
	#include <sys/ucred.h>
	#include <sys/un.h>
	#endif

	#include "slurm/slurm.h"
	#include "slurm/slurmdb.h"

	#include "src/common/data.h"
	#include "src/common/log.h"
	#include "src/interfaces/auth.h"
	#include "src/common/uid.h"
	#include "src/common/xassert.h"
	#include "src/common/xmalloc.h"
	#include "src/common/xstring.h"

	#include "src/slurmrestd/rest_auth.h"

	/*
	* These variables are required by the generic plugin interface. If they
	* are not found in the plugin, the plugin loader will ignore it.
	*
	* plugin_name - a string giving a human-readable description of the
	* plugin. There is no maximum length, but the symbol must refer to
	* a valid string.
	*
	* plugin_type - a string suggesting the type of the plugin or its
	* applicability to a particular form of data or method of data handling.
	* If the low-level plugin API is used, the contents of this string are
	* unimportant and may be anything. Slurm uses the higher-level plugin
	* interface which requires this string to be of the form
	*
	* <application>/<method>
	*
	* where <application> is a description of the intended application of
	* the plugin (e.g., "select" for Slurm node selection) and <method>
	* is a description of how this plugin satisfies that application. Slurm will
	* only load select plugins if the plugin_type string has a
	* prefix of "select/".
	*
	* plugin_version - an unsigned 32-bit integer containing the Slurm version
	* (major.minor.micro combined into a single number).
	*/
	const char plugin_name[] = "REST auth/local";
	const char plugin_type[] = "rest_auth/local";
	const uint32_t plugin_id = 101;
	const uint32_t plugin_version = SLURM_VERSION_NUMBER;

	extern int slurm_rest_auth_p_apply(rest_auth_context_t *context);

	static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
	/* protected by lock */
	static bool become_user = false;

	#define MAGIC 0xd11abee2
	typedef struct {
	int magic;
	void *db_conn;
	} plugin_data_t;

	extern void slurm_rest_auth_p_get_db_conn(rest_auth_context_t context)
	{
	plugin_data_t *data = context->plugin_data;
	xassert(data->magic == MAGIC);
	xassert(context->plugin_id == plugin_id);

	if (slurm_rest_auth_p_apply(context))
	return NULL;

	if (data->db_conn)
	return data->db_conn;

	errno = 0;
	data->db_conn = slurmdb_connection_get(NULL);

	if (!errno && data->db_conn)
	return data->db_conn;

	error("%s: unable to connect to slurmdbd: %m",
	__func__);
	data->db_conn = NULL;

	return NULL;
	}

	static int _auth_socket(on_http_request_args_t *args,
	rest_auth_context_t *ctxt,
	const char *header_user_name)
	{
	int rc;
	const char *name = conmgr_fd_get_name(args->context->con);
	uid_t cred_uid;
	gid_t cred_gid;
	pid_t cred_pid;

	xassert(!ctxt->user_name);

	if ((rc = conmgr_get_fd_auth_creds(args->context->con, &cred_uid,
	&cred_gid, &cred_pid))) {
	/* socket may be remote, local auth doesn't apply */
	debug("%s: [%s] unable to get socket ownership: %s",
	__func__, name, slurm_strerror(rc));
	return ESLURM_AUTH_CRED_INVALID;
	}

	if((cred_uid == -1) \|\| (cred_gid == -1) \|\| !cred_pid) {
	/* _PEERCRED failed silently /
	error("%s: [%s] rejecting socket connection with invalid SO_PEERCRED response",
	__func__, name);
	return ESLURM_AUTH_CRED_INVALID;
	} else if ((cred_uid == SLURM_AUTH_NOBODY) \|\|
	(cred_gid == SLURM_AUTH_NOBODY)) {
	error("%s: [%s] rejecting connection from nobody",
	__func__, name);
	return ESLURM_AUTH_CRED_INVALID;
	} else if (!cred_uid) {
	/* requesting socket is root */
	info("%s: [%s] accepted root socket connection with uid:%u gid:%u pid:%ld",
	__func__, name, cred_uid, cred_gid, (long) cred_pid);

	/*
	* root can be any user if they want - default to
	* running user.
	*/
	if (header_user_name)
	ctxt->user_name = xstrdup(header_user_name);
	else
	ctxt->user_name = uid_to_string_or_null(getuid());
	} else if (getuid() == cred_uid) {
	info("%s: [%s] accepted user socket connection with uid:%u gid:%u pid:%ld",
	__func__, name, cred_uid, cred_gid, (long) cred_pid);

	ctxt->user_name = uid_to_string_or_null(cred_uid);
	} else {
	/*
	* Use lock to ensure there are no race conditions for different
	* users trying to connect
	*/
	slurm_mutex_lock(&lock);
	if (become_user) {
	info("%s: [%s] accepted user proxy socket connection with uid:%u gid:%u pid:%ld",
	__func__, name, cred_uid, cred_gid,
	(long) cred_pid);

	if (getuid() \|\| getgid())
	fatal("%s: user proxy mode requires running as root",
	__func__);

	ctxt->user_name = uid_to_string_or_null(cred_uid);

	if (!ctxt->user_name)
	fatal("%s: [%s] unable to resolve user uid %u",
	__func__, name, cred_uid);

	if (setgroups(0, NULL))
	fatal("Unable to drop supplementary groups: %m");

	if (setuid(cred_uid))
	fatal("%s: [%s] unable to switch to user uid %u: %m",
	__func__, name, cred_uid);

	if ((getgid() != cred_gid) && setgid(cred_gid))
	fatal("%s: [%s] unable to switch to user gid %u: %m",
	__func__, name, cred_gid);

	if ((getuid() != cred_uid) \|\| (getgid() != cred_gid))
	fatal("%s: [%s] user switch sanity check failed",
	__func__, name);

	/*
	* Only allow user change once to ensure against replay
	* attacks. Next attempt to connect will be forced to be
	* the same user.
	*/
	become_user = false;
	slurm_mutex_unlock(&lock);
	} else {
	slurm_mutex_unlock(&lock);
	/* another user -> REJECT */
	error("%s: [%s] rejecting socket connection with uid:%u gid:%u pid:%ld",
	__func__, name, cred_uid, cred_gid,
	(long) cred_pid);
	return ESLURM_AUTH_CRED_INVALID;
	}
	}

	if (ctxt->user_name) {
	plugin_data_t data = xmalloc(sizeof(data));
	data->magic = MAGIC;
	ctxt->plugin_data = data;
	return SLURM_SUCCESS;
	} else
	return ESLURM_USER_ID_MISSING;
	}

	extern int slurm_rest_auth_p_authenticate(on_http_request_args_t *args,
	rest_auth_context_t *ctxt)
	{
	struct stat status = { 0 };
	const char *header_user_name = find_http_header(args->headers,
	HTTP_HEADER_USER_NAME);
	const conmgr_fd_status_t cstatus =
	conmgr_fd_get_status(args->context->con);
	const int input_fd = conmgr_fd_get_input_fd(args->context->con);
	const int output_fd = conmgr_fd_get_output_fd(args->context->con);
	const char *name = conmgr_fd_get_name(args->context->con);

	xassert(!ctxt->user_name);

	if ((input_fd < 0) \|\| (output_fd < 0)) {
	/* local auth requires there to be a valid fd */
	debug3("%s: skipping auth local with invalid input_fd:%u output_fd:%u",
	__func__, input_fd, output_fd);
	return ESLURM_AUTH_SKIP;
	}

	if (cstatus.is_socket && !cstatus.unix_socket) {
	/*
	* SO_PEERCRED only works on unix sockets
	*/
	debug("%s: [%s] socket authentication only supported on UNIX sockets",
	__func__, name);
	return ESLURM_AUTH_SKIP;
	} else if (cstatus.is_socket && cstatus.unix_socket) {
	return _auth_socket(args, ctxt, header_user_name);
	} else if (fstat(input_fd, &status)) {
	error("%s: [%s] unable to stat fd %d: %m",
	__func__, name, input_fd);
	return ESLURM_AUTH_CRED_INVALID;
	} else if (S_ISCHR(status.st_mode) \|\| S_ISFIFO(status.st_mode) \|\|
	S_ISREG(status.st_mode)) {
	bool reject_proxy = false;

	slurm_mutex_lock(&lock);
	if (become_user)
	reject_proxy = true;
	slurm_mutex_unlock(&lock);

	if (reject_proxy) {
	error("%s: [%s] rejecting PIPE connection in become user mode",
	__func__, name);
	return ESLURM_AUTH_CRED_INVALID;
	}

	if (status.st_mode & (S_ISUID \| S_ISGID)) {
	/* FIFO has sticky bits -> REJECT */
	error("%s: [%s] rejecting PIPE connection sticky bits permissions: %07o",
	__func__, name, status.st_mode);
	return ESLURM_AUTH_CRED_INVALID;
	} else if (status.st_mode & S_IRWXO) {
	/* FIFO has other read/write -> REJECT */
	error("%s: [%s] rejecting PIPE connection other read or write bits permissions: %07o",
	__func__, name, status.st_mode);
	return ESLURM_AUTH_CRED_INVALID;
	} else if (status.st_uid == getuid()) {
	/* FIFO is owned by same user */
	ctxt->user_name = uid_to_string_or_null(status.st_uid);

	if (ctxt->user_name) {
	plugin_data_t data = xmalloc(sizeof(data));
	data->magic = MAGIC;
	ctxt->plugin_data = data;

	info("[%s] accepted connection from user: %s[%u]",
	name, ctxt->user_name, status.st_uid);
	return SLURM_SUCCESS;
	} else {
	error("[%s] rejecting connection from unresolvable uid:%u",
	name, status.st_uid);
	return ESLURM_USER_ID_MISSING;
	}
	}

	return ESLURM_AUTH_CRED_INVALID;
	} else {
	error("%s: [%s] rejecting unknown file type with mode:%07o blk:%u char:%u dir:%u fifo:%u reg:%u link:%u",
	__func__, name, status.st_mode, S_ISBLK(status.st_mode),
	S_ISCHR(status.st_mode), S_ISDIR(status.st_mode),
	S_ISFIFO(status.st_mode), S_ISREG(status.st_mode),
	S_ISLNK(status.st_mode));
	return ESLURM_AUTH_CRED_INVALID;
	}
	}

	extern int slurm_rest_auth_p_apply(rest_auth_context_t *context)
	{
	int rc;

	xassert(((plugin_data_t *) context->plugin_data)->magic == MAGIC);
	xassert(context->plugin_id == plugin_id);

	rc = auth_g_thread_config(NULL, context->user_name);

	return rc;
	}

	extern void slurm_rest_auth_p_free(rest_auth_context_t *context)
	{
	plugin_data_t *data = context->plugin_data;
	xassert(data->magic == MAGIC);
	xassert(context->plugin_id == plugin_id);
	data->magic = ~MAGIC;

	if (data->db_conn)
	slurmdb_connection_close(&data->db_conn);

	xfree(context->plugin_data);
	}

	extern void slurm_rest_auth_p_init(bool bu)
	{
	if (!bu) {
	debug3("%s: REST local auth activated", __func__);
	} else if (!getuid()) {
	slurm_mutex_lock(&lock);
	if (become_user)
	fatal("duplicate call to %s", __func__);

	become_user = true;
	slurm_mutex_unlock(&lock);

	debug3("%s: REST local auth with become user mode active",
	__func__);
	} else {
	fatal("%s: become user mode requires running as root", __func__);
	}
	}

	extern void slurm_rest_auth_p_fini(void)
	{
	debug5("%s: REST local auth deactivated", __func__);
	}