>From 74e498ec2cd8f2c9693d61276c67a4a1f1abf4a4 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 13 Mar 2014 19:14:26 +0100 Subject: [PATCH] IPA: Remove util/sss_selinux.c --- Makefile.am | 2 - src/db/sysdb_selinux.c | 1 - src/providers/ipa/ipa_selinux.c | 208 +++++++++++++++++++++++++++++++- src/util/sss_selinux.c | 255 ---------------------------------------- src/util/sss_selinux.h | 54 --------- 5 files changed, 203 insertions(+), 317 deletions(-) delete mode 100644 src/util/sss_selinux.c delete mode 100644 src/util/sss_selinux.h diff --git a/Makefile.am b/Makefile.am index 750f626d17240a33e89a0b28c0ca5a6e2536c1cb..23bf392838aa9e63c687fd1139fd4cc5fc67d23d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -424,7 +424,6 @@ dist_noinst_HEADERS = \ src/util/sss_ldap.h \ src/util/sss_python.h \ src/util/sss_krb5.h \ - src/util/sss_selinux.h \ src/util/sss_utf8.h \ src/util/sss_ssh.h \ src/util/sss_ini.h \ @@ -608,7 +607,6 @@ libsss_util_la_SOURCES = \ src/util/murmurhash3.c \ src/util/atomic_io.c \ src/util/authtok.c \ - src/util/sss_selinux.c \ src/util/domain_info_utils.c \ src/util/util_lock.c \ src/util/util_errors.c \ diff --git a/src/db/sysdb_selinux.c b/src/db/sysdb_selinux.c index 2dbbb75b99acff28d1a92e1a2d2ccc22004188cc..0c0cc02c1fca30a65833b3cacae97a7505a19c1f 100644 --- a/src/db/sysdb_selinux.c +++ b/src/db/sysdb_selinux.c @@ -19,7 +19,6 @@ along with this program. If not, see . */ -#include "util/sss_selinux.h" #include "db/sysdb_selinux.h" #include "db/sysdb_private.h" diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c index 1fc0c68d0bdc7cc5131d61694db26a208c51d300..db9dc379be63ca05f00ff4af531645985601cf4d 100644 --- a/src/providers/ipa/ipa_selinux.c +++ b/src/providers/ipa/ipa_selinux.c @@ -24,7 +24,7 @@ #include #include "db/sysdb_selinux.h" -#include "util/sss_selinux.h" +#include "util/sss_utf8.h" #include "providers/ldap/sdap_async.h" #include "providers/ipa/ipa_common.h" #include "providers/ipa/ipa_config.h" @@ -39,6 +39,176 @@ #if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR #include +#define SELINUX_PRIORITY_USER_CAT 1 +#define SELINUX_PRIORITY_USER_GROUP 2 +#define SELINUX_PRIORITY_USER_NAME 4 +/* According to specification, host has higher priority */ +#define SELINUX_PRIORITY_HOST_CAT 8 +#define SELINUX_PRIORITY_HOST_GROUP 16 +#define SELINUX_PRIORITY_HOST_NAME 32 + +static bool match_entity(struct ldb_message_element *values, + struct ldb_message_element *sought_values) +{ + int i, j; + + for (i = 0; i < values->num_values; i++) { + for (j = 0; j < sought_values->num_values; j++) { + if (values->values[i].length != sought_values->values[j].length) { + continue; + } + + if (strncasecmp((char *)values->values[i].data, + (char *)sought_values->values[j].data, + values->values[i].length) == 0) + return true; + } + } + + return false; +} + +static bool +selinux_map_matches(struct sysdb_attrs *usermap, + struct sysdb_attrs *user, + struct sysdb_attrs *host, + uint32_t *_priority) +{ + struct ldb_message_element *users_el = NULL; + struct ldb_message_element *usercat = NULL; + struct ldb_message_element *hosts_el = NULL; + struct ldb_message_element *hostcat = NULL; + struct ldb_message_element *dn; + struct ldb_message_element *memberof; + int i; + uint32_t priority = 0; + bool matched_name; + bool matched_group; + bool matched_category; + errno_t ret; + + if (usermap == NULL) { + DEBUG(SSSDBG_MINOR_FAILURE, "NULL given as usermap! Skipping ...\n"); + return false; + } + + /* Search for user and host related elements */ + for (i = 0; i < usermap->num; i++) { + if (!strcasecmp(usermap->a[i].name, SYSDB_ORIG_MEMBER_USER)) { + users_el = &usermap->a[i]; + } else if (!strcasecmp(usermap->a[i].name, SYSDB_ORIG_MEMBER_HOST)) { + hosts_el = &usermap->a[i]; + } else if (!strcasecmp(usermap->a[i].name, SYSDB_USER_CATEGORY)) { + usercat = &usermap->a[i]; + } else if (!strcasecmp(usermap->a[i].name, SYSDB_HOST_CATEGORY)) { + hostcat = &usermap->a[i]; + } + } + + if (user) { + ret = sysdb_attrs_get_el(user, SYSDB_ORIG_DN, &dn); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, "User does not have origDN\n"); + return false; + } + ret = sysdb_attrs_get_el(user, SYSDB_ORIG_MEMBEROF, &memberof); + if (ret != EOK) { + DEBUG(SSSDBG_TRACE_ALL, + "User does not have orig memberof, " + "therefore it can't match to any rule\n"); + return false; + } + + /** + * The rule won't match if user category != "all" and user map doesn't + * contain neither user nor any of his groups in memberUser attribute + */ + matched_category = false; + if (usercat != NULL) { + for (i = 0; i < usercat->num_values; i++) { + if (strcasecmp((char *)usercat->values[i].data, "all") == 0) { + matched_category = true; + break; + } + } + } + + if (!matched_category) { + if (users_el == NULL) { + DEBUG(SSSDBG_TRACE_ALL, "No users specified in the rule!\n"); + return false; + } else { + matched_name = match_entity(users_el, dn); + matched_group = match_entity(users_el, memberof); + if (matched_name) { + priority |= SELINUX_PRIORITY_USER_NAME; + } else if (matched_group) { + priority |= SELINUX_PRIORITY_USER_GROUP; + } else { + DEBUG(SSSDBG_TRACE_ALL, "User did not match\n"); + return false; + } + } + } else { + priority |= SELINUX_PRIORITY_USER_CAT; + } + } + + if (host) { + ret = sysdb_attrs_get_el(host, SYSDB_ORIG_DN, &dn); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, "Host does not have origDN\n"); + return false; + } + ret = sysdb_attrs_get_el(host, SYSDB_ORIG_MEMBEROF, &memberof); + if (ret != EOK) { + DEBUG(SSSDBG_TRACE_ALL, + "Host does not have orig memberof, " + "therefore it can't match to any rule\n"); + return false; + } + + /** + * The rule won't match if host category != "all" and user map doesn't + * contain neither host nor any of its groups in memberHost attribute + */ + matched_category = false; + if (hostcat != NULL) { + for (i = 0; i < hostcat->num_values; i++) { + if (strcasecmp((char *)hostcat->values[i].data, "all") == 0) { + matched_category = true; + break; + } + } + } + if (!matched_category) { + if (hosts_el == NULL) { + DEBUG(SSSDBG_TRACE_ALL, "No users specified in the rule!\n"); + return false; + } else { + matched_name = match_entity(hosts_el, dn); + matched_group = match_entity(hosts_el, memberof); + if (matched_name) { + priority |= SELINUX_PRIORITY_HOST_NAME; + } else if (matched_group) { + priority |= SELINUX_PRIORITY_HOST_GROUP; + } else { + DEBUG(SSSDBG_TRACE_ALL, "Host did not match\n"); + return false; + } + } + } else { + priority |= SELINUX_PRIORITY_HOST_CAT; + } + } + + if (_priority != NULL) { + *_priority = priority; + } + + return true; +} + static struct tevent_req * ipa_get_selinux_send(TALLOC_CTX *mem_ctx, struct be_ctx *be_ctx, @@ -218,6 +388,7 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, struct ldb_message **msgs; struct sysdb_attrs **hosts; errno_t ret; + struct ldb_message *user_msg; op_ctx = talloc_zero(mem_ctx, struct ipa_selinux_op_ctx); if (op_ctx == NULL) { @@ -228,11 +399,22 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, op_ctx->user_domain = user_domain; op_ctx->selinux_ctx = selinux_ctx; - ret = sss_selinux_extract_user(op_ctx, user_domain, username, &op_ctx->user); + ret = sysdb_search_user_by_name(op_ctx, user_domain, username, attrs, + &user_msg); if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_user_by_name failed.\n"); goto fail; } + op_ctx->user = talloc_zero(op_ctx, struct sysdb_attrs); + if (op_ctx->user == NULL) { + goto fail; + } + + op_ctx->user->a = talloc_steal(op_ctx->user, user_msg->elements); + op_ctx->user->num = user_msg->num_elements; + talloc_free(user_msg); + host_dn = sysdb_custom_dn(op_ctx, ipa_domain, hostname, HBAC_HOSTS_SUBDIR); if (host_dn == NULL) { goto fail; @@ -437,7 +619,7 @@ ipa_selinux_process_maps(TALLOC_CTX *mem_ctx, } for (i = 0; i < selinux_map_count; i++) { - if (sss_selinux_match(selinux_maps[i], user, host, &priority)) { + if (selinux_map_matches(selinux_maps[i], user, host, &priority)) { if (priority < top_priority) { /* This rule has lower priority than what we already have, * skip it. */ @@ -526,7 +708,7 @@ ipa_selinux_process_seealso_maps(struct sysdb_attrs *user, DEBUG(SSSDBG_TRACE_ALL, "Matching HBAC rule %s with SELinux mappings\n", hbac_dn); - if (!sss_selinux_match(hbac_rules[i], user, host, &priority)) { + if (!selinux_map_matches(hbac_rules[i], user, host, &priority)) { DEBUG(SSSDBG_TRACE_ALL, "Rule did not match\n"); continue; } @@ -651,6 +833,22 @@ static errno_t write_selinux_login_file(const char *orig_name, char *string); static errno_t remove_selinux_login_file(const char *username); +static const char *selinux_map_get_seuser(struct sysdb_attrs *usermap) +{ + int i; + const uint8_t *name; + const uint8_t *template = (const uint8_t *)SYSDB_SELINUX_USER; + + for (i = 0; i < usermap->num; i++) { + name = (const uint8_t *)usermap->a[i].name; + if (sss_utf8_case_eq(name, template) == 0) { + return (const char *)usermap->a[i].values[0].data; + } + } + + return NULL; +} + /* Choose best selinux user based on given order and write * the user to selinux login file. */ static errno_t choose_best_seuser(struct sysdb_attrs **usermaps, @@ -693,7 +891,7 @@ static errno_t choose_best_seuser(struct sysdb_attrs **usermaps, */ for (i = 0; i < order_count; i++) { for (j = 0; usermaps[j] != NULL; j++) { - tmp_str = sss_selinux_map_get_seuser(usermaps[j]); + tmp_str = selinux_map_get_seuser(usermaps[j]); if (tmp_str && !strcasecmp(tmp_str, order_array[i])) { /* If file_content contained something, overwrite it. diff --git a/src/util/sss_selinux.c b/src/util/sss_selinux.c deleted file mode 100644 index 165aeca1bbb8ffe32bea3c59b12ec33349b09073..0000000000000000000000000000000000000000 --- a/src/util/sss_selinux.c +++ /dev/null @@ -1,255 +0,0 @@ -/* - SSSD - - SELinux-related utility functions - - Authors: - Jan Zeleny - - Copyright (C) 2012 Red Hat - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "util/sss_selinux.h" -#include "util/sss_utf8.h" -#include "db/sysdb_selinux.h" - -static bool match_entity(struct ldb_message_element *values, - struct ldb_message_element *sought_values) -{ - int i, j; - - for (i = 0; i < values->num_values; i++) { - for (j = 0; j < sought_values->num_values; j++) { - if (values->values[i].length != sought_values->values[j].length) { - continue; - } - - if (strncasecmp((char *)values->values[i].data, - (char *)sought_values->values[j].data, - values->values[i].length) == 0) - return true; - } - } - - return false; -} - -bool sss_selinux_match(struct sysdb_attrs *usermap, - struct sysdb_attrs *user, - struct sysdb_attrs *host, - uint32_t *_priority) -{ - struct ldb_message_element *users_el = NULL; - struct ldb_message_element *usercat = NULL; - struct ldb_message_element *hosts_el = NULL; - struct ldb_message_element *hostcat = NULL; - struct ldb_message_element *dn; - struct ldb_message_element *memberof; - int i; - uint32_t priority = 0; - bool matched_name; - bool matched_group; - bool matched_category; - errno_t ret; - - if (usermap == NULL) { - DEBUG(SSSDBG_MINOR_FAILURE, "NULL given as usermap! Skipping ...\n"); - return false; - } - - /* Search for user and host related elements */ - for (i = 0; i < usermap->num; i++) { - if (!strcasecmp(usermap->a[i].name, SYSDB_ORIG_MEMBER_USER)) { - users_el = &usermap->a[i]; - } else if (!strcasecmp(usermap->a[i].name, SYSDB_ORIG_MEMBER_HOST)) { - hosts_el = &usermap->a[i]; - } else if (!strcasecmp(usermap->a[i].name, SYSDB_USER_CATEGORY)) { - usercat = &usermap->a[i]; - } else if (!strcasecmp(usermap->a[i].name, SYSDB_HOST_CATEGORY)) { - hostcat = &usermap->a[i]; - } - } - - if (user) { - ret = sysdb_attrs_get_el(user, SYSDB_ORIG_DN, &dn); - if (ret != EOK) { - DEBUG(SSSDBG_MINOR_FAILURE, "User does not have origDN\n"); - return false; - } - ret = sysdb_attrs_get_el(user, SYSDB_ORIG_MEMBEROF, &memberof); - if (ret != EOK) { - DEBUG(SSSDBG_TRACE_ALL, - "User does not have orig memberof, " - "therefore it can't match to any rule\n"); - return false; - } - - /** - * The rule won't match if user category != "all" and user map doesn't - * contain neither user nor any of his groups in memberUser attribute - */ - matched_category = false; - if (usercat != NULL) { - for (i = 0; i < usercat->num_values; i++) { - if (strcasecmp((char *)usercat->values[i].data, "all") == 0) { - matched_category = true; - break; - } - } - } - - if (!matched_category) { - if (users_el == NULL) { - DEBUG(SSSDBG_TRACE_ALL, "No users specified in the rule!\n"); - return false; - } else { - matched_name = match_entity(users_el, dn); - matched_group = match_entity(users_el, memberof); - if (matched_name) { - priority |= SELINUX_PRIORITY_USER_NAME; - } else if (matched_group) { - priority |= SELINUX_PRIORITY_USER_GROUP; - } else { - DEBUG(SSSDBG_TRACE_ALL, "User did not match\n"); - return false; - } - } - } else { - priority |= SELINUX_PRIORITY_USER_CAT; - } - } - - if (host) { - ret = sysdb_attrs_get_el(host, SYSDB_ORIG_DN, &dn); - if (ret != EOK) { - DEBUG(SSSDBG_MINOR_FAILURE, "Host does not have origDN\n"); - return false; - } - ret = sysdb_attrs_get_el(host, SYSDB_ORIG_MEMBEROF, &memberof); - if (ret != EOK) { - DEBUG(SSSDBG_TRACE_ALL, - "Host does not have orig memberof, " - "therefore it can't match to any rule\n"); - return false; - } - - /** - * The rule won't match if host category != "all" and user map doesn't - * contain neither host nor any of its groups in memberHost attribute - */ - matched_category = false; - if (hostcat != NULL) { - for (i = 0; i < hostcat->num_values; i++) { - if (strcasecmp((char *)hostcat->values[i].data, "all") == 0) { - matched_category = true; - break; - } - } - } - if (!matched_category) { - if (hosts_el == NULL) { - DEBUG(SSSDBG_TRACE_ALL, "No users specified in the rule!\n"); - return false; - } else { - matched_name = match_entity(hosts_el, dn); - matched_group = match_entity(hosts_el, memberof); - if (matched_name) { - priority |= SELINUX_PRIORITY_HOST_NAME; - } else if (matched_group) { - priority |= SELINUX_PRIORITY_HOST_GROUP; - } else { - DEBUG(SSSDBG_TRACE_ALL, "Host did not match\n"); - return false; - } - } - } else { - priority |= SELINUX_PRIORITY_HOST_CAT; - } - } - - if (_priority != NULL) { - *_priority = priority; - } - - return true; -} - -errno_t sss_selinux_extract_user(TALLOC_CTX *mem_ctx, - struct sss_domain_info *domain, - const char *username, - struct sysdb_attrs **_user_attrs) -{ - TALLOC_CTX *tmp_ctx; - const char **attrs; - struct sysdb_attrs *user_attrs; - struct ldb_message *user_msg; - - errno_t ret; - - tmp_ctx = talloc_new(NULL); - if (tmp_ctx == NULL) { - ret = ENOMEM; - goto done; - } - - attrs = talloc_array(tmp_ctx, const char *, 3); - if (attrs == NULL) { - DEBUG(SSSDBG_CRIT_FAILURE, "talloc_array failed.\n"); - ret = ENOMEM; - goto done; - } - attrs[0] = SYSDB_ORIG_DN; - attrs[1] = SYSDB_ORIG_MEMBEROF; - attrs[2] = NULL; - - ret = sysdb_search_user_by_name(tmp_ctx, domain, username, attrs, - &user_msg); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_user_by_name failed.\n"); - goto done; - } - - user_attrs = talloc_zero(tmp_ctx, struct sysdb_attrs); - if (user_attrs == NULL) { - ret = ENOMEM; - goto done; - } - user_attrs->a = talloc_steal(user_attrs, user_msg->elements); - user_attrs->num = user_msg->num_elements; - - *_user_attrs = talloc_steal(mem_ctx, user_attrs); - ret = EOK; - -done: - talloc_free(tmp_ctx); - return ret; -} - -const char *sss_selinux_map_get_seuser(struct sysdb_attrs *usermap) -{ - int i; - const uint8_t *name; - const uint8_t *template = (const uint8_t *)SYSDB_SELINUX_USER; - - for (i = 0; i < usermap->num; i++) { - name = (const uint8_t *)usermap->a[i].name; - if (sss_utf8_case_eq(name, template) == 0) { - return (const char *)usermap->a[i].values[0].data; - } - } - - return NULL; -} diff --git a/src/util/sss_selinux.h b/src/util/sss_selinux.h deleted file mode 100644 index 8821e73b628cfe1af9474f4f623acc2886b59c06..0000000000000000000000000000000000000000 --- a/src/util/sss_selinux.h +++ /dev/null @@ -1,54 +0,0 @@ -/* - SSSD - - SELinux-related utility functions - - Authors: - Jan Zeleny - - Copyright (C) 2012 Red Hat - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#ifndef SSS_SELINUX_H_ -#define SSS_SELINUX_H_ - -#include -#include - -#include - -#define SELINUX_PRIORITY_USER_CAT 1 -#define SELINUX_PRIORITY_USER_GROUP 2 -#define SELINUX_PRIORITY_USER_NAME 4 -/* According to specification, host has higher priority */ -#define SELINUX_PRIORITY_HOST_CAT 8 -#define SELINUX_PRIORITY_HOST_GROUP 16 -#define SELINUX_PRIORITY_HOST_NAME 32 - -errno_t -sss_selinux_extract_user(TALLOC_CTX *mem_ctx, - struct sss_domain_info *domain, - const char *username, - struct sysdb_attrs **_user_attrs); - -bool sss_selinux_match(struct sysdb_attrs *usermap, - struct sysdb_attrs *user, - struct sysdb_attrs *host, - uint32_t *_priority); - -const char *sss_selinux_map_get_seuser(struct sysdb_attrs *usermap); - -#endif /* SSS_SELINUX_H_ */ -- 1.8.5.3