From 9e7c3dc2cc5dff653fcbe0cf298426604ffeb278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Fri, 13 Jan 2012 13:59:23 +0100 Subject: [PATCH 1/6] SUDO Integration - responder 'sudo_timed' option https://fedorahosted.org/sssd/ticket/1116 --- src/confdb/confdb.h | 1 + src/responder/sudo/sudosrv.c | 10 ++++++++++ src/responder/sudo/sudosrv_cmd.c | 7 +++++++ src/responder/sudo/sudosrv_get_sudorules.c | 11 +++++++++-- src/responder/sudo/sudosrv_private.h | 2 ++ 5 files changed, 29 insertions(+), 2 deletions(-) diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h index 7cfc73d..3720efb 100644 --- a/src/confdb/confdb.h +++ b/src/confdb/confdb.h @@ -93,6 +93,7 @@ /* SUDO */ #define CONFDB_SUDO_CONF_ENTRY "config/sudo" +#define CONFDB_SUDO_TIMED "sudo_timed" /* Data Provider */ #define CONFDB_DP_CONF_ENTRY "config/dp" diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c index 841be43..457b90b 100644 --- a/src/responder/sudo/sudosrv.c +++ b/src/responder/sudo/sudosrv.c @@ -113,6 +113,16 @@ int sudo_process_init(TALLOC_CTX *mem_ctx, } sudo_ctx->rctx->pvt_ctx = sudo_ctx; + /* Get sudo_timed option */ + ret = confdb_get_bool(sudo_ctx->rctx->cdb, sudo_ctx, + CONFDB_SUDO_CONF_ENTRY, CONFDB_SUDO_TIMED, + false, &sudo_ctx->option_timed); + if (ret != EOK) { + DEBUG(SSSDBG_FATAL_FAILURE, ("Error reading from confdb (%d) [%s]\n", + ret, strerror(ret))); + return ret; + } + /* Enable automatic reconnection to the Data Provider */ ret = confdb_get_int(sudo_ctx->rctx->cdb, sudo_ctx->rctx, CONFDB_SUDO_CONF_ENTRY, diff --git a/src/responder/sudo/sudosrv_cmd.c b/src/responder/sudo/sudosrv_cmd.c index 72e608b..e05ce7d 100644 --- a/src/responder/sudo/sudosrv_cmd.c +++ b/src/responder/sudo/sudosrv_cmd.c @@ -157,6 +157,13 @@ static int sudosrv_cmd_get_sudorules(struct cli_ctx *cli_ctx) } dctx->cmd_ctx = cmd_ctx; + dctx->sudo_ctx = talloc_get_type(cli_ctx->rctx->pvt_ctx, struct sudo_ctx); + if (!dctx->sudo_ctx) { + DEBUG(SSSDBG_FATAL_FAILURE, ("sudo_ctx not set\n")); + ret = EFAULT; + goto done; + } + /* get query */ sss_packet_get_body(cli_ctx->creq->in, &query_body, &query_len); if (query_len <= 0 || query_body == NULL) { diff --git a/src/responder/sudo/sudosrv_get_sudorules.c b/src/responder/sudo/sudosrv_get_sudorules.c index fca6257..5af5285 100644 --- a/src/responder/sudo/sudosrv_get_sudorules.c +++ b/src/responder/sudo/sudosrv_get_sudorules.c @@ -290,6 +290,7 @@ static void sudosrv_get_sudorules_dp_callback(struct tevent_req *req) static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, + bool timed, const char *username, uid_t uid, char **groupnames, @@ -326,6 +327,7 @@ static errno_t sudosrv_get_sudorules_from_cache(struct sudo_dom_ctx *dctx) } ret = sudosrv_get_sudorules_query_cache(dctx, sysdb, + dctx->sudo_ctx->option_timed, dctx->cmd_ctx->username, uid, groupnames, &dctx->res, &dctx->res_count); @@ -349,6 +351,7 @@ sort_sudo_rules(struct sysdb_attrs **rules, size_t count); static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, + bool timed, const char *username, uid_t uid, char **groupnames, @@ -361,6 +364,7 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, size_t count; struct sysdb_attrs **rules; struct ldb_message **msgs; + unsigned int flags = SYSDB_SUDO_FILTER_NONE; const char *attrs[] = { SYSDB_OBJECTCLASS SYSDB_SUDO_CACHE_AT_OC, SYSDB_SUDO_CACHE_AT_CN, @@ -378,9 +382,12 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) return ENOMEM; + flags = SYSDB_SUDO_FILTER_NGRS + | SYSDB_SUDO_FILTER_INCLUDE_ALL + | SYSDB_SUDO_FILTER_INCLUDE_DFL + | (timed ? SYSDB_SUDO_FILTER_TIMED : SYSDB_SUDO_FILTER_NONE); ret = sysdb_get_sudo_filter(tmp_ctx, username, uid, groupnames, - (SYSDB_SUDO_FILTER_NGRS | SYSDB_SUDO_FILTER_INCLUDE_ALL | - SYSDB_SUDO_FILTER_INCLUDE_DFL), &filter); + flags, &filter); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, ("Could not construct the search filter [%d]: %s\n", diff --git a/src/responder/sudo/sudosrv_private.h b/src/responder/sudo/sudosrv_private.h index 7401570..ae5d854 100644 --- a/src/responder/sudo/sudosrv_private.h +++ b/src/responder/sudo/sudosrv_private.h @@ -33,6 +33,7 @@ struct sudo_ctx { struct resp_ctx *rctx; + bool option_timed; }; struct sudo_cmd_ctx { @@ -42,6 +43,7 @@ struct sudo_cmd_ctx { }; struct sudo_dom_ctx { + struct sudo_ctx *sudo_ctx; struct sudo_cmd_ctx *cmd_ctx; struct sss_domain_info *domain; bool check_provider; -- 1.7.6.4