From 0d257e1ae6417ef4c3c7c4657b5565ff45128ae0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 31 Jan 2012 15:51:35 +0100 Subject: [PATCH 2/2] Fixes for sudo_timed https://fedorahosted.org/sssd/ticket/1116 --- src/db/sysdb_sudo.c | 65 +++++++++++++++++++++++++++++----------------- src/man/sssd.conf.5.xml | 13 +++++++++ 2 files changed, 54 insertions(+), 24 deletions(-) diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c index cea4fcbaf2f020f48a5c3c83a468638b0309148d..5f87a80cd85f44ae9b0feff04d77a7096d599f50 100644 --- a/src/db/sysdb_sudo.c +++ b/src/db/sysdb_sudo.c @@ -43,20 +43,29 @@ static errno_t sysdb_sudo_check_time(struct sysdb_attrs *rule, TALLOC_CTX *tmp_ctx = NULL; const char **values = NULL; char *tret = NULL; + time_t notBefore = 0; + time_t notAfter = 0; time_t converted; struct tm tm; errno_t ret; int i; + if (!result) return EINVAL; + *result = false; + tmp_ctx = talloc_new(NULL); NULL_CHECK(tmp_ctx, ret, done); /* * From man sudoers.ldap: * - * A timestamp is in the form yyyymmddHHMMZ. + * A timestamp is in the form yyyymmddHHMMSSZ. * If multiple sudoNotBefore entries are present, the *earliest* is used. * If multiple sudoNotAfter entries are present, the *last one* is used. + * + * From sudo sources, ldap.c: + * If either the sudoNotAfter or sudoNotBefore attributes are missing, + * no time restriction shall be imposed. */ /* check for sudoNotBefore */ @@ -64,19 +73,27 @@ static errno_t sysdb_sudo_check_time(struct sysdb_attrs *rule, tmp_ctx, &values); if (ret != EOK) { goto done; + } else if (ret == ENOENT) { + DEBUG(SSSDBG_TRACE_LIBS, + ("notBefore attribute is missing, the rule is valid\n")); + *result = true; + ret = EOK; } - if (values != NULL && values[0] != NULL) { - tret = strptime(values[0], SYSDB_SUDO_TIME_FORMAT, &tm); + + for (i=0; values[i] ; i++) { + tret = strptime(values[i], SYSDB_SUDO_TIME_FORMAT, &tm); if (tret == NULL || *tret != '\0') { - DEBUG(SSSDBG_FUNC_DATA, ("Invalid time format!\n")); + DEBUG(SSSDBG_MINOR_FAILURE, ("Invalid time format!\n")); ret = EINVAL; goto done; } converted = mktime(&tm); - if (now < converted) { - *result = false; - goto done; + /* Grab the earliest */ + if (!notBefore) { + notBefore = converted; + } else if (notBefore > converted) { + notBefore = converted; } } @@ -85,36 +102,36 @@ static errno_t sysdb_sudo_check_time(struct sysdb_attrs *rule, tmp_ctx, &values); if (ret != EOK) { goto done; + } else if (ret == ENOENT) { + DEBUG(SSSDBG_TRACE_LIBS, + ("notAfter attribute is missing, the rule is valid\n")); + *result = true; + ret = EOK; } - if (values != NULL && values[0] != NULL) { - /* find last value */ - for (i = 0; values[i] != NULL; i++) { - // do nothing - } - tret = strptime(values[i - 1], SYSDB_SUDO_TIME_FORMAT, &tm); + for (i=0; values[i] ; i++) { + tret = strptime(values[i], SYSDB_SUDO_TIME_FORMAT, &tm); if (tret == NULL || *tret != '\0') { - DEBUG(SSSDBG_FUNC_DATA, ("Invalid time format!\n")); + DEBUG(SSSDBG_MINOR_FAILURE, ("Invalid time format!\n")); ret = EINVAL; goto done; } converted = mktime(&tm); - if (now > converted) { - *result = false; - goto done; + /* Grab the latest */ + if (!notAfter) { + notAfter = converted; + } else if (notAfter < converted) { + notAfter = converted; } } - *result = true; + if (now >= notBefore && now <= notAfter) { + *result = true; + } + ret = EOK; - done: - if (ret == ENOENT) { - *result = true; - ret = EOK; - } - talloc_free(tmp_ctx); return ret; } diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index b12534b3c12020bc96f4175237ee7e9e486828ae..e06232fcb65ca97eb5550c74f7aef722548be311 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -629,6 +629,19 @@ + + sudo_timed (bool) + + + Whether or not to evaluate the sudoNotBefore + and sudoNotAfter attributes that implement + time-dependent sudoers entries. + + + Default: false + + + -- 1.7.7.6