>From 44ebdde63bae103ddfb141a8a34aec7e5a080d27 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Wed, 24 Apr 2013 20:26:40 +0200 Subject: [PATCH 2/2] SUDO: IPA provider This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733 --- Makefile.am | 5 +++ src/providers/ipa/ipa_common.c | 80 +++++++++++++++++++++++++++++++++++++++++ src/providers/ipa/ipa_common.h | 12 +++++++ src/providers/ipa/ipa_init.c | 24 +++++++++++++ src/providers/ipa/ipa_opts.h | 16 +++++++++ src/providers/ipa/ipa_sudo.c | 82 ++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 219 insertions(+) create mode 100644 src/providers/ipa/ipa_sudo.c diff --git a/Makefile.am b/Makefile.am index ef1802246226bd08826f028a784d80289b723d81..dce4f8b13ac42597c349fbfce728fb3e56293225 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1545,6 +1545,11 @@ libsss_ipa_la_SOURCES += \ src/providers/ipa/ipa_autofs.c endif +if BUILD_SUDO +libsss_ipa_la_SOURCES += \ + src/providers/ipa/ipa_sudo.c +endif + if BUILD_SSH libsss_ipa_la_SOURCES += src/providers/ipa/ipa_hostid.c endif diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c index be1bd1d2f8c42143d7ff1fe205ffb774ffe19dd0..2b4b0a9bdb4c754eb8da29adfbba9415baebc650 100644 --- a/src/providers/ipa/ipa_common.c +++ b/src/providers/ipa/ipa_common.c @@ -1008,3 +1008,83 @@ done: talloc_free(tmp_ctx); return ret; } + +int ipa_get_sudo_options(struct ipa_options *ipa_opts, + struct confdb_ctx *cdb, + const char *conf_path, + struct sdap_options **_opts, + bool *use_host_filter, + bool *include_regexp, + bool *include_netgroups) +{ + TALLOC_CTX *tmp_ctx; + errno_t ret; + char *basedn; + char *sudo_base; + + tmp_ctx = talloc_new(NULL); + if (!tmp_ctx) { + return ENOMEM; + } + + ret = domain_to_basedn(tmp_ctx, + dp_opt_get_string(ipa_opts->basic, IPA_KRB5_REALM), + &basedn); + if (ret != EOK) { + goto done; + } + + if (NULL == dp_opt_get_string(ipa_opts->id->basic, + SDAP_SUDO_SEARCH_BASE)) { + + sudo_base = talloc_asprintf(tmp_ctx, "ou=sudoers,%s", basedn); + if (!sudo_base) { + ret = ENOMEM; + goto done; + } + + ret = dp_opt_set_string(ipa_opts->id->basic, + SDAP_SUDO_SEARCH_BASE, + sudo_base); + if (ret != EOK) { + goto done; + } + + DEBUG(SSSDBG_TRACE_LIBS, ("Option %s set to %s\n", + ipa_opts->id->basic[SDAP_SUDO_SEARCH_BASE].opt_name, + dp_opt_get_string(ipa_opts->id->basic, + SDAP_SUDO_SEARCH_BASE))); + } + + ret = sdap_parse_search_base(ipa_opts->id, ipa_opts->id->basic, + SDAP_SUDO_SEARCH_BASE, + &ipa_opts->id->sudo_search_bases); + if (ret != EOK && ret != ENOENT) { + DEBUG(SSSDBG_OP_FAILURE, ("Could not parse sudo search base\n")); + goto done; + } + + /* attrs map */ + ret = sdap_get_map(ipa_opts->id, cdb, conf_path, + ipa_sudorule_map, + SDAP_OPTS_SUDO, + &ipa_opts->id->sudorule_map); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Could not get SUDO attribute map\n")); + return ret; + } + + /* host filter */ + *use_host_filter = dp_opt_get_bool(ipa_opts->id->basic, + SDAP_SUDO_USE_HOST_FILTER); + *include_netgroups = dp_opt_get_bool(ipa_opts->id->basic, + SDAP_SUDO_INCLUDE_NETGROUPS); + *include_regexp = dp_opt_get_bool(ipa_opts->id->basic, + SDAP_SUDO_INCLUDE_REGEXP); + + *_opts = ipa_opts->id; + ret = EOK; +done: + talloc_free(tmp_ctx); + return ret; +} diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index ae1c91731e9637c06dad555d1a87ef2e0cf53184..fe4ba2dd82c6db9fa88bc4558dbcd9bd429f2af4 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -168,6 +168,13 @@ int ipa_get_autofs_options(struct ipa_options *ipa_opts, struct confdb_ctx *cdb, const char *conf_path, struct sdap_options **_opts); +int ipa_get_sudo_options(struct ipa_options *ipa_opts, + struct confdb_ctx *cdb, + const char *conf_path, + struct sdap_options **_opts, + bool *use_host_filter, + bool *include_regexp, + bool *include_netgroups); int ipa_autofs_init(struct be_ctx *be_ctx, struct ipa_id_ctx *id_ctx, @@ -180,4 +187,9 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx, struct ipa_options *options, struct ipa_service **_service); +int ipa_sudo_init(struct be_ctx *be_ctx, + struct ipa_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data); + #endif /* _IPA_COMMON_H_ */ diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c index b65a6cea1ddd05272a8ae522be5c8b070a93ac1e..0e9fe0dd185e7b237bf4cda077e872dfd0d07fe2 100644 --- a/src/providers/ipa/ipa_init.c +++ b/src/providers/ipa/ipa_init.c @@ -526,3 +526,27 @@ int sssm_ipa_subdomains_init(struct be_ctx *bectx, return EOK; } + +int sssm_ipa_sudo_init(struct be_ctx *bectx, + struct bet_ops **ops, + void **pvt_data) +{ +#ifdef BUILD_SUDO + struct ipa_id_ctx *id_ctx; + int ret; + + DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing IPA sudo handler\n")); + + ret = sssm_ipa_id_init(bectx, ops, (void **) &id_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("sssm_ipa_id_init failed.\n")); + return ret; + } + + return ipa_sudo_init(bectx, id_ctx, ops, pvt_data); +#else + DEBUG(SSSDBG_MINOR_FAILURE, ("Sudo init handler called but SSSD is " + "built without sudo support, ignoring\n")); + return EOK; +#endif +} diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h index 6adbdd96a907c26938b8cb80d22f156b09bbacc3..2fe7e1c29e1dab8c18575a9fb2b368836514a1f0 100644 --- a/src/providers/ipa/ipa_opts.h +++ b/src/providers/ipa/ipa_opts.h @@ -290,4 +290,20 @@ struct sdap_attr_map ipa_autofs_entry_map[] = { SDAP_ATTR_MAP_TERMINATOR }; +struct sdap_attr_map ipa_sudorule_map[] = { + { "ldap_sudorule_object_class", "sudoRole", SYSDB_SUDO_CACHE_OC, NULL }, + { "ldap_sudorule_name", "cn", SYSDB_SUDO_CACHE_AT_CN, NULL }, + { "ldap_sudorule_command", "sudoCommand", SYSDB_SUDO_CACHE_AT_COMMAND, NULL }, + { "ldap_sudorule_host", "sudoHost", SYSDB_SUDO_CACHE_AT_HOST, NULL }, + { "ldap_sudorule_user", "sudoUser", SYSDB_SUDO_CACHE_AT_USER, NULL }, + { "ldap_sudorule_option", "sudoOption", SYSDB_SUDO_CACHE_AT_OPTION, NULL }, + { "ldap_sudorule_runasuser", "sudoRunAsUser", SYSDB_SUDO_CACHE_AT_RUNASUSER, NULL }, + { "ldap_sudorule_runasgroup", "sudoRunAsGroup", SYSDB_SUDO_CACHE_AT_RUNASGROUP, NULL }, + { "ldap_sudorule_notbefore", "sudoNotBefore", SYSDB_SUDO_CACHE_AT_NOTBEFORE, NULL }, + { "ldap_sudorule_notafter", "sudoNotAfter", SYSDB_SUDO_CACHE_AT_NOTAFTER, NULL }, + { "ldap_sudorule_order", "sudoOrder", SYSDB_SUDO_CACHE_AT_ORDER, NULL }, + { "ldap_sudorule_entry_usn", NULL, SYSDB_USN, NULL }, + SDAP_ATTR_MAP_TERMINATOR +}; + #endif /* IPA_OPTS_H_ */ diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c new file mode 100644 index 0000000000000000000000000000000000000000..c6fb3cb88361ea56b63e8d347c07cdaa2f796228 --- /dev/null +++ b/src/providers/ipa/ipa_sudo.c @@ -0,0 +1,82 @@ +/* + SSSD + + IPA Provider Initialization functions + + Authors: + Lukas Slebodnik + + Copyright (C) 2013 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + */ + +#include "providers/ipa/ipa_common.h" +#include "providers/ipa/ipa_id.h" +#include "providers/ipa/ipa_auth.h" + +#include "providers/ldap/sdap_sudo.h" +#include "db/sysdb_sudo.h" + +struct bet_ops ipa_sudo_ops = { + .handler = sdap_sudo_handler, + .finalize = NULL, + .check_online = sdap_check_online +}; + +int ipa_sudo_init(struct be_ctx *be_ctx, + struct ipa_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data) +{ + struct sdap_sudo_ctx *sudo_ctx = NULL; + int ret; + + DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo IPA back end\n")); + + sudo_ctx = talloc_zero(be_ctx, struct sdap_sudo_ctx); + if (sudo_ctx == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("talloc() failed\n")); + return ENOMEM; + } + + sudo_ctx->id_ctx = id_ctx->sdap_id_ctx; + *ops = &ipa_sudo_ops; + *pvt_data = sudo_ctx; + + /* we didn't do any full refresh now, + * so we don't have current usn values available */ + sudo_ctx->full_refresh_done = false; + + ret = ipa_get_sudo_options(id_ctx->ipa_options, be_ctx->cdb, + be_ctx->conf_path, &id_ctx->sdap_id_ctx->opts, + &sudo_ctx->use_host_filter, + &sudo_ctx->include_regexp, + &sudo_ctx->include_netgroups); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n", + ret, strerror(ret))); + return ret; + } + + ret = sdap_retrieve_host_information(be_ctx, sudo_ctx, + id_ctx->sdap_id_ctx->opts); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n", + ret, strerror(ret))); + return ret; + } + + return EOK; +} -- 1.8.1.4