From f4bed4426ab571bc933dfdfd606b106bf0f63709 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Fri, 11 Nov 2011 10:51:14 +0100 Subject: [PATCH 12/13] SUDO integration - SUDO LDAP provider - store sudoers to sysdb --- src/providers/ldap/sdap_sudo.c | 106 ++++++++++++++++++++++++++++++++++++++- src/providers/ldap/sdap_sudo.h | 1 + 2 files changed, 104 insertions(+), 3 deletions(-) diff --git a/src/providers/ldap/sdap_sudo.c b/src/providers/ldap/sdap_sudo.c index ec48a49..c188102 100644 --- a/src/providers/ldap/sdap_sudo.c +++ b/src/providers/ldap/sdap_sudo.c @@ -52,6 +52,10 @@ static int sdap_sudo_connect(struct sdap_sudo_ctx *sudo_ctx); static void sdap_sudo_connect_done(struct tevent_req *subreq); static int sdap_sudo_load_sudoers(struct sdap_sudo_ctx *sudo_ctx); static void sdap_sudo_load_sudoers_done(struct tevent_req *subreq); +static int sdap_sudo_purge_sudoers(struct sdap_sudo_ctx *sudo_ctx); +static int sdap_sudo_store_sudoers(struct sdap_sudo_ctx *sudo_ctx, + size_t replies_count, + struct sysdb_attrs **replies); void sdap_sudo_handler(struct be_req *be_req) { @@ -159,6 +163,7 @@ int sdap_sudo_load_sudoers(struct sdap_sudo_ctx *sudo_ctx) struct be_ctx *be_ctx = sudo_ctx->be_ctx; struct sdap_id_ctx *sdap_ctx = sudo_ctx->sdap_ctx; static const char *attrs[] = { + SDAP_SUDO_ATTR_CN, SDAP_SUDO_ATTR_USER, SDAP_SUDO_ATTR_HOST, SDAP_SUDO_ATTR_COMMAND, @@ -200,19 +205,33 @@ int sdap_sudo_load_sudoers(struct sdap_sudo_ctx *sudo_ctx) void sdap_sudo_load_sudoers_done(struct tevent_req *subreq) { struct sdap_sudo_ctx *sudo_ctx = NULL; - struct sysdb_attrs **reply = NULL; - size_t reply_count = 0; + struct sysdb_attrs **replies = NULL; + size_t replies_count = 0; int ret; DEBUG(SSSDBG_TRACE_FUNC, ("Entering sdap_sudo_load_sudoers_done()\n")); sudo_ctx = tevent_req_callback_data(subreq, struct sdap_sudo_ctx); - ret = sdap_get_generic_recv(subreq, sudo_ctx, &reply_count, &reply); + ret = sdap_get_generic_recv(subreq, sudo_ctx, &replies_count, &replies); if (ret != EOK) { goto fail; } + ret = sdap_sudo_purge_sudoers(sudo_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to purge sudoers cache\n")); + goto fail; + } + + ret = sdap_sudo_store_sudoers(sudo_ctx, replies_count, replies); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to store sudoers in cache\n")); + goto fail; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("Sudoers is successfuly stored in cache\n")); + sdap_sudo_reply(sudo_ctx, EOK); return; @@ -220,3 +239,84 @@ void sdap_sudo_load_sudoers_done(struct tevent_req *subreq) fail: sdap_sudo_reply(sudo_ctx, ret); } + +int sdap_sudo_purge_sudoers(struct sdap_sudo_ctx *sudo_ctx) +{ + struct sysdb_ctx *sysdb_ctx = sudo_ctx->be_ctx->sysdb; + struct ldb_dn *base_dn = NULL; + TALLOC_CTX *tmp_ctx = NULL; + int ret = EOK; + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n")); + ret = ENOMEM; + goto done; + } + + base_dn = sysdb_sudo_dn(sysdb_ctx, tmp_ctx, sudo_ctx->be_ctx->domain->name); + if (base_dn == NULL) { + ret = ENOMEM; + goto done; + } + + ret = sysdb_delete_recursive(sysdb_ctx, base_dn, true); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("sysdb_delete_recursive() failed.\n")); + goto done; + } + + ret = EOK; + +done: + talloc_free(tmp_ctx); + return ret; +} + +int sdap_sudo_store_sudoers(struct sdap_sudo_ctx *sudo_ctx, + size_t replies_count, + struct sysdb_attrs **replies) +{ + struct sysdb_ctx *sysdb_ctx = sudo_ctx->be_ctx->sysdb; + const char *name = NULL; + bool in_transaction = false; + int ret = EOK; + int i = 0; + + ret = sysdb_transaction_start(sysdb_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Could not start transaction\n")); + goto fail; + } + in_transaction = true; + + for (i = 0; i < replies_count; i++) { + ret = sysdb_attrs_get_string(replies[i], SDAP_SUDO_ATTR_CN, &name); + if (ret != EOK) { + goto fail; + } + + ret = sysdb_add_sudorule(sysdb_ctx, name, replies[i], 0, 0); + if (ret != EOK) { + goto fail; + } + } + + ret = sysdb_transaction_commit(sysdb_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to commit transaction\n")); + goto fail; + } + + return EOK; + +fail: + if (in_transaction) { + ret = sysdb_transaction_cancel(sysdb_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Could not cancel transaction\n")); + } + } + + return ret; +} diff --git a/src/providers/ldap/sdap_sudo.h b/src/providers/ldap/sdap_sudo.h index b3cf44a..8e1bdfd 100644 --- a/src/providers/ldap/sdap_sudo.h +++ b/src/providers/ldap/sdap_sudo.h @@ -29,6 +29,7 @@ struct sdap_sudo_ctx { struct sdap_id_conn_cache *sdap_conn_cache; }; +#define SDAP_SUDO_ATTR_CN "cn" #define SDAP_SUDO_ATTR_USER "sudoUser" #define SDAP_SUDO_ATTR_HOST "sudoHost" #define SDAP_SUDO_ATTR_COMMAND "sudoCommand" -- 1.7.6.4