On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch adds simple_allow_groups and simple_deny_groups options
to the simple access provider. It makes it possible to grant or
deny access based on a user's group memberships within the domain.
This patch makes one minor change to previous functionality: now
all deny rules will supersede allow rules. Previously, if both
simple_allow_users and simple_deny_users were set with the same
value, the allow would win.
Fixes
https://fedorahosted.org/sssd/ticket/440
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0A86gACgkQeiVVYja6o6NElwCeI1H9O8tzCkAM++awKInGJr9R
l0QAn20A7tbxmfOKdBuhXC4aMsyTes3V
=K45L
-----END PGP SIGNATURE-----
+
+ /* Construct a list of the user's groups */
+ for (i = 0; i < msg->num_elements; i++) {
+ if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {
If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
Why do you run the loop yourself instead of using ldb_msg_find_element() ?
+ /* Get the groups from the memberOf entries
+ * Allocate the array with room for both the NULL
+ * terminator and the primary group
+ */
+ groups = talloc_array(tmp_ctx, char *, msg->elements[i].num_values + 2);
+ if (!groups) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ for (j = 0; j < msg->elements[i].num_values; j++) {
+ ret = sysdb_group_dn_name(
+ ctx->sysdb, tmp_ctx,
+ (char *)msg->elements[i].values[j].data,
+ &groups[j]);
+ if (ret != EOK) {
+ goto done;
+ }
+ }
+ }
+ }
+
+ /* Get the user's primary group */
+ gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0);
+ if (!gid) {
+ ret = EINVAL;
+ goto done;
+ }
+ talloc_zfree(msg);
+
+ ret = sysdb_search_group_by_gid(tmp_ctx, ctx->sysdb, ctx->domain,
+ gid, group_attrs, &msg);
+ if (ret != EOK) {
+ DEBUG(1, ("Could not look up primary group [%lu]: [%d][%s]\n",
+ gid, ret, strerror(ret)));
+ goto done;
+ }
+
+ primary_group = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
+ if (!primary_group) {
+ ret = EINVAL;
+ goto done;
+ }
+
+ groups[j] = talloc_strdup(tmp_ctx, primary_group);
+ if (!groups[j]) {
+ ret = ENOMEM;
+ goto done;
+ }
+ groups[j+1] = NULL;
+ talloc_zfree(msg);
+
groups and j might be undefined.
bye,
Sumit