From 71aa5227f08a64667db33bd4e42800be0280e93d Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 9 May 2012 12:43:06 -0400
Subject: [PATCH 2/2] NSS: Add default_shell option

This option will allow administrators to set a default shell to be
used if a user does not have one set in the identity provider.

https://fedorahosted.org/sssd/ticket/1289
---
 src/confdb/confdb.h            |    1 +
 src/config/SSSDConfig.py       |    1 +
 src/config/etc/sssd.api.conf   |    1 +
 src/man/sssd.conf.5.xml        |   15 +++++++++++++++
 src/responder/nss/nsssrv.c     |    7 +++++++
 src/responder/nss/nsssrv.h     |    1 +
 src/responder/nss/nsssrv_cmd.c |    8 +++++++-
 7 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index c816d5334e7c3bd9ec6ec0e3bc4609a5df5e3d6a..2468f7e504b56c3c091b450058cc21a8b8887e45 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -85,6 +85,7 @@
 #define CONFDB_NSS_VETOED_SHELL  "vetoed_shells"
 #define CONFDB_NSS_ALLOWED_SHELL "allowed_shells"
 #define CONFDB_NSS_SHELL_FALLBACK "shell_fallback"
+#define CONFDB_NSS_DEFAULT_SHELL "default_shell"
 
 /* PAM */
 #define CONFDB_PAM_CONF_ENTRY "config/pam"
diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 894837d402cf95f21f2c50d002154e5d50fadbd2..a44e138f6461681709d78bbece86f6f8720ae31c 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -67,6 +67,7 @@ option_strings = {
     'allowed_shells' : _('The list of shells users are allowed to log in with'),
     'vetoed_shells' : _('The list of shells that will be vetoed, and replaced with the fallback shell'),
     'shell_fallback' : _('If a shell stored in central directory is allowed but not available, use this fallback'),
+    'default_shell': _('Shell to use if the provider does not list one'),
 
     # [pam]
     'offline_credentials_expiration' : _('How long to allow cached logins between online logins (days)'),
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index ca946dab0b465d24fad2ec47508e770d218a4734..a1caa7b53be52a7a7165d268634a66ec1c74933d 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -36,6 +36,7 @@ fallback_homedir = str, None, false
 allowed_shells = list, str, false
 vetoed_shells = list, str, false
 shell_fallback = str, None, false
+default_shell = str, None, false
 get_domains_timeout = int, None, false
 
 [pam]
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index ed3c6753d702ce9861cae3c45650f73cb924c5ac..ad1d6d0d9d117256aad4e852db1de3ae5bd89b3c 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -517,6 +517,21 @@
                     </listitem>
                 </varlistentry>
                 <varlistentry>
+                    <term>default_shell</term>
+                    <listitem>
+                        <para>
+                            The default shell to use if the provider does not
+                            return one during lookup. This option supercedes
+                            any other shell options if it takes effect.
+                        </para>
+                        <para>
+                            Default: not set (Return NULL if no shell is
+                            specified and rely on libc to substitute something
+                            sensible when necessary, usually /bin/sh)
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
                     <term>get_domains_timeout (int)</term>
                     <listitem>
                         <para>
diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c
index c8ee444a8c470e5fe8adece7f24368cad0264d80..9cb4a569722dcdab2bc6daaf55b13bb21aa6f2fd 100644
--- a/src/responder/nss/nsssrv.c
+++ b/src/responder/nss/nsssrv.c
@@ -192,6 +192,7 @@ static int nss_get_config(struct nss_ctx *nctx,
                                     CONFDB_NSS_VETOED_SHELL,
                                     &nctx->vetoed_shells);
     if (ret != EOK && ret != ENOENT) goto done;
+
     ret = nss_get_etc_shells(nctx, &nctx->etc_shells);
     if (ret != EOK) goto done;
 
@@ -201,6 +202,12 @@ static int nss_get_config(struct nss_ctx *nctx,
                             &nctx->shell_fallback);
     if (ret != EOK) goto done;
 
+    ret = confdb_get_string(cdb, nctx, CONFDB_NSS_CONF_ENTRY,
+                            CONFDB_NSS_DEFAULT_SHELL,
+                            NULL,
+                            &nctx->default_shell);
+    if (ret != EOK) goto done;
+
     ret = 0;
 done:
     return ret;
diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h
index 5b5ae50b9630f444239d665b628e7ecb70aea302..58cd3da0ff9220d917e6529e3f528eb751d83b02 100644
--- a/src/responder/nss/nsssrv.h
+++ b/src/responder/nss/nsssrv.h
@@ -66,6 +66,7 @@ struct nss_ctx {
     char **vetoed_shells;
     char **etc_shells;
     char *shell_fallback;
+    char *default_shell;
 
     struct sss_mc_ctx *pwd_mc_ctx;
     struct sss_mc_ctx *grp_mc_ctx;
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index d448fa859de0a8ad70d72eac0a36ac091c69aa12..263499bfe2761e1e0446360f8ea3b8323cac1fbe 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -161,7 +161,13 @@ static const char *get_shell_override(TALLOC_CTX *mem_ctx,
     int i;
 
     user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL);
-    if (!user_shell) return NULL;
+    if (!user_shell) {
+        /* Check whether there is a default shell specified */
+        if (nctx->default_shell) {
+            return talloc_strdup(mem_ctx, nctx->default_shell);
+        }
+        return NULL;
+    }
     if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell);
 
     if (nctx->vetoed_shells) {
-- 
1.7.10.1

