>From a4c72827382347edd8b31dac81a8cf163ee61f38 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sun, 11 Aug 2013 23:39:49 +0200 Subject: [PATCH] Make IPA SELinux provider aware of subdomain users Fixes https://fedorahosted.org/sssd/ticket/1892 --- src/db/sysdb_selinux.c | 9 ++++++--- src/db/sysdb_selinux.h | 2 +- src/providers/ipa/ipa_selinux.c | 24 ++++++++++++++++++------ src/responder/pam/pamsrv_cmd.c | 6 ++++-- 4 files changed, 29 insertions(+), 12 deletions(-) diff --git a/src/db/sysdb_selinux.c b/src/db/sysdb_selinux.c index a6b4809f67f43cbb8d71ad66a39a8b6776a2e0d2..f49f58d277e5b70d07efd9af3a680ceed19821a1 100644 --- a/src/db/sysdb_selinux.c +++ b/src/db/sysdb_selinux.c @@ -333,7 +333,7 @@ sysdb_get_selinux_usermaps(TALLOC_CTX *mem_ctx, } errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx, - struct sysdb_ctx *sysdb, + struct sss_domain_info *dom, const char *username, struct ldb_message ***_usermaps) { @@ -357,20 +357,23 @@ errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx, uint32_t top_priority = 0; errno_t ret; int i; + struct sss_domain_info *parent_dom; tmp_ctx = talloc_new(NULL); if (!tmp_ctx) { return ENOMEM; } + parent_dom = dom->parent ? dom->parent : dom; + /* Now extract user attributes */ - ret = sss_selinux_extract_user(tmp_ctx, sysdb, username, &user); + ret = sss_selinux_extract_user(tmp_ctx, dom->sysdb, username, &user); if (ret != EOK) { goto done; } /* Now extract all SELinux user maps */ - ret = sysdb_get_selinux_usermaps(tmp_ctx, sysdb, attrs, &msgs_count, &msgs); + ret = sysdb_get_selinux_usermaps(tmp_ctx, parent_dom->sysdb, attrs, &msgs_count, &msgs); if (ret) { goto done; } diff --git a/src/db/sysdb_selinux.h b/src/db/sysdb_selinux.h index 5fcbb56ef20f1ee11b979fc6e0b4ea87adfa939e..598936dbd68346aaf544d17b5dc6070bfa55af10 100644 --- a/src/db/sysdb_selinux.h +++ b/src/db/sysdb_selinux.h @@ -61,7 +61,7 @@ errno_t sysdb_search_selinux_usermap_by_mapname(TALLOC_CTX *mem_ctx, struct ldb_message **_usermap); errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx, - struct sysdb_ctx *sysdb, + struct sss_domain_info *dom, const char *username, struct ldb_message ***_usermaps); diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c index d1dbe576589d311dbaf2b589cb88eb61083e882a..21e518fd12c29918110c0388b177451298d0850b 100644 --- a/src/providers/ipa/ipa_selinux.c +++ b/src/providers/ipa/ipa_selinux.c @@ -36,6 +36,7 @@ #include "providers/ipa/ipa_access.h" #include "providers/ipa/ipa_selinux_common.h" #include "providers/ipa/ipa_selinux_maps.h" +#include "providers/krb5/krb5_utils.h" static struct tevent_req * ipa_get_selinux_send(struct be_req *breq, @@ -52,7 +53,7 @@ static errno_t ipa_get_selinux_recv(struct tevent_req *req, char **map_order); static struct ipa_selinux_op_ctx * -ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, +ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, struct be_req *be_req, const char *username, const char *hostname); static void ipa_selinux_handler_done(struct tevent_req *subreq); @@ -84,6 +85,8 @@ void ipa_selinux_handler(struct be_req *be_req) struct tevent_req *req; struct pam_data *pd; const char *hostname; + int ret; + struct sss_domain_info *dom; pd = talloc_get_type(be_req->req_data, struct pam_data); @@ -98,7 +101,13 @@ void ipa_selinux_handler(struct be_req *be_req) goto fail; } - op_ctx = ipa_selinux_create_op_ctx(be_req, be_req->sysdb, be_req, + ret = get_domain_or_subdomain(be_req, be_req->be_ctx, pd->domain, &dom); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("get_domain_or_subdomain failed.\n")); + goto fail; + } + + op_ctx = ipa_selinux_create_op_ctx(be_req, dom, be_req, pd->user, hostname); if (op_ctx == NULL) { DEBUG(SSSDBG_OP_FAILURE, ("Cannot create op context\n")); @@ -119,7 +128,7 @@ fail: } static struct ipa_selinux_op_ctx * -ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, +ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, struct be_req *be_req, const char *username, const char *hostname) { @@ -132,6 +141,7 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, struct ldb_message **msgs; struct sysdb_attrs **hosts; errno_t ret; + struct sss_domain_info *parent_dom; op_ctx = talloc_zero(mem_ctx, struct ipa_selinux_op_ctx); if (op_ctx == NULL) { @@ -139,18 +149,20 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, } op_ctx->be_req = be_req; - ret = sss_selinux_extract_user(op_ctx, sysdb, username, &op_ctx->user); + parent_dom = dom->parent ? dom->parent : dom; + + ret = sss_selinux_extract_user(op_ctx, dom->sysdb, username, &op_ctx->user); if (ret != EOK) { goto fail; } - host_dn = sysdb_custom_dn(sysdb, op_ctx, hostname, HBAC_HOSTS_SUBDIR); + host_dn = sysdb_custom_dn(parent_dom->sysdb, op_ctx, hostname, HBAC_HOSTS_SUBDIR); if (host_dn == NULL) { goto fail; } /* Look up the host to get its originalMemberOf entries */ - ret = sysdb_search_entry(op_ctx, sysdb, host_dn, + ret = sysdb_search_entry(op_ctx, parent_dom->sysdb, host_dn, LDB_SCOPE_BASE, NULL, attrs, &count, &msgs); if (ret == ENOENT || count == 0) { diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c index a180a8f1d93c6c0938782e225d192e76de408105..db1f90bc264b60c1075b48da419b5a35f987af3b 100644 --- a/src/responder/pam/pamsrv_cmd.c +++ b/src/responder/pam/pamsrv_cmd.c @@ -522,7 +522,9 @@ static errno_t process_selinux_mappings(struct pam_auth_req *preq) goto done; } - sysdb = preq->domain->sysdb; + /* Sysdb rules are always stored in the parent domain */ + sysdb = preq->domain->parent ? preq->domain->parent->sysdb : + preq->domain->sysdb; if (sysdb == NULL) { DEBUG(SSSDBG_FATAL_FAILURE, ("Fatal: Sysdb CTX not found for " "domain [%s]!\n", preq->domain->name)); @@ -598,7 +600,7 @@ static errno_t process_selinux_mappings(struct pam_auth_req *preq) } /* Fetch all maps applicable to the user who is currently logging in */ - ret = sysdb_search_selinux_usermap_by_username(tmp_ctx, sysdb, pd->user, + ret = sysdb_search_selinux_usermap_by_username(tmp_ctx, preq->domain, pd->user, &usermaps); if (ret != EOK && ret != ENOENT) { goto done; -- 1.8.2.1