Hi everyone,
Please find attached proof-of-concept patches for a part of NSS integration with tlog. Namely, addition of shell substitution for getpwnam requests.
The code is supposed to replace a user's shell with /usr/bin/tlog-rec, if session recording is enabled for all users, if it is enabled for that particular user, or for a group that it belongs to.
The configuration is done in a dedicated section of sssd.conf named "session_recording", which can contain three options "scope", "users", and "groups". Those correspond to the scope of session recording: "none", "some", and "all", corresponding in order to: disabled session recording, session recording enabled for the specified users/groups, and session recording enabled for all users handled by SSSD.
An example of a configuration can be:
[session_recording] ; Disabled scope = none
or
[session_recording] ; Enabled for everyone scope = all
or
[session_recording] ; Enabled for some users and groups scope = some users = user1, user2 groups = group1, group2
The parts to be done still are adding support for getpwuid and getpwent requests, exporting of the original shell in pam_sss, and of course cleaning it up and doing it according to your comments and requirements.
The code has some documentation in doxygen format, which I can change later if we decide on some other format, or no documentation at all.
Please, tell me if I'm doing anything wrong this far already, or suggest better ways to do it.
Thank you!
Nick
P.S. I'm on PTO for two weeks starting next week, so might not be able to answer quickly.