From 19e8d3f8124b4491495930e1aa4c444d7c6a31f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Tue, 17 Jan 2012 12:28:33 +0100 Subject: [PATCH 1/5] SUDO Integration - make sysdb_get_sudo_filter() more configurable https://fedorahosted.org/sssd/ticket/1143 --- src/db/sysdb_sudo.c | 99 +++++++++++++++++++++++++++++--------------------- src/db/sysdb_sudo.h | 15 ++++++-- 2 files changed, 68 insertions(+), 46 deletions(-) diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c index f7e87ee..9d97c19 100644 --- a/src/db/sysdb_sudo.c +++ b/src/db/sysdb_sudo.c @@ -67,76 +67,91 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, uid_t uid, char **groupnames, unsigned int flags, char **_filter) { - TALLOC_CTX *tmp_ctx; + TALLOC_CTX *tmp_ctx = NULL; + char *filter = NULL; + char *specific_filter = NULL; + char *time_filter = NULL; errno_t ret; - char *filter; - char *t; int i; tmp_ctx = talloc_new(NULL); NULL_CHECK(tmp_ctx, ret, done); - /* AND with objectclass */ - filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)", - SYSDB_OBJECTCLASS, - SYSDB_SUDO_CACHE_AT_OC); - NULL_CHECK(filter, ret, done); + /* build specific filter */ - /* And with the timed rules if requested */ - if (flags & SYSDB_SUDO_FILTER_TIMED) { - t = get_sudo_time_filter(filter); - filter = talloc_asprintf_append(filter, "%s", t); - talloc_free(t); - NULL_CHECK(filter, ret, done); + specific_filter = talloc_zero(tmp_ctx, char); /* assign to tmp_ctx */ + NULL_CHECK(specific_filter, ret, done); + + if (flags & SYSDB_SUDO_FILTER_INCLUDE_ALL) { + specific_filter = talloc_asprintf_append(specific_filter, "(%s=ALL)", + SYSDB_SUDO_CACHE_AT_USER); + NULL_CHECK(specific_filter, ret, done); } - /* Add global OR and the username */ - filter = talloc_asprintf_append(filter, "(|(%s=%s)", - SYSDB_SUDO_CACHE_AT_USER, - username); - NULL_CHECK(filter, ret, done); + if (flags & SYSDB_SUDO_FILTER_INCLUDE_DFL) { + specific_filter = talloc_asprintf_append(specific_filter, "(%s=defaults)", + SYSDB_NAME); + NULL_CHECK(specific_filter, ret, done); + } - if (uid) { - filter = talloc_asprintf_append(filter, "(%s=#%llu)", - SYSDB_SUDO_CACHE_AT_USER, - (unsigned long long) uid); - NULL_CHECK(filter, ret, done); + if ((flags & SYSDB_SUDO_FILTER_USERNAME) && (username != NULL)) { + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%s)", + SYSDB_SUDO_CACHE_AT_USER, + username); + NULL_CHECK(specific_filter, ret, done); + } + + if ((flags & SYSDB_SUDO_FILTER_UID) && (uid != 0)) { + specific_filter = talloc_asprintf_append(specific_filter, "(%s=#%llu)", + SYSDB_SUDO_CACHE_AT_USER, + (unsigned long long) uid); + NULL_CHECK(specific_filter, ret, done); } - if (groupnames) { - for (i=0; groupnames[i]; i++) { - filter = talloc_asprintf_append(filter, "(%s=%%%s)", - SYSDB_SUDO_CACHE_AT_USER, - groupnames[i]); - NULL_CHECK(filter, ret, done); + if ((flags & SYSDB_SUDO_FILTER_GROUPS) && (groupnames != NULL)) { + for (i=0; groupnames[i] != NULL; i++) { + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%%%s)", + SYSDB_SUDO_CACHE_AT_USER, + groupnames[i]); + NULL_CHECK(specific_filter, ret, done); } } if (flags & SYSDB_SUDO_FILTER_NGRS) { - filter = talloc_asprintf_append(filter, "(%s=+*)", - SYSDB_SUDO_CACHE_AT_USER); - NULL_CHECK(filter, ret, done); + specific_filter = talloc_asprintf_append(specific_filter, "(%s=+*)", + SYSDB_SUDO_CACHE_AT_USER); + NULL_CHECK(specific_filter, ret, done); } - if (flags & SYSDB_SUDO_FILTER_INCLUDE_ALL) { - filter = talloc_asprintf_append(filter, "(%s=ALL)", - SYSDB_SUDO_CACHE_AT_USER); + /* build time filter */ + + if (flags & SYSDB_SUDO_FILTER_TIMED) { + time_filter = get_sudo_time_filter(tmp_ctx); + NULL_CHECK(time_filter, ret, done); + } + + /* build global filter */ + + filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)", + SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_AT_OC); + NULL_CHECK(filter, ret, done); + + if (time_filter != NULL) { + filter = talloc_strdup_append(filter, time_filter); NULL_CHECK(filter, ret, done); } - if (flags & SYSDB_SUDO_FILTER_INCLUDE_DFL) { - filter = talloc_asprintf_append(filter, "(%s=defaults)", - SYSDB_NAME); + if (specific_filter[0] == '\0') { + filter = talloc_asprintf_append(filter, "(|%s)", specific_filter); NULL_CHECK(filter, ret, done); } - /* end the global AND and OR filters */ - filter = talloc_asprintf_append(filter, "))"); + filter = talloc_strdup_append(filter, ")"); NULL_CHECK(filter, ret, done); - ret = EOK; *_filter = talloc_steal(mem_ctx, filter); + done: talloc_free(tmp_ctx); return ret; diff --git a/src/db/sysdb_sudo.h b/src/db/sysdb_sudo.h index 67f9e91..b4e3eaf 100644 --- a/src/db/sysdb_sudo.h +++ b/src/db/sysdb_sudo.h @@ -46,10 +46,17 @@ /* When constructing a sysdb filter, OR these values to include.. */ #define SYSDB_SUDO_FILTER_NONE 0x00 /* no additional filter */ -#define SYSDB_SUDO_FILTER_NGRS 0x01 /* netgroups */ -#define SYSDB_SUDO_FILTER_TIMED 0x02 /* timed rules */ -#define SYSDB_SUDO_FILTER_INCLUDE_ALL 0x04 /* ALL */ -#define SYSDB_SUDO_FILTER_INCLUDE_DFL 0x08 /* include cn=default */ +#define SYSDB_SUDO_FILTER_USERNAME 0x01 /* username */ +#define SYSDB_SUDO_FILTER_UID 0x02 /* uid */ +#define SYSDB_SUDO_FILTER_GROUPS 0x04 /* groups */ +#define SYSDB_SUDO_FILTER_NGRS 0x08 /* netgroups */ +#define SYSDB_SUDO_FILTER_TIMED 0x10 /* timed rules */ +#define SYSDB_SUDO_FILTER_INCLUDE_ALL 0x20 /* ALL */ +#define SYSDB_SUDO_FILTER_INCLUDE_DFL 0x40 /* include cn=default */ +#define SYSDB_SUDO_FILTER_USERINFO SYSDB_SUDO_FILTER_USERNAME \ + | SYSDB_SUDO_FILTER_UID \ + | SYSDB_SUDO_FILTER_GROUPS \ + | SYSDB_SUDO_FILTER_NGRS errno_t sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, -- 1.7.6.4