From eca9de237561392b691a61d5c7d7531b4f3ed57c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Tue, 17 Jan 2012 13:15:51 +0100 Subject: [PATCH 3/5] SUDO Integration - responder command for cn=defaults https://fedorahosted.org/sssd/ticket/1143 --- src/responder/sudo/sudosrv_cmd.c | 55 ++++++++++++++++++++++++++++ src/responder/sudo/sudosrv_get_sudorules.c | 47 +++++++++++++++++------- src/responder/sudo/sudosrv_private.h | 2 + src/sss_client/sss_cli.h | 1 + 4 files changed, 91 insertions(+), 14 deletions(-) diff --git a/src/responder/sudo/sudosrv_cmd.c b/src/responder/sudo/sudosrv_cmd.c index e05ce7d..fe6a076 100644 --- a/src/responder/sudo/sudosrv_cmd.c +++ b/src/responder/sudo/sudosrv_cmd.c @@ -23,6 +23,7 @@ #include #include "util/util.h" +#include "providers/data_provider.h" #include "responder/common/responder.h" #include "responder/common/responder_packet.h" #include "responder/sudo/sudosrv_private.h" @@ -149,6 +150,7 @@ static int sudosrv_cmd_get_sudorules(struct cli_ctx *cli_ctx) goto done; } cmd_ctx->cli_ctx = cli_ctx; + cmd_ctx->type = BE_SUDO_REQ_USER; dctx = talloc_zero(cmd_ctx, struct sudo_dom_ctx); if (!dctx) { @@ -214,6 +216,58 @@ done: return sudosrv_cmd_done(dctx, ret); } +static int sudosrv_cmd_get_defaults(struct cli_ctx *cli_ctx) +{ + int ret = EOK; + struct sudo_cmd_ctx *cmd_ctx = NULL; + struct sudo_dom_ctx *dctx = NULL; + + cmd_ctx = talloc_zero(cli_ctx, struct sudo_cmd_ctx); + if (!cmd_ctx) { + ret = ENOMEM; + goto done; + } + cmd_ctx->cli_ctx = cli_ctx; + cmd_ctx->type = BE_SUDO_REQ_DEFAULTS; + cmd_ctx->username = NULL; + cmd_ctx->check_next = false; + + dctx = talloc_zero(cmd_ctx, struct sudo_dom_ctx); + if (!dctx) { + ret = ENOMEM; + goto done; + } + dctx->cmd_ctx = cmd_ctx; + + dctx->sudo_ctx = talloc_get_type(cli_ctx->rctx->pvt_ctx, struct sudo_ctx); + if (!dctx->sudo_ctx) { + DEBUG(SSSDBG_FATAL_FAILURE, ("sudo_ctx not set\n")); + ret = EFAULT; + goto done; + } + + DEBUG(SSSDBG_FUNC_DATA, ("Requesting cn=defaults\n")); + + /* sudo currently does not support domain selection + * so find first available domain + * TODO */ + dctx->domain = cli_ctx->rctx->domains; + while (dctx->domain && dctx->domain->fqnames) { + dctx->domain = dctx->domain->next; + } + if (!dctx->domain) { + DEBUG(SSSDBG_MINOR_FAILURE, ("No valid domain found\n")); + ret = ENOENT; + goto done; + } + + /* ok, find it ! */ + ret = sudosrv_get_rules(dctx); + +done: + return sudosrv_cmd_done(dctx, ret); +} + struct cli_protocol_version *register_cli_protocol_version(void) { static struct cli_protocol_version sudo_cli_protocol_version[] = { @@ -227,6 +281,7 @@ struct sss_cmd_table *get_sudo_cmds(void) { static struct sss_cmd_table sudo_cmds[] = { {SSS_GET_VERSION, sss_cmd_get_version}, {SSS_SUDO_GET_SUDORULES, sudosrv_cmd_get_sudorules}, + {SSS_SUDO_GET_DEFAULTS, sudosrv_cmd_get_defaults}, {SSS_CLI_NULL, NULL} }; diff --git a/src/responder/sudo/sudosrv_get_sudorules.c b/src/responder/sudo/sudosrv_get_sudorules.c index 88e4593..f6b3f4c 100644 --- a/src/responder/sudo/sudosrv_get_sudorules.c +++ b/src/responder/sudo/sudosrv_get_sudorules.c @@ -29,7 +29,6 @@ #include "responder/sudo/sudosrv_private.h" static errno_t sudosrv_get_user(struct sudo_dom_ctx *dctx); -static errno_t sudosrv_get_rules(struct sudo_dom_ctx *dctx); errno_t sudosrv_get_sudorules(struct sudo_dom_ctx *dctx) { @@ -238,7 +237,7 @@ done: static errno_t sudosrv_get_sudorules_from_cache(struct sudo_dom_ctx *dctx); static void sudosrv_get_sudorules_dp_callback(struct tevent_req *req); -static errno_t sudosrv_get_rules(struct sudo_dom_ctx *dctx) +errno_t sudosrv_get_rules(struct sudo_dom_ctx *dctx) { struct tevent_req *dpreq; struct sudo_cmd_ctx *cmd_ctx = dctx->cmd_ctx; @@ -246,7 +245,7 @@ static errno_t sudosrv_get_rules(struct sudo_dom_ctx *dctx) /* FIXME - cache logic will be here. For now, just refresh * the cache unconditionally */ dpreq = sudosrv_dp_refresh_send(cmd_ctx->cli_ctx->rctx, dctx->domain, - BE_SUDO_REQ_USER, cmd_ctx->username); + cmd_ctx->type, cmd_ctx->username); if (dpreq == NULL) { DEBUG(SSSDBG_CRIT_FAILURE, ("Fatal: Sysdb CTX not found for this domain!\n")); @@ -291,6 +290,7 @@ static void sudosrv_get_sudorules_dp_callback(struct tevent_req *req) static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, + uint32_t req_type, bool timed, const char *username, uid_t uid, @@ -319,15 +319,20 @@ static errno_t sudosrv_get_sudorules_from_cache(struct sudo_dom_ctx *dctx) goto done; } - ret = sysdb_get_sudo_user_info(tmp_ctx, dctx->cmd_ctx->username, - sysdb, &uid, &groupnames); - if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, - ("Unable to retrieve user info [%d]: %s\n", strerror(ret))); - goto done; + if (dctx->cmd_ctx->type == BE_SUDO_REQ_USER) { + ret = sysdb_get_sudo_user_info(tmp_ctx, dctx->cmd_ctx->username, + sysdb, &uid, &groupnames); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("Unable to retrieve user info [%d]: %s\n", strerror(ret))); + goto done; + } + } else { + uid = 0; + groupnames = NULL; } - ret = sudosrv_get_sudorules_query_cache(dctx, sysdb, + ret = sudosrv_get_sudorules_query_cache(dctx, sysdb, dctx->cmd_ctx->type, dctx->sudo_ctx->option_timed, dctx->cmd_ctx->username, uid, groupnames, @@ -352,6 +357,7 @@ sort_sudo_rules(struct sysdb_attrs **rules, size_t count); static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, + uint32_t req_type, bool timed, const char *username, uid_t uid, @@ -383,10 +389,23 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx, tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) return ENOMEM; - flags = SYSDB_SUDO_FILTER_USERINFO - | SYSDB_SUDO_FILTER_INCLUDE_ALL - | SYSDB_SUDO_FILTER_INCLUDE_DFL - | (timed ? SYSDB_SUDO_FILTER_TIMED : SYSDB_SUDO_FILTER_NONE); + switch (req_type) { + case BE_SUDO_REQ_ALL: + flags = timed ? SYSDB_SUDO_FILTER_TIMED : SYSDB_SUDO_FILTER_NONE; + break; + case BE_SUDO_REQ_DEFAULTS: + flags = SYSDB_SUDO_FILTER_INCLUDE_DFL; + break; + case BE_SUDO_REQ_USER: + flags = SYSDB_SUDO_FILTER_USERINFO + | SYSDB_SUDO_FILTER_INCLUDE_ALL + | (timed ? SYSDB_SUDO_FILTER_TIMED : SYSDB_SUDO_FILTER_NONE); + break; + default: + DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid request type %d\n", req_type)); + ret = EINVAL; + goto done; + } ret = sysdb_get_sudo_filter(tmp_ctx, username, uid, groupnames, flags, &filter); if (ret != EOK) { diff --git a/src/responder/sudo/sudosrv_private.h b/src/responder/sudo/sudosrv_private.h index c37f312..d4766b4 100644 --- a/src/responder/sudo/sudosrv_private.h +++ b/src/responder/sudo/sudosrv_private.h @@ -38,6 +38,7 @@ struct sudo_ctx { struct sudo_cmd_ctx { struct cli_ctx *cli_ctx; + uint32_t type; char *username; bool check_next; }; @@ -73,6 +74,7 @@ errno_t sudosrv_dp_refresh_recv(struct tevent_req *req, dbus_uint32_t *_err_min); errno_t sudosrv_get_sudorules(struct sudo_dom_ctx *dctx); +errno_t sudosrv_get_rules(struct sudo_dom_ctx *dctx); char * sudosrv_get_sudorules_parse_query(TALLOC_CTX *mem_ctx, const char *query_body, diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index dc15ac1..398463d 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -153,6 +153,7 @@ enum sss_cli_command { /* SUDO */ SSS_SUDO_GET_SUDORULES = 0x00C1, + SSS_SUDO_GET_DEFAULTS = 0x00C2, /* PAM related calls */ SSS_PAM_AUTHENTICATE = 0x00F1, /**< see pam_sm_authenticate(3) for -- 1.7.6.4