On (27/09/14 12:39), Pavel Reichl wrote:
Attached patch now contains both options.
Thanks.
On 09/25/2014 03:57 PM, Pavel Reichl wrote:
>Hello,
>
>please see attached patch which adds first of two options proposed in
>https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
>
>Thanks!
>
From 78a61eb76d9ccf1d060a621f987dc666b9db6e42 Mon Sep 17 00:00:00
2001
From: Pavel Reichl <preichl(a)redhat.com>
Date: Thu, 25 Sep 2014 14:52:31 +0100
Subject: [PATCH] PAM: new options pam_trusted_users & pam_public_domains
pam_public_domains option is a list of numerical UIDs or user names
that are trusted.
pam_public_domains option is a list of domains accessible even for
untrusted users.
Based on:
https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
---
src/confdb/confdb.h | 2 +
src/config/SSSDConfig/__init__.py.in | 2 +
src/config/etc/sssd.api.conf | 2 +
src/man/sssd.conf.5.xml | 46 ++++++++++++++++++
src/responder/pam/pamsrv.c | 94 ++++++++++++++++++++++++++++++++++++
src/responder/pam/pamsrv.h | 7 +++
src/responder/pam/pamsrv_cmd.c | 80 ++++++++++++++++++++++++++++--
src/util/domain_info_utils.c | 60 +++++++++++++++++++++++
src/util/util.h | 5 ++
9 files changed, 295 insertions(+), 3 deletions(-)
//snip
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index ad091e46e6cde1e12f554dde6470cf138412606e..3ff5fad82240c2c8a7e28c47397a20700b50ec04
100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -836,6 +836,52 @@ fallback_homedir = /home/%u
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>pam_trusted_users (string)</term>
+ <listitem>
+ <para>
+ Specifies the comma-separated list of UID values or
+ user names that are allowed to access the PAM
+ responder. User names are resolved to UIDs at
+ startup.
+ </para>
+ <para>
+ Default: all (All users are allowed to access
+ the PAM responder)
+ </para>
+ <para>
+ Please note that UID 0 is always allowed to access
+ the PAM responder even in case it is not in the
+ pam_trusted_users list.
+ </para>
+ <para>
+ Also please note that if there is a user name in
+ pam_trusted_users list which fails to be resolved
+ it will cause that SSSD will not be started.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>pam_public_domains (string)</term>
+ <listitem>
+ <para>
+ Specifies the comma-separated list of domain names
+ that are accessible even to untrusted users.
+ </para>
+ <para>
+ Two special values for pam_public_domains option
+ are defined:
+ </para>
+ <para>
+ none (Untrusted users are not allowed to access
+ any domains PAM repsponder.)
+ </para>
just one special
value is described here.
The second one "all" is not described.
+ <para>
+ Default: none
+ </para>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</refsect2>
//snip
struct pam_auth_dp_req {
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 561bd3d9678c73fdfa52592b5a0c502a46e89b5f..ebeaeeb1893b8f4078e3837f304b74dd46df7ec4
100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -762,6 +762,45 @@ static int pam_auth_req_destructor(struct pam_auth_req *preq)
return 0;
}
+static bool is_uid_trusted(int32_t uid,
^^^^^^^
It is better to have uid as unsigned value ("uint32_t")
+ size_t trusted_uids_count,
+ uid_t *trusted_uids)
+{
+ size_t i;
+
+ /* root is always trusted */
+ if (uid == 0) {
+ return true;
+ }
+
+ /* All uids are allowed */
+ if (trusted_uids_count == 0) {
+ return true;
+ }
+
+ for(i = 0; i < trusted_uids_count; i++) {
+ if (trusted_uids[i] == uid) {
+ return true;
+ }
+ }
+
+ return false;
+}
+