[SSSD] [PATCH] Add group support to the simple access provider
Sumit Bose
sbose at redhat.com
Fri Dec 10 11:34:15 UTC 2010
On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> This patch adds simple_allow_groups and simple_deny_groups options
> to the simple access provider. It makes it possible to grant or
> deny access based on a user's group memberships within the domain.
>
> This patch makes one minor change to previous functionality: now
> all deny rules will supersede allow rules. Previously, if both
> simple_allow_users and simple_deny_users were set with the same
> value, the allow would win.
>
> Fixes https://fedorahosted.org/sssd/ticket/440
> - --
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk0A86gACgkQeiVVYja6o6NElwCeI1H9O8tzCkAM++awKInGJr9R
> l0QAn20A7tbxmfOKdBuhXC4aMsyTes3V
> =K45L
> -----END PGP SIGNATURE-----
> +
> + /* Construct a list of the user's groups */
> + for (i = 0; i < msg->num_elements; i++) {
> + if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {
If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
Why do you run the loop yourself instead of using ldb_msg_find_element() ?
> + /* Get the groups from the memberOf entries
> + * Allocate the array with room for both the NULL
> + * terminator and the primary group
> + */
> + groups = talloc_array(tmp_ctx, char *, msg->elements[i].num_values + 2);
> + if (!groups) {
> + ret = ENOMEM;
> + goto done;
> + }
> +
> + for (j = 0; j < msg->elements[i].num_values; j++) {
> + ret = sysdb_group_dn_name(
> + ctx->sysdb, tmp_ctx,
> + (char *)msg->elements[i].values[j].data,
> + &groups[j]);
> + if (ret != EOK) {
> + goto done;
> + }
> + }
> + }
> + }
> +
> + /* Get the user's primary group */
> + gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0);
> + if (!gid) {
> + ret = EINVAL;
> + goto done;
> + }
> + talloc_zfree(msg);
> +
> + ret = sysdb_search_group_by_gid(tmp_ctx, ctx->sysdb, ctx->domain,
> + gid, group_attrs, &msg);
> + if (ret != EOK) {
> + DEBUG(1, ("Could not look up primary group [%lu]: [%d][%s]\n",
> + gid, ret, strerror(ret)));
> + goto done;
> + }
> +
> + primary_group = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
> + if (!primary_group) {
> + ret = EINVAL;
> + goto done;
> + }
> +
> + groups[j] = talloc_strdup(tmp_ctx, primary_group);
> + if (!groups[j]) {
> + ret = ENOMEM;
> + goto done;
> + }
> + groups[j+1] = NULL;
> + talloc_zfree(msg);
> +
groups and j might be undefined.
bye,
Sumit
More information about the sssd-devel
mailing list