[SSSD] [PATCH] Add group support to the simple access provider

Sumit Bose sbose at redhat.com
Fri Dec 10 11:34:15 UTC 2010


On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> This patch adds simple_allow_groups and simple_deny_groups options
> to the simple access provider. It makes it possible to grant or
> deny access based on a user's group memberships within the domain.
> 
> This patch makes one minor change to previous functionality: now
> all deny rules will supersede allow rules. Previously, if both
> simple_allow_users and simple_deny_users were set with the same
> value, the allow would win.
> 
> Fixes https://fedorahosted.org/sssd/ticket/440
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk0A86gACgkQeiVVYja6o6NElwCeI1H9O8tzCkAM++awKInGJr9R
> l0QAn20A7tbxmfOKdBuhXC4aMsyTes3V
> =K45L
> -----END PGP SIGNATURE-----

> +
> +    /* Construct a list of the user's groups */
> +    for (i = 0; i < msg->num_elements; i++) {
> +        if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {

If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
Why do you run the loop yourself instead of using ldb_msg_find_element() ?

> +            /* Get the groups from the memberOf entries
> +             * Allocate the array with room for both the NULL
> +             * terminator and the primary group
> +             */
> +            groups = talloc_array(tmp_ctx, char *, msg->elements[i].num_values + 2);
> +            if (!groups) {
> +                ret = ENOMEM;
> +                goto done;
> +            }
> +
> +            for (j = 0; j < msg->elements[i].num_values; j++) {
> +                ret = sysdb_group_dn_name(
> +                        ctx->sysdb, tmp_ctx,
> +                        (char *)msg->elements[i].values[j].data,
> +                        &groups[j]);
> +                if (ret != EOK) {
> +                    goto done;
> +                }
> +            }
> +        }
> +    }
> +
> +    /* Get the user's primary group */
> +    gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0);
> +    if (!gid) {
> +        ret = EINVAL;
> +        goto done;
> +    }
> +    talloc_zfree(msg);
> +
> +    ret = sysdb_search_group_by_gid(tmp_ctx, ctx->sysdb, ctx->domain,
> +                                    gid, group_attrs, &msg);
> +    if (ret != EOK) {
> +        DEBUG(1, ("Could not look up primary group [%lu]: [%d][%s]\n",
> +                  gid, ret, strerror(ret)));
> +        goto done;
> +    }
> +
> +    primary_group = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
> +    if (!primary_group) {
> +        ret = EINVAL;
> +        goto done;
> +    }
> +
> +    groups[j] = talloc_strdup(tmp_ctx, primary_group);
> +    if (!groups[j]) {
> +        ret = ENOMEM;
> +        goto done;
> +    }
> +    groups[j+1] = NULL;
> +    talloc_zfree(msg);
> +

groups and j might be undefined.

bye,
Sumit



More information about the sssd-devel mailing list