[SSSD] [PATCHES] SUDO Integration

Jakub Hrozek jhrozek at redhat.com
Fri Dec 16 16:19:38 UTC 2011


On Fri, Dec 16, 2011 at 02:02:11PM +0100, Pavel Březina wrote:
> https://fedorahosted.org/sssd/ticket/1105 (review ticket)
> https://fedorahosted.org/sssd/ticket/623 (sudo integration)
> 
> Hello,
> it is finally here.

yay!

> 
> These patches *assume* that "Responders: Split getting domain by
> name into separate function" patch has been applied, it can be found
> in "Ability to set a domain as case sensitive or insensitive"
> thread.
> 
> Design page:
> https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIntegrationNewApproach
> 
> What's left:
> 1. implementing support of sssd in sudo sudoers plugin

This is Daniel's part using the API we provided. The whole sudo
integration feature could be moved out of "experimental" stage when
there's sudo package that is able to talk to SSSD.

One thing I'd like to get feedback on at this point is how do we
collaborate on the API with sudo.

The API is a collection of functions that are able to pack the sudo
request and send it over the socket to SSSD and parse the wire data
received from SSSD.

I'm not sure it would be wise to release the API as a full-fledged shared
library (although technically it makes sense) - some distributions such
as RHEL keep their libraries ABI compatible for the lifetime of the
distribution. What if we need to modify the API next release?

So far, Daniel just copied the API source into his WIP sudo tree so he
could develop the sudo part.

> 2. periodical update of all rules

Basically an equivalent of the "enumerate" task.
https://fedorahosted.org/sssd/ticket/1110

> 3. provide documentation

Include all the options and the responder itself in the manual pages
https://fedorahosted.org/sssd/ticket/1109

> 4. in memory cache in responder

Based on the design discussed on the list
https://fedorahosted.org/sssd/ticket/1111

> 5. refactor DP request using "RESPONDER: Refactor DP requests into
> tevent_req style" patch

https://fedorahosted.org/sssd/ticket/1115

With a little more detail - I'd like to see a new tevent_req style request
along the lines of sss_dp_get_account_send/_done/_recv just for sudo
rules. I'd like to reuse sss_dp_get_account_int_* request - there's a
couple of lines that are account specific, but I believe we could reuse
and share the code after very little refactoring.

> 6. provide few more configuration options

https://fedorahosted.org/sssd/ticket/1116

> 7. support the IPA scheme

https://fedorahosted.org/sssd/ticket/1108

> 
> How to configure it:
> 1. configure --enable-all-experimental-features
> 2. sssd.conf:
>    services += sudo
>    domain options: sudo_provider, ldap_sudo_search_base
> 
> How to test it:
> > sss_sudo_cli username
> This will display rules for %username. It performs two lookups:
> 1. using native sssd api to get and display raw date (it prints
> every byte as char so don't be scared of silly characters that are
> shown instead of numbers)
> 2. using api that we provide to sudo and use it to display data in
> user readable format
> 

This is exactly what sudo will be doing so the SSSD part of the effort
is quite testable at the moment.

> Big thanks to Jakub, who has written whole sysdb api and a big part
> of responder.
> 
> Regards,
> Pavel Březina.




More information about the sssd-devel mailing list