[SSSD] Shell overrides

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri Jul 29 12:52:22 UTC 2011


On Fri, 29 Jul 2011, Stephen Gallagher wrote:

> So my view is that your LDAP entries are wrong and should be fixed. That
> said, I do see at least two possibly valid case for being able to veto a
> shell as a login shell. If dash (a variant of the bourne shell used for
> scripts but not logins) is present in /etc/shells for support of some
> scripts on the system, we probably want to be able to ensure that it is
> never used as a login shell by any user (since it's not designed to
> handle this well). Granted, that's still probably another case of the
> user in LDAP being misconfigured.
>
> The second possibility is that some platforms may have an implementation
> of a particular shell with serious known issues (for example, a copy
> of /bin/tcsh that does not in fact include the full tcsh extensions to
> csh). If an OS contains such a known-broken shell that it cannot remove
> for one reason or another (such as support for a broken legacy script),
> we'd want to be able to forcibly veto this as well.

I agree in our case the LDAP tree contains duff information and should be
fixed.  That's a separate line of attack I'm pursuing.

> So, I suppose I'm willing to see this added. John, would you be willing
> to do the legwork on this if we show you where things need to be added?

I'd be happy to help on this, yes.

This is the patch I'd produced internally based on what was added already for
the override_shell stuff:

diff -ur sssd-1.5.11.orig/src/confdb/confdb.h sssd-1.5.11/src/confdb/confdb.h
--- sssd-1.5.11.orig/src/confdb/confdb.h	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/confdb/confdb.h	2011-07-28 15:39:55.455556158 +0100
@@ -74,6 +74,7 @@
  #define CONFDB_NSS_FILTER_GROUPS "filter_groups"
  #define CONFDB_NSS_PWFIELD  "pwfield"
  #define CONFDB_NSS_OVERRIDE_HOMEDIR "override_homedir"
+#define CONFDB_NSS_VETOED_SHELL  "vetoed_shells"
  #define CONFDB_NSS_ALLOWED_SHELL "allowed_shells"
  #define CONFDB_NSS_SHELL_FALLBACK "shell_fallback"

diff -ur sssd-1.5.11.orig/src/config/SSSDConfig.py sssd-1.5.11/src/config/SSSDConfig.py
--- sssd-1.5.11.orig/src/config/SSSDConfig.py	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/config/SSSDConfig.py	2011-07-28 15:41:35.106569862 +0100
@@ -60,6 +60,7 @@
      'pwfield' : _('The value of the password field the NSS provider should return'),
      'override_homedir' : _('Override homedir value from the identity provider with this value'),
      'allowed_shells' : _('The list of shells users are allowed to log in with'),
+    'vetoed_shells' : _('The list of shells that will be ignored, and replaced with the fallback shell'),
      'shell_fallback' : _('If a shell stored in central directory is allowed but not available, use this fallback'),

      # [pam]
diff -ur sssd-1.5.11.orig/src/man/sssd.conf.5.xml sssd-1.5.11/src/man/sssd.conf.5.xml
--- sssd-1.5.11.orig/src/man/sssd.conf.5.xml	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/man/sssd.conf.5.xml	2011-07-28 15:48:23.780656479 +0100
@@ -424,6 +424,14 @@
                      </listitem>
                  </varlistentry>
                  <varlistentry>
+                    <term>vetoed_shells (string)</term>
+                    <listitem>
+                        <para>
+                            Replace any instance of these shells with the fallback_shell
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
                      <term>shell_fallback (string)</term>
                      <listitem>
                          <para>
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv.c sssd-1.5.11/src/responder/nss/nsssrv.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv.c	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv.c	2011-07-28 15:47:05.574269965 +0100
@@ -188,6 +188,10 @@
                                      &nctx->allowed_shells);
      if (ret != EOK && ret != ENOENT) goto done;

+    ret = confdb_get_string_as_list(cdb, nctx, CONFDB_NSS_CONF_ENTRY,
+                                    CONFDB_NSS_VETOED_SHELL,
+                                    &nctx->vetoed_shells);
+    if (ret != EOK && ret != ENOENT) goto done;
      ret = nss_get_etc_shells(nctx, &nctx->etc_shells);
      if (ret != EOK) goto done;

diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c sssd-1.5.11/src/responder/nss/nsssrv_cmd.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv_cmd.c	2011-07-28 15:46:10.787877792 +0100
@@ -314,7 +314,18 @@

      user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL);
      if (!user_shell) return NULL;
-    if (!nctx->allowed_shells) return talloc_strdup(mem_ctx, user_shell);
+    if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell);
+
+    if (nctx->vetoed_shells)
+    {
+        for (i=0; nctx->vetoed_shells[i]; i++) {
+            if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) {
+                DEBUG(5, ("The shell '%s' is vetoed. "
+                         "Using fallback\n", user_shell));
+                return talloc_strdup(mem_ctx, nctx->shell_fallback);
+            }
+        }
+    }

      for (i=0; nctx->etc_shells[i]; i++) {
          if (strcmp(user_shell, nctx->etc_shells[i]) == 0) {
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv.h sssd-1.5.11/src/responder/nss/nsssrv.h
--- sssd-1.5.11.orig/src/responder/nss/nsssrv.h	2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv.h	2011-07-28 15:42:00.332070919 +0100
@@ -60,6 +60,7 @@

      char *override_homedir;
      char **allowed_shells;
+    char **vetoed_shells;
      char **etc_shells;
      char *shell_fallback;
  };



More information about the sssd-devel mailing list