[SSSD] [PATCHES] HBAC access control rewrite

Stephen Gallagher sgallagh at redhat.com
Fri Jun 24 18:24:09 UTC 2011


On Fri, 2011-06-24 at 11:15 -0400, Simo Sorce wrote:
> On Fri, 2011-06-24 at 09:54 -0400, Stephen Gallagher wrote:
> > New patches attached with some significant changes. After much
> > discussion, we decided that, rather than implement a facility for
> > identifying "unresolved groups" for the user, we would instead perform
> > a
> > group lookup during the initial pull-down of the HBAC rules. This way,
> > we know that all groups that are relevant to HBAC rules are available
> > on
> > the system. So if a user is a member of a group that is not
> > resolvable,
> > we don't have to worry that it might match a DENY rule.
> 
> NACK
> 
> New patches fail to take in account non-posix groups.

I've added three new patches to account for the non-POSIX groups. I've
also removed the old patch 0001, as with these new changes it is no
longer necessary.

Patch 0009 and 0010 make no functional changes, they just reorganize the
code a little bit to make 0012 easier.

Patch 0012: This makes two changes.
1) Change the construction of the eval request to use
ipa_get_groupname() and the originalMemberOf attribute to create the
list of groups, rather than calling initgroups.

2) In hbac_user_attrs_to_rule(), if the member is not detected as a
POSIX user or group, check to see if it matches with
ipa_get_groupname(), indicating that it is a non-POSIX group. There is
no need to detect non-POSIX users here, as they wouldn't be eligible to
log in anyway.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-helper-function-msgs2attrs_array.patch
Type: text/x-patch
Size: 2325 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Add-HBAC-evaluator-and-tests.patch
Type: text/x-patch
Size: 38888 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-Add-helper-functions-for-looking-up-HBAC-rule-compon.patch
Type: text/x-patch
Size: 84838 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Remove-old-HBAC-implementation.patch
Type: text/x-patch
Size: 57255 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-Add-new-HBAC-lookup-and-evaluation-routines.patch
Type: text/x-patch
Size: 22756 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-Add-ipa_hbac_refresh-option.patch
Type: text/x-patch
Size: 6201 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-Update-groups-during-rule-download.patch
Type: text/x-patch
Size: 18749 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-Return-PAM_PERM_DENIED-if-no-rules-apply.patch
Type: text/x-patch
Size: 2813 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0007.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0010-Move-hbac_user_attrs_to_rule-to-ipa_hbac_user.c.patch
Type: text/x-patch
Size: 15877 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0008.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0011-Make-get_ipa_groupname-public.patch
Type: text/x-patch
Size: 2102 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0009.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0012-Construct-usergroups-from-the-originalMemberOf-attri.patch
Type: text/x-patch
Size: 7403 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment-0010.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110624/862aca6d/attachment.sig>


More information about the sssd-devel mailing list