[SSSD] [PATCH] SUDO: Provide a sudo DP request based on the internal_req
Jakub Hrozek
jhrozek at redhat.com
Mon Jan 23 20:00:33 UTC 2012
On Mon, Jan 23, 2012 at 07:02:06PM +0100, Pavel Březina wrote:
> Dne 23.1.2012 18:32, Jakub Hrozek napsal(a):
> >On Mon, Jan 23, 2012 at 10:19:37AM -0500, Stephen Gallagher wrote:
> >>On Mon, 2012-01-23 at 16:08 +0100, Jakub Hrozek wrote:
> >>>On Mon, Jan 23, 2012 at 03:55:26PM +0100, Pavel Březina wrote:
> >>>>Dne 23.1.2012 15:39, Jakub Hrozek napsal(a):
> >>>>>On Mon, Jan 23, 2012 at 10:23:36AM +0100, Pavel Březina wrote:
> >>>>>>Dne 23.1.2012 02:24, Stephen Gallagher napsal(a):
> >>>>>>>Also, when you call sss_dp_issue_request(), you're passing 'state' as
> >>>>>>>the pvt data for sss_dp_get_sudoers_msg(), but you meant to pass 'info',
> >>>>>>>I think.
> >>>>>>
> >>>>>>Shouldn't we start using tallog_get_type_abort() to detect these situations?
> >>>>>>
> >>>>>
> >>>>>I'm not sure we should ever abort, except for situations like options
> >>>>>mismatch (those can be potentially very dangerous).
> >>>>
> >>>>We can set up our own 'abort' function using talloc_set_abort_fn().
> >>>>For example: we can create an abort function that would kill sssd if
> >>>>it is under development but prints DEBUG messages in users version.
> >>>>
> >>>
> >>>I like this idea if we can get around the requirement of having to
> >>>support an old talloc version.
> >>>
> >>>>This function is not yet documented.
> >>>
> >>>You can send a patch to man talloc :-)
> >>
> >>I'm all for this. Please file an enhancement ticket to track it.
> >
> >A new patch rebased on top of the recent changes to enums is attached.
>
> Just a nitpick - shouldn't enum sss_dp_type be named sss_dp_sudo_type?
> Otherwise ack.
It should and is in the attached patch.
>
> Good work!
>
> Would it make sense to completely replace BE_REQ_SUDO with this
> enum? I would certainly like it and I can do it as a part of my
> cn=defaults patches where I'm refactoring SUDO DP so it is easier to
> implement new responder request.
Not so sure, I still like the division betwen SSS_DP_* on the responder
side and BE_REQ_* on the back end side.
I'd like to hear other opinions, though.
-------------- next part --------------
From 233683a35e76be2ca31e70a153cce1b753eaaf2b Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Thu, 19 Jan 2012 10:00:47 +0100
Subject: [PATCH] SUDO: Provide a sudo DP request based on the internal_req
---
src/providers/data_provider.h | 1 +
src/responder/sudo/sudosrv_dp.c | 125 ++++++++++++++++++++++++++++++++++
src/responder/sudo/sudosrv_private.h | 19 +++++
3 files changed, 145 insertions(+), 0 deletions(-)
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index fb61c730a2daca28b76a6f50fed5019a17d8a6d6..eb4f98cf3a62a6356b31758c0ebbd028ae0fff21 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -137,6 +137,7 @@
#define BE_REQ_INITGROUPS 0x0003
#define BE_REQ_NETGROUP 0x0004
#define BE_REQ_SERVICES 0x0005
+#define BE_REQ_SUDO 0x0006
#define BE_REQ_FAST 0x1000
/* AUTH related common data and functions */
diff --git a/src/responder/sudo/sudosrv_dp.c b/src/responder/sudo/sudosrv_dp.c
index 27f01f92b160d9805b69815fb789d5176c356f8b..31306e340951531ecb407fd9073a1ea993d5b5e5 100644
--- a/src/responder/sudo/sudosrv_dp.c
+++ b/src/responder/sudo/sudosrv_dp.c
@@ -220,3 +220,128 @@ errno_t sudosrv_dp_refresh_recv(struct tevent_req *req,
TEVENT_REQ_RETURN_ON_ERROR(req);
return EOK;
}
+
+struct sss_dp_get_sudoers_info {
+ struct sss_domain_info *dom;
+
+ bool fast_reply;
+ enum sss_dp_sudo_type type;
+ const char *name;
+};
+
+static DBusMessage *
+sss_dp_get_sudoers_msg(void *pvt);
+
+struct tevent_req *
+sss_dp_get_sudoers_send(TALLOC_CTX *mem_ctx,
+ struct resp_ctx *rctx,
+ struct sss_domain_info *dom,
+ bool fast_reply,
+ enum sss_dp_sudo_type type,
+ const char *name)
+{
+ struct tevent_req *req;
+ struct sss_dp_req_state *state;
+ struct sss_dp_get_sudoers_info *info;
+ errno_t ret;
+ char *key;
+
+ req = tevent_req_create(mem_ctx, &state, struct sss_dp_req_state);
+ if (!req) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ if (!dom) {
+ ret = EINVAL;
+ goto error;
+ }
+
+ info = talloc_zero(state, struct sss_dp_get_sudoers_info);
+ info->fast_reply = fast_reply;
+ info->type = type;
+ info->name = name;
+ info->dom = dom;
+
+ key = talloc_asprintf(state, "%d:%s@%s", type, name, dom->name);
+ if (!key) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ ret = sss_dp_issue_request(state, rctx, key, dom, sss_dp_get_sudoers_msg,
+ info, req);
+ talloc_free(key);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Could not issue DP request [%d]: %s\n",
+ ret, strerror(ret)));
+ goto error;
+ }
+
+ return req;
+
+error:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, rctx->ev);
+ return req;
+}
+
+static DBusMessage *
+sss_dp_get_sudoers_msg(void *pvt)
+{
+ DBusMessage *msg;
+ dbus_bool_t dbret;
+ struct sss_dp_get_sudoers_info *info;
+ uint32_t be_type = BE_REQ_SUDO;
+ char *filter;
+
+ info = talloc_get_type(pvt, struct sss_dp_get_sudoers_info);
+
+ if (info->fast_reply) {
+ be_type |= BE_REQ_FAST;
+ }
+
+ filter = talloc_asprintf(info, "name=%s", info->name);
+ if (!filter) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory?!\n"));
+ return NULL;
+ }
+
+ msg = dbus_message_new_method_call(NULL,
+ DP_PATH,
+ DP_INTERFACE,
+ DP_METHOD_SUDOHANDLER);
+ if (msg == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory?!\n"));
+ return NULL;
+ }
+
+ /* create the message */
+ DEBUG(SSSDBG_TRACE_FUNC,
+ ("Creating SUDOers request for [%s][%u][%s]\n",
+ info->dom->name, be_type, filter));
+
+ dbret = dbus_message_append_args(msg,
+ DBUS_TYPE_UINT32, &be_type,
+ DBUS_TYPE_STRING, &filter,
+ DBUS_TYPE_INVALID);
+ talloc_free(filter);
+ if (!dbret) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to build message\n"));
+ dbus_message_unref(msg);
+ return NULL;
+ }
+
+ return msg;
+}
+
+errno_t
+sss_dp_get_sudoers_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ dbus_uint16_t *dp_err,
+ dbus_uint32_t *dp_ret,
+ char **err_msg)
+{
+ return sss_dp_req_recv(mem_ctx, req, dp_err, dp_ret, err_msg);
+}
diff --git a/src/responder/sudo/sudosrv_private.h b/src/responder/sudo/sudosrv_private.h
index 7401570cc548ed22be5ec64e0c0d5c2fb00490c1..6188daea626a810386898d3335876f92bac5af9a 100644
--- a/src/responder/sudo/sudosrv_private.h
+++ b/src/responder/sudo/sudosrv_private.h
@@ -106,4 +106,23 @@ int sudosrv_response_append_attr(TALLOC_CTX *mem_ctx,
uint8_t **_response_body,
size_t *_response_len);
+enum sss_dp_sudo_type {
+ SSS_DP_SUDO
+};
+
+struct tevent_req *
+sss_dp_get_sudoers_send(TALLOC_CTX *mem_ctx,
+ struct resp_ctx *rctx,
+ struct sss_domain_info *dom,
+ bool fast_reply,
+ enum sss_dp_sudo_type type,
+ const char *name);
+
+errno_t
+sss_dp_get_sudoers_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ dbus_uint16_t *err_maj,
+ dbus_uint32_t *err_min,
+ char **err_msg);
+
#endif /* _SUDOSRV_PRIVATE_H_ */
--
1.7.7.5
More information about the sssd-devel
mailing list