[SSSD] [PATCHES] SUDO: IPA provider

Lukas Slebodnik lslebodn at redhat.com
Thu Apr 25 11:29:49 UTC 2013


ehlo,

I am attaching two patches.
First patch make retrieving host information more reusable. It is a preparation
for easily reusing existing ldap code in SUDO IPA provider in second patch.

I am attaching two patches.
First patch make retrieving host information much more reusable. It is
a preparation for easily reusing existing ldap code in SUDO IPA provider
in the second patch.

LS
-------------- next part --------------
>From dc955451dbd7830105d6efd05464f4d0f87ec6c5 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Thu, 25 Apr 2013 10:59:18 +0200
Subject: [PATCH 1/2] Split retrieving host information into separate function.

Exporting code from sdap_sudo_init into new function
sdap_retrieve_host_information. This refactoring make retrieving host
information more reusable and function can be easily reused in other sudo
providers.
---
 src/providers/ldap/sdap_sudo.c | 20 ++++++++++++++++++--
 src/providers/ldap/sdap_sudo.h |  4 ++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/providers/ldap/sdap_sudo.c b/src/providers/ldap/sdap_sudo.c
index 3472da67c0b211ebae0782828addc361bbfeeab3..c415aa240b2ba9ddf66be0d33e1842623f836950 100644
--- a/src/providers/ldap/sdap_sudo.c
+++ b/src/providers/ldap/sdap_sudo.c
@@ -125,7 +125,6 @@ int sdap_sudo_init(struct be_ctx *be_ctx,
                    void **pvt_data)
 {
     struct sdap_sudo_ctx *sudo_ctx = NULL;
-    struct tevent_req *req = NULL;
     int ret;
 
     DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo LDAP back end\n"));
@@ -155,7 +154,24 @@ int sdap_sudo_init(struct be_ctx *be_ctx,
         return ret;
     }
 
-    req = sdap_sudo_get_hostinfo_send(sudo_ctx, id_ctx->opts, be_ctx);
+    ret = sdap_retrieve_host_information(be_ctx, sudo_ctx, id_ctx->opts);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+                                  ret, strerror(ret)));
+            return ret;
+    }
+
+    return EOK;
+}
+
+int sdap_retrieve_host_information(struct be_ctx *be_ctx,
+                                   struct sdap_sudo_ctx *sudo_ctx,
+                                   struct sdap_options *opts)
+{
+    struct tevent_req *req = NULL;
+    int ret;
+
+    req = sdap_sudo_get_hostinfo_send(sudo_ctx, opts, be_ctx);
     if (req == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to retrieve host information - "
               "(host filter will be disabled)\n"));
diff --git a/src/providers/ldap/sdap_sudo.h b/src/providers/ldap/sdap_sudo.h
index e2764b90c91470ed64e4c07a792206fa034646a6..586b6bb0d1f3f3e2cb88c95a396a86bca6adb523 100644
--- a/src/providers/ldap/sdap_sudo.h
+++ b/src/providers/ldap/sdap_sudo.h
@@ -82,6 +82,10 @@ int sdap_sudo_timer_recv(TALLOC_CTX *mem_ctx,
                          struct tevent_req **_subreq);
 
 /* host info */
+int sdap_retrieve_host_information(struct be_ctx *be_ctx,
+                                   struct sdap_sudo_ctx *sudo_ctx,
+                                   struct sdap_options *opts);
+
 struct tevent_req * sdap_sudo_get_hostinfo_send(TALLOC_CTX *mem_ctx,
                                                 struct sdap_options *opts,
                                                 struct be_ctx *be_ctx);
-- 
1.8.1.4

-------------- next part --------------
>From 44ebdde63bae103ddfb141a8a34aec7e5a080d27 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 24 Apr 2013 20:26:40 +0200
Subject: [PATCH 2/2] SUDO: IPA provider

This patch added auto configuration SUDO with ipa provider and compat tree.

https://fedorahosted.org/sssd/ticket/1733
---
 Makefile.am                    |  5 +++
 src/providers/ipa/ipa_common.c | 80 +++++++++++++++++++++++++++++++++++++++++
 src/providers/ipa/ipa_common.h | 12 +++++++
 src/providers/ipa/ipa_init.c   | 24 +++++++++++++
 src/providers/ipa/ipa_opts.h   | 16 +++++++++
 src/providers/ipa/ipa_sudo.c   | 82 ++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 219 insertions(+)
 create mode 100644 src/providers/ipa/ipa_sudo.c

diff --git a/Makefile.am b/Makefile.am
index ef1802246226bd08826f028a784d80289b723d81..dce4f8b13ac42597c349fbfce728fb3e56293225 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1545,6 +1545,11 @@ libsss_ipa_la_SOURCES += \
     src/providers/ipa/ipa_autofs.c
 endif
 
+if BUILD_SUDO
+libsss_ipa_la_SOURCES += \
+    src/providers/ipa/ipa_sudo.c
+endif
+
 if BUILD_SSH
 libsss_ipa_la_SOURCES += src/providers/ipa/ipa_hostid.c
 endif
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index be1bd1d2f8c42143d7ff1fe205ffb774ffe19dd0..2b4b0a9bdb4c754eb8da29adfbba9415baebc650 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -1008,3 +1008,83 @@ done:
     talloc_free(tmp_ctx);
     return ret;
 }
+
+int ipa_get_sudo_options(struct ipa_options *ipa_opts,
+                         struct confdb_ctx *cdb,
+                         const char *conf_path,
+                         struct sdap_options **_opts,
+                         bool *use_host_filter,
+                         bool *include_regexp,
+                         bool *include_netgroups)
+{
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    char *basedn;
+    char *sudo_base;
+
+    tmp_ctx = talloc_new(NULL);
+    if (!tmp_ctx) {
+        return ENOMEM;
+    }
+
+    ret = domain_to_basedn(tmp_ctx,
+                           dp_opt_get_string(ipa_opts->basic, IPA_KRB5_REALM),
+                           &basedn);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    if (NULL == dp_opt_get_string(ipa_opts->id->basic,
+                                  SDAP_SUDO_SEARCH_BASE)) {
+
+        sudo_base = talloc_asprintf(tmp_ctx, "ou=sudoers,%s", basedn);
+        if (!sudo_base) {
+            ret = ENOMEM;
+            goto done;
+        }
+
+        ret = dp_opt_set_string(ipa_opts->id->basic,
+                                SDAP_SUDO_SEARCH_BASE,
+                                sudo_base);
+        if (ret != EOK) {
+            goto done;
+        }
+
+        DEBUG(SSSDBG_TRACE_LIBS, ("Option %s set to %s\n",
+              ipa_opts->id->basic[SDAP_SUDO_SEARCH_BASE].opt_name,
+              dp_opt_get_string(ipa_opts->id->basic,
+                                SDAP_SUDO_SEARCH_BASE)));
+    }
+
+    ret = sdap_parse_search_base(ipa_opts->id, ipa_opts->id->basic,
+                                 SDAP_SUDO_SEARCH_BASE,
+                                 &ipa_opts->id->sudo_search_bases);
+    if (ret != EOK && ret != ENOENT) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not parse sudo search base\n"));
+        goto done;
+    }
+
+    /* attrs map */
+    ret = sdap_get_map(ipa_opts->id, cdb, conf_path,
+                       ipa_sudorule_map,
+                       SDAP_OPTS_SUDO,
+                       &ipa_opts->id->sudorule_map);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not get SUDO attribute map\n"));
+        return ret;
+    }
+
+    /* host filter */
+    *use_host_filter = dp_opt_get_bool(ipa_opts->id->basic,
+                                       SDAP_SUDO_USE_HOST_FILTER);
+    *include_netgroups = dp_opt_get_bool(ipa_opts->id->basic,
+                                         SDAP_SUDO_INCLUDE_NETGROUPS);
+    *include_regexp = dp_opt_get_bool(ipa_opts->id->basic,
+                                      SDAP_SUDO_INCLUDE_REGEXP);
+
+    *_opts = ipa_opts->id;
+    ret = EOK;
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index ae1c91731e9637c06dad555d1a87ef2e0cf53184..fe4ba2dd82c6db9fa88bc4558dbcd9bd429f2af4 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -168,6 +168,13 @@ int ipa_get_autofs_options(struct ipa_options *ipa_opts,
                            struct confdb_ctx *cdb,
                            const char *conf_path,
                            struct sdap_options **_opts);
+int ipa_get_sudo_options(struct ipa_options *ipa_opts,
+                         struct confdb_ctx *cdb,
+                         const char *conf_path,
+                         struct sdap_options **_opts,
+                         bool *use_host_filter,
+                         bool *include_regexp,
+                         bool *include_netgroups);
 
 int ipa_autofs_init(struct be_ctx *be_ctx,
                     struct ipa_id_ctx *id_ctx,
@@ -180,4 +187,9 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
                      struct ipa_options *options,
                      struct ipa_service **_service);
 
+int ipa_sudo_init(struct be_ctx *be_ctx,
+                  struct ipa_id_ctx *id_ctx,
+                  struct bet_ops **ops,
+                  void **pvt_data);
+
 #endif /* _IPA_COMMON_H_ */
diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index b65a6cea1ddd05272a8ae522be5c8b070a93ac1e..0e9fe0dd185e7b237bf4cda077e872dfd0d07fe2 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -526,3 +526,27 @@ int sssm_ipa_subdomains_init(struct be_ctx *bectx,
 
     return EOK;
 }
+
+int sssm_ipa_sudo_init(struct be_ctx *bectx,
+                       struct bet_ops **ops,
+                       void **pvt_data)
+{
+#ifdef BUILD_SUDO
+    struct ipa_id_ctx *id_ctx;
+    int ret;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing IPA sudo handler\n"));
+
+    ret = sssm_ipa_id_init(bectx, ops, (void **) &id_ctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("sssm_ipa_id_init failed.\n"));
+        return ret;
+    }
+
+    return ipa_sudo_init(bectx, id_ctx, ops, pvt_data);
+#else
+    DEBUG(SSSDBG_MINOR_FAILURE, ("Sudo init handler called but SSSD is "
+                                 "built without sudo support, ignoring\n"));
+    return EOK;
+#endif
+}
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 6adbdd96a907c26938b8cb80d22f156b09bbacc3..2fe7e1c29e1dab8c18575a9fb2b368836514a1f0 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -290,4 +290,20 @@ struct sdap_attr_map ipa_autofs_entry_map[] = {
     SDAP_ATTR_MAP_TERMINATOR
 };
 
+struct sdap_attr_map ipa_sudorule_map[] = {
+    { "ldap_sudorule_object_class", "sudoRole", SYSDB_SUDO_CACHE_OC, NULL },
+    { "ldap_sudorule_name", "cn", SYSDB_SUDO_CACHE_AT_CN, NULL },
+    { "ldap_sudorule_command", "sudoCommand", SYSDB_SUDO_CACHE_AT_COMMAND, NULL },
+    { "ldap_sudorule_host", "sudoHost", SYSDB_SUDO_CACHE_AT_HOST, NULL },
+    { "ldap_sudorule_user", "sudoUser", SYSDB_SUDO_CACHE_AT_USER, NULL },
+    { "ldap_sudorule_option", "sudoOption", SYSDB_SUDO_CACHE_AT_OPTION, NULL },
+    { "ldap_sudorule_runasuser", "sudoRunAsUser", SYSDB_SUDO_CACHE_AT_RUNASUSER, NULL },
+    { "ldap_sudorule_runasgroup", "sudoRunAsGroup", SYSDB_SUDO_CACHE_AT_RUNASGROUP, NULL },
+    { "ldap_sudorule_notbefore", "sudoNotBefore", SYSDB_SUDO_CACHE_AT_NOTBEFORE, NULL },
+    { "ldap_sudorule_notafter", "sudoNotAfter", SYSDB_SUDO_CACHE_AT_NOTAFTER, NULL },
+    { "ldap_sudorule_order", "sudoOrder", SYSDB_SUDO_CACHE_AT_ORDER, NULL },
+    { "ldap_sudorule_entry_usn", NULL, SYSDB_USN, NULL },
+    SDAP_ATTR_MAP_TERMINATOR
+};
+
 #endif /* IPA_OPTS_H_ */
diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c
new file mode 100644
index 0000000000000000000000000000000000000000..c6fb3cb88361ea56b63e8d347c07cdaa2f796228
--- /dev/null
+++ b/src/providers/ipa/ipa_sudo.c
@@ -0,0 +1,82 @@
+/*
+ SSSD
+
+ IPA Provider Initialization functions
+
+ Authors:
+ Lukas Slebodnik <lslebodn at redhat.com>
+
+ Copyright (C) 2013 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "providers/ipa/ipa_common.h"
+#include "providers/ipa/ipa_id.h"
+#include "providers/ipa/ipa_auth.h"
+
+#include "providers/ldap/sdap_sudo.h"
+#include "db/sysdb_sudo.h"
+
+struct bet_ops ipa_sudo_ops = {
+    .handler = sdap_sudo_handler,
+    .finalize = NULL,
+    .check_online = sdap_check_online
+};
+
+int ipa_sudo_init(struct be_ctx *be_ctx,
+                  struct ipa_id_ctx *id_ctx,
+                  struct bet_ops **ops,
+                  void **pvt_data)
+{
+    struct sdap_sudo_ctx *sudo_ctx = NULL;
+    int ret;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo IPA back end\n"));
+
+    sudo_ctx = talloc_zero(be_ctx, struct sdap_sudo_ctx);
+    if (sudo_ctx == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc() failed\n"));
+        return ENOMEM;
+    }
+
+    sudo_ctx->id_ctx = id_ctx->sdap_id_ctx;
+    *ops = &ipa_sudo_ops;
+    *pvt_data = sudo_ctx;
+
+    /* we didn't do any full refresh now,
+     * so we don't have current usn values available */
+    sudo_ctx->full_refresh_done = false;
+
+    ret = ipa_get_sudo_options(id_ctx->ipa_options, be_ctx->cdb,
+                               be_ctx->conf_path, &id_ctx->sdap_id_ctx->opts,
+                               &sudo_ctx->use_host_filter,
+                               &sudo_ctx->include_regexp,
+                               &sudo_ctx->include_netgroups);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+                                  ret, strerror(ret)));
+        return ret;
+    }
+
+    ret = sdap_retrieve_host_information(be_ctx, sudo_ctx,
+                                         id_ctx->sdap_id_ctx->opts);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+                                  ret, strerror(ret)));
+            return ret;
+    }
+
+    return EOK;
+}
-- 
1.8.1.4



More information about the sssd-devel mailing list