[SSSD] [PATCHES] SUDO: IPA provider
Lukas Slebodnik
lslebodn at redhat.com
Thu Apr 25 11:29:49 UTC 2013
ehlo,
I am attaching two patches.
First patch make retrieving host information more reusable. It is a preparation
for easily reusing existing ldap code in SUDO IPA provider in second patch.
I am attaching two patches.
First patch make retrieving host information much more reusable. It is
a preparation for easily reusing existing ldap code in SUDO IPA provider
in the second patch.
LS
-------------- next part --------------
>From dc955451dbd7830105d6efd05464f4d0f87ec6c5 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Thu, 25 Apr 2013 10:59:18 +0200
Subject: [PATCH 1/2] Split retrieving host information into separate function.
Exporting code from sdap_sudo_init into new function
sdap_retrieve_host_information. This refactoring make retrieving host
information more reusable and function can be easily reused in other sudo
providers.
---
src/providers/ldap/sdap_sudo.c | 20 ++++++++++++++++++--
src/providers/ldap/sdap_sudo.h | 4 ++++
2 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/src/providers/ldap/sdap_sudo.c b/src/providers/ldap/sdap_sudo.c
index 3472da67c0b211ebae0782828addc361bbfeeab3..c415aa240b2ba9ddf66be0d33e1842623f836950 100644
--- a/src/providers/ldap/sdap_sudo.c
+++ b/src/providers/ldap/sdap_sudo.c
@@ -125,7 +125,6 @@ int sdap_sudo_init(struct be_ctx *be_ctx,
void **pvt_data)
{
struct sdap_sudo_ctx *sudo_ctx = NULL;
- struct tevent_req *req = NULL;
int ret;
DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo LDAP back end\n"));
@@ -155,7 +154,24 @@ int sdap_sudo_init(struct be_ctx *be_ctx,
return ret;
}
- req = sdap_sudo_get_hostinfo_send(sudo_ctx, id_ctx->opts, be_ctx);
+ ret = sdap_retrieve_host_information(be_ctx, sudo_ctx, id_ctx->opts);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+ ret, strerror(ret)));
+ return ret;
+ }
+
+ return EOK;
+}
+
+int sdap_retrieve_host_information(struct be_ctx *be_ctx,
+ struct sdap_sudo_ctx *sudo_ctx,
+ struct sdap_options *opts)
+{
+ struct tevent_req *req = NULL;
+ int ret;
+
+ req = sdap_sudo_get_hostinfo_send(sudo_ctx, opts, be_ctx);
if (req == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to retrieve host information - "
"(host filter will be disabled)\n"));
diff --git a/src/providers/ldap/sdap_sudo.h b/src/providers/ldap/sdap_sudo.h
index e2764b90c91470ed64e4c07a792206fa034646a6..586b6bb0d1f3f3e2cb88c95a396a86bca6adb523 100644
--- a/src/providers/ldap/sdap_sudo.h
+++ b/src/providers/ldap/sdap_sudo.h
@@ -82,6 +82,10 @@ int sdap_sudo_timer_recv(TALLOC_CTX *mem_ctx,
struct tevent_req **_subreq);
/* host info */
+int sdap_retrieve_host_information(struct be_ctx *be_ctx,
+ struct sdap_sudo_ctx *sudo_ctx,
+ struct sdap_options *opts);
+
struct tevent_req * sdap_sudo_get_hostinfo_send(TALLOC_CTX *mem_ctx,
struct sdap_options *opts,
struct be_ctx *be_ctx);
--
1.8.1.4
-------------- next part --------------
>From 44ebdde63bae103ddfb141a8a34aec7e5a080d27 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 24 Apr 2013 20:26:40 +0200
Subject: [PATCH 2/2] SUDO: IPA provider
This patch added auto configuration SUDO with ipa provider and compat tree.
https://fedorahosted.org/sssd/ticket/1733
---
Makefile.am | 5 +++
src/providers/ipa/ipa_common.c | 80 +++++++++++++++++++++++++++++++++++++++++
src/providers/ipa/ipa_common.h | 12 +++++++
src/providers/ipa/ipa_init.c | 24 +++++++++++++
src/providers/ipa/ipa_opts.h | 16 +++++++++
src/providers/ipa/ipa_sudo.c | 82 ++++++++++++++++++++++++++++++++++++++++++
6 files changed, 219 insertions(+)
create mode 100644 src/providers/ipa/ipa_sudo.c
diff --git a/Makefile.am b/Makefile.am
index ef1802246226bd08826f028a784d80289b723d81..dce4f8b13ac42597c349fbfce728fb3e56293225 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1545,6 +1545,11 @@ libsss_ipa_la_SOURCES += \
src/providers/ipa/ipa_autofs.c
endif
+if BUILD_SUDO
+libsss_ipa_la_SOURCES += \
+ src/providers/ipa/ipa_sudo.c
+endif
+
if BUILD_SSH
libsss_ipa_la_SOURCES += src/providers/ipa/ipa_hostid.c
endif
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index be1bd1d2f8c42143d7ff1fe205ffb774ffe19dd0..2b4b0a9bdb4c754eb8da29adfbba9415baebc650 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -1008,3 +1008,83 @@ done:
talloc_free(tmp_ctx);
return ret;
}
+
+int ipa_get_sudo_options(struct ipa_options *ipa_opts,
+ struct confdb_ctx *cdb,
+ const char *conf_path,
+ struct sdap_options **_opts,
+ bool *use_host_filter,
+ bool *include_regexp,
+ bool *include_netgroups)
+{
+ TALLOC_CTX *tmp_ctx;
+ errno_t ret;
+ char *basedn;
+ char *sudo_base;
+
+ tmp_ctx = talloc_new(NULL);
+ if (!tmp_ctx) {
+ return ENOMEM;
+ }
+
+ ret = domain_to_basedn(tmp_ctx,
+ dp_opt_get_string(ipa_opts->basic, IPA_KRB5_REALM),
+ &basedn);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ if (NULL == dp_opt_get_string(ipa_opts->id->basic,
+ SDAP_SUDO_SEARCH_BASE)) {
+
+ sudo_base = talloc_asprintf(tmp_ctx, "ou=sudoers,%s", basedn);
+ if (!sudo_base) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = dp_opt_set_string(ipa_opts->id->basic,
+ SDAP_SUDO_SEARCH_BASE,
+ sudo_base);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_LIBS, ("Option %s set to %s\n",
+ ipa_opts->id->basic[SDAP_SUDO_SEARCH_BASE].opt_name,
+ dp_opt_get_string(ipa_opts->id->basic,
+ SDAP_SUDO_SEARCH_BASE)));
+ }
+
+ ret = sdap_parse_search_base(ipa_opts->id, ipa_opts->id->basic,
+ SDAP_SUDO_SEARCH_BASE,
+ &ipa_opts->id->sudo_search_bases);
+ if (ret != EOK && ret != ENOENT) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Could not parse sudo search base\n"));
+ goto done;
+ }
+
+ /* attrs map */
+ ret = sdap_get_map(ipa_opts->id, cdb, conf_path,
+ ipa_sudorule_map,
+ SDAP_OPTS_SUDO,
+ &ipa_opts->id->sudorule_map);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Could not get SUDO attribute map\n"));
+ return ret;
+ }
+
+ /* host filter */
+ *use_host_filter = dp_opt_get_bool(ipa_opts->id->basic,
+ SDAP_SUDO_USE_HOST_FILTER);
+ *include_netgroups = dp_opt_get_bool(ipa_opts->id->basic,
+ SDAP_SUDO_INCLUDE_NETGROUPS);
+ *include_regexp = dp_opt_get_bool(ipa_opts->id->basic,
+ SDAP_SUDO_INCLUDE_REGEXP);
+
+ *_opts = ipa_opts->id;
+ ret = EOK;
+done:
+ talloc_free(tmp_ctx);
+ return ret;
+}
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index ae1c91731e9637c06dad555d1a87ef2e0cf53184..fe4ba2dd82c6db9fa88bc4558dbcd9bd429f2af4 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -168,6 +168,13 @@ int ipa_get_autofs_options(struct ipa_options *ipa_opts,
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_opts);
+int ipa_get_sudo_options(struct ipa_options *ipa_opts,
+ struct confdb_ctx *cdb,
+ const char *conf_path,
+ struct sdap_options **_opts,
+ bool *use_host_filter,
+ bool *include_regexp,
+ bool *include_netgroups);
int ipa_autofs_init(struct be_ctx *be_ctx,
struct ipa_id_ctx *id_ctx,
@@ -180,4 +187,9 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
struct ipa_options *options,
struct ipa_service **_service);
+int ipa_sudo_init(struct be_ctx *be_ctx,
+ struct ipa_id_ctx *id_ctx,
+ struct bet_ops **ops,
+ void **pvt_data);
+
#endif /* _IPA_COMMON_H_ */
diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index b65a6cea1ddd05272a8ae522be5c8b070a93ac1e..0e9fe0dd185e7b237bf4cda077e872dfd0d07fe2 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -526,3 +526,27 @@ int sssm_ipa_subdomains_init(struct be_ctx *bectx,
return EOK;
}
+
+int sssm_ipa_sudo_init(struct be_ctx *bectx,
+ struct bet_ops **ops,
+ void **pvt_data)
+{
+#ifdef BUILD_SUDO
+ struct ipa_id_ctx *id_ctx;
+ int ret;
+
+ DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing IPA sudo handler\n"));
+
+ ret = sssm_ipa_id_init(bectx, ops, (void **) &id_ctx);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("sssm_ipa_id_init failed.\n"));
+ return ret;
+ }
+
+ return ipa_sudo_init(bectx, id_ctx, ops, pvt_data);
+#else
+ DEBUG(SSSDBG_MINOR_FAILURE, ("Sudo init handler called but SSSD is "
+ "built without sudo support, ignoring\n"));
+ return EOK;
+#endif
+}
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 6adbdd96a907c26938b8cb80d22f156b09bbacc3..2fe7e1c29e1dab8c18575a9fb2b368836514a1f0 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -290,4 +290,20 @@ struct sdap_attr_map ipa_autofs_entry_map[] = {
SDAP_ATTR_MAP_TERMINATOR
};
+struct sdap_attr_map ipa_sudorule_map[] = {
+ { "ldap_sudorule_object_class", "sudoRole", SYSDB_SUDO_CACHE_OC, NULL },
+ { "ldap_sudorule_name", "cn", SYSDB_SUDO_CACHE_AT_CN, NULL },
+ { "ldap_sudorule_command", "sudoCommand", SYSDB_SUDO_CACHE_AT_COMMAND, NULL },
+ { "ldap_sudorule_host", "sudoHost", SYSDB_SUDO_CACHE_AT_HOST, NULL },
+ { "ldap_sudorule_user", "sudoUser", SYSDB_SUDO_CACHE_AT_USER, NULL },
+ { "ldap_sudorule_option", "sudoOption", SYSDB_SUDO_CACHE_AT_OPTION, NULL },
+ { "ldap_sudorule_runasuser", "sudoRunAsUser", SYSDB_SUDO_CACHE_AT_RUNASUSER, NULL },
+ { "ldap_sudorule_runasgroup", "sudoRunAsGroup", SYSDB_SUDO_CACHE_AT_RUNASGROUP, NULL },
+ { "ldap_sudorule_notbefore", "sudoNotBefore", SYSDB_SUDO_CACHE_AT_NOTBEFORE, NULL },
+ { "ldap_sudorule_notafter", "sudoNotAfter", SYSDB_SUDO_CACHE_AT_NOTAFTER, NULL },
+ { "ldap_sudorule_order", "sudoOrder", SYSDB_SUDO_CACHE_AT_ORDER, NULL },
+ { "ldap_sudorule_entry_usn", NULL, SYSDB_USN, NULL },
+ SDAP_ATTR_MAP_TERMINATOR
+};
+
#endif /* IPA_OPTS_H_ */
diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c
new file mode 100644
index 0000000000000000000000000000000000000000..c6fb3cb88361ea56b63e8d347c07cdaa2f796228
--- /dev/null
+++ b/src/providers/ipa/ipa_sudo.c
@@ -0,0 +1,82 @@
+/*
+ SSSD
+
+ IPA Provider Initialization functions
+
+ Authors:
+ Lukas Slebodnik <lslebodn at redhat.com>
+
+ Copyright (C) 2013 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "providers/ipa/ipa_common.h"
+#include "providers/ipa/ipa_id.h"
+#include "providers/ipa/ipa_auth.h"
+
+#include "providers/ldap/sdap_sudo.h"
+#include "db/sysdb_sudo.h"
+
+struct bet_ops ipa_sudo_ops = {
+ .handler = sdap_sudo_handler,
+ .finalize = NULL,
+ .check_online = sdap_check_online
+};
+
+int ipa_sudo_init(struct be_ctx *be_ctx,
+ struct ipa_id_ctx *id_ctx,
+ struct bet_ops **ops,
+ void **pvt_data)
+{
+ struct sdap_sudo_ctx *sudo_ctx = NULL;
+ int ret;
+
+ DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo IPA back end\n"));
+
+ sudo_ctx = talloc_zero(be_ctx, struct sdap_sudo_ctx);
+ if (sudo_ctx == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc() failed\n"));
+ return ENOMEM;
+ }
+
+ sudo_ctx->id_ctx = id_ctx->sdap_id_ctx;
+ *ops = &ipa_sudo_ops;
+ *pvt_data = sudo_ctx;
+
+ /* we didn't do any full refresh now,
+ * so we don't have current usn values available */
+ sudo_ctx->full_refresh_done = false;
+
+ ret = ipa_get_sudo_options(id_ctx->ipa_options, be_ctx->cdb,
+ be_ctx->conf_path, &id_ctx->sdap_id_ctx->opts,
+ &sudo_ctx->use_host_filter,
+ &sudo_ctx->include_regexp,
+ &sudo_ctx->include_netgroups);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+ ret, strerror(ret)));
+ return ret;
+ }
+
+ ret = sdap_retrieve_host_information(be_ctx, sudo_ctx,
+ id_ctx->sdap_id_ctx->opts);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Cannot get SUDO options [%d]: %s\n",
+ ret, strerror(ret)));
+ return ret;
+ }
+
+ return EOK;
+}
--
1.8.1.4
More information about the sssd-devel
mailing list