[SSSD] [PATCH] Make IPA SELinux provider aware of subdomain users

Jakub Hrozek jhrozek at redhat.com
Fri Aug 30 12:07:27 UTC 2013


Hi,

attached is a 1.9 version of a fix for
https://fedorahosted.org/sssd/ticket/1892.

It's not the best looking code but unfortunately in 1.9 there is still
the old sysdb API before Simo's refactoring where we need to pass the
right sysdb context.
-------------- next part --------------
>From a4c72827382347edd8b31dac81a8cf163ee61f38 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 11 Aug 2013 23:39:49 +0200
Subject: [PATCH] Make IPA SELinux provider aware of subdomain users

Fixes https://fedorahosted.org/sssd/ticket/1892
---
 src/db/sysdb_selinux.c          |  9 ++++++---
 src/db/sysdb_selinux.h          |  2 +-
 src/providers/ipa/ipa_selinux.c | 24 ++++++++++++++++++------
 src/responder/pam/pamsrv_cmd.c  |  6 ++++--
 4 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/src/db/sysdb_selinux.c b/src/db/sysdb_selinux.c
index a6b4809f67f43cbb8d71ad66a39a8b6776a2e0d2..f49f58d277e5b70d07efd9af3a680ceed19821a1 100644
--- a/src/db/sysdb_selinux.c
+++ b/src/db/sysdb_selinux.c
@@ -333,7 +333,7 @@ sysdb_get_selinux_usermaps(TALLOC_CTX *mem_ctx,
 }
 
 errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx,
-                                                 struct sysdb_ctx *sysdb,
+                                                 struct sss_domain_info *dom,
                                                  const char *username,
                                                  struct ldb_message ***_usermaps)
 {
@@ -357,20 +357,23 @@ errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx,
     uint32_t top_priority = 0;
     errno_t ret;
     int i;
+    struct sss_domain_info *parent_dom;
 
     tmp_ctx = talloc_new(NULL);
     if (!tmp_ctx) {
         return ENOMEM;
     }
 
+    parent_dom = dom->parent ? dom->parent : dom;
+
     /* Now extract user attributes */
-    ret = sss_selinux_extract_user(tmp_ctx, sysdb, username, &user);
+    ret = sss_selinux_extract_user(tmp_ctx, dom->sysdb, username, &user);
     if (ret != EOK) {
         goto done;
     }
 
     /* Now extract all SELinux user maps */
-    ret = sysdb_get_selinux_usermaps(tmp_ctx, sysdb, attrs, &msgs_count, &msgs);
+    ret = sysdb_get_selinux_usermaps(tmp_ctx, parent_dom->sysdb, attrs, &msgs_count, &msgs);
     if (ret) {
         goto done;
     }
diff --git a/src/db/sysdb_selinux.h b/src/db/sysdb_selinux.h
index 5fcbb56ef20f1ee11b979fc6e0b4ea87adfa939e..598936dbd68346aaf544d17b5dc6070bfa55af10 100644
--- a/src/db/sysdb_selinux.h
+++ b/src/db/sysdb_selinux.h
@@ -61,7 +61,7 @@ errno_t sysdb_search_selinux_usermap_by_mapname(TALLOC_CTX *mem_ctx,
                                                 struct ldb_message **_usermap);
 
 errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx,
-                                                 struct sysdb_ctx *sysdb,
+                                                 struct sss_domain_info *dom,
                                                  const char *username,
                                                  struct ldb_message ***_usermaps);
 
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index d1dbe576589d311dbaf2b589cb88eb61083e882a..21e518fd12c29918110c0388b177451298d0850b 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -36,6 +36,7 @@
 #include "providers/ipa/ipa_access.h"
 #include "providers/ipa/ipa_selinux_common.h"
 #include "providers/ipa/ipa_selinux_maps.h"
+#include "providers/krb5/krb5_utils.h"
 
 static struct tevent_req *
 ipa_get_selinux_send(struct be_req *breq,
@@ -52,7 +53,7 @@ static errno_t ipa_get_selinux_recv(struct tevent_req *req,
                                     char **map_order);
 
 static struct ipa_selinux_op_ctx *
-ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
+ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
                           struct be_req *be_req, const char *username,
                           const char *hostname);
 static void ipa_selinux_handler_done(struct tevent_req *subreq);
@@ -84,6 +85,8 @@ void ipa_selinux_handler(struct be_req *be_req)
     struct tevent_req *req;
     struct pam_data *pd;
     const char *hostname;
+    int ret;
+    struct sss_domain_info *dom;
 
     pd = talloc_get_type(be_req->req_data, struct pam_data);
 
@@ -98,7 +101,13 @@ void ipa_selinux_handler(struct be_req *be_req)
         goto fail;
     }
 
-    op_ctx = ipa_selinux_create_op_ctx(be_req, be_req->sysdb, be_req,
+    ret = get_domain_or_subdomain(be_req, be_req->be_ctx, pd->domain, &dom);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("get_domain_or_subdomain failed.\n"));
+        goto fail;
+    }
+
+    op_ctx = ipa_selinux_create_op_ctx(be_req, dom, be_req,
                                        pd->user, hostname);
     if (op_ctx == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, ("Cannot create op context\n"));
@@ -119,7 +128,7 @@ fail:
 }
 
 static struct ipa_selinux_op_ctx *
-ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
+ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
                           struct be_req *be_req, const char *username,
                           const char *hostname)
 {
@@ -132,6 +141,7 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
     struct ldb_message **msgs;
     struct sysdb_attrs **hosts;
     errno_t ret;
+    struct sss_domain_info *parent_dom;
 
     op_ctx = talloc_zero(mem_ctx, struct ipa_selinux_op_ctx);
     if (op_ctx == NULL) {
@@ -139,18 +149,20 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
     }
     op_ctx->be_req = be_req;
 
-    ret = sss_selinux_extract_user(op_ctx, sysdb, username, &op_ctx->user);
+    parent_dom = dom->parent ? dom->parent : dom;
+
+    ret = sss_selinux_extract_user(op_ctx, dom->sysdb, username, &op_ctx->user);
     if (ret != EOK) {
         goto fail;
     }
 
-    host_dn = sysdb_custom_dn(sysdb, op_ctx, hostname, HBAC_HOSTS_SUBDIR);
+    host_dn = sysdb_custom_dn(parent_dom->sysdb, op_ctx, hostname, HBAC_HOSTS_SUBDIR);
     if (host_dn == NULL) {
         goto fail;
     }
 
     /* Look up the host to get its originalMemberOf entries */
-    ret = sysdb_search_entry(op_ctx, sysdb, host_dn,
+    ret = sysdb_search_entry(op_ctx, parent_dom->sysdb, host_dn,
                              LDB_SCOPE_BASE, NULL,
                              attrs, &count, &msgs);
     if (ret == ENOENT || count == 0) {
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index a180a8f1d93c6c0938782e225d192e76de408105..db1f90bc264b60c1075b48da419b5a35f987af3b 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -522,7 +522,9 @@ static errno_t process_selinux_mappings(struct pam_auth_req *preq)
         goto done;
     }
 
-    sysdb = preq->domain->sysdb;
+    /* Sysdb rules are always stored in the parent domain */
+    sysdb = preq->domain->parent ? preq->domain->parent->sysdb :
+                                   preq->domain->sysdb;
     if (sysdb == NULL) {
         DEBUG(SSSDBG_FATAL_FAILURE, ("Fatal: Sysdb CTX not found for "
                                      "domain [%s]!\n", preq->domain->name));
@@ -598,7 +600,7 @@ static errno_t process_selinux_mappings(struct pam_auth_req *preq)
     }
 
     /* Fetch all maps applicable to the user who is currently logging in */
-    ret = sysdb_search_selinux_usermap_by_username(tmp_ctx, sysdb, pd->user,
+    ret = sysdb_search_selinux_usermap_by_username(tmp_ctx, preq->domain, pd->user,
                                                    &usermaps);
     if (ret != EOK && ret != ENOENT) {
         goto done;
-- 
1.8.2.1



More information about the sssd-devel mailing list