[SSSD] [PATCH] PAM: new option pam_trusted_users
Pavel Reichl
preichl at redhat.com
Mon Sep 29 16:07:37 UTC 2014
On 09/29/2014 05:18 PM, Lukas Slebodnik wrote:
> On (27/09/14 12:39), Pavel Reichl wrote:
>> Attached patch now contains both options.
>>
>> Thanks.
>>
>>
>> On 09/25/2014 03:57 PM, Pavel Reichl wrote:
>>> Hello,
>>>
>>> please see attached patch which adds first of two options proposed in
>>> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
>>>
>>> Thanks!
>>>
> >From 78a61eb76d9ccf1d060a621f987dc666b9db6e42 Mon Sep 17 00:00:00 2001
>> From: Pavel Reichl <preichl at redhat.com>
>> Date: Thu, 25 Sep 2014 14:52:31 +0100
>> Subject: [PATCH] PAM: new options pam_trusted_users & pam_public_domains
>>
>> pam_public_domains option is a list of numerical UIDs or user names
>> that are trusted.
>>
>> pam_public_domains option is a list of domains accessible even for
>> untrusted users.
>>
>> Based on:
>> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
>> ---
>> src/confdb/confdb.h | 2 +
>> src/config/SSSDConfig/__init__.py.in | 2 +
>> src/config/etc/sssd.api.conf | 2 +
>> src/man/sssd.conf.5.xml | 46 ++++++++++++++++++
>> src/responder/pam/pamsrv.c | 94 ++++++++++++++++++++++++++++++++++++
>> src/responder/pam/pamsrv.h | 7 +++
>> src/responder/pam/pamsrv_cmd.c | 80 ++++++++++++++++++++++++++++--
>> src/util/domain_info_utils.c | 60 +++++++++++++++++++++++
>> src/util/util.h | 5 ++
>> 9 files changed, 295 insertions(+), 3 deletions(-)
>>
> //snip
>
>> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
>> index ad091e46e6cde1e12f554dde6470cf138412606e..3ff5fad82240c2c8a7e28c47397a20700b50ec04 100644
>> --- a/src/man/sssd.conf.5.xml
>> +++ b/src/man/sssd.conf.5.xml
>> @@ -836,6 +836,52 @@ fallback_homedir = /home/%u
>> </para>
>> </listitem>
>> </varlistentry>
>> + <varlistentry>
>> + <term>pam_trusted_users (string)</term>
>> + <listitem>
>> + <para>
>> + Specifies the comma-separated list of UID values or
>> + user names that are allowed to access the PAM
>> + responder. User names are resolved to UIDs at
>> + startup.
>> + </para>
>> + <para>
>> + Default: all (All users are allowed to access
>> + the PAM responder)
>> + </para>
>> + <para>
>> + Please note that UID 0 is always allowed to access
>> + the PAM responder even in case it is not in the
>> + pam_trusted_users list.
>> + </para>
>> + <para>
>> + Also please note that if there is a user name in
>> + pam_trusted_users list which fails to be resolved
>> + it will cause that SSSD will not be started.
>> + </para>
>> + </listitem>
>> + </varlistentry>
>> + <varlistentry>
>> + <term>pam_public_domains (string)</term>
>> + <listitem>
>> + <para>
>> + Specifies the comma-separated list of domain names
>> + that are accessible even to untrusted users.
>> + </para>
>> + <para>
>> + Two special values for pam_public_domains option
>> + are defined:
>> + </para>
>> + <para>
>> + none (Untrusted users are not allowed to access
>> + any domains PAM repsponder.)
>> + </para>
> just one special value is described here.
> The second one "all" is not described.
>
>> + <para>
>> + Default: none
>> + </para>
>> + </listitem>
>> + </varlistentry>
>> +
>> </variablelist>
>> </refsect2>
>>
> //snip
>
>> struct pam_auth_dp_req {
>> diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
>> index 561bd3d9678c73fdfa52592b5a0c502a46e89b5f..ebeaeeb1893b8f4078e3837f304b74dd46df7ec4 100644
>> --- a/src/responder/pam/pamsrv_cmd.c
>> +++ b/src/responder/pam/pamsrv_cmd.c
>> @@ -762,6 +762,45 @@ static int pam_auth_req_destructor(struct pam_auth_req *preq)
>> return 0;
>> }
>>
>> +static bool is_uid_trusted(int32_t uid,
> ^^^^^^^
> It is better to have uid as unsigned value ("uint32_t")
>
>> + size_t trusted_uids_count,
>> + uid_t *trusted_uids)
>> +{
>> + size_t i;
>> +
>> + /* root is always trusted */
>> + if (uid == 0) {
>> + return true;
>> + }
>> +
>> + /* All uids are allowed */
>> + if (trusted_uids_count == 0) {
>> + return true;
>> + }
>> +
>> + for(i = 0; i < trusted_uids_count; i++) {
>> + if (trusted_uids[i] == uid) {
>> + return true;
>> + }
>> + }
>> +
>> + return false;
>> +}
>> +
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
OK, thanks for review. I made changes you requested in both mails.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-PAM-new-options-pam_trusted_users-pam_public_domains.patch
Type: text/x-patch
Size: 17306 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140929/e2c96e02/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-PAM-Add-domains-option-to-pam_sss.patch
Type: text/x-patch
Size: 9113 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140929/e2c96e02/attachment-0001.bin>
More information about the sssd-devel
mailing list