[SSSD] [PATCH] PAM: new option pam_trusted_users

Pavel Reichl preichl at redhat.com
Mon Sep 29 16:07:37 UTC 2014


On 09/29/2014 05:18 PM, Lukas Slebodnik wrote:
> On (27/09/14 12:39), Pavel Reichl wrote:
>> Attached patch now contains both options.
>>
>> Thanks.
>>
>>
>> On 09/25/2014 03:57 PM, Pavel Reichl wrote:
>>> Hello,
>>>
>>> please see attached patch which adds first of two options proposed in
>>> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
>>>
>>> Thanks!
>>>
> >From 78a61eb76d9ccf1d060a621f987dc666b9db6e42 Mon Sep 17 00:00:00 2001
>> From: Pavel Reichl <preichl at redhat.com>
>> Date: Thu, 25 Sep 2014 14:52:31 +0100
>> Subject: [PATCH] PAM: new options pam_trusted_users & pam_public_domains
>>
>> pam_public_domains option is a list of numerical UIDs or user names
>> that are trusted.
>>
>> pam_public_domains option is a list of domains accessible even for
>> untrusted users.
>>
>> Based on:
>> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM
>> ---
>> src/confdb/confdb.h                  |  2 +
>> src/config/SSSDConfig/__init__.py.in |  2 +
>> src/config/etc/sssd.api.conf         |  2 +
>> src/man/sssd.conf.5.xml              | 46 ++++++++++++++++++
>> src/responder/pam/pamsrv.c           | 94 ++++++++++++++++++++++++++++++++++++
>> src/responder/pam/pamsrv.h           |  7 +++
>> src/responder/pam/pamsrv_cmd.c       | 80 ++++++++++++++++++++++++++++--
>> src/util/domain_info_utils.c         | 60 +++++++++++++++++++++++
>> src/util/util.h                      |  5 ++
>> 9 files changed, 295 insertions(+), 3 deletions(-)
>>
> //snip
>
>> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
>> index ad091e46e6cde1e12f554dde6470cf138412606e..3ff5fad82240c2c8a7e28c47397a20700b50ec04 100644
>> --- a/src/man/sssd.conf.5.xml
>> +++ b/src/man/sssd.conf.5.xml
>> @@ -836,6 +836,52 @@ fallback_homedir = /home/%u
>>                          </para>
>>                      </listitem>
>>                  </varlistentry>
>> +                <varlistentry>
>> +                    <term>pam_trusted_users (string)</term>
>> +                    <listitem>
>> +                        <para>
>> +                            Specifies the comma-separated list of UID values or
>> +                            user names that are allowed to access the PAM
>> +                            responder. User names are resolved to UIDs at
>> +                            startup.
>> +                        </para>
>> +                        <para>
>> +                            Default: all (All users are allowed to access
>> +                            the PAM responder)
>> +                        </para>
>> +                        <para>
>> +                            Please note that UID 0 is always allowed to access
>> +                            the PAM responder even in case it is not in the
>> +                            pam_trusted_users list.
>> +                        </para>
>> +                        <para>
>> +                            Also please note that if there is a user name in
>> +                            pam_trusted_users list which fails to be resolved
>> +                            it will cause that SSSD will not be started.
>> +                        </para>
>> +                    </listitem>
>> +                </varlistentry>
>> +                <varlistentry>
>> +                    <term>pam_public_domains (string)</term>
>> +                    <listitem>
>> +                        <para>
>> +                            Specifies the comma-separated list of domain names
>> +                            that are accessible even to untrusted users.
>> +                        </para>
>> +                        <para>
>> +                            Two special values for pam_public_domains option
>> +                            are defined:
>> +                        </para>
>> +                        <para>
>> +                            none (Untrusted users are not allowed to access
>> +                            any domains PAM repsponder.)
>> +                        </para>
>                            just one special value is described here.
>                            The second one "all" is not described.
>
>> +                        <para>
>> +                            Default: none
>> +                        </para>
>> +                    </listitem>
>> +                </varlistentry>
>> +
>>              </variablelist>
>>          </refsect2>
>>
> //snip
>
>> struct pam_auth_dp_req {
>> diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
>> index 561bd3d9678c73fdfa52592b5a0c502a46e89b5f..ebeaeeb1893b8f4078e3837f304b74dd46df7ec4 100644
>> --- a/src/responder/pam/pamsrv_cmd.c
>> +++ b/src/responder/pam/pamsrv_cmd.c
>> @@ -762,6 +762,45 @@ static int pam_auth_req_destructor(struct pam_auth_req *preq)
>>      return 0;
>> }
>>
>> +static bool is_uid_trusted(int32_t uid,
>                               ^^^^^^^
>                          It is better to have uid as unsigned value ("uint32_t")
>
>> +                           size_t trusted_uids_count,
>> +                           uid_t *trusted_uids)
>> +{
>> +    size_t i;
>> +
>> +    /* root is always trusted */
>> +    if (uid == 0) {
>> +        return true;
>> +    }
>> +
>> +    /* All uids are allowed */
>> +    if (trusted_uids_count == 0) {
>> +        return true;
>> +    }
>> +
>> +    for(i = 0; i < trusted_uids_count; i++) {
>> +        if (trusted_uids[i] == uid) {
>> +            return true;
>> +        }
>> +    }
>> +
>> +    return false;
>> +}
>> +
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
OK, thanks for review. I made changes you requested in both mails.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-PAM-new-options-pam_trusted_users-pam_public_domains.patch
Type: text/x-patch
Size: 17306 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140929/e2c96e02/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-PAM-Add-domains-option-to-pam_sss.patch
Type: text/x-patch
Size: 9113 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140929/e2c96e02/attachment-0001.bin>


More information about the sssd-devel mailing list