src/db/sysdb_selinux.c

	sysdb_selinux.c revision ecfd767c65c39414a86937380b9986c6d2e0aecf
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny/*
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   SSSD
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   System Database - SELinux support
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   Copyright (C) Jan Zeleny <jzeleny@redhat.com>    2012
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   This program is free software; you can redistribute it and/or modify
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   it under the terms of the GNU General Public License as published by
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   the Free Software Foundation; either version 3 of the License, or
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   (at your option) any later version.
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   This program is distributed in the hope that it will be useful,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   but WITHOUT ANY WARRANTY; without even the implied warranty of
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   GNU General Public License for more details.
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   You should have received a copy of the GNU General Public License
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny   along with this program.  If not, see <http://www.gnu.org/licenses/>.
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny*/
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny#include "util/sss_selinux.h"
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny#include "db/sysdb_selinux.h"
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny#include "db/sysdb_private.h"
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny/* Some generic routines */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenystatic errno_t get_rm_msg(TALLOC_CTX *mem_ctx,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                          struct ldb_message *old_msg,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                          struct sysdb_attrs *new_attrs,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                          struct ldb_message **_msg)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message *rm_msg;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *tmp_str;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    int i;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    rm_msg = ldb_msg_new(mem_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (rm_msg == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    rm_msg->dn = old_msg->dn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    rm_msg->elements = talloc_zero_array(rm_msg, struct ldb_message_element,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                         old_msg->num_elements);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    rm_msg->num_elements = 0;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    for (i = 0; i < old_msg->num_elements; i++) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = sysdb_attrs_get_string(new_attrs, old_msg->elements[i].name, &tmp_str);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        if (ret != ENOENT) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            continue;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        rm_msg->elements[rm_msg->num_elements] = old_msg->elements[i];
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        rm_msg->elements[rm_msg->num_elements].flags = LDB_FLAG_MOD_DELETE;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        rm_msg->num_elements++;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
20aee697450e41423ca0e2fc749e659d18f19976Jakub Hrozek    ret = EOK;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        talloc_free(rm_msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    } else {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        *_msg = rm_msg;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenystatic errno_t
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenysysdb_add_selinux_entity(struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                         struct ldb_dn *dn,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                         const char *objectclass,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                         struct sysdb_attrs *attrs,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                         time_t now)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message *msg;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    TALLOC_CTX *tmp_ctx;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_ctx = talloc_new(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!tmp_ctx) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    msg = ldb_msg_new(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!msg) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_attrs_add_string(attrs, SYSDB_OBJECTCLASS, objectclass);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_OP_FAILURE, ("Could not set map object class [%d]: %s\n",
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny              ret, strerror(ret)));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!now) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        now = time(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_attrs_add_time_t(attrs, SYSDB_CREATE_TIME, now);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    msg->dn = dn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    msg->elements = attrs->a;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    msg->num_elements = attrs->num;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = ldb_add(sysdb->ldb, msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_error_to_errno(ret);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_TRACE_LIBS, ("Error: %d (%s)\n", ret, strerror(ret)));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_zfree(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenystatic errno_t sysdb_store_selinux_entity(struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                          struct sysdb_attrs *attrs,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                          enum selinux_entity_type type)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    TALLOC_CTX *tmp_ctx;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message *msg;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message *rm_msg;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    bool in_transaction = false;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *objectclass;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *name;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    char *clean_name;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_dn *dn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t sret = EOK;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    time_t now;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_ctx = talloc_new(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!tmp_ctx) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    switch (type) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        case SELINUX_USER_MAP:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            objectclass = SYSDB_SELINUX_USERMAP_CLASS;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            ret = sysdb_attrs_get_string(attrs, SYSDB_NAME, &name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            ret = sysdb_dn_sanitize(tmp_ctx, name, &clean_name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            dn = ldb_dn_new_fmt(tmp_ctx, sysdb->ldb, SYSDB_TMPL_SEUSERMAP,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                clean_name, sysdb->domain->name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            break;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        case SELINUX_CONFIG:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            objectclass = SYSDB_SELINUX_CLASS;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            dn = ldb_dn_new_fmt(tmp_ctx, sysdb->ldb, SYSDB_TMPL_SELINUX_BASE,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                sysdb->domain->name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            break;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (type != SELINUX_CONFIG && type != SELINUX_USER_MAP) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_CRIT_FAILURE, ("Bad SELinux entity type: [%d]\n", type));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = EINVAL;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!dn) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_transaction_start(sysdb);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    in_transaction = true;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    now = time(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_attrs_add_time_t(attrs, SYSDB_LAST_UPDATE, now);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (type == SELINUX_CONFIG) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = sysdb_search_selinux_config(tmp_ctx, sysdb, NULL, &msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    } else if (type == SELINUX_USER_MAP) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = sysdb_search_selinux_usermap_by_mapname(tmp_ctx, sysdb, name,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                      NULL, &msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret && ret != ENOENT) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret == ENOENT) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = sysdb_add_selinux_entity(sysdb, dn, objectclass, attrs, now);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_set_entry_attr(sysdb, dn, attrs, SYSDB_MOD_REP);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    /* Now delete attributes which are no longer present */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = get_rm_msg(tmp_ctx, msg, attrs, &rm_msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (rm_msg->num_elements > 0) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ldb_modify(sysdb->ldb, rm_msg);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (in_transaction) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        if (ret == EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            sret = sysdb_transaction_commit(sysdb);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            if (sret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                DEBUG(SSSDBG_OP_FAILURE, ("Could not commit transaction\n"));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        if (ret != EOK || sret != EOK){
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            sret = sysdb_transaction_cancel(sysdb);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            if (sret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                DEBUG(SSSDBG_OP_FAILURE, ("Could not cancel transaction\n"));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_MINOR_FAILURE, ("Error: %d (%s)\n", ret, strerror(ret)));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_zfree(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenyerrno_t sysdb_store_selinux_usermap(struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                    struct sysdb_attrs *attrs)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return sysdb_store_selinux_entity(sysdb, attrs, SELINUX_USER_MAP);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenyerrno_t sysdb_store_selinux_config(struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                   const char *default_user,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                   const char *order)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct sysdb_attrs *attrs;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    attrs = talloc_zero(NULL, struct sysdb_attrs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (attrs == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_attrs_add_string(attrs, SYSDB_SELINUX_DEFAULT_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                 default_user);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_attrs_add_string(attrs, SYSDB_SELINUX_DEFAULT_ORDER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                 order);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret =  sysdb_store_selinux_entity(sysdb, attrs, SELINUX_CONFIG);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_free(attrs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozekerrno_t sysdb_delete_usermaps(struct sysdb_ctx *sysdb)
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek{
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    struct ldb_dn *dn = NULL;
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    errno_t ret;
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    dn = ldb_dn_new_fmt(sysdb, sysdb->ldb,
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek                        SYSDB_TMPL_SELINUX_BASE, sysdb->domain->name);
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    if (!dn) return ENOMEM;
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    ret = sysdb_delete_recursive(sysdb, dn, true);
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    talloc_free(dn);
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    if (ret != EOK) {
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, ("sysdb_delete_recursive failed.\n"));
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek        return ret;
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek    return EOK;
ecfd767c65c39414a86937380b9986c6d2e0aecfJakub Hrozek}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny/* --- SYSDB SELinux search routines --- */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenyerrno_t sysdb_search_selinux_usermap_by_mapname(TALLOC_CTX *mem_ctx,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                const char *name,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                const char **attrs,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                struct ldb_message **_usermap)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    TALLOC_CTX *tmp_ctx;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *def_attrs[] = { SYSDB_NAME,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_USER_CATEGORY,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_HOST_CATEGORY,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_ORIG_MEMBER_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_ORIG_MEMBER_HOST,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_SELINUX_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                NULL };
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message **msgs = NULL;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_dn *basedn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    size_t msgs_count = 0;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    char *clean_name;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    int ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_ctx = talloc_new(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!tmp_ctx) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_dn_sanitize(tmp_ctx, name, &clean_name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    basedn = ldb_dn_new_fmt(tmp_ctx, sysdb->ldb, SYSDB_TMPL_SEUSERMAP,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            clean_name, sysdb->domain->name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!basedn) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_search_entry(tmp_ctx, sysdb, basedn, LDB_SCOPE_BASE, NULL,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                             attrs?attrs:def_attrs, &msgs_count, &msgs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    *_usermap = talloc_steal(mem_ctx, msgs[0]);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret == ENOENT) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_TRACE_FUNC, ("No such entry\n"));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    else if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_TRACE_FUNC, ("Error: %d (%s)\n", ret, strerror(ret)));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_zfree(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenyerrno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                 struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                 const char *username,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                                 struct ldb_message ***_usermaps)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    TALLOC_CTX *tmp_ctx;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *attrs[] = { SYSDB_NAME,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_USER_CATEGORY,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_HOST_CATEGORY,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_ORIG_MEMBER_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_ORIG_MEMBER_HOST,
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                            SYSDB_SELINUX_HOST_PRIORITY,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_SELINUX_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            NULL };
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message **msgs = NULL;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct sysdb_attrs *user;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct sysdb_attrs *tmp_attrs;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message **usermaps;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct sss_domain_info *domain;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_dn *basedn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    size_t msgs_count = 0;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    size_t usermaps_cnt;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny    uint32_t priority = 0;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny    uint32_t host_priority = 0;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny    uint32_t top_priority = 0;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    char *filter;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    int i;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_ctx = talloc_new(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!tmp_ctx) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    /* Now extract user attributes */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sss_selinux_extract_user(tmp_ctx, sysdb, username, &user);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret != EOK) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    /* Now extract all SELinux user maps */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    domain = sysdb_ctx_get_domain(sysdb);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    basedn = ldb_dn_new_fmt(tmp_ctx, sysdb_ctx_get_ldb(sysdb),
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            SYSDB_TMPL_SELINUX_BASE, domain->name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!basedn) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    filter = talloc_asprintf(tmp_ctx, "(objectclass=%s)", SYSDB_SELINUX_USERMAP_CLASS);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (filter == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_search_entry(tmp_ctx, sysdb, basedn, LDB_SCOPE_SUBTREE, filter,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                             attrs, &msgs_count, &msgs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    /* Now filter those that match */
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_attrs = talloc_zero(tmp_ctx, struct sysdb_attrs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (tmp_attrs == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    usermaps = talloc_zero_array(tmp_ctx, struct ldb_message *, msgs_count + 1);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (usermaps == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    usermaps_cnt = 0;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    for (i = 0; i < msgs_count; i++) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        tmp_attrs->a = msgs[i]->elements;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        tmp_attrs->num = msgs[i]->num_elements;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny        if (sss_selinux_match(tmp_attrs, user, NULL, &priority)) {
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            priority &= ~(SELINUX_PRIORITY_HOST_NAME |
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                          SELINUX_PRIORITY_HOST_GROUP |
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                          SELINUX_PRIORITY_HOST_CAT);
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            /* Now figure out host priority */
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            ret = sysdb_attrs_get_uint32_t(tmp_attrs,
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                                           SYSDB_SELINUX_HOST_PRIORITY,
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                                           &host_priority);
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            if (ret != EOK) {
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                continue;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            }
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            priority += host_priority;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            if (priority < top_priority) {
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                /* This rule has lower priority than what we already have,
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                 * skip it */
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                continue;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            } else if (priority > top_priority) {
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                /* If the rule has higher priority, drop what we already
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                 * have */
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                while (usermaps_cnt > 0) {
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                    usermaps_cnt--;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                    talloc_zfree(usermaps[usermaps_cnt]);
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                }
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny                top_priority = priority;
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny            }
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny
1a3e6221b38a7cae27d7e84a30bb8ea3c3900a47Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            usermaps[usermaps_cnt] = talloc_steal(usermaps, msgs[i]);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            usermaps_cnt++;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        } else {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny            talloc_zfree(msgs[i]);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (usermaps[0] == NULL) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOENT;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    *_usermaps = talloc_steal(mem_ctx, usermaps);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_zfree(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenyerrno_t sysdb_search_selinux_config(TALLOC_CTX *mem_ctx,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                    struct sysdb_ctx *sysdb,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                    const char **attrs,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                    struct ldb_message **_config)
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny{
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    TALLOC_CTX *tmp_ctx;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    const char *def_attrs[] = { SYSDB_SELINUX_DEFAULT_USER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                SYSDB_SELINUX_DEFAULT_ORDER,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                                NULL };
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_message **msgs;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    size_t msgs_count;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    struct ldb_dn *basedn;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    errno_t ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    tmp_ctx = talloc_new(NULL);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!tmp_ctx) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        return ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    basedn = ldb_dn_new_fmt(tmp_ctx, sysdb->ldb, SYSDB_TMPL_SELINUX_BASE,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                            sysdb->domain->name);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (!basedn) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        ret = ENOMEM;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    ret = sysdb_search_entry(tmp_ctx, sysdb, basedn, LDB_SCOPE_BASE, NULL,
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny                             attrs?attrs:def_attrs, &msgs_count, &msgs);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        goto done;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    *_config = talloc_steal(mem_ctx, msgs[0]);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zelenydone:
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    if (ret == ENOENT) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_TRACE_FUNC, ("No SELinux root entry found\n"));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    } else if (ret) {
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny        DEBUG(SSSDBG_TRACE_FUNC, ("Error: %d (%s)\n", ret, strerror(ret)));
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    }
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    talloc_free(tmp_ctx);
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny    return ret;
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny}
4c11f752e1f10cf5740d53a3206bb795e9e34fe8Jan Zeleny