3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek/*
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek Authors:
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek Jakub Hrozek <jhrozek@redhat.com>
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek Copyright (C) 2011 Red Hat
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek This program is free software; you can redistribute it and/or modify
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek it under the terms of the GNU General Public License as published by
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek the Free Software Foundation; either version 3 of the License, or
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek (at your option) any later version.
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek This program is distributed in the hope that it will be useful,
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek but WITHOUT ANY WARRANTY; without even the implied warranty of
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek GNU General Public License for more details.
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek You should have received a copy of the GNU General Public License
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek along with this program. If not, see <http://www.gnu.org/licenses/>.
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek*/
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
5389b3714be747f1a11ac51beb0c5988cfb6c240Lukas Slebodnik#include "config.h"
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek#include <talloc.h>
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina#include <time.h>
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek#include "db/sysdb.h"
1a542b3698d8c42cf075b722f8838f106eb09fccPavel Březina#include "db/sysdb_private.h"
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek#include "db/sysdb_sudo.h"
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina#define SUDO_ALL_FILTER "(" SYSDB_OBJECTCLASS "=" SYSDB_SUDO_CACHE_OC ")"
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek#define NULL_CHECK(val, rval, label) do { \
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek if (!val) { \
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek rval = ENOMEM; \
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek goto label; \
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek } \
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek} while(0)
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek/* ==================== Utility functions ==================== */
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
80941dd89fd8bc7c4a1272c304f737ce0fd5fc54Sumit Bosestatic errno_t sysdb_sudo_convert_time(const char *str, time_t *unix_time)
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina{
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina struct tm tm;
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina char *tret = NULL;
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina /* SUDO requires times to be in generalized time format:
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina * YYYYMMDDHHMMSS[.|,fraction][(+|-HHMM)|Z]
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina *
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina * We need to use more format strings to parse this with strptime().
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina */
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina const char **format = NULL;
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina const char *formats[] = {"%Y%m%d%H%M%SZ", /* 201212121300Z */
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina "%Y%m%d%H%M%S%z", /* 201212121300+-0200 */
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina "%Y%m%d%H%M%S.0Z",
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina "%Y%m%d%H%M%S.0%z",
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina "%Y%m%d%H%M%S,0Z",
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina "%Y%m%d%H%M%S,0%z",
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina NULL};
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina for (format = formats; *format != NULL; format++) {
e6f4dbf8474e928ca7da33d6be18e94cbc66a5dePavel Březina /* strptime() may leave some fields uninitialized */
e6f4dbf8474e928ca7da33d6be18e94cbc66a5dePavel Březina memset(&tm, 0, sizeof(struct tm));
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina tret = strptime(str, *format, &tm);
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina if (tret != NULL && *tret == '\0') {
80941dd89fd8bc7c4a1272c304f737ce0fd5fc54Sumit Bose *unix_time = mktime(&tm);
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina return EOK;
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina }
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina }
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina return EINVAL;
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina}
5a2cce34cf8843613b0b9dfde054b3d471dd5f3aPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březinastatic errno_t sysdb_sudo_check_time(struct sysdb_attrs *rule,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina time_t now,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina bool *result)
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina{
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina TALLOC_CTX *tmp_ctx = NULL;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina const char **values = NULL;
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina const char *name = NULL;
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek time_t notBefore = 0;
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek time_t notAfter = 0;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina time_t converted;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina errno_t ret;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina int i;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek if (!result) return EINVAL;
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek *result = false;
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina tmp_ctx = talloc_new(NULL);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina NULL_CHECK(tmp_ctx, ret, done);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina ret = sysdb_attrs_get_string(rule, SYSDB_SUDO_CACHE_AT_CN, &name);
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina if (ret == ENOENT) {
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina name = "<missing>";
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina } else if(ret != EOK) {
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina goto done;
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina }
db419c61035cb262010cc8d5a4047191c2b60f05Pavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina /*
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina * From man sudoers.ldap:
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina *
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina * If multiple sudoNotBefore entries are present, the *earliest* is used.
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina * If multiple sudoNotAfter entries are present, the *last one* is used.
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek *
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek * From sudo sources, ldap.c:
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek * If either the sudoNotAfter or sudoNotBefore attributes are missing,
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek * no time restriction shall be imposed.
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina */
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina /* check for sudoNotBefore */
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina ret = sysdb_attrs_get_string_array(rule, SYSDB_SUDO_CACHE_AT_NOTBEFORE,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina tmp_ctx, &values);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (ret == EOK) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina for (i=0; values[i] ; i++) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina ret = sysdb_sudo_convert_time(values[i], &converted);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Invalid time format in rule [%s]!\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina goto done;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina }
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina /* Grab the earliest */
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (!notBefore) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina notBefore = converted;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina } else if (notBefore > converted) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina notBefore = converted;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina }
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina } else if (ret != ENOENT) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina goto done;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina /* check for sudoNotAfter */
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina ret = sysdb_attrs_get_string_array(rule, SYSDB_SUDO_CACHE_AT_NOTAFTER,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina tmp_ctx, &values);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (ret == EOK) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina for (i=0; values[i] ; i++) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina ret = sysdb_sudo_convert_time(values[i], &converted);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Invalid time format in rule [%s]!\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name);
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina goto done;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina }
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina /* Grab the latest */
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if (!notAfter) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina notAfter = converted;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina } else if (notAfter < converted) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina notAfter = converted;
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina }
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina } else if (ret != ENOENT) {
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina goto done;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina if ((notBefore == 0 || now >= notBefore)
d1f3610aefcb634f212d4c099fac102b3e4dee59Pavel Březina && (notAfter == 0 || now <= notAfter)) {
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina *result = true;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
5ac292b5faea231d93c0cd0f58d0f2f1776a7120Stephen Gallagher if (*result) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Rule [%s] matches time restrictions\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name);
55fdd0d28e7c88f333ad78183b0ba37a1da34160Pavel Březina } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Rule [%s] does not match time "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "restrictions\n", name);
55fdd0d28e7c88f333ad78183b0ba37a1da34160Pavel Březina }
55fdd0d28e7c88f333ad78183b0ba37a1da34160Pavel Březina
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozek ret = EOK;
4be402505ba20b43361753f0e6e1589c9b029e81Jakub Hrozekdone:
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina talloc_free(tmp_ctx);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina return ret;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina}
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březinaerrno_t sysdb_sudo_filter_rules_by_time(TALLOC_CTX *mem_ctx,
5ff1c3c5a12930692cb6284d14f7fda3a974af8ePavel Březina uint32_t in_num_rules,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina struct sysdb_attrs **in_rules,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina time_t now,
5ff1c3c5a12930692cb6284d14f7fda3a974af8ePavel Březina uint32_t *_num_rules,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina struct sysdb_attrs ***_rules)
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek{
5ff1c3c5a12930692cb6284d14f7fda3a974af8ePavel Březina uint32_t num_rules = 0;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina struct sysdb_attrs **rules = NULL;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina TALLOC_CTX *tmp_ctx = NULL;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina bool allowed = false;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina errno_t ret;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina int i;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina tmp_ctx = talloc_new(NULL);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina NULL_CHECK(tmp_ctx, ret, done);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina if (now == 0) {
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina now = time(NULL);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina for (i = 0; i < in_num_rules; i++) {
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina ret = sysdb_sudo_check_time(in_rules[i], now, &allowed);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina if (ret == EOK && allowed) {
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina num_rules++;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina rules = talloc_realloc(tmp_ctx, rules, struct sysdb_attrs *,
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina num_rules);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina NULL_CHECK(rules, ret, done);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina rules[num_rules - 1] = in_rules[i];
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina *_num_rules = num_rules;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina *_rules = talloc_steal(mem_ctx, rules);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina ret = EOK;
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březinadone:
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina talloc_free(tmp_ctx);
c9aab1c04c399ca2d1abef74f6df22ced34983dcPavel Březina return ret;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek}
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinastatic char *
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinasysdb_sudo_filter_userinfo(TALLOC_CTX *mem_ctx,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina const char *username,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char **groupnames,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina uid_t uid)
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek{
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina const char *attr = SYSDB_SUDO_CACHE_AT_USER;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina TALLOC_CTX *tmp_ctx;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *sanitized_name;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *filter;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek errno_t ret;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek int i;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek tmp_ctx = talloc_new(NULL);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (tmp_ctx == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return NULL;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf(tmp_ctx, "(%s=ALL)", attr);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (filter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = ENOMEM;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina goto done;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina }
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = sss_filter_sanitize(tmp_ctx, username, &sanitized_name);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (ret != EOK) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina goto done;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf_append(filter, "(%s=%s)", attr, sanitized_name);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (filter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = ENOMEM;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina goto done;
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (uid != 0) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf_append(filter, "(%s=#%"SPRIuid")", attr, uid);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (filter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = ENOMEM;
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina goto done;
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (groupnames != NULL) {
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina for (i=0; groupnames[i] != NULL; i++) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = sss_filter_sanitize(tmp_ctx, groupnames[i], &sanitized_name);
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina if (ret != EOK) {
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina goto done;
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina }
c526cd124515cc2d44a413dcbfd4a74ddb490150Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf_append(filter, "(%s=%%%s)", attr,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina sanitized_name);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (filter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina ret = ENOMEM;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina goto done;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina talloc_steal(mem_ctx, filter);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinadone:
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina talloc_free(tmp_ctx);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (ret != EOK) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return NULL;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina}
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinachar *
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinasysdb_sudo_filter_expired(TALLOC_CTX *mem_ctx,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina const char *username,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char **groupnames,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina uid_t uid)
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina{
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *userfilter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina time_t now;
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter = sysdb_sudo_filter_userinfo(mem_ctx, username, groupnames, uid);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (userfilter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return NULL;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina now = time(NULL);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf(mem_ctx,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina "(&(%s=%s)(%s<=%lld)(|(%s=defaults)%s(%s=+*)))",
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_CACHE_EXPIRE, (long long)now,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_NAME,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_SUDO_CACHE_AT_USER);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina talloc_free(userfilter);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina}
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinachar *
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinasysdb_sudo_filter_defaults(TALLOC_CTX *mem_ctx)
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina{
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return talloc_asprintf(mem_ctx, "(&(%s=%s)(%s=defaults))",
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_NAME);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina}
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinachar *
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinasysdb_sudo_filter_user(TALLOC_CTX *mem_ctx,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina const char *username,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char **groupnames,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina uid_t uid)
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina{
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *userfilter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter = sysdb_sudo_filter_userinfo(mem_ctx, username, groupnames, uid);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (userfilter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return NULL;
f7af8c5b369938725e47585c641ae5b017d442a1Pavel Březina }
f7af8c5b369938725e47585c641ae5b017d442a1Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf(mem_ctx, "(&(%s=%s)(|%s))",
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina talloc_free(userfilter);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina}
f6171b2bc954a367f316853ab71090eb213bdee3Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinachar *
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březinasysdb_sudo_filter_netgroups(TALLOC_CTX *mem_ctx,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina const char *username,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char **groupnames,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina uid_t uid)
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina{
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *userfilter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina char *filter;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter = sysdb_sudo_filter_userinfo(mem_ctx, username, groupnames, uid);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina if (userfilter == NULL) {
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return NULL;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina }
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina filter = talloc_asprintf(mem_ctx, "(&(%s=%s)(%s=+*)(!(|%s)))",
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina SYSDB_SUDO_CACHE_AT_USER,
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina userfilter);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina talloc_free(userfilter);
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina return filter;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek}
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozekerrno_t
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozeksysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce struct sss_domain_info *domain,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek const char *username,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek const char **_orig_name,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek uid_t *_uid,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek char ***_groupnames)
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek{
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek TALLOC_CTX *tmp_ctx;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek errno_t ret;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina struct ldb_message *group_msg = NULL;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek struct ldb_result *res;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek char **sysdb_groupnames = NULL;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina const char *primary_group = NULL;
8bbf89c5ab798c112773fe23515c3a9df56dde71Nick Guay uid_t uid = 0;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina gid_t gid = 0;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina size_t num_groups = 0;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek const char *groupname;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina const char *group_attrs[] = { SYSDB_NAME,
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina NULL };
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek const char *orig_name;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek tmp_ctx = talloc_new(NULL);
f643754db81eeade60485bbe3d80324d889cc4f3Pavel Březina NULL_CHECK(tmp_ctx, ret, done);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek /*
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek * Even though we lookup initgroups with views, we don't want to use
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek * overridden group names/gids since the rules contains the original
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek * values.
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek */
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek ret = sysdb_initgroups_with_views(tmp_ctx, domain, username, &res);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up user %s\n", username);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek goto done;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (res->count == 0) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "No such user %s\n", username);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek ret = ENOENT;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek goto done;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek }
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek /* Even though the database might be queried with the overriden name,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek * the original name must be used in the filter later on
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek */
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek orig_name = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_NAME, NULL);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (orig_name == NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "No original name?\n");
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek ret = EINVAL;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek goto done;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek }
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "original name: %s\n", orig_name);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina if (_uid != NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina if (!uid) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "A user with no UID?\n");
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina ret = EIO;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina goto done;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek /* get secondary group names */
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (_groupnames != NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (res->count < 2) {
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina /* No groups for this user in sysdb currently */
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina sysdb_groupnames = NULL;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina num_groups = 0;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina } else {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek sysdb_groupnames = talloc_zero_array(tmp_ctx, char *, res->count);
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina NULL_CHECK(sysdb_groupnames, ret, done);
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek /* Start counting from 1 to exclude the user entry */
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek num_groups = 0;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek for (size_t i = 1; i < res->count; i++) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek groupname = ldb_msg_find_attr_as_string(res->msgs[i],
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek SYSDB_NAME,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek NULL);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (groupname == NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE, "A group with no name?");
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek continue;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina }
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek sysdb_groupnames[num_groups] = talloc_strdup(sysdb_groupnames,
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek groupname);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (sysdb_groupnames[num_groups] == NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE, "Cannot strdup %s\n", groupname);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek continue;
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek }
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek num_groups++;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina /* resolve primary group */
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek gid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_GIDNUM, 0);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina if (gid != 0) {
4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek ret = sysdb_search_group_by_gid(tmp_ctx, domain, gid, group_attrs,
4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek &group_msg);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina if (ret == EOK) {
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina primary_group = ldb_msg_find_attr_as_string(group_msg, SYSDB_NAME,
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina NULL);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina if (primary_group == NULL) {
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina ret = ENOMEM;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina goto done;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina }
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina num_groups++;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina sysdb_groupnames = talloc_realloc(tmp_ctx, sysdb_groupnames,
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina char *, num_groups + 1);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina NULL_CHECK(sysdb_groupnames, ret, done);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina sysdb_groupnames[num_groups - 1] = talloc_strdup(sysdb_groupnames,
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina primary_group);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina NULL_CHECK(sysdb_groupnames[num_groups - 1], ret, done);
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina sysdb_groupnames[num_groups] = NULL;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina } else if (ret != ENOENT) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up group [%d]: %s\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina goto done;
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina }
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina }
e7b5b99e5a5d276f32039c4fb8b21ba51bdb1537Pavel Březina
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek ret = EOK;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (orig_name != NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek *_orig_name = talloc_steal(mem_ctx, orig_name);
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek }
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina if (_uid != NULL) {
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina *_uid = uid;
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina }
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek if (_groupnames != NULL) {
dee665060ba71ff61ad223e755ae61441118fbbaJakub Hrozek *_groupnames = talloc_steal(mem_ctx, sysdb_groupnames);
cda8ff6cfdef22356dc3c06ec5204344912f0f0bPavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozekdone:
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek talloc_free(tmp_ctx);
69e7d6649b58c66675ef38084868fc5356c5a240Jakub Hrozek return ret;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek}
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozekstatic errno_t sysdb_sudo_set_refresh_time(struct sss_domain_info *domain,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina const char *attr_name,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina time_t value)
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina{
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina TALLOC_CTX *tmp_ctx;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina struct ldb_dn *dn;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina struct ldb_message *msg = NULL;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina struct ldb_result *res = NULL;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina errno_t ret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina int lret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina tmp_ctx = talloc_new(NULL);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (!tmp_ctx) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = ENOMEM;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek dn = ldb_dn_new_fmt(tmp_ctx, domain->sysdb->ldb,
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek SYSDB_TMPL_CUSTOM_SUBTREE,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce SUDORULE_SUBDIR, domain->name);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (!dn) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = ENOMEM;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek lret = ldb_search(domain->sysdb->ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina NULL, NULL);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (lret != LDB_SUCCESS) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina msg = ldb_msg_new(tmp_ctx);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (msg == NULL) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = ENOMEM;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina msg->dn = dn;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (res->count == 0) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina lret = ldb_msg_add_string(msg, "cn", SUDORULE_SUBDIR);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (lret != LDB_SUCCESS) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina } else if (res->count != 1) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina DEBUG(SSSDBG_CRIT_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Got more than one reply for base search!\n");
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = EIO;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina } else {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina lret = ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_REPLACE, NULL);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (lret != LDB_SUCCESS) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina lret = ldb_msg_add_fmt(msg, attr_name, "%lld", (long long)value);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (lret != LDB_SUCCESS) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (res->count) {
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek lret = ldb_modify(domain->sysdb->ldb, msg);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina } else {
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek lret = ldb_add(domain->sysdb->ldb, msg);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik if (lret != LDB_SUCCESS) {
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik DEBUG(SSSDBG_MINOR_FAILURE,
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik "ldb operation failed: [%s](%d)[%s]\n",
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik ldb_strerror(lret), lret, ldb_errstring(domain->sysdb->ldb));
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březinadone:
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina talloc_free(tmp_ctx);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina return ret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina}
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozekstatic errno_t sysdb_sudo_get_refresh_time(struct sss_domain_info *domain,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina const char *attr_name,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina time_t *value)
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina{
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina TALLOC_CTX *tmp_ctx;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina struct ldb_dn *dn;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina struct ldb_result *res;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina errno_t ret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina int lret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina const char *attrs[2] = {attr_name, NULL};
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina tmp_ctx = talloc_new(NULL);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (tmp_ctx == NULL) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina return ENOMEM;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek dn = ldb_dn_new_fmt(tmp_ctx, domain->sysdb->ldb, SYSDB_TMPL_CUSTOM_SUBTREE,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce SUDORULE_SUBDIR, domain->name);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (!dn) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = ENOMEM;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek lret = ldb_search(domain->sysdb->ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina attrs, NULL);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (lret != LDB_SUCCESS) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = sysdb_error_to_errno(lret);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina if (res->count == 0) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina /* This entry has not been populated in LDB
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina * This is a common case, as unlike LDAP,
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina * LDB does not need to have all of its parent
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina * objects actually exist.
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina */
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina *value = 0;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = EOK;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina } else if (res->count != 1) {
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina DEBUG(SSSDBG_CRIT_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Got more than one reply for base search!\n");
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = EIO;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina goto done;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina }
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina *value = ldb_msg_find_attr_as_int(res->msgs[0], attr_name, 0);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina ret = EOK;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březinadone:
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina talloc_free(tmp_ctx);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina return ret;
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina}
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozekerrno_t sysdb_sudo_set_last_full_refresh(struct sss_domain_info *domain,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce time_t value)
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina{
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek return sysdb_sudo_set_refresh_time(domain,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce SYSDB_SUDO_AT_LAST_FULL_REFRESH, value);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina}
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozekerrno_t sysdb_sudo_get_last_full_refresh(struct sss_domain_info *domain,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce time_t *value)
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina{
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek return sysdb_sudo_get_refresh_time(domain,
b0fa48b0d612b46a86e45f8e4b5d9feae9784c2bSimo Sorce SYSDB_SUDO_AT_LAST_FULL_REFRESH, value);
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina}
44749ce0c1fee9babee80060fa0db99eebb2ab51Pavel Březina
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina/* ==================== Purge functions ==================== */
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic const char *
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_get_rule_name(struct sysdb_attrs *rule)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *name;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_attrs_get_string(rule, SYSDB_SUDO_CACHE_AT_CN, &name);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret == ERANGE) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_MINOR_FAILURE, "Warning: found rule that contains none "
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina "or multiple CN values. It will be skipped.\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return NULL;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina } else if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to obtain rule name [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret, strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return NULL;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return name;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozekstatic errno_t sysdb_sudo_purge_all(struct sss_domain_info *domain)
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina{
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina struct ldb_dn *base_dn = NULL;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina TALLOC_CTX *tmp_ctx = NULL;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina errno_t ret;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina tmp_ctx = talloc_new(NULL);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina NULL_CHECK(tmp_ctx, ret, done);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
e2ac9be4f293b96f3c8992f1171e44bc1da5cfcaMichal Zidek base_dn = sysdb_custom_subtree_dn(tmp_ctx, domain, SUDORULE_SUBDIR);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina NULL_CHECK(base_dn, ret, done);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_TRACE_FUNC, "Deleting all cached sudo rules\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek ret = sysdb_delete_recursive(domain->sysdb, base_dn, true);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_delete_recursive failed.\n");
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina goto done;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina }
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina ret = EOK;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březinadone:
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina talloc_free(tmp_ctx);
2d34690ae92215d355b0272001d9e68214dc80f6Jakub Hrozek return ret;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina}
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic errno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_purge_byname(struct sss_domain_info *domain,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *name)
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina{
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Deleting sudo rule %s\n", name);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek return sysdb_delete_custom(domain, name, SUDORULE_SUBDIR);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina}
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic errno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_purge_byrules(struct sss_domain_info *dom,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina struct sysdb_attrs **rules,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t num_rules)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *name;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t i;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_TRACE_FUNC, "About to remove rules from sudo cache\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (num_rules == 0 || rules == NULL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EOK;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina for (i = 0; i < num_rules; i++) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina name = sysdb_sudo_get_rule_name(rules[i]);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (name == NULL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina continue;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_purge_byname(dom, name);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_MINOR_FAILURE, "Failed to delete rule "
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina "%s [%d]: %s\n", name, ret, sss_strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina continue;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EOK;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic errno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_purge_byfilter(struct sss_domain_info *domain,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *filter)
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek{
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek TALLOC_CTX *tmp_ctx;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina struct sysdb_attrs **rules;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek struct ldb_message **msgs;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t count;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek errno_t ret;
f643754db81eeade60485bbe3d80324d889cc4f3Pavel Březina const char *attrs[] = { SYSDB_OBJECTCLASS,
f643754db81eeade60485bbe3d80324d889cc4f3Pavel Březina SYSDB_NAME,
f643754db81eeade60485bbe3d80324d889cc4f3Pavel Březina SYSDB_SUDO_CACHE_AT_CN,
f643754db81eeade60485bbe3d80324d889cc4f3Pavel Březina NULL };
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (filter == NULL || strcmp(filter, SUDO_ALL_FILTER) == 0) {
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek return sysdb_sudo_purge_all(domain);
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek tmp_ctx = talloc_new(NULL);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (tmp_ctx == NULL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = ENOMEM;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina goto done;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_search_custom(tmp_ctx, domain, filter,
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek SUDORULE_SUBDIR, attrs,
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek &count, &msgs);
aeb3cef10158a1c621d58c6d982e53569e40c6c0Lukas Slebodnik if (ret == ENOENT) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "No rules matched\n");
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek ret = EOK;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek goto done;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina } else if (ret != EOK) {
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up SUDO rules\n");
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina goto done;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_msg2attrs(tmp_ctx, count, msgs, &rules);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to convert ldb message to "
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina "sysdb attrs [%d]: %s\n", ret, sss_strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina goto done;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_purge_byrules(domain, rules, count);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinadone:
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina talloc_free(tmp_ctx);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinaerrno_t sysdb_sudo_purge(struct sss_domain_info *domain,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *delete_filter,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina struct sysdb_attrs **rules,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t num_rules)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina bool in_transaction = false;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t sret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek ret = sysdb_transaction_start(domain->sysdb);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina }
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina in_transaction = true;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (delete_filter) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_purge_byfilter(domain, delete_filter);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina } else {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_purge_byrules(domain, rules, num_rules);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina goto done;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_transaction_commit(domain->sysdb);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina goto done;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina in_transaction = false;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinadone:
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (in_transaction) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina sret = sysdb_transaction_cancel(domain->sysdb);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (sret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Could not cancel transaction\n");
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to purge sudo cache [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret, sss_strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic errno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_add_sss_attrs(struct sysdb_attrs *rule,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *name,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina int cache_timeout,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina time_t now)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina time_t expire;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_attrs_add_string(rule, SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to add %s attribute [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina SYSDB_OBJECTCLASS, ret, strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_attrs_add_string(rule, SYSDB_NAME, name);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to add %s attribute [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina SYSDB_OBJECTCLASS, ret, strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina expire = cache_timeout > 0 ? now + cache_timeout : 0;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_attrs_add_time_t(rule, SYSDB_CACHE_EXPIRE, expire);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to add %s attribute [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina SYSDB_CACHE_EXPIRE, ret, strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EOK;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čechstatic errno_t sysdb_sudo_add_lowered_users(struct sss_domain_info *domain,
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech struct sysdb_attrs *rule)
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech{
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech TALLOC_CTX *tmp_ctx;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech const char **users = NULL;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech errno_t ret;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (domain->case_sensitive == true || rule == NULL) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech return EOK;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech tmp_ctx = talloc_new(NULL);
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (tmp_ctx == NULL) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech return ENOMEM;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech ret = sysdb_attrs_get_string_array(rule, SYSDB_SUDO_CACHE_AT_USER, tmp_ctx,
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech &users);
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (ret != EOK) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech DEBUG(SSSDBG_OP_FAILURE, "Unable to get %s attribute [%d]: %s\n",
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech SYSDB_SUDO_CACHE_AT_USER, ret, strerror(ret));
7e23edbaa7a6bbd0b461d5792535896b6a77928bPetr Čech ret = ERR_MALFORMED_ENTRY;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech goto done;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (users == NULL) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech ret = EOK;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech goto done;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech for (int i = 0; users[i] != NULL; i++) {
a5ecc93abb01cece628fdef04ebad43bba267419Jakub Hrozek ret = sysdb_attrs_add_lower_case_string(rule, true,
a5ecc93abb01cece628fdef04ebad43bba267419Jakub Hrozek SYSDB_SUDO_CACHE_AT_USER,
a5ecc93abb01cece628fdef04ebad43bba267419Jakub Hrozek users[i]);
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (ret != EOK) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech DEBUG(SSSDBG_OP_FAILURE,
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech "Unable to add %s attribute [%d]: %s\n",
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech SYSDB_SUDO_CACHE_AT_USER, ret, strerror(ret));
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech goto done;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech ret = EOK;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čechdone:
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech talloc_zfree(tmp_ctx);
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech return ret;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech}
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinastatic errno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_store_rule(struct sss_domain_info *domain,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina struct sysdb_attrs *rule,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina int cache_timeout,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina time_t now)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina const char *name;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina name = sysdb_sudo_get_rule_name(rule);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (name == NULL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EINVAL;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_TRACE_FUNC, "Adding sudo rule %s\n", name);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech ret = sysdb_sudo_add_lowered_users(domain, rule);
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech if (ret != EOK) {
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech return ret;
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech }
f4a1046bb88d7a0ab3617e49ae94bfa849d10645Petr Čech
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_add_sss_attrs(rule, name, cache_timeout, now);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_store_custom(domain, name, SUDORULE_SUBDIR, rule);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to store rule %s [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina name, ret, strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EOK;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina}
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinaerrno_t
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březinasysdb_sudo_store(struct sss_domain_info *domain,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina struct sysdb_attrs **rules,
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t num_rules)
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina{
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina bool in_transaction = false;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t sret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina errno_t ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina time_t now;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina size_t i;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (num_rules == 0 || rules == NULL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return EOK;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_transaction_start(domain->sysdb);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina return ret;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina in_transaction = true;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina now = time(NULL);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina for (i = 0; i < num_rules; i++) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret = sysdb_sudo_store_rule(domain, rules[i],
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina domain->sudo_timeout, now);
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret == EINVAL) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina /* Multiple CNs are error on server side, we can just ignore this
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina * rule and save the others. Loud debug message is in logs. */
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina continue;
7e23edbaa7a6bbd0b461d5792535896b6a77928bPetr Čech } else if (ret == ERR_MALFORMED_ENTRY) {
7e23edbaa7a6bbd0b461d5792535896b6a77928bPetr Čech /* Attribute SYSDB_SUDO_CACHE_AT_USER is missing but we can
7e23edbaa7a6bbd0b461d5792535896b6a77928bPetr Čech * continue with next sudoRule. */
7e23edbaa7a6bbd0b461d5792535896b6a77928bPetr Čech continue;
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina } else if (ret != EOK) {
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek goto done;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek }
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek ret = sysdb_transaction_commit(domain->sysdb);
3a59cbd0b7b9c5dd3c62ac1679876070c264d80fMichal Zidek if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
3a59cbd0b7b9c5dd3c62ac1679876070c264d80fMichal Zidek goto done;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina }
3a59cbd0b7b9c5dd3c62ac1679876070c264d80fMichal Zidek in_transaction = false;
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozekdone:
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina if (in_transaction) {
6a31a971a376a992afb838fe60b311360c970267Jakub Hrozek sret = sysdb_transaction_cancel(domain->sysdb);
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina if (sret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Could not cancel transaction\n");
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina }
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina }
f5d4b05027acce06e3509ecb68869d1c7ef37180Pavel Březina
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina if (ret != EOK) {
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "Unable to store sudo rules [%d]: %s\n",
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina ret, sss_strerror(ret));
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina }
68abbe716bed7c8d6790d9bec168ef44469306a1Pavel Březina
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek return ret;
3f98cdc011bb4e8cd22c088f288b0bcdb6452492Jakub Hrozek}
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cecherrno_t sysdb_search_sudo_rules(TALLOC_CTX *mem_ctx,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct sss_domain_info *domain,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech const char *sub_filter,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech const char **attrs,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech size_t *_msgs_count,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct ldb_message ***_msgs)
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech{
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech TALLOC_CTX *tmp_ctx;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech size_t msgs_count;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct ldb_message **msgs;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct ldb_dn *dn;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech char *filter;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech int ret;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech tmp_ctx = talloc_new(NULL);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech NULL_CHECK(tmp_ctx, ret, done);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech dn = ldb_dn_new_fmt(tmp_ctx, domain->sysdb->ldb, SYSDB_TMPL_CUSTOM_SUBTREE,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech SUDORULE_SUBDIR, domain->name);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech if (dn == NULL) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech DEBUG(SSSDBG_OP_FAILURE, "Failed to build base dn\n");
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech ret = ENOMEM;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech goto done;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech }
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech if (sub_filter == NULL) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech filter = talloc_asprintf(tmp_ctx, "(%s)", SUDO_ALL_FILTER);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech } else {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech filter = talloc_asprintf(tmp_ctx, "(&%s%s)",
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech SUDO_ALL_FILTER, sub_filter);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech }
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech if (filter == NULL) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech DEBUG(SSSDBG_OP_FAILURE, "Failed to build filter\n");
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech ret = ENOMEM;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech goto done;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech }
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech DEBUG(SSSDBG_TRACE_INTERNAL,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech "Search sudo rules with filter: %s\n", filter);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech ret = sysdb_search_entry(tmp_ctx, domain->sysdb, dn,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech LDB_SCOPE_SUBTREE, filter, attrs,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech &msgs_count, &msgs);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech if (ret == ENOENT) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech DEBUG(SSSDBG_TRACE_INTERNAL, "No such entry\n");
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech *_msgs = NULL;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech *_msgs_count = 0;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech goto done;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech } else if (ret != EOK) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech DEBUG(SSSDBG_MINOR_FAILURE, "Error: %d (%s)\n", ret, sss_strerror(ret));
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech goto done;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech }
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech *_msgs_count = msgs_count;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech *_msgs = talloc_steal(mem_ctx, msgs);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech ret = EOK;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cechdone:
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech talloc_zfree(tmp_ctx);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech return ret;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech}
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cechstatic struct ldb_dn *
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cechsysdb_sudo_rule_dn(TALLOC_CTX *mem_ctx,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct sss_domain_info *domain,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech const char *name)
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech{
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech return sysdb_custom_dn(mem_ctx, domain, name, SUDORULE_SUBDIR);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech}
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cecherrno_t
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cechsysdb_set_sudo_rule_attr(struct sss_domain_info *domain,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech const char *name,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct sysdb_attrs *attrs,
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech int mod_op)
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech{
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech errno_t ret;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech struct ldb_dn *dn;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech TALLOC_CTX *tmp_ctx;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech tmp_ctx = talloc_new(NULL);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech if (tmp_ctx == NULL) {
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech return ENOMEM;
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech }
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech dn = sysdb_sudo_rule_dn(tmp_ctx, domain, name);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech NULL_CHECK(dn, ret, done);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech ret = sysdb_set_entry_attr(domain->sysdb, dn, attrs, mod_op);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cechdone:
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech talloc_free(tmp_ctx);
e2d26e97d62f06f65e8228b28746471cc5f73fe5Petr Cech return ret;
61913b8f0d1ba54d82640500d7486fac5f72b030Pavel Březina}