ipa_access.c revision fdfe33975cd902bf7a334e49f2667f6346c4e6ae
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay/*
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay SSSD
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA Backend Module -- Access control
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay Authors:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay Sumit Bose <sbose@redhat.com>
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay Copyright (C) 2009 Red Hat
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay This program is free software; you can redistribute it and/or modify
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay it under the terms of the GNU General Public License as published by
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay the Free Software Foundation; either version 3 of the License, or
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay (at your option) any later version.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay This program is distributed in the hope that it will be useful,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay but WITHOUT ANY WARRANTY; without even the implied warranty of
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay GNU General Public License for more details.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay You should have received a copy of the GNU General Public License
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay along with this program. If not, see <http://www.gnu.org/licenses/>.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay*/
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include <sys/param.h>
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include <security/pam_modules.h>
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "util/util.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ldap/sdap_async.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ldap/sdap_access.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_common.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_access.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_hbac.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_hosts.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_hbac_private.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay#include "providers/ipa/ipa_hbac_rules.h"
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void ipa_access_reply(struct hbac_ctx *hbac_ctx, int pam_status)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_req *be_req = hbac_ctx->be_req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct pam_data *pd;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd->pam_status = pam_status;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* destroy HBAC context now to release all used resources and LDAP connection */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (pam_status == PAM_SUCCESS || pam_status == PAM_PERM_DENIED) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_OK, pam_status, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_FATAL, pam_status, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayenum hbac_result {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_ALLOW = 1,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_DENY,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_NOT_APPLICABLE
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay};
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayenum check_result {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay RULE_APPLICABLE = 0,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay RULE_NOT_APPLICABLE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay RULE_ERROR
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay};
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void ipa_hbac_check(struct tevent_req *req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic int hbac_retry(struct hbac_ctx *hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_connect_done(struct tevent_req *subreq);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void ipa_hbac_evaluate_rules(struct hbac_ctx *hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayvoid ipa_access_handler(struct be_req *be_req)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct pam_data *pd;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx *ipa_access_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct tevent_req *req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct sss_domain_info *dom;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_ctx = talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay dom = be_ctx->domain;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Subdomain request, verify subdomain */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay dom = find_domain_by_name(be_ctx->domain, pd->domain, true);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* First, verify that this account isn't locked.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * We need to do this in case the auth phase was
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * skipped (such as during GSSAPI single-sign-on
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * or SSH public key exchange.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay req = sdap_access_send(be_req, be_ctx->ev, be_ctx, dom,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_ctx->sdap_access_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_ctx->sdap_access_ctx->id_ctx->conn,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!req) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_set_callback(req, ipa_hbac_check, be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void ipa_hbac_check(struct tevent_req *req)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_req *be_req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct pam_data *pd;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_ctx *hbac_ctx = NULL;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay const char *deny_method;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx *ipa_access_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay int ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req = tevent_req_callback_data(req, struct be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_ctx = be_req_get_be_ctx(be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sdap_access_recv(req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay switch(ret) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay case EOK:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Account wasn't locked. Continue below
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * to HBAC processing.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay break;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay case ERR_ACCESS_DENIED:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Account was locked. Return permission denied
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * here.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd->pam_status = PAM_PERM_DENIED;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_OK, pd->pam_status, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay case ERR_ACCOUNT_EXPIRED:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd->pam_status = PAM_ACCT_EXPIRED;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_OK, pd->pam_status, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay default:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* We got an unexpected error. Return it as-is */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay pd->pam_status = PAM_SYSTEM_ERR;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_FATAL, pd->pam_status,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sss_strerror(ret));
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx = talloc_zero(be_req, struct hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "talloc failed.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ENOMEM;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->be_req = be_req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->pd = pd;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_ctx = talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->access_ctx = ipa_access_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_ctx = ipa_access_ctx->sdap_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->ipa_options = ipa_access_ctx->ipa_options;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->tr_ctx = ipa_access_ctx->tr_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->search_bases = ipa_access_ctx->hbac_search_bases;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx->search_bases == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "No HBAC search base found.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = EINVAL;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay deny_method = dp_opt_get_string(hbac_ctx->ipa_options,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_HBAC_DENY_METHOD);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (strcasecmp(deny_method, "IGNORE") == 0) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->get_deny_rules = false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->get_deny_rules = true;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sss_log(SSS_LOG_NOTICE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "WARNING: Using deny rules is deprecated, the option "
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "ipa_hbac_treat_deny_as will be removed in the next "
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "upstream version\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = hbac_retry(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayfail:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Return an proper error */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_req_terminate(be_req, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic int hbac_retry(struct hbac_ctx *hbac_ctx)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct tevent_req *subreq;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay int ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay bool offline;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay time_t now, refresh_interval;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx *access_ctx = hbac_ctx->access_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay offline = be_is_offline(be_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_TRACE_ALL,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "Connection status is [%s].\n", offline ? "offline" : "online");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay refresh_interval = dp_opt_get_int(hbac_ctx->ipa_options,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_HBAC_REFRESH);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay now = time(NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (now < access_ctx->last_update + refresh_interval) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Simulate offline mode and just go to the cache */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_TRACE_FUNC, "Performing cached HBAC evaluation\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay offline = true;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!offline) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx->sdap_op == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_op = sdap_id_op_create(hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_ctx->conn->conn_cache);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx->sdap_op == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "sdap_id_op_create failed.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return EIO;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay subreq = sdap_id_op_connect_send(hbac_ctx->sdap_op, hbac_ctx, &ret);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!subreq) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "sdap_id_op_connect_send failed: %d(%s).\n", ret, strerror(ret));
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->sdap_op);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_set_callback(subreq, hbac_connect_done, hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Evaluate the rules based on what we have in the
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * sysdb
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_hbac_evaluate_rules(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return EOK;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return EOK;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_connect_done(struct tevent_req *subreq)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_ctx *hbac_ctx = tevent_req_callback_data(subreq, struct hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay int ret, dp_error;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sdap_id_op_connect_recv(subreq, &dp_error);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(subreq);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (dp_error == DP_ERR_OFFLINE) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* switching to offline mode */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->sdap_op);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_hbac_evaluate_rules(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = hbac_get_host_info_step(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayfail:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_clear_rule_data(struct hbac_ctx *hbac_ctx)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->host_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->hosts);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->hostgroup_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->hostgroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->service_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->services);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->servicegroup_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->servicegroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->rule_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->rules);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay/* Check whether the current HBAC request is processed in off-line mode */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic inline bool hbac_ctx_is_offline(struct hbac_ctx *ctx)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return ctx == NULL || ctx->sdap_op == NULL;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay/* Check the step result code and continue, retry, get offline result or abort accordingly */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay int dp_error;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret == EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return true;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx_is_offline(hbac_ctx)) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* already offline => the error is fatal */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sdap_id_op_done(hbac_ctx->sdap_op, ret, &dp_error);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (dp_error == DP_ERR_OFFLINE) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* switching to offline mode */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(hbac_ctx->sdap_op);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Free any of the results we've gotten */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_clear_rule_data(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay dp_error = DP_ERR_OK;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (dp_error == DP_ERR_OK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* retry */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = hbac_retry(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret == EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_get_service_info_step(struct tevent_req *req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_get_rule_info_step(struct tevent_req *req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_sysdb_save (struct tevent_req *req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay const char *hostname;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct tevent_req *req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (dp_opt_get_bool(hbac_ctx->ipa_options, IPA_HBAC_SUPPORT_SRCHOST)) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Support srchost
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * -> we don't want any particular host,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * we want all hosts
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hostname = NULL;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* THIS FEATURE IS DEPRECATED */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_MINOR_FAILURE, "WARNING: Using deprecated option "
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "ipa_hbac_support_srchost.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sss_log(SSS_LOG_NOTICE, "WARNING: Using deprecated option "
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "ipa_hbac_support_srchost.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hostname = dp_opt_get_string(hbac_ctx->ipa_options, IPA_HOSTNAME);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay req = ipa_host_info_send(hbac_ctx, be_ctx->ev,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sdap_id_op_handle(hbac_ctx->sdap_op),
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_ctx->opts,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hostname,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->access_ctx->host_map,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->access_ctx->hostgroup_map,
799f04e2ccd434ea51e5c7f59c5d83210c220c90Michal Zidek hbac_ctx->access_ctx->host_search_bases);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (req == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Could not get host info\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return ENOMEM;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_set_callback(req, hbac_get_service_info_step, hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return EOK;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_get_service_info_step(struct tevent_req *req)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay errno_t ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_ctx *hbac_ctx =
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_callback_data(req, struct hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_host_info_recv(req, hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->host_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->hosts,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->hostgroup_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->hostgroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!hbac_check_step_result(hbac_ctx, ret)) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Get services and service groups */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay req = ipa_hbac_service_info_send(hbac_ctx, be_ctx->ev,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sdap_id_op_handle(hbac_ctx->sdap_op),
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_ctx->opts,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->search_bases);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (req == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE,"Could not get service info\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_set_callback(req, hbac_get_rule_info_step, hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayfail:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_get_rule_info_step(struct tevent_req *req)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay errno_t ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay size_t i;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay const char *ipa_hostname;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay const char *hostname;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_ctx *hbac_ctx =
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_callback_data(req, struct hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_hbac_service_info_recv(req, hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->service_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->services,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->servicegroup_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->servicegroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!hbac_check_step_result(hbac_ctx, ret)) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Get the ipa_host attrs */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->ipa_host = NULL;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_hostname = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ipa_hostname == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "Missing ipa_hostname, this should never happen.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay for (i = 0; i < hbac_ctx->host_count; i++) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_attrs_get_string(hbac_ctx->hosts[i],
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay SYSDB_FQDN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hostname);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Could not locate IPA host\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (strcasecmp(hostname, ipa_hostname) == 0) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->ipa_host = hbac_ctx->hosts[i];
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay break;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (hbac_ctx->ipa_host == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Could not locate IPA host\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Get the list of applicable rules */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay req = ipa_hbac_rule_info_send(hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->get_deny_rules,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay be_ctx->ev,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay sdap_id_op_handle(hbac_ctx->sdap_op),
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->sdap_ctx->opts,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->search_bases,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->ipa_host);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (req == NULL) {
a004873f367b026fd033d4aa0bfa4225555c346eMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Could not get rules\n");
a004873f367b026fd033d4aa0bfa4225555c346eMichal Zidek goto fail;
a004873f367b026fd033d4aa0bfa4225555c346eMichal Zidek }
a004873f367b026fd033d4aa0bfa4225555c346eMichal Zidek
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_set_callback(req, hbac_sysdb_save, hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayfail:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaystatic void hbac_sysdb_save(struct tevent_req *req)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay errno_t ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay bool in_transaction = false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_ctx *hbac_ctx =
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tevent_req_callback_data(req, struct hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct sss_domain_info *domain = be_ctx->domain;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ldb_dn *base_dn;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx *access_ctx =
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ipa_access_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay TALLOC_CTX *tmp_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_hbac_rule_info_recv(req, hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->rule_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->rules);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_zfree(req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret == ENOENT) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* No rules were found that apply to this
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * host.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tmp_ctx = talloc_new(NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (tmp_ctx == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Delete any rules in the sysdb so offline logins
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * are also denied.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay base_dn = sysdb_custom_subtree_dn(tmp_ctx, domain, HBAC_RULES_SUBDIR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (base_dn == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_free(tmp_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_delete_recursive(domain->sysdb, base_dn, true);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_free(tmp_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_delete_recursive failed.\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* If no rules are found, we default to DENY */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_PERM_DENIED);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (!hbac_check_step_result(hbac_ctx, ret)) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_transaction_start(domain->sysdb);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_FATAL_FAILURE, "Could not start transaction\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay in_transaction = true;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Save the hosts */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_hbac_sysdb_save(domain,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_HOSTS_SUBDIR, SYSDB_FQDN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->host_count, hbac_ctx->hosts,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_HOSTGROUPS_SUBDIR, SYSDB_NAME,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->hostgroup_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->hostgroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Error saving hosts: [%d][%s]\n",
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret, strerror(ret));
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Save the services */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_hbac_sysdb_save(domain,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_SERVICES_SUBDIR, IPA_CN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->service_count, hbac_ctx->services,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_SERVICEGROUPS_SUBDIR, IPA_CN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->servicegroup_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->servicegroups);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Error saving services: [%d][%s]\n",
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret, strerror(ret));
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Save the rules */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ipa_hbac_sysdb_save(domain,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_RULES_SUBDIR, IPA_UNIQUE_ID,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->rule_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_ctx->rules,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay NULL, NULL, 0, NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Error saving rules: [%d][%s]\n",
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret, strerror(ret));
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_transaction_commit(domain->sysdb);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto fail;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay in_transaction = false;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* We don't need the rule data any longer,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * the rest of the processing relies on
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay * sysdb lookups.
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_clear_rule_data(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay access_ctx->last_update = time(NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Now evaluate the request against the rules */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_hbac_evaluate_rules(hbac_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayfail:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (in_transaction) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_transaction_cancel(domain->sysdb);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_FATAL_FAILURE, "Could not cancel transaction\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayvoid ipa_hbac_evaluate_rules(struct hbac_ctx *hbac_ctx)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct be_ctx *be_ctx = be_req_get_be_ctx(hbac_ctx->be_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay errno_t ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_rule **hbac_rules;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_eval_req *eval_req;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay enum hbac_eval_result result;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct hbac_info *info;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay /* Get HBAC rules from the sysdb */
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = hbac_get_cached_rules(hbac_ctx, be_ctx->domain,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_ctx->rule_count, &hbac_ctx->rules);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Could not retrieve rules from the cache\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = hbac_ctx_to_rules(hbac_ctx, hbac_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &hbac_rules, &eval_req);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret == EPERM) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "DENY rules detected. Denying access to all users\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_PERM_DENIED);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else if (ret != EOK) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Could not construct HBAC rules\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay result = hbac_evaluate(hbac_rules, eval_req, &info);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (result == HBAC_EVAL_ALLOW) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_MINOR_FAILURE, "Access granted by HBAC rule [%s]\n",
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay info->rule_name);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_free_info(info);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SUCCESS);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else if (result == HBAC_EVAL_ERROR) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Error [%s] occurred in rule [%s]\n",
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_error_string(info->code),
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay info->rule_name);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_free_info(info);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } else if (result == HBAC_EVAL_OOM) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Insufficient memory\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_MINOR_FAILURE, "Access denied by HBAC rules\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay hbac_free_info(info);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ipa_access_reply(hbac_ctx, PAM_PERM_DENIED);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guayerrno_t hbac_get_cached_rules(TALLOC_CTX *mem_ctx,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct sss_domain_info *domain,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay size_t *_rule_count,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct sysdb_attrs ***_rules)
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay{
21d485184df986e1a123f70c689517386e51a5ceMichal Zidek errno_t ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct ldb_message **msgs;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay struct sysdb_attrs **rules;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay size_t rule_count;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay TALLOC_CTX *tmp_ctx;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay char *filter;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay const char *attrs[] = { OBJECTCLASS,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_CN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay SYSDB_ORIG_DN,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_UNIQUE_ID,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_ENABLED_FLAG,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_ACCESS_RULE_TYPE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_MEMBER_USER,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_USER_CATEGORY,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_MEMBER_SERVICE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_SERVICE_CATEGORY,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_SOURCE_HOST,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_SOURCE_HOST_CATEGORY,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_EXTERNAL_HOST,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_MEMBER_HOST,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay IPA_HOST_CATEGORY,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay NULL };
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay tmp_ctx = talloc_new(NULL);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (tmp_ctx == NULL) return ENOMEM;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay filter = talloc_asprintf(tmp_ctx, "(objectClass=%s)", IPA_HBAC_RULE);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (filter == NULL) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = ENOMEM;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto done;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_search_custom(tmp_ctx, domain, filter,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay HBAC_RULES_SUBDIR, attrs,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay &rule_count, &msgs);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (ret != EOK && ret != ENOENT) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up HBAC rules\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto done;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay } if (ret == ENOENT) {
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay rule_count = 0;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = sysdb_msg2attrs(tmp_ctx, rule_count, msgs, &rules);
21d485184df986e1a123f70c689517386e51a5ceMichal Zidek if (ret != EOK) {
21d485184df986e1a123f70c689517386e51a5ceMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE,
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay "Could not convert ldb message to sysdb_attrs\n");
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay goto done;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay }
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (_rules) *_rules = talloc_steal(mem_ctx, rules);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay if (_rule_count) *_rule_count = rule_count;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay ret = EOK;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guaydone:
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay talloc_free(tmp_ctx);
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay return ret;
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay}
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay