/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_rules_common.h"
struct sysdb_attrs **list)
{
int ret;
int i;
for (i = 0; i < count; i++) {
return ret;
}
}
return EOK;
}
static errno_t
{
return EOK;
}
/********************************************
* Functions for handling conversion to the *
* HBAC evaluator format *
********************************************/
static errno_t
static errno_t
struct hbac_eval_req **request);
struct hbac_eval_req **request)
{
size_t i;
/* First create an array of rules */
goto done;
}
/* Create each rule one at a time */
for (i = 0; i < hbac_ctx->rule_count ; i++) {
goto done;
goto done;
}
}
/* Create the eval request */
goto done;
}
done:
return ret;
}
static errno_t
{
const char *rule_type;
} else {
}
goto done;
}
&rule_type);
goto done;
}
/* Get the users */
goto done;
}
/* Get the services */
goto done;
}
/* Get the target hosts */
&new_rule->targethosts);
"Could not parse target hosts for rule [%s]\n",
goto done;
}
/* Get the source hosts */
"Could not parse source hosts for rule [%s]\n",
goto done;
}
done:
return ret;
}
const char *category_attr,
{
size_t i;
const char **categories;
tmp_ctx, &categories);
for (i = 0; categories[i]; i++) {
continue;
}
categories[i]);
}
}
*_categories = cats;
done:
return ret;
}
static errno_t
struct sss_domain_info *domain,
const char *username,
struct hbac_request_element **user_element);
static errno_t
struct sss_domain_info *domain,
const char *servicename,
struct hbac_request_element **svc_element);
static errno_t
struct sss_domain_info *domain,
const char *hostname,
struct hbac_request_element **host_element);
static errno_t
struct hbac_eval_req **request)
{
const char *rhost;
const char *thost;
goto done;
}
/* Get user the user name and groups,
* take care of subdomain users as well */
goto done;
}
} else {
}
/* Get the PAM service and service groups */
/* Get the source host */
/* If we haven't been passed an rhost,
* the rhost is unknown. This will fail
* to match any rule requiring the
* source host.
*/
} else {
}
/* The target host is always the current machine */
"Missing ipa_hostname, this should never happen.\n");
goto done;
}
&eval_req->targethost);
done:
return ret;
}
static errno_t
struct sss_domain_info *domain,
const char *username,
struct hbac_request_element **user_element)
{
unsigned int num_groups = 0;
char *shortname;
int exp_comp;
goto done;
}
goto done;
}
if (ipa_domain == NULL) {
goto done;
}
if (ipa_groups_basedn == NULL) {
goto done;
}
/* +1 because there will be a RDN preceding the base DN */
/*
* Get all the groups the user is a member of.
* This includes both POSIX and non-POSIX groups.
*/
goto done;
}
/* This should not happen at this point */
"User [%s] not found in cache.\n", username);
goto done;
/* The first item is the user entry */
goto done;
}
/* This also includes the sentinel, b/c we'll skip the user entry below */
goto done;
}
/* Start counting from 1 to exclude the user entry */
/* Only groups from the IPA domain can be referenced from HBAC rules. To
* avoid evaluating groups which might even have the same name, but come
* from a trusted domain, we first copy the DN to a temporary one..
*/
"Skipping non-IPA group %s\n",
continue;
}
if (fqgroupname == NULL) {
"Skipping malformed entry [%s]\n",
continue;
}
continue;
}
num_groups++;
}
/* Shrink the array memory */
num_groups+1);
goto done;
}
}
done:
}
return ret;
}
static errno_t
struct sss_domain_info *domain,
const char *servicename,
struct hbac_request_element **svc_element)
{
char *name;
goto done;
}
goto done;
}
/* Look up the service to get its originalMemberOf entries */
/* We won't be able to identify any groups
* This rule will only match the name or
* a service category of ALL
*/
goto done;
goto done;
} else if (count > 1) {
goto done;
}
if (!el) {
/* Service is not a member of any groups
* This rule will only match the name or
* a service category of ALL
*/
goto done;
}
goto done;
}
for (i = j = 0; i < el->num_values; i++) {
&name);
continue;
}
/* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
* service group. We'll just ignore those (could be
* HBAC rules)
*/
j++;
}
}
done:
}
return ret;
}
static errno_t
struct sss_domain_info *domain,
const char *hostname,
struct hbac_request_element **host_element)
{
char *name;
goto done;
}
/* We don't know the host (probably an rhost)
* So we can't determine it's groups either.
*/
goto done;
}
goto done;
}
/* Look up the host to get its originalMemberOf entries */
/* We won't be able to identify any groups
* This rule will only match the name or
* a host category of ALL
*/
goto done;
goto done;
} else if (count > 1) {
goto done;
}
if (!el) {
/* Host is not a member of any groups
* This rule will only match the name or
* a host category of ALL
*/
goto done;
}
goto done;
}
for (i = j = 0; i < el->num_values; i++) {
&name);
continue;
}
/* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
* host group. We'll just ignore those (could be
* HBAC rules)
*/
j++;
}
}
done:
}
return ret;
}
const char **
{
goto done;
}
attrs[0] = OBJECTCLASS;
done:
return attrs;
}