316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi#include "providers/ipa/ipa_hbac_private.h"

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi#include "providers/ipa/ipa_hbac.h"

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi#include "providers/ipa/ipa_common.h"

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomiipa_hbac_save_list(struct sysdb_ctx *sysdb, bool delete_subdir,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *subdir, struct sss_domain_info *domain,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *naming_attribute, size_t count,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct sysdb_attrs **list)

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi{

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi int ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi size_t c;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct ldb_dn *base_dn;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *object_name;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct ldb_message_element *el;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi TALLOC_CTX *tmp_ctx;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi tmp_ctx = talloc_new(NULL);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (tmp_ctx == NULL) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("talloc_new failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (delete_subdir) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi base_dn = sysdb_custom_subtree_dn(sysdb, tmp_ctx, domain, subdir);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (base_dn == NULL) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_delete_recursive(sysdb, base_dn, true);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("sysdb_delete_recursive failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi for (c = 0; c < count; c++) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_attrs_get_el(list[c], naming_attribute, &el);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("sysdb_attrs_get_el failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (el->num_values == 0) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("[%s] not found.\n", naming_attribute));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = EINVAL;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi object_name = talloc_strndup(tmp_ctx, (const char *)el->values[0].data,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi el->values[0].length);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (object_name == NULL) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("talloc_strndup failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(9, ("Object name: [%s].\n", object_name));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_store_custom(sysdb, object_name, subdir, list[c]);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("sysdb_store_custom failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = EOK;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomidone:

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi talloc_free(tmp_ctx);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi}

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomiipa_hbac_sysdb_save(struct sysdb_ctx *sysdb, struct sss_domain_info *domain,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *primary_subdir, const char *attr_name,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi size_t primary_count, struct sysdb_attrs **primary,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *group_subdir, const char *groupattr_name,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi size_t group_count, struct sysdb_attrs **groups)

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi{

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi errno_t ret, sret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi bool in_transaction = false;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if ((primary_count == 0 || primary == NULL)

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi || (group_count > 0 && groups == NULL)) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi /* There always has to be at least one

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return EINVAL;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi /* Save the entries and groups to the cache */

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_transaction_start(sysdb);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to start transaction\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi };

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi in_transaction = true;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi /* First, save the specific entries */

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = ipa_hbac_save_list(sysdb, true,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi primary_subdir,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi domain,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi attr_name,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi primary_count,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi primary);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("Could not save %s. [%d][%s]\n",

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi primary_subdir, ret, strerror(ret)));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi /* Second, save the groups */

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (group_count > 0) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = ipa_hbac_save_list(sysdb, true,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi group_subdir,

6b136bb200a5f803d0ef5af225ad891e862b6b75Timo Sirainen domain,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi groupattr_name,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi group_count,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi groups);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("Could not save %s. [%d][%s]\n",

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi group_subdir, ret, strerror(ret)));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_transaction_commit(sysdb);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to commit transaction\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi in_transaction = false;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomidone:

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (in_transaction) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi sret = sysdb_transaction_cancel(sysdb);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (sret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(0, ("Could not cancel sysdb transaction\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(3, ("Error [%d][%s]\n", ret, strerror(ret)));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi}

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomireplace_attribute_name(const char *old_name,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *new_name, const size_t count,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct sysdb_attrs **list)

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi{

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi int ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi int i;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi for (i = 0; i < count; i++) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_attrs_replace_name(list[i], old_name, new_name);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("sysdb_attrs_replace_name failed.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return EOK;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi}

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomistatic errno_t

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomicreate_empty_grouplist(struct hbac_request_element *el)

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi{

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi el->groups = talloc_array(el, const char *, 1);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (!el->groups) return ENOMEM;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi el->groups[0] = NULL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi return EOK;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi}

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomistatic errno_t

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomihbac_attrs_to_rule(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_ctx *hbac_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi size_t index,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_rule **rule);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomistatic errno_t

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomihbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_ctx *hbac_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_eval_req **request);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomihbac_ctx_to_rules(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_ctx *hbac_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_rule ***rules,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_eval_req **request)

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi{

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi errno_t ret;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_rule **new_rules;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_eval_req *new_request;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi size_t i;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi TALLOC_CTX *tmp_ctx = NULL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (!rules || !request) return EINVAL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi tmp_ctx = talloc_new(mem_ctx);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (tmp_ctx == NULL) return ENOMEM;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* First create an array of rules */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rules = talloc_array(tmp_ctx, struct hbac_rule *,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx->rule_count + 1);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (new_rules == NULL) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = ENOMEM;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Create each rule one at a time */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi for (i = 0; i < hbac_ctx->rule_count ; i++) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_attrs_to_rule(new_rules, hbac_ctx, i, &(new_rules[i]));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret == EPERM) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi } else if (ret != EOK) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Could not construct rules\n"));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rules[i] = NULL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Create the eval request */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_ctx_to_eval_request(tmp_ctx, hbac_ctx, &new_request);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Could not construct eval request\n"));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi *rules = talloc_steal(mem_ctx, new_rules);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi *request = talloc_steal(mem_ctx, new_request);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = EOK;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomidone:

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi talloc_free(tmp_ctx);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi return ret;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi}

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomistatic errno_t

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvihbac_attrs_to_rule(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_ctx *hbac_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi size_t idx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_rule **rule)

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi{

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi errno_t ret;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_rule *new_rule;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct ldb_message_element *el;

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi const char *rule_type;

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule = talloc_zero(mem_ctx, struct hbac_rule);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (new_rule == NULL) return ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_attrs_get_el(hbac_ctx->rules[idx],

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi IPA_CN, &el);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK || el->num_values == 0) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(4, ("rule has no name, assuming '(none)'.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi new_rule->name = talloc_strdup(new_rule, "(none)");

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi } else {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi new_rule->name = talloc_strndup(new_rule,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi (const char*) el->values[0].data,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi el->values[0].length);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi DEBUG(7, ("Processing rule [%s]\n", new_rule->name));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_attrs_get_bool(hbac_ctx->rules[idx], IPA_ENABLED_FLAG,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi &new_rule->enabled);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) goto done;

955c276b9de538cfbfe4cff19f2a610f57e8d5c7Timo Sirainen

6b136bb200a5f803d0ef5af225ad891e862b6b75Timo Sirainen if (!new_rule->enabled) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = EOK;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi ret = sysdb_attrs_get_string(hbac_ctx->rules[idx],

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi IPA_ACCESS_RULE_TYPE,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi &rule_type);

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi if (ret != EOK) goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (strcasecmp(rule_type, IPA_HBAC_ALLOW) != 0) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(7, ("Rule [%s] is not an ALLOW rule\n", new_rule->name));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = EPERM;

955c276b9de538cfbfe4cff19f2a610f57e8d5c7Timo Sirainen goto done;

6b136bb200a5f803d0ef5af225ad891e862b6b75Timo Sirainen }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

6b136bb200a5f803d0ef5af225ad891e862b6b75Timo Sirainen /* Get the users */

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = hbac_user_attrs_to_rule(new_rule,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi hbac_ctx_sysdb(hbac_ctx),

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi new_rule->name,

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi hbac_ctx->rules[idx],

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi &new_rule->users);

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi if (ret != EOK) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi DEBUG(1, ("Could not parse users for rule [%s]\n",

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi new_rule->name));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Get the services */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_service_attrs_to_rule(new_rule,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx_sysdb(hbac_ctx),

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx->rules[idx],

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi &new_rule->services);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Could not parse services for rule [%s]\n",

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Get the target hosts */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_thost_attrs_to_rule(new_rule,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx_sysdb(hbac_ctx),

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx->rules[idx],

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi &new_rule->targethosts);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Could not parse target hosts for rule [%s]\n",

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Get the source hosts */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

bd5684768b6084ddca07c210fd4dbb6372acc56aTimo Sirainen ret = hbac_shost_attrs_to_rule(new_rule,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx_sysdb(hbac_ctx),

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi hbac_ctx->rules[idx],

fadd4c92940c10a01556e1ebcb2f17890b35d7bcMartti Rannanjärvi dp_opt_get_bool(hbac_ctx->ipa_options,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi IPA_HBAC_SUPPORT_SRCHOST),

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi &new_rule->srchosts);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Could not parse source hosts for rule [%s]\n",

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi new_rule->name));

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi *rule = new_rule;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = EOK;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomidone:

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != EOK) talloc_free(new_rule);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi}

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomihbac_get_category(struct sysdb_attrs *attrs,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *category_attr,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi uint32_t *_categories)

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi{

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi errno_t ret;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi size_t i;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi uint32_t cats = HBAC_CATEGORY_NULL;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char **categories;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi TALLOC_CTX *tmp_ctx = talloc_new(NULL);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (tmp_ctx == NULL) return ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = sysdb_attrs_get_string_array(attrs, category_attr,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi tmp_ctx, &categories);

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi if (ret != EOK && ret != ENOENT) goto done;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (ret != ENOENT) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi for (i = 0; categories[i]; i++) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (strcasecmp("all", categories[i]) == 0) {

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi DEBUG(5, ("Category is set to 'all'.\n"));

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi cats |= HBAC_CATEGORY_ALL;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi continue;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi DEBUG(9, ("Unsupported user category [%s].\n",

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi categories[i]));

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi *_categories = cats;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = EOK;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

955c276b9de538cfbfe4cff19f2a610f57e8d5c7Timo Sirainendone:

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi talloc_free(tmp_ctx);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi return ret;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi}

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomistatic errno_t

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomihbac_eval_user_element(TALLOC_CTX *mem_ctx,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct sysdb_ctx *sysdb,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct sss_domain_info *domain,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi const char *username,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct hbac_request_element **user_element);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomistatic errno_t

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomihbac_eval_service_element(TALLOC_CTX *mem_ctx,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct sysdb_ctx *sysdb,

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi struct sss_domain_info *domain,

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi const char *servicename,

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi struct hbac_request_element **svc_element);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomistatic errno_t

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomihbac_eval_host_element(TALLOC_CTX *mem_ctx,

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi struct sysdb_ctx *sysdb,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi struct sss_domain_info *domain,

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi const char *hostname,

fadd4c92940c10a01556e1ebcb2f17890b35d7bcMartti Rannanjärvi struct hbac_request_element **host_element);

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomistatic errno_t

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomihbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_ctx *hbac_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_eval_req **request)

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi{

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi errno_t ret;

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi struct pam_data *pd = hbac_ctx->pd;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi TALLOC_CTX *tmp_ctx;

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi struct hbac_eval_req *eval_req;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct sysdb_ctx *sysdb = hbac_ctx_sysdb(hbac_ctx);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct sss_domain_info *domain = hbac_ctx_be(hbac_ctx)->domain;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi const char *rhost;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi const char *thost;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi struct sss_domain_info *user_dom;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi tmp_ctx = talloc_new(mem_ctx);

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi if (tmp_ctx == NULL) return ENOMEM;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi eval_req = talloc_zero(tmp_ctx, struct hbac_eval_req);

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi if (eval_req == NULL) {

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi ret = ENOMEM;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi goto done;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi }

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi eval_req->request_time = time(NULL);

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi /* Get user the user name and groups,

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi if (strcasecmp(pd->domain, domain->name) != 0) {

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi user_dom = new_subdomain(tmp_ctx, domain, pd->domain, NULL, NULL);

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi if (user_dom == NULL) {

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi DEBUG(SSSDBG_OP_FAILURE, ("new_subdomain failed.\n"));

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi ret = ENOMEM;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi goto done;

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi }

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi ret = hbac_eval_user_element(eval_req, user_dom->sysdb, user_dom,

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi pd->user, &eval_req->user);

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi } else {

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi ret = hbac_eval_user_element(eval_req, sysdb, domain,

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi pd->user, &eval_req->user);

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Get the PAM service and service groups */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_eval_service_element(eval_req, sysdb, domain,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi pd->service, &eval_req->service);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Get the source host */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (pd->rhost == NULL || pd->rhost[0] == '\0') {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* If we haven't been passed an rhost,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi rhost = NULL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi } else {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi rhost = pd->rhost;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_eval_host_element(eval_req, sysdb, domain,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi rhost, &eval_req->srchost);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* The target host is always the current machine */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi thost = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (thost == NULL) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi DEBUG(1, ("Missing ipa_hostname, this should never happen.\n"));

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = EINVAL;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = hbac_eval_host_element(eval_req, sysdb, domain,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi thost, &eval_req->targethost);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi if (ret != EOK) goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi *request = talloc_steal(mem_ctx, eval_req);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = EOK;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomidone:

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi talloc_free(tmp_ctx);

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi return ret;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi}

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomistatic errno_t

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomihbac_eval_user_element(TALLOC_CTX *mem_ctx,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct sysdb_ctx *sysdb,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct sss_domain_info *domain,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi const char *username,

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_request_element **user_element)

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi{

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi errno_t ret;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi unsigned int i;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi unsigned int num_groups = 0;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi TALLOC_CTX *tmp_ctx;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi const char *member_dn;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct hbac_request_element *users;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi struct ldb_message *msg;

cce36a2c5573e4c69b01b163b08e6c8586c56aa6Aki Tuomi struct ldb_message_element *el;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi const char *attrs[] = { SYSDB_ORIG_MEMBEROF, NULL };

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi tmp_ctx = talloc_new(mem_ctx);

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi if (tmp_ctx == NULL) return ENOMEM;

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi users = talloc_zero(tmp_ctx, struct hbac_request_element);

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi if (users == NULL) {

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi ret = ENOMEM;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi goto done;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi }

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi users->name = username;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi /* Read the originalMemberOf attribute

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi ret = sysdb_search_user_by_name(tmp_ctx, sysdb, domain,

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi users->name, attrs, &msg);

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi if (ret != EOK) {

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi DEBUG(1, ("Could not determine user memberships for [%s]\n",

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi users->name));

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi goto done;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi }

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi el = ldb_msg_find_element(msg, SYSDB_ORIG_MEMBEROF);

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi if (el == NULL || el->num_values == 0) {

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi DEBUG(7, ("No groups for [%s]\n", users->name));

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi ret = create_empty_grouplist(users);

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi goto done;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi }

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi DEBUG(7, ("[%d] groups for [%s]\n", el->num_values, users->name));

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi users->groups = talloc_array(users, const char *, el->num_values + 1);

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi if (users->groups == NULL) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi ret = ENOMEM;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi goto done;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi for (i = 0; i < el->num_values; i++) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi member_dn = (const char *)el->values[i].data;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi ret = get_ipa_groupname(users->groups, sysdb, member_dn,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi &users->groups[num_groups]);

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi if (ret != EOK && ret != ENOENT) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi DEBUG(3, ("Parse error on [%s]\n", member_dn));

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi goto done;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi } else if (ret == EOK) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi DEBUG(7, ("Added group [%s] for user [%s]\n",

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi users->groups[num_groups], users->name));

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi num_groups++;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi continue;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi /* Skip entries that are not groups */

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi DEBUG(8, ("Skipping non-group memberOf [%s]\n", member_dn));

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi users->groups[num_groups] = NULL;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi if (num_groups < el->num_values) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi /* Shrink the array memory */

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi users->groups = talloc_realloc(users, users->groups, const char *,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi num_groups+1);

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi if (users->groups == NULL) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi ret = ENOMEM;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi goto done;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi ret = EOK;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvidone:

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi if (ret == EOK) {

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi *user_element = talloc_steal(mem_ctx, users);

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi }

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi talloc_free(tmp_ctx);

fadd4c92940c10a01556e1ebcb2f17890b35d7bcMartti Rannanjärvi return ret;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi}

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvistatic errno_t

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvihbac_eval_service_element(TALLOC_CTX *mem_ctx,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi struct sysdb_ctx *sysdb,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi struct sss_domain_info *domain,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi const char *servicename,

401160c5ca4c3c8f122f437d00f5e4498243d7bfMartti Rannanjärvi struct hbac_request_element **svc_element)

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi{

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi errno_t ret;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi size_t i, j, count;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi TALLOC_CTX *tmp_ctx;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi struct hbac_request_element *svc;

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi struct ldb_message **msgs;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct ldb_message_element *el;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi struct ldb_dn *svc_dn;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi const char *memberof_attrs[] = { SYSDB_ORIG_MEMBEROF, NULL };

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi char *name;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi tmp_ctx = talloc_new(mem_ctx);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (tmp_ctx == NULL) return ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi svc = talloc_zero(tmp_ctx, struct hbac_request_element);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (svc == NULL) {

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

1471b423978eee881844419e1bff8c9895a59ea1Aki Tuomi }

fba8aa9864290ef74486cb2333220180f6bd1de9Martti Rannanjärvi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi svc->name = servicename;

58562739e57d14eeced3bc5923d7f907b6df4ab2Martti Rannanjärvi

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi svc_dn = sysdb_custom_dn(sysdb, tmp_ctx,

0be99975517967a2a074bf55de39aae65fe893c6Martti Rannanjärvi domain, svc->name, HBAC_SERVICES_SUBDIR);

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi if (svc_dn == NULL) {

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi ret = ENOMEM;

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi goto done;

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi }

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi /* Look up the service to get its originalMemberOf entries */

5efce910194a73988c098c31098576cb1fcb1c8bAki Tuomi ret = sysdb_search_entry(tmp_ctx, sysdb, svc_dn,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi LDB_SCOPE_BASE, NULL,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi memberof_attrs,

316cbe323513a0f20d1cf519fe9405e231d633e2Aki Tuomi &count, &msgs);

if (ret == ENOENT || count == 0) {

/* We won't be able to identify any groups

ret = create_empty_grouplist(svc);

goto done;

} else if (ret != EOK) {

goto done;

} else if (count > 1) {

DEBUG(1, ("More than one result for a BASE search!\n"));

ret = EIO;

goto done;

}

el = ldb_msg_find_element(msgs[0], SYSDB_ORIG_MEMBEROF);

if (!el) {

/* Service is not a member of any groups

ret = create_empty_grouplist(svc);

goto done;

}

svc->groups = talloc_array(svc, const char *, el->num_values + 1);

if (svc->groups == NULL) {

ret = ENOMEM;

goto done;

}

for (i = j = 0; i < el->num_values; i++) {

ret = get_ipa_servicegroupname(tmp_ctx, sysdb,

(const char *)el->values[i].data,

&name);

if (ret != EOK && ret != ENOENT) goto done;

/* ENOENT means we had a memberOf entry that wasn't a

if (ret == EOK) {

svc->groups[j] = talloc_steal(svc->groups, name);

j++;

}

}

svc->groups[j] = NULL;

ret = EOK;

done:

if (ret == EOK) {

*svc_element = talloc_steal(mem_ctx, svc);

}

talloc_free(tmp_ctx);

return ret;

}

static errno_t

hbac_eval_host_element(TALLOC_CTX *mem_ctx,

struct sysdb_ctx *sysdb,

struct sss_domain_info *domain,

const char *hostname,

struct hbac_request_element **host_element)

{

errno_t ret;

size_t i, j, count;

TALLOC_CTX *tmp_ctx;

struct hbac_request_element *host;

struct ldb_message **msgs;

struct ldb_message_element *el;

struct ldb_dn *host_dn;

const char *memberof_attrs[] = { SYSDB_ORIG_MEMBEROF, NULL };

char *name;

tmp_ctx = talloc_new(mem_ctx);

if (tmp_ctx == NULL) return ENOMEM;

host = talloc_zero(tmp_ctx, struct hbac_request_element);

if (host == NULL) {

ret = ENOMEM;

goto done;

}

host->name = hostname;

if (host->name == NULL) {

/* We don't know the host (probably an rhost)

ret = create_empty_grouplist(host);

goto done;

}

host_dn = sysdb_custom_dn(sysdb, tmp_ctx,

domain, host->name, HBAC_HOSTS_SUBDIR);

if (host_dn == NULL) {

ret = ENOMEM;

goto done;

}

/* Look up the host to get its originalMemberOf entries */

ret = sysdb_search_entry(tmp_ctx, sysdb, host_dn,

LDB_SCOPE_BASE, NULL,

memberof_attrs,

&count, &msgs);

if (ret == ENOENT || count == 0) {

/* We won't be able to identify any groups

ret = create_empty_grouplist(host);

goto done;

} else if (ret != EOK) {

goto done;

} else if (count > 1) {

DEBUG(1, ("More than one result for a BASE search!\n"));

ret = EIO;

goto done;

}

el = ldb_msg_find_element(msgs[0], SYSDB_ORIG_MEMBEROF);

if (!el) {

/* Host is not a member of any groups

ret = create_empty_grouplist(host);

goto done;

}

host->groups = talloc_array(host, const char *, el->num_values + 1);

if (host->groups == NULL) {

ret = ENOMEM;

goto done;

}

for (i = j = 0; i < el->num_values; i++) {

ret = get_ipa_hostgroupname(tmp_ctx, sysdb,

(const char *)el->values[i].data,

&name);

if (ret != EOK && ret != ENOENT) goto done;

/* ENOENT means we had a memberOf entry that wasn't a

if (ret == EOK) {

host->groups[j] = talloc_steal(host->groups, name);

j++;

}

}

host->groups[j] = NULL;

ret = EOK;

done:

if (ret == EOK) {

*host_element = talloc_steal(mem_ctx, host);

}

talloc_free(tmp_ctx);

return ret;

}