/*
SSSD
IPA Backend Module -- Session Management
Authors:
Fabiano Fidêncio <fidencio@redhat.com>
Copyright (C) 2017 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "util/child_common.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_subdomains.h"
#include "providers/ipa/ipa_session.h"
#include "providers/ipa/ipa_rules_common.h"
#include "providers/ipa/ipa_deskprofile_private.h"
#include "providers/ipa/ipa_deskprofile_config.h"
#include "providers/ipa/ipa_deskprofile_rules.h"
#include "providers/ipa/ipa_deskprofile_rules_util.h"
/* Those here are used for sending a message to the deskprofile client
* informing that our side is done. */
struct ipa_fetch_deskprofile_state {
const char *username;
/* Hosts */
/* Rules */
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_session_ctx *session_ctx,
const char *username)
{
bool offline;
struct ipa_fetch_deskprofile_state);
return NULL;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
/* This value is in minutes ... */
/* This value is in seconds ... */
next_request /= 60;
"No rules were found in the last request.\n"
"Next request will happen in any login after %ld minutes\n",
goto immediately;
}
"Performing cached Desktop Profile evaluation\n");
goto immediately;
}
goto immediately;
}
return req;
} else {
}
return req;
}
static errno_t
{
int ret;
"sdap_id_op_connect_send() failed: %d (%s)\n",
return ret;
}
return EAGAIN;
}
static void
{
int dp_error;
goto done;
}
return;
}
done:
} else {
}
}
static errno_t
{
const char *hostname;
return ENOMEM;
}
return EAGAIN;
}
static void
{
goto done;
}
goto done;
}
state->ipa_options);
goto done;
}
return;
done:
}
static void
{
goto done;
}
goto done;
}
goto done;
}
return;
done:
}
static void
{
int dp_error;
bool found;
/* Set ret to EOK so we can safely call sdap_id_op_done. */
found = false;
found = true;
} else {
goto done;
}
/* retry */
}
return;
return;
}
/* For now, let's completely purge the previous stored
* rules before saving the new ones */
"Unable to remove Desktop Profile rules\n");
goto done;
}
if (!found) {
goto done;
}
goto done;
}
done:
return;
}
}
static errno_t
{
return EOK;
}
struct ipa_pam_session_handler_state {
/* Those attributes are used for:
* - saving the deskprofile rules to the disk;
* - deleting the deskprofile rules from the disk;
* - contacting the deskprofile client that everything is ready;
*/
char *shortname;
char *domain;
char *user_dir;
};
static errno_t
struct sss_domain_info *domain,
const char *username,
char **_shortname,
char **_domain,
char **_user_dir,
static errno_t
struct sss_domain_info *domain,
const char *username, /* fully-qualified */
const char *user_dir,
const char *hostname,
static errno_t
const char *user_dir,
struct tevent_req *
struct ipa_session_ctx *session_ctx,
struct dp_req_params *params)
{
struct ipa_pam_session_handler_state);
return NULL;
}
/* Get all the user info that will be needed in order the delete the
* user's deskprofile directory from the disk, create the user's directory,
* save the fetched rules to the disk and notify the deskprofile client
* that this operation is done. */
"ipa_deskprofile_get_user_info() failed [%d]: %s\n",
goto done;
}
/* As no proper merging mechanism has been implemented yet ...
* let's just remove the user directory stored in the disk as it's
* going to be created again in case there's any rule fetched. */
"ipa_deskprofile_rules_remove_user_dir() failed.\n");
goto done;
}
goto done;
}
return req;
done:
return req;
}
static void
{
const char *hostname;
}
goto done;
"Unable to fetch Desktop Profile rules [%d]: %s\n",
goto done;
}
done:
/* TODO For backward compatibility we always return EOK to DP now. */
}
struct tevent_req *req,
{
return EOK;
}
static errno_t
struct sss_domain_info *domain,
const char *username,
char **_shortname,
char **_domain,
char **_user_dir,
{
char *shortname;
char *domain_name;
char *user_dir;
return ENOMEM;
}
&shortname, &domain_name);
goto done;
}
goto done;
}
goto done;
}
"sysdb_getpwnam() got more users than expected. "
goto done;
}
/* As IPA doesn't handle root users ou groups, we know for sure that's
* something wrong in case we get uid = 0 or gid = 0.
*/
goto done;
}
done:
return ret;
}
static errno_t
struct sss_domain_info *domain,
const char *username, /* fully-qualified */
const char *user_dir,
const char *hostname,
{
const char **attrs_get_cached_rules;
return ENOMEM;
}
/* Get Desktop Profile priority from sysdb */
"deskprofile_get_cached_priority() failed [%d]: %s\n",
goto done;
}
/* Get Desktop Profile rules from sysdb */
if (attrs_get_cached_rules == NULL) {
"deskprofile_get_attrs_get_cached_rules() failed\n");
goto done;
}
&rules);
"Could not retrieve Desktop Profile rules from the cache\n");
goto done;
}
/* Create the user directory where the rules are going to be stored */
"Cannot create the user directory [%d]: %s\n",
goto done;
}
/* Save the rules to the disk */
for (size_t i = 0; i < rule_count; i++) {
rules[i],
uid,
gid);
"Failed to save a Desktop Profile Rule to disk [%d]: %s\n",
goto done;
}
}
/* Notify FleetCommander that our side is done */
priority);
"ipa_pam_session_handler_notify_deskprofile_client() "
"failed [%d]: %s\n",
goto done;
}
done:
return ret;
}
static DBusConnection *
{
if (dbus_error_is_set(&error)) {
"Unable to connect to the FleetCommanderClient bus [%s]: %s\n",
goto done;
}
done:
return conn;
}
static errno_t
const char *user_dir,
{
bool dbus_ret;
goto done;
}
"ProcessSSSDFiles",
DBUS_TYPE_UINT16, &prio);
goto done;
}
goto done;
}
done:
}
}
return ret;
}