simple_access.c revision c8119652b17229a5aca9b110365c310a6afdce30
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen Simple access control
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen Copyright (C) Sumit Bose <sbose@redhat.com> 2010
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen This program is free software; you can redistribute it and/or modify
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen it under the terms of the GNU General Public License as published by
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen the Free Software Foundation; either version 3 of the License, or
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen (at your option) any later version.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen This program is distributed in the hope that it will be useful,
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen but WITHOUT ANY WARRANTY; without even the implied warranty of
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen GNU General Public License for more details.
9ddd3d7d8651985e373a6c48e0ddc76b8a4ef1c7Timo Sirainen You should have received a copy of the GNU General Public License
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen along with this program. If not, see <http://www.gnu.org/licenses/>.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen#define CONFDB_SIMPLE_ALLOW_USERS "simple_allow_users"
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen#define CONFDB_SIMPLE_DENY_USERS "simple_deny_users"
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen#define CONFDB_SIMPLE_ALLOW_GROUPS "simple_allow_groups"
d03a871a77f8ec36f48f5fea98d810e51b186fdbTimo Sirainen#define CONFDB_SIMPLE_DENY_GROUPS "simple_deny_groups"
38505846b6d083e19f0a7d1373761bdda5d9a5a9Timo Sirainenstatic bool string_equal(bool cs, const char *s1, const char *s2)
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen return sss_utf8_case_eq((const uint8_t *)s1, (const uint8_t *)s2) == EOK;
f016dec9837e6a41867708e4b89ca5308dedab05Timo Sirainenerrno_t simple_access_check(struct simple_ctx *ctx, const char *username,
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* First, check whether the user is in the allowed users list */
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen for(i = 0; ctx->allow_users[i] != NULL; i++) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen if (string_equal(cs, username, ctx->allow_users[i])) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen DEBUG(9, ("User [%s] found in allow list, access granted.\n",
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* Do not return immediately on explicit allow
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * We need to make sure none of the user's groups
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * are denied.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* If neither allow rule is in place, we'll assume allowed
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * unless a deny rule disables us below.
f016dec9837e6a41867708e4b89ca5308dedab05Timo Sirainen /* Next check whether this user has been specifically denied */
0ad9d535b04fe4a80534702617e17fd0d261fafaTimo Sirainen if (string_equal(cs, username, ctx->deny_users[i])) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen DEBUG(9, ("User [%s] found in deny list, access denied.\n",
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* Return immediately on explicit denial */
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen if (!ctx->allow_groups && !ctx->deny_groups) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* There are no group restrictions, so just return
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * here with whatever we've decided.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* Now get a list of this user's groups and check those against the
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * simple_allow_groups list.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen ret = sysdb_search_user_by_name(tmp_ctx, ctx->sysdb,
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen DEBUG(1, ("Could not look up username [%s]: [%d][%s]\n",
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen /* Construct a list of the user's groups */
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen el = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen /* Get the groups from the memberOf entries
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen * Allocate the array with room for both the NULL
4a0641e1ff10f0b0299fd36baf38057c54268e48Timo Sirainen * terminator and the primary group
4a0641e1ff10f0b0299fd36baf38057c54268e48Timo Sirainen groups = talloc_array(tmp_ctx, char *, el->num_values + 2);
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* User is not a member of any groups except primary */
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* Get the user's primary group */
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0);
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen ret = sysdb_search_group_by_gid(tmp_ctx, ctx->sysdb,
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen DEBUG(1, ("Could not look up primary group [%lu]: [%d][%s]\n",
9ddd3d7d8651985e373a6c48e0ddc76b8a4ef1c7Timo Sirainen /* We have to treat this as non-fatal, because the primary
9ddd3d7d8651985e373a6c48e0ddc76b8a4ef1c7Timo Sirainen * group may be local to the machine and not available in
9ddd3d7d8651985e373a6c48e0ddc76b8a4ef1c7Timo Sirainen * our ID provider.
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen primary_group = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen groups[j] = talloc_strdup(tmp_ctx, primary_group);
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* Now process allow and deny group rules
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * If access was already granted above, we'll skip
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen * this redundant rule check
7c849dbc7be089175c1a83a84ee7249ed695810dTimo Sirainen for(j = 0; groups[j]; j++) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen if (string_equal(cs, groups[j], ctx->allow_groups[i])) {
9137c55411aa39d41c1e705ddc34d5bd26c65021Timo Sirainen /* If any group has matched, we can skip out on the
3b8d05391336c0e4d24c8ddcc962f350409ffbd3Timo Sirainen * processing early
matched = false;
for(j = 0; groups[j]; j++) {
matched = true;
if (matched) {
*access_granted = false;
done:
return ret;
int ret;
bool access_granted = false;
goto done;
struct simple_ctx);
goto done;
if (access_granted) {
done:
void **pvt_data)
return ENOMEM;
goto failed;
goto failed;
goto failed;
goto failed;
return EOK;
return ret;