responder/sudo/sudosrv_get_sudorules.c

	sudosrv_get_sudorules.c revision 898eb701893c3df1bd9f536c47555db39a10667c
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina/*
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    Authors:
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina        Pavel Březina <pbrezina@redhat.com>
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina        Jakub Hrozek <jhrozek@redhat.com>
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    Copyright (C) 2011 Red Hat
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    This program is free software; you can redistribute it and/or modify
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    it under the terms of the GNU General Public License as published by
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    the Free Software Foundation; either version 3 of the License, or
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    (at your option) any later version.
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    This program is distributed in the hope that it will be useful,
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    but WITHOUT ANY WARRANTY; without even the implied warranty of
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    GNU General Public License for more details.
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    You should have received a copy of the GNU General Public License
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    along with this program.  If not, see <http://www.gnu.org/licenses/>.
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina*/
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
c9b2b7f3f02bf40b698c70640f151d0113736195Jakub Hrozek#include "config.h"
c9b2b7f3f02bf40b698c70640f151d0113736195Jakub Hrozek
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include <stdint.h>
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include <string.h>
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include <talloc.h>
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include "util/util.h"
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include "db/sysdb_sudo.h"
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina#include "responder/sudo/sudosrv_private.h"
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic errno_t sudosrv_get_user(struct sudo_dom_ctx *dctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březinaerrno_t sudosrv_get_sudorules(struct sudo_dom_ctx *dctx)
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dctx->check_provider = true;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sudosrv_get_user(dctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == EAGAIN) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_TRACE_INTERNAL,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Looking up the user info from Data Provider\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return EAGAIN;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Error looking up user information [%d]: %s\n", ret, strerror(ret)));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    /* OK, got the user from cache. Try to get the rules. */
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    ret = sudosrv_get_rules(dctx->cmd_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == EAGAIN) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_TRACE_INTERNAL,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Looking up the sudo rules from Data Provider\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return EAGAIN;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Error looking up sudo rules [%d]: %s\n", ret, strerror(ret)));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    return EOK;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic void sudosrv_dp_send_acct_req_done(struct tevent_req *req);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic void sudosrv_check_user_dp_callback(uint16_t err_maj, uint32_t err_min,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                           const char *err_msg, void *ptr);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic errno_t sudosrv_get_user(struct sudo_dom_ctx *dctx)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    TALLOC_CTX *tmp_ctx = NULL;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sss_domain_info *dom = dctx->domain;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sudo_cmd_ctx *cmd_ctx = dctx->cmd_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct cli_ctx *cli_ctx = dctx->cmd_ctx->cli_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sysdb_ctx *sysdb;
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina    struct ldb_result *user;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    time_t cache_expire = 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct tevent_req *dpreq;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct dp_callback_ctx *cb_ctx;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    const char *original_name = NULL;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    char *name = NULL;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina    uid_t uid = 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    tmp_ctx = talloc_new(NULL);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    if (tmp_ctx == NULL) {
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        return ENOMEM;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    }
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    while (dom) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek       /* if it is a domainless search, skip domains that require fully
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        * qualified names instead */
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        while (dom && cmd_ctx->check_next && dom->fqnames) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            dom = dom->next;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        if (!dom) break;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        /* make sure to update the dctx if we changed domain */
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        dctx->domain = dom;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        talloc_free(name);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        name = sss_get_cased_name(tmp_ctx, cmd_ctx->username,
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                                  dom->case_sensitive);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        if (name == NULL) {
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = ENOMEM;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        }
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_FUNC_DATA, ("Requesting info about [%s@%s]\n",
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina              name, dom->name));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
b7b50b21d2254a079b1b1c299909483d23db1512Sumit Bose        sysdb = dctx->domain->sysdb;
b7b50b21d2254a079b1b1c299909483d23db1512Sumit Bose        if (sysdb == NULL) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek             DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                   ("sysdb context not found for this domain!\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina             ret = EIO;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina             goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        ret = sysdb_getpwnam(dctx, sysdb, name, &user);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                  ("Failed to make request to our cache!\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = EIO;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        if (user->count > 1) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                  ("getpwnam call returned more than one result !?!\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = EIO;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        if (user->count == 0 && !dctx->check_provider) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            /* if a multidomain search, try with next */
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            if (cmd_ctx->check_next) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                dctx->check_provider = true;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                dom = dom->next;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                if (dom) continue;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            DEBUG(SSSDBG_MINOR_FAILURE, ("No results for getpwnam call\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = ENOENT;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        /* One result found, check cache expiry */
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        if (user->count == 1) {
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina            cache_expire = ldb_msg_find_attr_as_uint64(user->msgs[0],
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                       SYSDB_CACHE_EXPIRE, 0);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        /* If cache miss and we haven't checked DP yet OR the entry is
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek         * outdated, go to DP */
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        if ((user->count == 0 || cache_expire < time(NULL))
699cb9781f64796af68ea620fd4952d47ac0d64aPavel Březina            && dctx->check_provider) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            dpreq = sss_dp_get_account_send(cli_ctx, cli_ctx->rctx,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                            dom, false, SSS_DP_INITGROUPS,
0c7aa697991ea9df960fae14fd567ebdda3b4ff4Stephen Gallagher                                            cmd_ctx->username, 0, NULL);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            if (!dpreq) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                      ("Out of memory sending data provider request\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                ret = ENOMEM;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            cb_ctx = talloc_zero(cli_ctx, struct dp_callback_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            if(!cb_ctx) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                talloc_zfree(dpreq);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                ret = ENOMEM;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            cb_ctx->callback = sudosrv_check_user_dp_callback;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            cb_ctx->ptr = dctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            cb_ctx->cctx = cli_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            cb_ctx->mem_ctx = cli_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            tevent_req_set_callback(dpreq, sudosrv_dp_send_acct_req_done, cb_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            /* tell caller we are in an async call */
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = EAGAIN;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        }
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina        /* check uid */
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina        uid = ldb_msg_find_attr_as_int(user->msgs[0], SYSDB_UIDNUM, 0);
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina        if (uid != cmd_ctx->uid) {
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            /* if a multidomain search, try with next */
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            if (cmd_ctx->check_next) {
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                dctx->check_provider = true;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                dom = dom->next;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                if (dom) continue;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            }
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            DEBUG(SSSDBG_MINOR_FAILURE, ("UID does not match\n"));
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            ret = ENOENT;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            goto done;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina        }
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        /* user is stored in cache, remember cased and original name */
744dff21cc626efdc646dd293c97c6a19a9f6ed5Pavel Březina        original_name = ldb_msg_find_attr_as_string(user->msgs[0],
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina                                                    SYSDB_NAME, NULL);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        if (name == NULL) {
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, ("A user with no name?\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = EFAULT;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        }
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        cmd_ctx->cased_username = talloc_move(cmd_ctx, &name);
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        cmd_ctx->orig_username = talloc_strdup(cmd_ctx, original_name);
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        if (cmd_ctx->orig_username == NULL) {
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            ret = ENOMEM;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina            goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        /* and set domain */
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        cmd_ctx->domain = dom;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_TRACE_FUNC, ("Returning info for user [%s@%s]\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              cmd_ctx->username, dctx->domain->name));
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        ret = EOK;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    ret = ENOENT;
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březinadone:
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    talloc_free(tmp_ctx);
278284224aa10805d58c978977e43b1d1126f9b1Pavel Březina    return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic void sudosrv_dp_send_acct_req_done(struct tevent_req *req)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct dp_callback_ctx *cb_ctx =
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek            tevent_req_callback_data(req, struct dp_callback_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dbus_uint16_t err_maj;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dbus_uint32_t err_min;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    char *err_msg;
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sss_dp_get_account_recv(cb_ctx->mem_ctx, req,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                  &err_maj, &err_min,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                  &err_msg);
9d1d6019a27a0ed70a665700a9f6acc55f874811Stephen Gallagher    talloc_zfree(req);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Fatal error, killing connection!\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        talloc_free(cb_ctx->cctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    cb_ctx->callback(err_maj, err_min, err_msg, cb_ctx->ptr);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic void sudosrv_check_user_dp_callback(uint16_t err_maj, uint32_t err_min,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                           const char *err_msg, void *ptr)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sudo_dom_ctx *dctx = talloc_get_type(ptr, struct sudo_dom_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (err_maj) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek             ("Unable to get information from Data Provider\n"
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              "Error: %u, %u, %s\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              (unsigned int)err_maj, (unsigned int)err_min, err_msg));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    DEBUG(SSSDBG_TRACE_INTERNAL,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek          ("Data Provider returned, check the cache again\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dctx->check_provider = false;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sudosrv_get_user(dctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == EAGAIN) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Could not look up the user [%d]: %s\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ret, strerror(ret)));
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina        sudosrv_cmd_done(dctx->cmd_ctx, ret);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    DEBUG(SSSDBG_TRACE_INTERNAL, ("Looking up sudo rules..\n"));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    ret = sudosrv_get_rules(dctx->cmd_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == EAGAIN) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Error getting sudo rules [%d]: %s\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ret, strerror(ret)));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        sudosrv_cmd_done(dctx->cmd_ctx, EIO);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekdone:
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    sudosrv_cmd_done(dctx->cmd_ctx, ret);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březinastatic errno_t sudosrv_get_sudorules_from_cache(struct sudo_cmd_ctx *cmd_ctx,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                                size_t *_num_rules);
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozekstatic void
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozeksudosrv_get_sudorules_dp_callback(uint16_t err_maj, uint32_t err_min,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek                                  const char *err_msg, void *ptr);
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozekstatic void
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozeksudosrv_dp_req_done(struct tevent_req *req);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březinastatic errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 struct sysdb_ctx *sysdb,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 enum sss_dp_sudo_type type,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 const char **attrs,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 unsigned int flags,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 const char *username,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 uid_t uid,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 char **groupnames,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 struct sysdb_attrs ***_rules,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                                 size_t *_count);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březinaerrno_t sudosrv_get_rules(struct sudo_cmd_ctx *cmd_ctx)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    TALLOC_CTX *tmp_ctx = NULL;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    struct tevent_req *dpreq = NULL;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    struct dp_callback_ctx *cb_ctx = NULL;
29bf02dbdd8168d7be04f4f15cff4321833a71c4Stephen Gallagher    struct sysdb_ctx *sysdb;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    char **groupnames = NULL;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    size_t expired_rules_num = 0;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    struct sysdb_attrs **expired_rules = NULL;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    errno_t ret;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    unsigned int flags = SYSDB_SUDO_FILTER_NONE;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    const char *attrs[] = { SYSDB_NAME,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                            NULL };
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (cmd_ctx->domain == NULL) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, ("Domain is not set!\n"));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        return EFAULT;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
29bf02dbdd8168d7be04f4f15cff4321833a71c4Stephen Gallagher    sysdb = cmd_ctx->domain->sysdb;
29bf02dbdd8168d7be04f4f15cff4321833a71c4Stephen Gallagher
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    tmp_ctx = talloc_new(NULL);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (tmp_ctx == NULL) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        return ENOMEM;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina    switch (cmd_ctx->type) {
76db25eab9010a33657f35e5afc8477c996df7a3Pavel Březina        case SSS_SUDO_DEFAULTS:
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            DEBUG(SSSDBG_TRACE_FUNC, ("Retrieving default options "
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                  "for [%s] from [%s]\n", cmd_ctx->orig_username,
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                  cmd_ctx->domain->name));
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            break;
76db25eab9010a33657f35e5afc8477c996df7a3Pavel Březina        case SSS_SUDO_USER:
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            DEBUG(SSSDBG_TRACE_FUNC, ("Retrieving rules "
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                  "for [%s] from [%s]\n", cmd_ctx->orig_username,
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                  cmd_ctx->domain->name));
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina            break;
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina    }
41ef946f3f74a46b9e26118116e4811e259b30efPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    /* Fetch all expired rules:
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina     * sudo asks sssd twice - for defaults and for rules. If we refresh all
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina     * expired rules for this user and defaults at once we will save one
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina     * provider call
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina     */
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    ret = sysdb_get_sudo_user_info(tmp_ctx, cmd_ctx->orig_username, sysdb,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                   NULL, &groupnames);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina             ("Unable to retrieve user info [%d]: %s\n", strerror(ret)));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    flags =   SYSDB_SUDO_FILTER_INCLUDE_ALL
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            | SYSDB_SUDO_FILTER_INCLUDE_DFL
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            | SYSDB_SUDO_FILTER_ONLY_EXPIRED
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            | SYSDB_SUDO_FILTER_USERINFO;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    ret = sudosrv_get_sudorules_query_cache(tmp_ctx, sysdb, cmd_ctx->type,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                            attrs, flags, cmd_ctx->orig_username,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                            cmd_ctx->uid, groupnames,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                            &expired_rules, &expired_rules_num);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (ret != EOK) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina             ("Unable to retrieve expired sudo rules [%d]: %s\n", strerror(ret)));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        goto done;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    }
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    cmd_ctx->expired_rules_num = expired_rules_num;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (expired_rules_num > 0) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        /* refresh expired rules then continue */
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        DEBUG(SSSDBG_TRACE_INTERNAL, ("Refreshing expired rules\n"));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        dpreq = sss_dp_get_sudoers_send(tmp_ctx, cmd_ctx->cli_ctx->rctx,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                        cmd_ctx->domain, false,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                        SSS_DP_SUDO_REFRESH_RULES,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                        cmd_ctx->orig_username,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                                        expired_rules_num, expired_rules);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        if (dpreq == NULL) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            DEBUG(SSSDBG_CRIT_FAILURE,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                  ("Cannot issue DP request.\n"));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            ret = EIO;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            goto done;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        cb_ctx = talloc_zero(tmp_ctx, struct dp_callback_ctx);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        if (!cb_ctx) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            talloc_zfree(dpreq);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            ret = ENOMEM;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            goto done;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        cb_ctx->callback = sudosrv_get_sudorules_dp_callback;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        cb_ctx->ptr = cmd_ctx;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        cb_ctx->cctx = cmd_ctx->cli_ctx;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        cb_ctx->mem_ctx = cmd_ctx;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        tevent_req_set_callback(dpreq, sudosrv_dp_req_done, cb_ctx);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        ret = EAGAIN;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    } else {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        /* nothing is expired return what we have in the cache */
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        DEBUG(SSSDBG_TRACE_INTERNAL, ("About to get sudo rules from cache\n"));
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        ret = sudosrv_get_sudorules_from_cache(cmd_ctx, NULL);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        if (ret != EOK) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            DEBUG(SSSDBG_OP_FAILURE,
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                  ("Failed to make a request to our cache [%d]: %s\n",
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina                   ret, strerror(ret)));
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina            goto done;
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (dpreq != NULL) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        talloc_steal(cmd_ctx->cli_ctx, dpreq);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    }
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    if (cb_ctx != NULL) {
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina        talloc_steal(cmd_ctx, cb_ctx);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    }
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březinadone:
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    talloc_free(tmp_ctx);
010c35e66398bbeb82fb1b31fc619b1a9eaf2d3dPavel Březina    return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozekstatic void
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozeksudosrv_dp_req_done(struct tevent_req *req)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    struct dp_callback_ctx *cb_ctx =
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek        tevent_req_callback_data(req, struct dp_callback_ctx);
898eb701893c3df1bd9f536c47555db39a10667cStephen Gallagher    struct cli_ctx *cli_ctx;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dbus_uint16_t err_maj;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    dbus_uint32_t err_min;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    char *err_msg;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    if (cb_ctx == NULL) {
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        /* we are not interested in returned values */
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        talloc_free(req);
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        return;
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    }
898eb701893c3df1bd9f536c47555db39a10667cStephen Gallagher    cli_ctx = talloc_get_type(cb_ctx->cctx, struct cli_ctx);
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    ret = sss_dp_get_sudoers_recv(cb_ctx->mem_ctx, req,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek                                  &err_maj, &err_min,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek                                  &err_msg);
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    talloc_free(req);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, ("Fatal error, killing connection!\n"));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        talloc_free(cli_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    cb_ctx->callback(err_maj, err_min, err_msg, cb_ctx->ptr);
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek}
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozekstatic void
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozeksudosrv_get_sudorules_dp_callback(uint16_t err_maj, uint32_t err_min,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek                                  const char *err_msg, void *ptr)
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek{
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    struct sudo_cmd_ctx *cmd_ctx = talloc_get_type(ptr, struct sudo_cmd_ctx);
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    struct tevent_req *dpreq = NULL;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    errno_t ret;
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    size_t num_rules;
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    if (err_maj) {
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek              ("Unable to get information from Data Provider\n"
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek               "Error: %u, %u, %s\n"
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek               "Will try to return what we have in cache\n",
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek               (unsigned int)err_maj, (unsigned int)err_min, err_msg));
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek    }
3b121852048a7931f8a608527b760963e2ed2bb4Jakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    DEBUG(SSSDBG_TRACE_INTERNAL, ("About to get sudo rules from cache\n"));
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    ret = sudosrv_get_sudorules_from_cache(cmd_ctx, &num_rules);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Failed to make a request to our cache [%d]: %s\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ret, strerror(ret)));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        sudosrv_cmd_done(cmd_ctx, EIO);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    if (cmd_ctx->expired_rules_num > 0
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        && err_min == ENOENT) {
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        DEBUG(SSSDBG_TRACE_INTERNAL,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina              ("Some expired rules were removed from the server, "
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina               "scheduling full refresh out of band\n"));
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        dpreq = sss_dp_get_sudoers_send(cmd_ctx->cli_ctx->rctx,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                        cmd_ctx->cli_ctx->rctx,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                        cmd_ctx->domain, false,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                        SSS_DP_SUDO_FULL_REFRESH,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                        cmd_ctx->orig_username,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                        0, NULL);
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        if (dpreq == NULL) {
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina            DEBUG(SSSDBG_CRIT_FAILURE,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                  ("Cannot issue DP request.\n"));
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        } else {
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina            tevent_req_set_callback(dpreq, sudosrv_dp_req_done, NULL);
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        }
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    }
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    sudosrv_cmd_done(cmd_ctx, ret);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březinastatic errno_t sudosrv_get_sudorules_from_cache(struct sudo_cmd_ctx *cmd_ctx,
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina                                                size_t *_num_rules)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    TALLOC_CTX *tmp_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sysdb_ctx *sysdb;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    char **groupnames = NULL;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    const char *debug_name = NULL;
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina    unsigned int flags = SYSDB_SUDO_FILTER_NONE;
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina    const char *attrs[] = { SYSDB_OBJECTCLASS
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_OC,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_CN,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_USER,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_HOST,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_COMMAND,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_OPTION,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_RUNASUSER,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_RUNASGROUP,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_NOTBEFORE,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_NOTAFTER,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            SYSDB_SUDO_CACHE_AT_ORDER,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                            NULL };
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    if (cmd_ctx->domain == NULL) {
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, ("Domain is not set!\n"));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        return EFAULT;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    tmp_ctx = talloc_new(NULL);
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    if (tmp_ctx == NULL) {
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        return ENOMEM;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    sysdb = cmd_ctx->domain->sysdb;
b7b50b21d2254a079b1b1c299909483d23db1512Sumit Bose    if (sysdb == NULL) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("sysdb context not found for this domain!\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        ret = EIO;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    switch (cmd_ctx->type) {
76db25eab9010a33657f35e5afc8477c996df7a3Pavel Březina    case SSS_SUDO_USER:
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        debug_name = cmd_ctx->cased_username;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        ret = sysdb_get_sudo_user_info(tmp_ctx, cmd_ctx->orig_username, sysdb,
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                                       NULL, &groupnames);
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina        if (ret != EOK) {
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE,
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina                 ("Unable to retrieve user info [%d]: %s\n", strerror(ret)));
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina            goto done;
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina        }
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina        flags = SYSDB_SUDO_FILTER_USERINFO | SYSDB_SUDO_FILTER_INCLUDE_ALL;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        break;
76db25eab9010a33657f35e5afc8477c996df7a3Pavel Březina    case SSS_SUDO_DEFAULTS:
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        debug_name = "<default options>";
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina        flags = SYSDB_SUDO_FILTER_INCLUDE_DFL;
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina        break;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina    ret = sudosrv_get_sudorules_query_cache(cmd_ctx, sysdb, cmd_ctx->type,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                                            attrs, flags, cmd_ctx->orig_username,
46d3d2c731e8c7e138462e5b60a39a279dc77d81Pavel Březina                                            cmd_ctx->uid, groupnames,
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina                                            &cmd_ctx->rules, &cmd_ctx->num_rules);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek             ("Unable to retrieve sudo rules [%d]: %s\n", strerror(ret)));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    DEBUG(SSSDBG_TRACE_FUNC, ("Returning rules for [%s@%s]\n",
b0abb3bfdfd95951a23c9fc223c735805ffd2969Pavel Březina          debug_name, cmd_ctx->domain->name));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    if (_num_rules != NULL) {
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina        *_num_rules = cmd_ctx->num_rules;
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina    }
20f82655b3a29cf0784ba5c912927d1ada1287dfPavel Březina
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = EOK;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekdone:
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    talloc_free(tmp_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic errno_t
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozeksort_sudo_rules(struct sysdb_attrs **rules, size_t count);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 struct sysdb_ctx *sysdb,
c47e9d522f0d87259e5074ea643daaa3dfcb8d92Pavel Březina                                                 enum sss_dp_sudo_type type,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                                                 const char **attrs,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                                                 unsigned int flags,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 const char *username,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 uid_t uid,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 char **groupnames,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 struct sysdb_attrs ***_rules,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                                                 size_t *_count)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    TALLOC_CTX *tmp_ctx;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    char *filter;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    errno_t ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    size_t count;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sysdb_attrs **rules;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct ldb_message **msgs;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    tmp_ctx = talloc_new(NULL);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (tmp_ctx == NULL) return ENOMEM;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sysdb_get_sudo_filter(tmp_ctx, username, uid, groupnames,
5e7ddcae402bc284d43c5ebb5d215310a5658abaPavel Březina                                flags, &filter);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Could not construct the search filter [%d]: %s\n",
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek               ret, strerror(ret)));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    DEBUG(SSSDBG_FUNC_DATA, ("Searching sysdb with [%s]\n", filter));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sysdb_search_custom(tmp_ctx, sysdb, filter,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                              SUDORULE_SUBDIR, attrs,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek                              &count, &msgs);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK && ret != ENOENT) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, ("Error looking up SUDO rules"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } if (ret == ENOENT) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek       *_rules = NULL;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek       *_count = 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek       ret = EOK;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek       goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sysdb_msg2attrs(tmp_ctx, count, msgs, &rules);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Could not convert ldb message to sysdb_attrs\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sort_sudo_rules(rules, count);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek              ("Could not sort rules by sudoOrder\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        goto done;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    *_rules = talloc_steal(mem_ctx, rules);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    *_count = count;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = EOK;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekdone:
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    talloc_free(tmp_ctx);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    return ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic int
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozeksudo_order_cmp_fn(const void *a, const void *b)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    struct sysdb_attrs *r1, *r2;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    uint32_t o1, o2;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    int ret;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    r1 = * (struct sysdb_attrs * const *) a;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    r2 = * (struct sysdb_attrs * const *) b;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (!r1 || !r2) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_CRIT_FAILURE, ("BUG: Wrong data?\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sysdb_attrs_get_uint32_t(r1, SYSDB_SUDO_CACHE_AT_ORDER, &o1);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == ENOENT) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        /* man sudoers-ldap: If the sudoOrder attribute is not present,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek         * a value of 0 is assumed */
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        o1 = 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE, ("Cannot get sudoOrder value\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    ret = sysdb_attrs_get_uint32_t(r2, SYSDB_SUDO_CACHE_AT_ORDER, &o2);
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (ret == ENOENT) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        /* man sudoers-ldap: If the sudoOrder attribute is not present,
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek         * a value of 0 is assumed */
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        o2 = 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (ret != EOK) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        DEBUG(SSSDBG_OP_FAILURE, ("Cannot get sudoOrder value\n"));
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    if (o1 > o2) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return 1;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    } else if (o1 < o2) {
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek        return -1;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    }
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    return 0;
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek}
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozekstatic errno_t
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozeksort_sudo_rules(struct sysdb_attrs **rules, size_t count)
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek{
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek    qsort(rules, count, sizeof(struct sysdb_attrs *),
20e310e32a47e861ce0c11bcd1dcf89dc78d8abaJakub Hrozek          sudo_order_cmp_fn);
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina    return EOK;
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina}