3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek#include "util/util.h"

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek#include "tools/common/sss_tools.h"

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek#include "tools/sssctl/sssctl.h"

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina#include "sbus/sssd_dbus.h"

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina#include "responder/ifp/ifp_iface.h"

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek#include "providers/ipa/ipa_hbac_private.h"

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek#include "providers/ipa/ipa_rules_common.h"

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozektypedef errno_t (*sssctl_dom_access_reporter_fn)(struct sss_tool_ctx *tool_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct sss_domain_info *domain);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic errno_t get_rdn_value(TALLOC_CTX *mem_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct sss_domain_info *dom,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *dn_attr,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char **_rdn_value)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek errno_t ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek TALLOC_CTX *tmp_ctx;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_dn *dn = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const struct ldb_val *rdn_val;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *rdn_str;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek tmp_ctx = talloc_new(NULL);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (tmp_ctx == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek dn = ldb_dn_new(tmp_ctx, sysdb_ctx_get_ldb(dom->sysdb), dn_attr);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (dn == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rdn_val = ldb_dn_get_rdn_val(dn);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (rdn_val == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "No RDN value?\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rdn_str = talloc_strndup(tmp_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek (const char *)rdn_val->data,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rdn_val->length);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (rdn_str == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = EOK;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek *_rdn_value = talloc_steal(mem_ctx, rdn_str);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekdone:

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek talloc_zfree(tmp_ctx);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic errno_t is_member_group(struct sss_domain_info *dom,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *dn_attr,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *group_rdn,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek bool *_is_group)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *comp_name;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const struct ldb_val *comp_val;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek TALLOC_CTX *tmp_ctx;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek bool is_group = false;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek errno_t ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_dn *dn = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek tmp_ctx = talloc_new(NULL);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (tmp_ctx == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek dn = ldb_dn_new(tmp_ctx, sysdb_ctx_get_ldb(dom->sysdb), dn_attr);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (dn == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek comp_name = ldb_dn_get_component_name(dn, 1);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek comp_val = ldb_dn_get_component_val(dn, 1);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (strcasecmp("cn", comp_name) == 0

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek && strncasecmp(group_rdn,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek (const char *) comp_val->data,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek comp_val->length) == 0) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek is_group = true;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = EOK;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekdone:

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek *_is_group = is_group;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek talloc_zfree(tmp_ctx);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic void print_category(struct sss_domain_info *domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message *rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *category_attr_name,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *category_label)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message_element *category_attr;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek category_attr = ldb_msg_find_element(rule_msg, category_attr_name);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (category_attr == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE, "Cannot find %s\n", category_attr_name);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (category_attr->num_values > 0) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\t%s: ", category_label);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek for (unsigned i = 0; i < category_attr->num_values; i++) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("%s%s",

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek i > 0 ? ", " : "",

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek (const char *) category_attr->values[i].data);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic void print_member_attr(struct sss_domain_info *domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message *rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *member_attr_name,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *group_rdn,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *object_label,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *group_label)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek errno_t ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek TALLOC_CTX *tmp_ctx = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char **member_names = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek size_t name_count = 0;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char **member_group_names = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek size_t group_count = 0;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message_element *member_attr = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek tmp_ctx = talloc_new(NULL);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (tmp_ctx == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_attr = ldb_msg_find_element(rule_msg, member_attr_name);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_attr == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE, "Cannot find %s\n", member_attr_name);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_names = talloc_zero_array(tmp_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_attr->num_values + 1);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_group_names = talloc_zero_array(tmp_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_attr->num_values + 1);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_names == NULL || member_group_names == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "OOM?\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek for (size_t i = 0; i < member_attr->num_values; i++) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek bool is_group;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *rdn_string;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *dn_attr;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek dn_attr = (const char *) member_attr->values[i].data;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = is_member_group(domain, dn_attr, group_rdn, &is_group);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (ret != EOK) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek continue;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = get_rdn_value(tmp_ctx, domain, dn_attr, &rdn_string);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (ret != EOK) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek continue;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (is_group == false) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_names[name_count] = talloc_steal(member_names,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rdn_string);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_names[name_count] == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek name_count++;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek } else {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek member_group_names[group_count] = talloc_strdup(member_group_names,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rdn_string);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_group_names[group_count] == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek group_count++;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_names[0] != NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\t%s: ", object_label);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek for (int i = 0; member_names[i]; i++) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("%s%s", i > 0 ? ", " : "", member_names[i]);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (member_group_names[0] != NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\t%s: ", group_label);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek for (int i = 0; member_group_names[i]; i++) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("%s%s", i > 0 ? ", " : "", member_group_names[i]);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekdone:

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek talloc_free(tmp_ctx);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic void print_ipa_hbac_rule(struct sss_domain_info *domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message *rule_msg)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message_element *el;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek el = ldb_msg_find_element(rule_msg, IPA_CN);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (el == NULL || el->num_values < 1) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE, "A rule with no name\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("Rule name: %1$s\n", el->values[0].data);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek print_member_attr(domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_MEMBER_USER,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek "groups",

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("Member users"),

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("Member groups"));

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek print_category(domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_USER_CATEGORY,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("User category"));

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek print_member_attr(domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_MEMBER_SERVICE,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek "hbacservicegroups",

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("Member services"),

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("Member service groups"));

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek print_category(domain,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek rule_msg,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_SERVICE_CATEGORY,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek _("Service category"));

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březinastatic errno_t refresh_hbac_rules(struct sss_tool_ctx *tool_ctx,

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina struct sss_domain_info *domain)

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina{

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina TALLOC_CTX *tmp_ctx;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina sss_sifp_error error;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina sss_sifp_ctx *sifp;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina DBusMessage *reply;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina const char *path;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina errno_t ret;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina tmp_ctx = talloc_new(NULL);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (tmp_ctx == NULL) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina return ENOMEM;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina }

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina path = sbus_opath_compose(tmp_ctx, IFP_PATH_DOMAINS, domain->name);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (path == NULL) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina printf(_("Out of memory!\n"));

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = ENOMEM;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina goto done;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina }

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina error = sssctl_sifp_init(tool_ctx, &sifp);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (error != SSS_SIFP_OK) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina sssctl_sifp_error(sifp, error, "Unable to connect to the InfoPipe");

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = EIO;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina goto done;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina }

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina error = sssctl_sifp_send(tmp_ctx, sifp, &reply, path,

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina IFACE_IFP_DOMAINS_DOMAIN,

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina IFACE_IFP_DOMAINS_DOMAIN_REFRESHACCESSRULES);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (error != SSS_SIFP_OK) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina sssctl_sifp_error(sifp, error, "Unable to refresh HBAC rules");

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = EIO;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina goto done;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina }

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = sbus_parse_reply(reply);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (ret != EOK) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina goto done;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina }

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = EOK;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březinadone:

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina talloc_free(tmp_ctx);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina return ret;

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina}

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekstatic errno_t sssctl_ipa_access_report(struct sss_tool_ctx *tool_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct sss_domain_info *domain)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek TALLOC_CTX *tmp_ctx = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *filter = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek errno_t ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *attrs[] = {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek OBJECTCLASS,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_CN,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_MEMBER_USER,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_USER_CATEGORY,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_MEMBER_SERVICE,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_SERVICE_CATEGORY,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_MEMBER_HOST,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek IPA_HOST_CATEGORY,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek NULL,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek };

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek size_t rule_count;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct ldb_message **msgs = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek /* Run the pam account phase to make sure the rules are fetched by SSSD */

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = refresh_hbac_rules(tool_ctx, domain);

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina if (ret != EOK) {

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ERROR("Unable to refresh HBAC rules, using cached content\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek /* Non-fatal */

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek tmp_ctx = talloc_new(tool_ctx);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (tmp_ctx == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek filter = talloc_asprintf(tmp_ctx, "(objectClass=%s)", IPA_HBAC_RULE);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (filter == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = ENOMEM;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = sysdb_search_custom(tmp_ctx, domain, filter,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek HBAC_RULES_SUBDIR, attrs,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek &rule_count, &msgs);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (ret != EOK && ret != ENOENT) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up HBAC rules\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (ret == ENOENT) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("No cached rules. All users will be denied access\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = EOK;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek goto done;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek PRINT("%1$zu rules cached\n\n", rule_count);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek for (size_t i = 0; i < rule_count; i++) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek print_ipa_hbac_rule(domain, msgs[i]);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ret = EOK;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekdone:

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek talloc_zfree(tmp_ctx);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozeksssctl_dom_access_reporter_fn get_report_fn(const char *provider)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (strcmp(provider, "ipa") == 0) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return sssctl_ipa_access_report;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozekerrno_t sssctl_access_report(struct sss_cmdline *cmdline,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct sss_tool_ctx *tool_ctx,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek void *pvt)

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek{

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek errno_t ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek const char *domname = NULL;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek sssctl_dom_access_reporter_fn reporter;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek struct sss_domain_info *dom;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina ret = sss_tool_popt_ex(cmdline, NULL, SSS_TOOL_OPT_OPTIONAL,

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek NULL, NULL, "DOMAIN", _("Specify domain name."),

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek &domname, NULL);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (ret != EOK) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "Unable to parse command arguments\n");

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek dom = find_domain_by_name(tool_ctx->domains, domname, true);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (dom == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ERROR("Cannot find domain %1$s\n", domname);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ERR_DOMAIN_NOT_FOUND;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek reporter = get_report_fn(dom->provider);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek if (reporter == NULL) {

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek ERROR("Access report not implemented for domains of type %1$s\n",

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek dom->provider);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek return ret;

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek }

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek

be804178d5e5fee64be2b080e73f4ce7b0074f76Pavel Březina return reporter(tool_ctx, dom);

3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8Jakub Hrozek}