sysdb_sudo.c revision 9675bccabff4e79d224f64611ad9ff3e073b488e
/*
Authors:
Jakub Hrozek <jhrozek@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#define _XOPEN_SOURCE
#include <talloc.h>
#include <time.h>
#include "db/sysdb_private.h"
#include "db/sysdb_sudo.h"
if (!val) { \
goto label; \
} \
} while(0)
/* ==================== Utility functions ==================== */
{
/* SUDO requires times to be in generalized time format:
* YYYYMMDDHHMMSS[.|,fraction][(+|-HHMM)|Z]
*
* We need to use more format strings to parse this with strptime().
*/
"%Y%m%d%H%M%S%z", /* 201212121300+-0200 */
"%Y%m%d%H%M%S.0Z",
"%Y%m%d%H%M%S.0%z",
"%Y%m%d%H%M%S,0Z",
"%Y%m%d%H%M%S,0%z",
NULL};
return EOK;
}
}
return EINVAL;
}
bool *result)
{
int i;
*result = false;
name = "<missing>";
goto done;
}
/*
* From man sudoers.ldap:
*
* If multiple sudoNotBefore entries are present, the *earliest* is used.
* If multiple sudoNotAfter entries are present, the *last one* is used.
*
* From sudo sources, ldap.c:
* If either the sudoNotAfter or sudoNotBefore attributes are missing,
* no time restriction shall be imposed.
*/
/* check for sudoNotBefore */
("notBefore attribute is missing, the rule [%s] is valid\n",
name));
*result = true;
goto done;
goto done;
}
for (i=0; values[i] ; i++) {
name));
goto done;
}
/* Grab the earliest */
if (!notBefore) {
}
}
/* check for sudoNotAfter */
("notAfter attribute is missing, the rule [%s] is valid\n",
name));
*result = true;
goto done;
goto done;
}
for (i=0; values[i] ; i++) {
name));
goto done;
}
/* Grab the latest */
if (!notAfter) {
}
}
*result = true;
}
done:
return ret;
}
struct sysdb_attrs **in_rules,
struct sysdb_attrs ***_rules)
{
bool allowed = false;
int i;
if (now == 0) {
}
for (i = 0; i < in_num_rules; i++) {
num_rules++;
}
}
*_num_rules = num_rules;
done:
return ret;
}
char **_filter)
{
char *specific_filter = NULL;
int i;
/* build specific filter */
if (flags & SYSDB_SUDO_FILTER_INCLUDE_ALL) {
}
if (flags & SYSDB_SUDO_FILTER_INCLUDE_DFL) {
}
username);
}
(unsigned long long) uid);
}
for (i=0; groupnames[i] != NULL; i++) {
groupnames[i]);
}
}
if (flags & SYSDB_SUDO_FILTER_NGRS) {
}
/* build global filter */
if (specific_filter[0] != '\0') {
}
if (flags & SYSDB_SUDO_FILTER_ONLY_EXPIRED) {
SYSDB_CACHE_EXPIRE, (long long)now);
}
done:
return ret;
}
char ***groupnames)
{
struct ldb_message *msg;
char **sysdb_groupnames = NULL;
const char *primary_group = NULL;
struct ldb_message_element *groups;
size_t num_groups = 0;
int i;
const char *attrs[] = { SYSDB_MEMBEROF,
NULL };
const char *group_attrs[] = { SYSDB_NAME,
NULL };
goto done;
}
if (!uid) {
goto done;
}
}
/* resolve secondary groups */
if (groupnames != NULL) {
/* No groups for this user in sysdb currently */
num_groups = 0;
} else {
/* Get a list of the groups by groupname only */
for (i = 0; i < groups->num_values; i++) {
&sysdb_groupnames[i]);
goto done;
}
}
}
}
/* resolve primary group */
if (gid != 0) {
group_attrs, &group_msg);
NULL);
if (primary_group == NULL) {
goto done;
}
num_groups++;
char *, num_groups + 1);
goto done;
}
}
}
if (groupnames != NULL) {
}
done:
return ret;
}
const char *rule_name,
struct sysdb_attrs *attrs)
{
return ret;
}
return ret;
}
return ret;
}
return EOK;
}
const char *attr_name,
{
int lret;
if (!tmp_ctx) {
goto done;
}
if (!dn) {
goto done;
}
if (lret != LDB_SUCCESS) {
goto done;
}
goto done;
}
if (lret != LDB_SUCCESS) {
goto done;
}
("Got more than one reply for base search!\n"));
goto done;
} else {
if (lret != LDB_SUCCESS) {
goto done;
}
}
if (lret != LDB_SUCCESS) {
goto done;
}
} else {
}
done:
return ret;
}
const char *attr_name,
{
struct ldb_result *res;
int lret;
return ENOMEM;
}
if (!dn) {
goto done;
}
if (lret != LDB_SUCCESS) {
goto done;
}
/* This entry has not been populated in LDB
* This is a common case, as unlike LDAP,
* LDB does not need to have all of its parent
* objects actually exist.
*/
*value = 0;
goto done;
("Got more than one reply for base search!\n"));
goto done;
}
done:
return ret;
}
{
value);
}
{
value);
}
/* ==================== Purge functions ==================== */
struct sss_domain_info *domain)
{
goto done;
}
done:
return ret;
}
const char *name)
{
}
struct sss_domain_info *domain,
const char *filter)
{
struct ldb_message **msgs;
const char *name;
int i;
bool in_transaction = false;
const char *attrs[] = { SYSDB_OBJECTCLASS,
NULL };
/* just purge all if there's no filter */
if (!filter) {
}
/* match entries based on the filter and remove them one by one */
goto done;
goto done;
}
goto done;
}
in_transaction = true;
for (i = 0; i < count; i++) {
/* skip this one but still delete other entries */
continue;
}
goto done;
}
}
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}