ipa_access.c revision 697160f588c509982e9b504ecb857cea7dd308a5
/*
SSSD
IPA Backend Module -- Access control
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2009 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_access.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_hbac.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_hbac_rules.h"
{
/* destroy HBAC context now to release all used resources and LDAP connection */
} else {
}
}
enum hbac_result {
HBAC_ALLOW = 1,
};
enum check_result {
RULE_APPLICABLE = 0,
};
{
struct ipa_access_ctx *ipa_access_ctx;
struct tevent_req *req;
struct ipa_access_ctx);
/* First, verify that this account isn't locked.
* We need to do this in case the auth phase was
* skipped (such as during GSSAPI single-sign-on
* or SSH public key exchange.
*/
pd);
if (!req) {
return;
}
}
{
const char *deny_method;
int pam_status = PAM_SYSTEM_ERR;
struct ipa_access_ctx *ipa_access_ctx;
int ret;
switch(pam_status) {
case PAM_SUCCESS:
/* Account wasn't locked. Continue below
* to HBAC processing.
*/
break;
case PAM_PERM_DENIED:
/* Account was locked. Return permission denied
* here.
*/
return;
default:
/* We got an unexpected error. Return it as-is */
return;
}
goto fail;
}
struct ipa_access_ctx);
goto fail;
}
hbac_ctx->get_deny_rules = false;
} else {
hbac_ctx->get_deny_rules = true;
}
goto fail;
}
return;
fail:
if (hbac_ctx) {
/* Return an proper error */
} else {
}
}
{
struct tevent_req *subreq;
int ret;
bool offline;
/* Simulate offline mode and just go to the cache */
offline = true;
}
if (!offline) {
return EIO;
}
}
if (!subreq) {
return ret;
}
} else {
/* Evaluate the rules based on what we have in the
* sysdb
*/
return EOK;
}
return EOK;
}
{
if (dp_error == DP_ERR_OFFLINE) {
/* switching to offline mode */
return;
goto fail;
}
goto fail;
}
return;
fail:
}
{
hbac_ctx->host_count = 0;
hbac_ctx->hostgroup_count = 0;
hbac_ctx->service_count = 0;
hbac_ctx->servicegroup_count = 0;
hbac_ctx->rule_count = 0;
}
/* Check the step result code and continue, retry, get offline result or abort accordingly */
{
int dp_error;
return true;
}
if (hbac_ctx_is_offline(hbac_ctx)) {
/* already offline => the error is fatal */
return false;
}
if (dp_error == DP_ERR_OFFLINE) {
/* switching to offline mode */
/* Free any of the results we've gotten */
}
/* retry */
return false;
}
}
}
return false;
}
{
const char *hostname;
struct tevent_req *req;
/* Support srchost
* -> we don't want any particular host,
* we want all hosts
*/
} else {
}
return ENOMEM;
}
return EOK;
}
{
&hbac_ctx->hostgroups);
return;
}
/* Get services and service groups */
goto fail;
}
return;
fail:
}
{
size_t i;
const char *ipa_hostname;
const char *hostname;
return;
}
/* Get the ipa_host attrs */
if (ipa_hostname == NULL) {
goto fail;
}
for (i = 0; i < hbac_ctx->host_count; i++) {
&hostname);
goto fail;
}
break;
}
}
goto fail;
}
/* Get the list of applicable rules */
goto fail;
}
return;
fail:
}
{
bool in_transaction = false;
struct ipa_access_ctx *access_ctx =
struct ipa_access_ctx);
/* No rules were found that apply to this
* host.
*/
return;
}
/* Delete any rules in the sysdb so offline logins
* are also denied.
*/
return;
}
return;
}
/* If no rules are found, we default to DENY */
return;
}
return;
}
DEBUG(0, ("Could not start transaction\n"));
goto fail;
}
in_transaction = true;
/* Save the hosts */
goto fail;
}
/* Save the services */
goto fail;
}
/* Save the rules */
goto fail;
}
goto fail;
}
in_transaction = false;
/* We don't need the rule data any longer,
* the rest of the processing relies on
* sysdb lookups.
*/
/* Now evaluate the request against the rules */
return;
fail:
if (in_transaction) {
DEBUG(0, ("Could not cancel transaction\n"));
}
}
}
{
struct hbac_rule **hbac_rules;
struct hbac_eval_req *eval_req;
enum hbac_eval_result result;
/* Get HBAC rules from the sysdb */
}
&hbac_rules, &eval_req);
return;
return;
}
if (result == HBAC_EVAL_ALLOW) {
return;
} else if (result == HBAC_EVAL_ERROR) {
return;
} else if (result == HBAC_EVAL_OOM) {
return;
}
}
struct sss_domain_info *domain,
struct sysdb_attrs ***_rules)
{
struct ldb_message **msgs;
struct sysdb_attrs **rules;
char *filter;
const char *attrs[] = { OBJECTCLASS,
NULL };
goto done;
}
&rule_count, &msgs);
goto done;
rule_count = 0;
}
goto done;
}
done:
return ret;
}