/*
SSSD
IPA Backend Module -- selinux loading
Authors:
Jan Zeleny <jzeleny@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "db/sysdb_selinux.h"
#include "util/child_common.h"
#include "util/sss_selinux.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_rules.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_maps.h"
#include "providers/ipa/ipa_subdomains.h"
#ifndef SELINUX_CHILD_DIR
#ifndef SSSD_LIBEXEC_PATH
#error "SSSD_LIBEXEC_PATH not defined"
#endif /* SSSD_LIBEXEC_PATH */
#endif /* SELINUX_CHILD_DIR */
/* fd used by the selinux_child process for logging */
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order);
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***usermaps);
static errno_t
struct sss_domain_info *domain,
struct sysdb_attrs **maps)
{
bool in_transaction = false;
int i;
if (ret) {
goto done;
}
in_transaction = true;
for (i = 0; i < map_count; i++) {
"Ignoring.\n", i);
} else {
}
}
if (ret) {
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
struct map_order_ctx {
char *order;
char **order_array;
};
struct selinux_child_input {
const char *seuser;
const char *mls_range;
const char *username;
};
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
static errno_t
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***_usermaps)
{
int i;
const char *seealso_str;
if (!tmp_ctx) {
return ENOMEM;
}
selinux_map_count + 1);
if (seealso_rules == NULL) {
goto done;
}
goto done;
}
for (i = 0; i < selinux_map_count; i++) {
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
continue;
}
/* SELinux map did not matched -> check sealso attribute for
* possible HBAC match */
continue;
goto done;
}
}
goto done;
}
done:
return ret;
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
{
int i, j;
const char *seealso_dn;
const char *hbac_dn;
for (i = 0; i < hbac_rule_count; i++) {
return ret;
}
/* We need to do this translation for further processing. We have to
* do it manually because no map was used to retrieve HBAC rules.
*/
"Matching HBAC rule %s with SELinux mappings\n", hbac_dn);
continue;
}
/* HBAC rule matched, find if it is in the "possible" list */
for (j = 0; j < seealso_rules_count; j++) {
usermap = seealso_rules[j];
continue;
}
return ret;
}
"attributes to SELinux user map [%s]\n",
/* Selinux maps priority evaluation removed --DELETE this comment before pushing*/
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
return ret;
}
return ret;
}
/* Speed up the next iteration */
seealso_rules[j] = NULL;
}
}
}
return EOK;
}
struct map_order_ctx **_mo_ctx)
{
int i;
int len;
goto done;
}
goto done;
}
/* The "order" string contains one or more SELinux user records
* separated by $. Now we need to create an array of string from
* this one string. First find out how many elements in the array
* will be. This way only one alloc will be necessary for the array
*/
for (i = 0; i < len; i++) {
}
goto done;
}
goto done;
}
/* Now fill the array with pointers to the original string. Also
* use binary zeros to make multiple string out of the one.
*/
for (i = 0; i < len; i++) {
mo_ctx->order_count++;
}
}
done:
return ret;
}
const char *orig_name,
struct sss_domain_info *dom,
const char *seuser_mls_string,
struct selinux_child_input **_sci);
/* Choose best selinux user based on given order and write
* the user to selinux login file. */
struct sysdb_attrs **usermaps,
struct sss_domain_info *user_domain,
struct map_order_ctx *mo_ctx,
const char *default_user,
struct selinux_child_input **_sci)
{
const char *tmp_str;
int i, j;
return ENOMEM;
}
/* If no maps match, we'll use the default SELinux user from the
* config */
if (seuser_mls_str == NULL) {
goto done;
}
/* Iterate through the order array and try to find SELinux users
* in fetched maps. The order array contains all SELinux users
* allowed in the domain in the same order they should appear
* in the SELinux config file. If any user from the order array
* is not in fetched user maps, it means it should not be allowed
* for the user who is just logging in.
*
* Right now we have empty content of the SELinux config file,
* we shall add only those SELinux users that are present both in
* the order array and user maps applicable to the user who is
* logging in.
*/
for (i = 0; i < mo_ctx->order_count; i++) {
/* If seuser_mls_str contained something, overwrite it.
* This record has higher priority.
*/
if (seuser_mls_str == NULL) {
goto done;
}
break;
}
}
}
goto done;
}
done:
return ret;
}
static errno_t
const char *orig_name,
struct sss_domain_info *dom,
const char *seuser_mls_string,
struct selinux_child_input **_sci)
{
char *seuser;
const char *mls_range;
char *ptr;
char *username_final;
return ENOMEM;
}
/* Split seuser and mls_range */
goto done;
}
ptr++;
}
if (*ptr == '\0') {
/* No mls_range specified */
mls_range = "";
} else {
}
/* pam_selinux needs the username in the same format getpwnam() would
* return it
*/
dom->case_preserve, 0);
if (username_final == NULL) {
goto done;
}
}
goto done;
}
goto done;
}
done:
return ret;
}
struct selinux_child_state {
};
static errno_t selinux_child_init(void);
struct tevent_context *ev,
struct selinux_child_input *sci)
{
return NULL;
}
goto immediately;
}
ret = selinux_child_init();
goto immediately;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
}
return req;
}
{
}
{
return ENOMEM;
}
rp = 0;
/* seuser */
seuser_len, &rp);
/* mls_range */
mls_range_len, &rp);
/* username */
username_len, &rp);
return EOK;
}
{
if (ret == -1) {
return ret;
}
if (ret == -1) {
return ret;
}
if (pid == 0) { /* child */
return ret;
} else if (pid > 0) { /* parent */
close(pipefd_to_child[0]);
"Could not set up child signal handler\n");
return ret;
}
} else { /* error */
return ret;
}
return EOK;
}
{
return;
}
return;
}
}
{
return;
}
"selinux_child_parse_response failed: [%d][%s]\n",
return;
} else if (child_result != 0){
"Error in selinux_child: [%d][%s]\n",
return;
}
return;
}
{
size_t p = 0;
/* semanage retval */
return EOK;
}
{
return EOK;
}
/* A more generic request to gather all SELinux and HBAC rules. Updates
* cache if necessary
*/
struct ipa_get_selinux_state {
};
static errno_t
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx)
{
bool offline;
return NULL;
}
if (!offline) {
/* SELinux maps were recently updated -> force offline */
"Performing cached SELinux processing\n");
offline = true;
}
}
if (!offline) {
goto immediate;
}
if (!subreq) {
goto immediate;
}
} else {
goto immediate;
}
return req;
} else {
}
return req;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
int ret;
const char *hostname;
if (dp_error == DP_ERR_OFFLINE) {
return;
}
goto fail;
}
goto fail;
}
/* If the access control module is the same as the selinux module
* and the access control had already discovered the host
*/
return ipa_get_config_step(req);
}
goto fail;
}
NULL,
goto fail;
}
return;
fail:
}
static errno_t
{
NULL };
const char *default_user;
const char *order;
struct ipa_get_selinux_state);
/* read the config entry */
return ret;
}
NULL);
NULL);
return ENOMEM;
}
if (default_user) {
return ret;
}
}
return ret;
}
/* read all the SELinux rules */
return ret;
}
return ret;
}
/* read all the HBAC rules */
return ret;
}
return EOK;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
return ipa_get_config_step(req);
done:
}
}
{
const char *domain;
struct ipa_get_selinux_state);
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
if (!subreq) {
goto done;
}
return;
done:
} else {
}
}
{
const char *tmp_str;
bool check_hbac;
int i;
/* This is returned if no SELinux mapping
* rules were found. In that case no error
* occurred, but we don't want any more processing.*/
}
goto done;
}
check_hbac = false;
check_hbac = true;
break;
}
}
if (check_hbac) {
if (access_mod == selinux_mod) {
&state->hbac_rules);
/* Terminates the request */
goto done;
}
"Need to refresh HBAC rules\n");
goto done;
}
return;
}
done:
} else {
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
&state->hbac_rules);
} else {
}
}
static errno_t
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order)
{
const char *tmp_str;
&tmp_str);
return ret;
}
if (*default_user == NULL) {
return ENOMEM;
}
}
&tmp_str);
return ret;
}
return ENOMEM;
}
return EOK;
}
static errno_t
struct sss_domain_info *ipa_domain,
struct sss_domain_info *user_domain,
const char *username,
const char *hostname,
struct sysdb_attrs **_user,
struct sysdb_attrs **_host)
{
NULL };
return ENOMEM;
}
goto done;
}
goto done;
}
/* Look up the host to get its originalMemberOf entries */
goto done;
goto done;
} else if (count > 1) {
goto done;
}
goto done;
}
done:
}
return ret;
}
static errno_t
struct sss_domain_info *ipa_domain,
const char *default_user,
const char *map_order,
struct sysdb_attrs **maps)
{
bool in_transaction = false;
goto done;
}
in_transaction = true;
goto done;
}
goto done;
}
if (map_count > 0) {
goto done;
}
}
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
static errno_t
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **maps,
struct sysdb_attrs **hbac_rules,
const char *map_order,
struct sss_domain_info *user_domain,
const char *default_user,
struct selinux_child_input **_sci)
{
/* Process the maps and return list of best matches
* (maps with highest priority). */
goto done;
}
"Failed to create ordered SELinux users array.\n");
goto done;
}
"Failed to evaluate ordered SELinux users array.\n");
goto done;
}
done:
}
return ret;
}
struct ipa_selinux_handler_state {
};
struct tevent_req *
struct ipa_selinux_ctx *selinux_ctx,
struct dp_req_params *params)
{
const char *hostname;
struct ipa_selinux_handler_state);
return NULL;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
return req;
/* TODO For backward compatibility we always return EOK to DP now. */
return req;
}
{
&hbac_count, &hbac_rules,
&default_user, &map_order);
goto done;
}
goto done;
}
&sci);
goto done;
}
/* Update the SELinux context in a privileged child as the back end is
* running unprivileged
*/
goto done;
}
return;
done:
/* TODO For backward compatibility we always return EOK to DP now. */
}
{
goto done;
}
}
done:
/* TODO For backward compatibility we always return EOK to DP now. */
}
struct tevent_req *req,
{
return EOK;
}