ipa_selinux.c revision 6dff95bdfe437afc0b62b5270d0d84140981c786
/*
SSSD
IPA Backend Module -- selinux loading
Authors:
Jan Zeleny <jzeleny@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "db/sysdb_selinux.h"
#include "util/child_common.h"
#include "util/sss_selinux.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_rules.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_maps.h"
#include "providers/ipa/ipa_subdomains.h"
#if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR
#ifndef SELINUX_CHILD_DIR
#ifndef SSSD_LIBEXEC_PATH
#error "SSSD_LIBEXEC_PATH not defined"
#endif /* SSSD_LIBEXEC_PATH */
#define SELINUX_CHILD_DIR SSSD_LIBEXEC_PATH
#endif /* SELINUX_CHILD_DIR */
#define SELINUX_CHILD_LOG_FILE "selinux_child"
/* fd used by the selinux_child process for logging */
int selinux_child_debug_fd = -1;
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order);
static struct ipa_selinux_op_ctx *
struct sss_domain_info *ipa_domain,
struct sss_domain_info *user_domain,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***usermaps);
struct ipa_selinux_op_ctx {
struct sss_domain_info *user_domain;
struct sss_domain_info *ipa_domain;
struct ipa_selinux_ctx *selinux_ctx;
struct sysdb_attrs *user;
struct sysdb_attrs *host;
};
{
struct ipa_selinux_ctx *selinux_ctx;
struct ipa_selinux_op_ctx *op_ctx;
struct tevent_req *req;
const char *hostname;
struct sss_domain_info *user_domain;
struct be_ctx *subdom_be_ctx;
struct ipa_selinux_ctx);
if (!hostname) {
goto fail;
}
if (subdom_be_ctx == NULL) {
"cannot lookup domain [%s].\n",
goto fail;
} else {
if (user_domain == NULL) {
goto fail;
}
}
} else {
}
goto fail;
}
goto fail;
}
return;
fail:
}
static errno_t
struct sss_domain_info *domain,
struct sysdb_attrs **maps)
{
bool in_transaction = false;
int i;
if (ret) {
goto done;
}
in_transaction = true;
for (i = 0; i < map_count; i++) {
"Ignoring.\n", i);
} else {
}
}
if (ret) {
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
static struct ipa_selinux_op_ctx *
struct sss_domain_info *ipa_domain,
struct sss_domain_info *user_domain,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx)
{
struct ipa_selinux_op_ctx *op_ctx;
const char *attrs[] = { SYSDB_ORIG_DN,
NULL };
struct ldb_message **msgs;
struct sysdb_attrs **hosts;
return NULL;
}
goto fail;
}
goto fail;
}
/* Look up the host to get its originalMemberOf entries */
return op_ctx;
goto fail;
} else if (count > 1) {
goto fail;
}
goto fail;
}
return op_ctx;
fail:
return NULL;
}
struct map_order_ctx {
char *order;
char **order_array;
};
struct map_order_ctx **_mo_ctx);
struct selinux_child_input {
const char *seuser;
const char *mls_range;
const char *username;
};
struct sysdb_attrs **usermaps,
struct sss_domain_info *user_domain,
struct map_order_ctx *mo_ctx,
const char *default_user,
struct selinux_child_input **_sci);
struct tevent_context *ev,
struct selinux_child_input *sci);
{
bool in_transaction = false;
char *default_user = NULL;
size_t hbac_count = 0;
struct sysdb_attrs **hbac_rules = 0;
struct sysdb_attrs **best_match_maps;
struct map_order_ctx *map_order_ctx;
struct tevent_req *child_req;
&hbac_count, &hbac_rules,
&default_user, &map_order);
goto fail;
}
goto fail;
}
in_transaction = true;
"Cannot delete existing maps from sysdb\n");
goto fail;
}
goto fail;
}
if (map_count > 0) {
goto fail;
}
}
goto fail;
}
in_transaction = false;
/* Process the maps and return list of best matches (maps with
* highest priority). The input maps are also parent memory
* context for the output list of best matches. The best match
* maps should never be freed explicitly but always through
* their parent (or any indirect parent) */
goto fail;
}
"Failed to create ordered SELinux users array.\n");
goto fail;
}
"Failed to evaluate ordered SELinux users array.\n");
goto fail;
}
/* Update the SELinux context in a privileged child as the back end is
* running unprivileged
*/
goto fail;
}
return;
fail:
if (in_transaction) {
}
}
} else {
}
}
{
struct ipa_selinux_op_ctx *op_ctx;
return;
}
/* If we got here in online mode, set last_update to current time */
if (!be_is_offline(be_ctx)) {
}
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
static errno_t
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***_usermaps)
{
int i;
uint32_t top_priority = 0;
struct sysdb_attrs **seealso_rules;
size_t num_seealso_rules = 0;
const char *seealso_str;
struct sysdb_attrs **usermaps;
if (!tmp_ctx) {
return ENOMEM;
}
selinux_map_count + 1);
if (seealso_rules == NULL) {
goto done;
}
goto done;
}
for (i = 0; i < selinux_map_count; i++) {
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
continue;
}
/* SELinux map did not matched -> check sealso attribute for
* possible HBAC match */
continue;
goto done;
}
}
goto done;
}
done:
return ret;
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
{
int i, j;
struct ldb_message_element *el;
struct sysdb_attrs *usermap;
const char *seealso_dn;
const char *hbac_dn;
for (i = 0; i < hbac_rule_count; i++) {
return ret;
}
/* We need to do this translation for further processing. We have to
* do it manually because no map was used to retrieve HBAC rules.
*/
"Matching HBAC rule %s with SELinux mappings\n", hbac_dn);
continue;
}
/* HBAC rule matched, find if it is in the "possible" list */
for (j = 0; j < seealso_rules_count; j++) {
usermap = seealso_rules[j];
continue;
}
return ret;
}
"attributes to SELinux user map [%s]\n",
/* Selinux maps priority evaluation removed --DELETE this comment before pushing*/
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
return ret;
}
return ret;
}
/* Speed up the next iteration */
seealso_rules[j] = NULL;
}
}
}
return EOK;
}
struct map_order_ctx **_mo_ctx)
{
int i;
int len;
struct map_order_ctx *mo_ctx;
goto done;
}
goto done;
}
/* The "order" string contains one or more SELinux user records
* separated by $. Now we need to create an array of string from
* this one string. First find out how many elements in the array
* will be. This way only one alloc will be necessary for the array
*/
for (i = 0; i < len; i++) {
}
goto done;
}
goto done;
}
/* Now fill the array with pointers to the original string. Also
* use binary zeros to make multiple string out of the one.
*/
for (i = 0; i < len; i++) {
mo_ctx->order_count++;
}
}
done:
return ret;
}
const char *orig_name,
struct sss_domain_info *dom,
const char *seuser_mls_string,
struct selinux_child_input **_sci);
/* Choose best selinux user based on given order and write
* the user to selinux login file. */
struct sysdb_attrs **usermaps,
struct sss_domain_info *user_domain,
struct map_order_ctx *mo_ctx,
const char *default_user,
struct selinux_child_input **_sci)
{
char *seuser_mls_str = NULL;
const char *tmp_str;
int i, j;
struct selinux_child_input *sci;
return ENOMEM;
}
/* If no maps match, we'll use the default SELinux user from the
* config */
if (seuser_mls_str == NULL) {
goto done;
}
/* Iterate through the order array and try to find SELinux users
* in fetched maps. The order array contains all SELinux users
* allowed in the domain in the same order they should appear
* in the SELinux config file. If any user from the order array
* is not in fetched user maps, it means it should not be allowed
* for the user who is just logging in.
*
* Right now we have empty content of the SELinux config file,
* we shall add only those SELinux users that are present both in
* the order array and user maps applicable to the user who is
* logging in.
*/
for (i = 0; i < mo_ctx->order_count; i++) {
/* If seuser_mls_str contained something, overwrite it.
* This record has higher priority.
*/
if (seuser_mls_str == NULL) {
goto done;
}
break;
}
}
}
goto done;
}
done:
return ret;
}
static errno_t
const char *orig_name,
struct sss_domain_info *dom,
const char *seuser_mls_string,
struct selinux_child_input **_sci)
{
char *seuser;
const char *mls_range;
char *ptr;
char *username;
char *username_final;
char *domain_name = NULL;
struct selinux_child_input *sci;
return ENOMEM;
}
/* Split seuser and mls_range */
goto done;
}
ptr++;
}
if (*ptr == '\0') {
/* No mls_range specified */
mls_range = "";
} else {
}
/* pam_selinux needs the username in the same format getpwnam() would
* return it
*/
goto done;
}
NULL);
/* username is already a fully qualified name */
|| ret == ERR_REGEX_NOMATCH) {
if (username_final == NULL) {
goto done;
}
} else {
goto done;
}
} else {
}
goto done;
}
goto done;
}
done:
return ret;
}
struct selinux_child_state {
struct selinux_child_input *sci;
struct tevent_context *ev;
struct child_io_fds *io;
};
static errno_t selinux_child_init(void);
struct tevent_context *ev,
struct selinux_child_input *sci)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct selinux_child_state *state;
return NULL;
}
goto immediately;
}
ret = selinux_child_init();
goto immediately;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
}
return req;
}
static errno_t selinux_child_init(void)
{
}
{
return ENOMEM;
}
rp = 0;
/* seuser */
seuser_len, &rp);
/* mls_range */
mls_range_len, &rp);
/* username */
username_len, &rp);
return EOK;
}
{
int pipefd_to_child[2];
int pipefd_from_child[2];
if (ret == -1) {
return ret;
}
if (ret == -1) {
return ret;
}
if (pid == 0) { /* child */
return ret;
} else if (pid > 0) { /* parent */
close(pipefd_to_child[0]);
"Could not set up child signal handler\n");
return ret;
}
} else { /* error */
return ret;
}
return EOK;
}
{
struct tevent_req *req;
struct selinux_child_state *state;
return;
}
return;
}
}
{
struct tevent_req *req;
struct selinux_child_state *state;
return;
}
"selinux_child_parse_response failed: [%d][%s]\n",
return;
} else if (child_result != 0){
"Error in selinux_child: [%d][%s]\n",
return;
}
return;
}
{
size_t p = 0;
/* semanage retval */
return EOK;
}
{
return EOK;
}
/* A more generic request to gather all SELinux and HBAC rules. Updates
* cache if necessary
*/
struct ipa_get_selinux_state {
struct ipa_selinux_ctx *selinux_ctx;
struct sdap_id_op *op;
struct sysdb_attrs *host;
struct sysdb_attrs *user;
struct sysdb_attrs *defaults;
struct sysdb_attrs **selinuxmaps;
struct sysdb_attrs **hbac_rules;
};
static errno_t
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct ipa_get_selinux_state *state;
bool offline;
return NULL;
}
if (!offline) {
/* SELinux maps were recently updated -> force offline */
"Performing cached SELinux processing\n");
offline = true;
}
}
if (!offline) {
goto immediate;
}
if (!subreq) {
goto immediate;
}
} else {
goto immediate;
}
return req;
} else {
}
return req;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
int dp_error = DP_ERR_FATAL;
int ret;
const char *access_name;
const char *selinux_name;
const char *hostname;
if (dp_error == DP_ERR_OFFLINE) {
return;
}
goto fail;
}
goto fail;
}
/* If the access control module is the same as the selinux module
* and the access control had already discovered the host
*/
return ipa_get_config_step(req);
}
goto fail;
}
NULL,
goto fail;
}
return;
fail:
}
static errno_t
{
struct ldb_message **maps;
struct ldb_message *defaults;
const char *attrs[] = { SYSDB_NAME,
NULL };
const char *default_user;
const char *order;
struct ipa_get_selinux_state);
/* read the config entry */
return ret;
}
NULL);
NULL);
return ENOMEM;
}
if (default_user) {
return ret;
}
}
return ret;
}
/* read all the SELinux rules */
return ret;
}
return ret;
}
/* read all the HBAC rules */
return ret;
}
return EOK;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
struct sysdb_attrs **hostgroups;
struct sysdb_attrs **host;
goto done;
}
return ipa_get_config_step(req);
done:
}
}
{
const char *domain;
struct tevent_req *subreq;
struct ipa_get_selinux_state);
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
if (!subreq) {
goto done;
}
return;
done:
} else {
}
}
{
struct tevent_req *req;
struct ipa_get_selinux_state *state;
struct ipa_id_ctx *id_ctx;
char *selinux_name;
char *access_name;
const char *tmp_str;
bool check_hbac;
int i;
/* This is returned if no SELinux mapping
* rules were found. In that case no error
* occurred, but we don't want any more processing.*/
}
goto done;
}
check_hbac = false;
check_hbac = true;
break;
}
}
if (check_hbac) {
&state->hbac_rules);
/* Terminates the request */
goto done;
}
"Need to refresh HBAC rules\n");
goto done;
}
return;
}
done:
} else {
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
&state->hbac_rules);
} else {
}
}
static errno_t
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order)
{
struct ipa_get_selinux_state *state =
const char *tmp_str;
&tmp_str);
return ret;
}
if (*default_user == NULL) {
return ENOMEM;
}
}
&tmp_str);
return ret;
}
return ENOMEM;
}
return EOK;
}
/*end of #if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR */
#else
/* Simply return success if HAVE_SELINUX_LOGIN_DIR is not defined. */
{
}
#endif