ipa_selinux.c revision 7a1a56860993475d0025e7411547649abf09d32c
/*
SSSD
IPA Backend Module -- selinux loading
Authors:
Jan Zeleny <jzeleny@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "db/sysdb_selinux.h"
#include "util/sss_selinux.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_rules.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_maps.h"
#include "providers/ipa/ipa_subdomains.h"
#if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order);
static struct ipa_selinux_op_ctx *
struct sss_domain_info *domain,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***usermaps);
struct ipa_selinux_op_ctx {
struct sss_domain_info *domain;
struct ipa_selinux_ctx *selinux_ctx;
struct sysdb_attrs *user;
struct sysdb_attrs *host;
};
{
struct ipa_selinux_ctx *selinux_ctx;
struct ipa_selinux_op_ctx *op_ctx;
struct tevent_req *req;
const char *hostname;
struct sss_domain_info *user_domain;
struct be_ctx *subdom_be_ctx;
struct ipa_selinux_ctx);
if (!hostname) {
goto fail;
}
if (subdom_be_ctx == NULL) {
"cannot lookup domain [%s].\n",
goto fail;
} else {
if (user_domain == NULL) {
goto fail;
}
}
} else {
}
goto fail;
}
goto fail;
}
return;
fail:
}
static errno_t
struct sss_domain_info *domain,
struct sysdb_attrs **maps)
{
bool in_transaction = false;
int i;
if (ret) {
goto done;
}
in_transaction = true;
for (i = 0; i < map_count; i++) {
"Ignoring.\n", i));
} else {
}
}
if (ret) {
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
static struct ipa_selinux_op_ctx *
struct sss_domain_info *domain,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx)
{
struct ipa_selinux_op_ctx *op_ctx;
const char *attrs[] = { SYSDB_ORIG_DN,
NULL };
struct ldb_message **msgs;
struct sysdb_attrs **hosts;
return NULL;
}
goto fail;
}
goto fail;
}
/* Look up the host to get its originalMemberOf entries */
return op_ctx;
goto fail;
} else if (count > 1) {
goto fail;
}
goto fail;
}
return op_ctx;
fail:
return NULL;
}
char **order_array, int order_count,
const char *default_user);
{
bool in_transaction = false;
char *default_user = NULL;
size_t hbac_count = 0;
struct sysdb_attrs **hbac_rules = 0;
struct sysdb_attrs **best_match_maps;
char **order_array;
&hbac_count, &hbac_rules,
&default_user, &map_order);
goto fail;
}
/* Process the maps and return list of best matches (maps with
* highest priority). The input maps are also parent memory
* context for the output list of best matches. The best match
* maps should never be freed explicitly but always through
* their parent (or any indirect parent) */
goto fail;
}
&order_array, &order_count);
("Failed to create ordered SELinux users array.\n"));
goto fail;
}
("Failed to evaluate ordered SELinux users array.\n"));
goto fail;
}
goto fail;
}
in_transaction = true;
("Cannot delete existing maps from sysdb\n"));
goto fail;
}
goto fail;
}
goto fail;
}
}
goto fail;
}
in_transaction = false;
/* If we got here in online mode, set last_update to current time */
if (!be_is_offline(be_ctx)) {
}
return;
fail:
if (in_transaction) {
}
}
} else {
}
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
static errno_t
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs ***_usermaps)
{
int i;
uint32_t top_priority = 0;
struct sysdb_attrs **seealso_rules;
size_t num_seealso_rules = 0;
const char *seealso_str;
struct sysdb_attrs **usermaps;
if (!tmp_ctx) {
return ENOMEM;
}
selinux_map_count + 1);
if (seealso_rules == NULL) {
goto done;
}
goto done;
}
for (i = 0; i < selinux_map_count; i++) {
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
continue;
}
/* SELinux map did not matched -> check sealso attribute for
* possible HBAC match */
continue;
goto done;
}
}
goto done;
}
done:
return ret;
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
struct sysdb_attrs **usermaps,
{
int i, j;
struct ldb_message_element *el;
struct sysdb_attrs *usermap;
const char *seealso_dn;
const char *hbac_dn;
for (i = 0; i < hbac_rule_count; i++) {
return ret;
}
/* We need to do this translation for further processing. We have to
* do it manually because no map was used to retrieve HBAC rules.
*/
("Matching HBAC rule %s with SELinux mappings\n", hbac_dn));
continue;
}
/* HBAC rule matched, find if it is in the "possible" list */
for (j = 0; j < seealso_rules_count; j++) {
usermap = seealso_rules[j];
continue;
}
return ret;
}
"attributes to SELinux user map [%s]\n",
hbac_dn, seealso_dn));
/* Selinux maps priority evaluation removed --DELETE this comment before pushing*/
if (priority < top_priority) {
/* This rule has lower priority than what we already have,
* skip it. */
continue;
} else if (priority > top_priority) {
/* This rule has higher priority, drop what we already have */
while (best_match_maps_cnt > 0) {
}
}
return ret;
}
return ret;
}
/* Speed up the next iteration */
seealso_rules[j] = NULL;
}
}
}
return EOK;
}
{
char **order_array;
int i;
int len;
goto done;
}
goto done;
}
/* The "order" string contains one or more SELinux user records
* separated by $. Now we need to create an array of string from
* this one string. First find out how many elements in the array
* will be. This way only one alloc will be necessary for the array
*/
order_count = 1;
for (i = 0; i < len; i++) {
}
if (order_array == NULL) {
goto done;
}
/* Now fill the array with pointers to the original string. Also
* use binary zeros to make multiple string out of the one.
*/
order_array[0] = order;
order_count = 1;
for (i = 0; i < len; i++) {
if (order[i] == '$') {
order[i] = '\0';
order_count++;
}
}
done:
return ret;
}
/* Choose best selinux user based on given order and write
* the user to selinux login file. */
char **order_array, int order_count,
const char *default_user)
{
char *file_content = NULL;
const char *tmp_str;
int i, j;
return ENOMEM;
}
/* If no maps match, we'll use the default SELinux user from the
* config */
if (file_content == NULL) {
goto done;
}
/* Iterate through the order array and try to find SELinux users
* in fetched maps. The order array contains all SELinux users
* allowed in the domain in the same order they should appear
* in the SELinux config file. If any user from the order array
* is not in fetched user maps, it means it should not be allowed
* for the user who is just logging in.
*
* Right now we have empty content of the SELinux config file,
* we shall add only those SELinux users that are present both in
* the order array and user maps applicable to the user who is
* logging in.
*/
for (i = 0; i < order_count; i++) {
/* If file_content contained something, overwrite it.
* This record has higher priority.
*/
if (file_content == NULL) {
goto done;
}
break;
}
}
}
done:
if (!file_content) {
/* Don't overwrite original error condition if there was one */
}
return ret;
}
{
int fd = -1;
char *full_string = NULL;
int enforce;
if (len == 0) {
return EINVAL;
}
return ENOMEM;
}
goto done;
}
goto done;
}
if (fd < 0) {
/* if selinux is disabled and selogin dir does not exist,
* just ignore the error */
goto done;
}
/* continue if we can't get enforce mode or selinux is enabled */
}
goto done;
}
if (full_string == NULL) {
goto done;
}
errno = 0;
if (written == -1) {
goto done;
}
goto done;
}
errno = 0;
} else {
}
fd = -1;
done:
if (fd != -1) {
tmp_path));
}
}
return ret;
}
{
char *path;
errno = 0;
if (ret < 0) {
/* Just return success if the file was not there */
} else {
("Could not remove login file %s [%d]: %s\n",
}
}
return ret;
}
/* A more generic request to gather all SELinux and HBAC rules. Updates
* cache if necessary
*/
struct ipa_get_selinux_state {
struct ipa_selinux_ctx *selinux_ctx;
struct sdap_id_op *op;
struct sysdb_attrs *host;
struct sysdb_attrs *user;
struct sysdb_attrs *defaults;
struct sysdb_attrs **selinuxmaps;
struct sysdb_attrs **hbac_rules;
};
static errno_t
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct ipa_get_selinux_state *state;
bool offline;
return NULL;
}
if (!offline) {
/* SELinux maps were recently updated -> force offline */
("Performing cached SELinux processing\n"));
offline = true;
}
}
if (!offline) {
goto immediate;
}
if (!subreq) {
goto immediate;
}
} else {
goto immediate;
}
return req;
} else {
}
return req;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
int dp_error = DP_ERR_FATAL;
int ret;
const char *access_name;
const char *selinux_name;
const char *hostname;
if (dp_error == DP_ERR_OFFLINE) {
return;
}
goto fail;
}
goto fail;
}
/* If the access control module is the same as the selinux module
* and the access control had already discovered the host
*/
return ipa_get_config_step(req);
}
goto fail;
}
NULL,
goto fail;
}
return;
fail:
}
static errno_t
{
struct ldb_message **maps;
struct ldb_message *defaults;
const char *attrs[] = { SYSDB_NAME,
NULL };
const char *default_user;
const char *order;
struct ipa_get_selinux_state);
/* read the config entry */
return ret;
}
NULL);
NULL);
return ENOMEM;
}
return ret;
}
return ret;
}
/* read all the SELinux rules */
return ret;
}
return ret;
}
/* read all the HBAC rules */
return ret;
}
return EOK;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
struct sysdb_attrs **hostgroups;
struct sysdb_attrs **host;
goto done;
}
return ipa_get_config_step(req);
done:
}
}
{
const char *domain;
struct tevent_req *subreq;
struct ipa_get_selinux_state);
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
if (!subreq) {
goto done;
}
return;
done:
} else {
}
}
{
struct tevent_req *req;
struct ipa_get_selinux_state *state;
struct ipa_id_ctx *id_ctx;
char *selinux_name;
char *access_name;
const char *tmp_str;
bool check_hbac;
int i;
/* This is returned if no SELinux mapping
* rules were found. In that case no error
* occurred, but we don't want any more processing.*/
}
goto done;
}
check_hbac = false;
check_hbac = true;
break;
}
}
if (check_hbac) {
&state->hbac_rules);
/* Terminates the request */
goto done;
}
"Need to refresh HBAC rules\n"));
goto done;
}
return;
}
done:
} else {
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
&state->hbac_rules);
} else {
}
}
static errno_t
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order)
{
struct ipa_get_selinux_state *state =
const char *tmp_str;
&tmp_str);
return ret;
}
if (*default_user == NULL) {
return ENOMEM;
}
}
&tmp_str);
return ret;
}
return ENOMEM;
}
} else {
*default_user = NULL;
}
} else {
*count = 0;
}
} else {
*hbac_count = 0;
*hbac_rules = NULL;
}
return EOK;
}
/*end of #if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR */
#else
/* Simply return success if HAVE_SELINUX_LOGIN_DIR is not defined. */
{
}
#endif