ipa_selinux.c revision ccc2af010bbbe6d8a7496fb717216135bc4c1993
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz IPA Backend Module -- selinux loading
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd Jan Zeleny <jzeleny@redhat.com>
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd Copyright (C) 2012 Red Hat
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd This program is free software; you can redistribute it and/or modify
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd it under the terms of the GNU General Public License as published by
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd the Free Software Foundation; either version 3 of the License, or
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd (at your option) any later version.
52fff662005b1866a3ff09bb6c902800c5cc6dedjerenkrantz This program is distributed in the hope that it will be useful,
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd but WITHOUT ANY WARRANTY; without even the implied warranty of
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd GNU General Public License for more details.
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd You should have received a copy of the GNU General Public License
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd along with this program. If not, see <http://www.gnu.org/licenses/>.
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic struct tevent_req *
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantzstatic errno_t ipa_get_selinux_recv(struct tevent_req *req,
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic struct ipa_selinux_op_ctx *
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd const char *hostname);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic void ipa_selinux_handler_done(struct tevent_req *subreq);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic void ipa_get_selinux_connect_done(struct tevent_req *subreq);
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4ndstatic void ipa_get_selinux_hosts_done(struct tevent_req *subreq);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic void ipa_get_selinux_config_done(struct tevent_req *subreq);
35ff2d06df95b9593ee312dfff883c76f3b97798noodlstatic void ipa_get_selinux_maps_done(struct tevent_req *subreq);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic void ipa_get_selinux_hbac_done(struct tevent_req *subreq);
3267af3f6fbf9743e64a9f019c745317f18cd9f7poirierstatic errno_t ipa_selinux_process_maps(struct sysdb_attrs *user,
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin const char *hostname;
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin pd = talloc_get_type(be_req->req_data, struct pam_data);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin hostname = dp_opt_get_string(selinux_ctx->id_ctx->ipa_options->basic,
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin DEBUG(SSSDBG_OP_FAILURE, ("Cannot determine this machine's host name\n"));
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin op_ctx = ipa_selinux_create_op_ctx(be_req, be_req->be_ctx->domain->sysdb,
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin DEBUG(SSSDBG_OP_FAILURE, ("Cannot create op context\n"));
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin DEBUG(SSSDBG_OP_FAILURE, ("Cannot initiate the search\n"));
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin tevent_req_set_callback(req, ipa_selinux_handler_done, op_ctx);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin be_req->fn(be_req, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinstatic struct ipa_selinux_op_ctx *
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirinipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin op_ctx = talloc_zero(mem_ctx, struct ipa_selinux_op_ctx);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin ret = sss_selinux_extract_user(op_ctx, sysdb, domain, username, &op_ctx->user);
8951c7d73bfa2ae5a2c8fe5bd27f3e677be02564noirin host_dn = sysdb_custom_dn(sysdb, op_ctx, domain, hostname, HBAC_HOSTS_SUBDIR);
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz /* Look up the host to get its originalMemberOf entries */
1f53e295ebd19aed1767d12da7abfab9936c148cjerenkrantz ret = sysdb_search_entry(op_ctx, sysdb, host_dn,
1b390add6886fb1c0acdea82be0ef0920f1158casf DEBUG(SSSDBG_OP_FAILURE, ("More than one result for a BASE search!\n"));
50039065d571fe01fd458a3f031c995a1fd53c22rbowenstatic void ipa_selinux_handler_done(struct tevent_req *req)
bdd978e5ecd8daa2542d4d4e1988c78a622cd7f4nd struct ipa_selinux_op_ctx *op_ctx = tevent_req_callback_data(req, struct ipa_selinux_op_ctx);
bool in_transaction = false;
goto fail;
goto fail;
goto fail;
in_transaction = true;
goto fail;
goto fail;
goto fail;
goto fail;
in_transaction = false;
fail:
if (in_transaction) {
static errno_t
static errno_t
const char *seealso_str;
if (!tmp_ctx) {
return ENOMEM;
goto done;
num_seealso_rules = 0;
for (i = 0; i < selinux_map_count; i++) {
priority);
goto done;
goto done;
goto done;
done:
return ret;
static errno_t
const char *seealso_dn;
const char *hbac_dn;
for (i = 0; i < hbac_rule_count; i++) {
return ret;
for (j = 0; j < seealso_rules_count; j++) {
return ret;
priority);
return ret;
return ret;
return ret;
return EOK;
struct ipa_get_selinux_state {
static errno_t
static struct tevent_req *
bool offline;
return NULL;
if (!offline) {
goto immediate;
if (!subreq) {
goto immediate;
goto immediate;
return req;
return req;
struct tevent_req);
struct ipa_get_selinux_state);
int ret;
const char *access_name;
const char *selinux_name;
const char *hostname;
goto fail;
goto fail;
goto fail;
NULL,
goto fail;
fail:
static errno_t
NULL };
const char *default_user;
const char *order;
struct ipa_get_selinux_state);
return ret;
NULL);
NULL);
return ENOMEM;
return ret;
return ret;
return ret;
return ret;
return ret;
return EOK;
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
done:
const char *domain;
struct ipa_get_selinux_state);
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
if (!subreq) {
goto done;
done:
char *selinux_name;
char *access_name;
const char *tmp_str;
bool check_hbac;
goto done;
check_hbac = false;
check_hbac = true;
if (check_hbac) {
goto done;
goto done;
done:
struct tevent_req);
struct ipa_get_selinux_state);
static errno_t
char **default_user,
char **map_order)
const char *tmp_str;
&tmp_str);
return ret;
return ENOMEM;
&tmp_str);
return ret;
return ENOMEM;
*count = 0;
*hbac_count = 0;
return EOK;