ipa_selinux.c revision ebb1f28998c06984765e3e78d30911c1c3ec84e2
/*
SSSD
IPA Backend Module -- selinux loading
Authors:
Jan Zeleny <jzeleny@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "db/sysdb_selinux.h"
#include "util/sss_selinux.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_rules.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_common.h"
#include "providers/ipa/ipa_selinux_maps.h"
struct ipa_get_selinux_state {
struct ipa_selinux_ctx *selinux_ctx;
struct sdap_id_op *op;
const char *hostname;
struct sysdb_attrs *host;
struct sysdb_attrs *user;
struct sysdb_attrs *defaults;
struct sysdb_attrs **selinuxmaps;
struct sysdb_attrs **possible_match;
};
static struct
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs ***maps,
char **default_user,
char **map_order);
static int
struct sysdb_attrs **rules,
{
struct ipa_selinux_ctx *selinux_ctx;
struct tevent_req *req;
struct ipa_selinux_ctx);
goto fail;
}
return;
fail:
}
{
bool in_transaction = false;
char *default_user = NULL;
&default_user, &map_order);
goto fail;
}
goto fail;
}
in_transaction = true;
("Cannot delete existing maps from sysdb\n"));
goto fail;
}
goto fail;
}
goto fail;
}
}
goto fail;
}
/* Just in case more code will follow after this place in the future */
in_transaction = false;
return;
fail:
if (in_transaction) {
}
}
} else {
}
}
struct ipa_selinux_ctx *selinux_ctx)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct ipa_get_selinux_state *state;
bool offline;
return NULL;
}
if (!offline) {
goto immediate;
}
if (!subreq) {
goto immediate;
}
} else {
goto immediate;
}
return req;
} else {
}
return req;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
int dp_error = DP_ERR_FATAL;
int ret;
const char *access_name;
const char *selinux_name;
const char *attrs[] = { SYSDB_ORIG_DN,
NULL };
struct ldb_message **msgs;
struct sysdb_attrs **hosts;
struct sss_domain_info *domain;
if (dp_error == DP_ERR_OFFLINE) {
}
goto fail;
}
goto fail;
}
/* Look up the host to get its originalMemberOf entries */
/* We need to query the server */
goto server;
goto fail;
} else if (count > 1) {
goto fail;
}
goto fail;
}
return ipa_get_config_step(req);
}
NULL,
goto fail;
}
return;
fail:
}
{
struct tevent_req);
struct ipa_get_selinux_state);
struct sysdb_attrs **hostgroups;
struct sysdb_attrs **host;
goto done;
}
return ipa_get_config_step(req);
done:
}
}
{
const char *domain;
struct tevent_req *subreq;
struct ipa_get_selinux_state);
return;
}
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
if (!subreq) {
goto done;
}
return;
done:
} else {
}
}
{
struct tevent_req *req;
struct ipa_get_selinux_state *state;
struct ipa_id_ctx *id_ctx;
char *selinux_name;
char *access_name;
struct sysdb_attrs **rules;
const char *tmp_str;
int i;
/* This is returned if no SELinux mapping
* rules were found. In that case no error
* occurred, but we don't want any more processing.*/
}
goto done;
}
goto done;
}
priority);
goto done;
}
continue;
}
continue;
}
}
if (state->possible_matches) {
&rule_count, &rules);
goto done;
}
goto done;
}
goto done;
}
return;
}
done:
} else {
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
struct sysdb_attrs **rules;
&rules);
("Received %d HBAC rules\n", rule_count));
goto done;
}
done:
} else {
}
}
static int
struct sysdb_attrs **rules,
{
int i, j;
const char *hbac_dn;
const char *seealso_dn;
struct sysdb_attrs *usermap;
struct ldb_message_element *el;
for (i = 0; i < rule_count; i++) {
goto done;
}
/* We need to do this translation for further processing. We have to
* do it manually because no map was used to retrieve HBAC rules.
*/
("Matching HBAC rule %s with SELinux mappings\n", hbac_dn));
continue;
}
/* HBAC rule matched, find if it is in the "possible" list */
for (j = 0; j < state->possible_matches; j++) {
continue;
}
goto done;
}
"attributes to SELinux user map [%s]\n",
hbac_dn, seealso_dn));
priority);
goto done;
}
goto done;
}
goto done;
}
/* Just to boost the following lookup */
}
}
}
/* Now we can dispose all possible rules, since they aren't possible any more */
done:
return ret;
}
static errno_t
struct sysdb_attrs ***maps,
char **default_user,
char **map_order)
{
struct ipa_get_selinux_state *state =
const char *tmp_str;
&tmp_str);
return ret;
}
if (*default_user == NULL) {
return ENOMEM;
}
}
&tmp_str);
return ret;
}
return ENOMEM;
}
} else {
*default_user = NULL;
}
} else {
*count = 0;
}
return EOK;
}