ipa_selinux.c revision fa0dba8f5536537a69d47218f2372d0f2582c12e
/*
SSSD
IPA Backend Module -- selinux loading
Authors:
Jan Zeleny <jzeleny@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include "db/sysdb_selinux.h"
#include "util/sss_selinux.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_config.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ipa/ipa_hosts.h"
#include "providers/ipa/ipa_hbac_rules.h"
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_common.h"
#include "providers/ipa/ipa_selinux_maps.h"
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx);
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order);
static struct ipa_selinux_op_ctx *
const char *hostname);
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
struct ipa_selinux_op_ctx {
struct sysdb_attrs *user;
struct sysdb_attrs *host;
};
{
struct ipa_selinux_ctx *selinux_ctx;
struct ipa_selinux_op_ctx *op_ctx;
struct tevent_req *req;
const char *hostname;
struct ipa_selinux_ctx);
if (!hostname) {
goto fail;
}
goto fail;
}
goto fail;
}
return;
fail:
}
static struct ipa_selinux_op_ctx *
const char *hostname)
{
struct ipa_selinux_op_ctx *op_ctx;
const char *attrs[] = { SYSDB_ORIG_DN,
NULL };
struct ldb_message **msgs;
struct sysdb_attrs **hosts;
return NULL;
}
goto fail;
}
goto fail;
}
/* Look up the host to get its originalMemberOf entries */
return op_ctx;
goto fail;
} else if (count > 1) {
goto fail;
}
goto fail;
}
return op_ctx;
fail:
return NULL;
}
{
bool in_transaction = false;
char *default_user = NULL;
size_t hbac_count = 0;
struct sysdb_attrs **hbac_rules = 0;
&hbac_count, &hbac_rules,
&default_user, &map_order);
goto fail;
}
goto fail;
}
goto fail;
}
in_transaction = true;
("Cannot delete existing maps from sysdb\n"));
goto fail;
}
goto fail;
}
goto fail;
}
}
goto fail;
}
in_transaction = false;
return;
fail:
if (in_transaction) {
}
}
} else {
}
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **selinux_maps,
struct sysdb_attrs **hbac_rules,
{
int i;
struct sysdb_attrs **seealso_rules;
const char *seealso_str;
if (!tmp_ctx) {
return ENOMEM;
}
selinux_map_count + 1);
if (seealso_rules == NULL) {
goto done;
}
num_seealso_rules = 0;
for (i = 0; i < selinux_map_count; i++) {
priority);
goto done;
}
continue;
}
continue;
goto done;
}
}
goto done;
}
done:
return ret;
}
static errno_t
struct sysdb_attrs *host,
struct sysdb_attrs **seealso_rules,
struct sysdb_attrs **hbac_rules,
{
int i, j;
struct ldb_message_element *el;
struct sysdb_attrs *usermap;
const char *seealso_dn;
const char *hbac_dn;
for (i = 0; i < hbac_rule_count; i++) {
return ret;
}
/* We need to do this translation for further processing. We have to
* do it manually because no map was used to retrieve HBAC rules.
*/
("Matching HBAC rule %s with SELinux mappings\n", hbac_dn));
continue;
}
/* HBAC rule matched, find if it is in the "possible" list */
for (j = 0; j < seealso_rules_count; j++) {
usermap = seealso_rules[j];
continue;
}
return ret;
}
"attributes to SELinux user map [%s]\n",
hbac_dn, seealso_dn));
priority);
return ret;
}
return ret;
}
return ret;
}
/* Speed up the next iteration */
seealso_rules[j] = NULL;
}
}
}
return EOK;
}
/* A more generic request to gather all SELinux and HBAC rules. Updates
* cache if necessary
*/
struct ipa_get_selinux_state {
struct ipa_selinux_ctx *selinux_ctx;
struct sdap_id_op *op;
struct sysdb_attrs *host;
struct sysdb_attrs *user;
struct sysdb_attrs *defaults;
struct sysdb_attrs **selinuxmaps;
struct sysdb_attrs **hbac_rules;
};
static errno_t
static struct tevent_req *
struct sysdb_attrs *user,
struct sysdb_attrs *host,
struct ipa_selinux_ctx *selinux_ctx)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct ipa_get_selinux_state *state;
bool offline;
return NULL;
}
if (!offline) {
goto immediate;
}
if (!subreq) {
goto immediate;
}
} else {
goto immediate;
}
return req;
} else {
}
return req;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
int dp_error = DP_ERR_FATAL;
int ret;
const char *access_name;
const char *selinux_name;
const char *hostname;
if (dp_error == DP_ERR_OFFLINE) {
return;
}
goto fail;
}
goto fail;
}
/* If the access control module is the same as the selinux module
* and the access control had already discovered the host
*/
return ipa_get_config_step(req);
}
goto fail;
}
NULL,
goto fail;
}
return;
fail:
}
static errno_t
{
struct ldb_message **maps;
struct ldb_message *defaults;
const char *attrs[] = { SYSDB_NAME,
NULL };
const char *default_user;
const char *order;
struct ipa_get_selinux_state);
/* read the config entry */
return ret;
}
NULL);
NULL);
return ENOMEM;
}
return ret;
}
return ret;
}
/* read all the SELinux rules */
return ret;
}
return ret;
}
/* read all the HBAC rules */
return ret;
}
return EOK;
}
{
struct tevent_req);
struct ipa_get_selinux_state);
struct sysdb_attrs **hostgroups;
struct sysdb_attrs **host;
goto done;
}
return ipa_get_config_step(req);
done:
}
}
{
const char *domain;
struct tevent_req *subreq;
struct ipa_get_selinux_state);
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
goto done;
}
if (!subreq) {
goto done;
}
return;
done:
} else {
}
}
{
struct tevent_req *req;
struct ipa_get_selinux_state *state;
struct ipa_id_ctx *id_ctx;
char *selinux_name;
char *access_name;
const char *tmp_str;
bool check_hbac;
int i;
/* This is returned if no SELinux mapping
* rules were found. In that case no error
* occurred, but we don't want any more processing.*/
}
goto done;
}
check_hbac = false;
check_hbac = true;
break;
}
}
if (check_hbac) {
/* Terminates the request */
goto done;
}
"Need to refresh HBAC rules\n"));
goto done;
}
return;
}
done:
} else {
}
}
{
struct tevent_req);
struct ipa_get_selinux_state);
&state->hbac_rules);
} else {
}
}
static errno_t
struct sysdb_attrs ***maps,
struct sysdb_attrs ***hbac_rules,
char **default_user,
char **map_order)
{
struct ipa_get_selinux_state *state =
const char *tmp_str;
&tmp_str);
return ret;
}
if (*default_user == NULL) {
return ENOMEM;
}
}
&tmp_str);
return ret;
}
return ENOMEM;
}
} else {
*default_user = NULL;
}
} else {
*count = 0;
}
} else {
*hbac_count = 0;
*hbac_rules = NULL;
}
return EOK;
}