sdap_sudo.c revision ca4b7b92738f3dd463914e3de5757cd98d37a983
/*
Authors:
Pavel Březina <pbrezina@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <string.h>
#include <tevent.h>
#include "providers/dp_backend.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_sudo.h"
#include "providers/ldap/sdap_sudo_cache.h"
#include "providers/ldap/sdap_sudo_timer.h"
#include "db/sysdb_sudo.h"
static void
{
}
struct bet_ops sdap_sudo_ops = {
};
struct sdap_id_ctx *id_ctx,
void **pvt_data)
{
int ret;
*ops = &sdap_sudo_ops;
return ret;
}
return ret;
}
return EOK;
}
{
bool refreshed = false;
/* set up periodical update of sudo rules */
if (refresh_enabled) {
if (refresh_ctx == NULL) {
("sdap_sudo_refresh_ctx_init() failed!\n"));
return ENOMEM;
}
/* If this is the first startup, we need to kick off
* an refresh immediately, to close a window where
* clients requesting sudo information won't get an
* immediate reply with no entries
*/
return ret;
}
if (refreshed) {
/* At least one update has previously run,
* so clients will get cached data. We will delay
* starting to enumerate by 10s so we don't slow
* down the startup process if this is happening
* during system boot.
*/
"for 10 seconds\n"));
} else {
/* This is our first startup. Schedule the
* update to start immediately once we
* enter the mainloop.
*/
tv = tevent_timeval_current();
}
return ret;
}
}
return EOK;
}
struct sdap_sudo_load_sudoers_state {
struct tevent_context *ev;
struct sdap_sudo_ctx *sudo_ctx;
struct sdap_options *opts;
struct sdap_handle *sh;
const char **attrs;
const char *filter;
struct sdap_search_base **search_bases;
int timeout;
};
struct sdap_sudo_refresh_state {
struct be_sudo_req *sudo_req;
struct sdap_options *opts;
struct sdap_id_op *sdap_op;
struct sdap_id_conn_cache *sdap_conn_cache;
int dp_error;
int error;
};
struct tevent_context *ev,
struct be_sudo_req *sudo_req,
struct sdap_options *opts,
struct sdap_handle *sh);
struct sysdb_attrs ***rules);
struct sss_domain_info *domain,
struct be_sudo_req *sudo_req);
struct sdap_options *opts,
struct sysdb_attrs **rules);
struct sdap_attr_map *map,
struct be_sudo_req *sudo_req);
struct sdap_attr_map *map,
const char *username,
char **groups);
{
int dp_error;
int error;
int ret;
return;
}
}
{
struct sdap_id_ctx);
/* get user info */
goto fail;
}
} else {
}
id_ctx->conn_cache);
goto fail;
}
return;
fail:
}
struct be_sudo_req *sudo_req,
struct sdap_options *opts,
struct sdap_id_conn_cache *conn_cache)
{
int ret;
if (!req) {
return NULL;
}
case BE_REQ_SUDO_ALL:
break;
case BE_REQ_SUDO_DEFAULTS:
break;
case BE_REQ_SUDO_USER:
break;
default:
goto immediately;
}
/* asynchronous processing */
return req;
}
} else {
}
return req;
}
int *dp_error,
int *error)
{
return EOK;
}
{
int ret;
return EOK;
}
return EIO;
}
}
return ret;
}
return EAGAIN;
}
{
int dp_error;
int ret;
if (dp_error == DP_ERR_OFFLINE) {
return;
goto fail;
}
goto fail;
}
return;
fail:
}
struct tevent_context *ev,
struct be_sudo_req *sudo_req,
struct sdap_options *opts,
struct sdap_handle *sh)
{
int ret;
if (!req) {
return NULL;
}
state->ldap_rules_count = 0;
if (!state->search_bases) {
("SUDOERS lookup request without a search base\n"));
goto done;
}
/* create filter */
goto fail;
}
/* create attrs from map */
goto fail;
}
/* begin search */
done:
}
return req;
fail:
return NULL;
}
{
if (search_base == NULL) {
/* should not happen */
return EFAULT;
}
/* create filter */
return ENOMEM;
}
/* send request */
("Searching for sudo rules with base [%s]\n",
search_base->basedn));
true);
return ENOMEM;
}
return EOK;
}
{
int ret;
int i;
("Receiving sudo rules with base [%s]\n",
search_base->basedn));
if (ret) {
return;
}
/* add rules to result */
if (count > 0) {
struct sysdb_attrs *,
return;
}
for (i = 0; i < count; i++) {
}
}
/* go to next base */
}
return;
}
/* we are done */
}
struct sysdb_attrs ***rules)
{
return EOK;
}
{
int ret;
goto done;
}
/* purge cache */
goto done;
}
/* store rules */
rules_count, rules);
goto done;
}
done:
} else {
}
}
struct sss_domain_info *domain,
struct be_sudo_req *sudo_req)
{
bool in_transaction = false;
return ENOMEM;
}
goto done;
}
in_transaction = true;
case BE_REQ_SUDO_ALL:
break;
case BE_REQ_SUDO_DEFAULTS:
break;
case BE_REQ_SUDO_USER:
/* netgroups */
goto done;
}
goto done;
}
/* user, uid, groups */
true);
goto done;
}
break;
default:
return EINVAL;
}
goto done;
}
in_transaction = false;
}
done:
if (in_transaction) {
}
}
return ret;
}
struct sdap_options *opts,
struct sysdb_attrs **rules)
{
/* Empty sudoers? Done. */
return EOK;
}
rules, rules_count);
return ret;
}
return EOK;
}
struct sdap_attr_map *map,
struct be_sudo_req *sudo_req)
{
case BE_REQ_SUDO_ALL:
break;
case BE_REQ_SUDO_DEFAULTS:
SDAP_SUDO_DEFAULTS); /* FIXME: add option for this */
break;
case BE_REQ_SUDO_USER:
break;
default:
return NULL;
}
}
/* alway update cn=defaults and sudoUser=ALL */
struct sdap_attr_map *map,
const char *username,
char **groups)
{
int ret;
/* user name */
goto fail;
}
goto fail;
}
/* user uid */
uid);
goto fail;
}
/* groups */
goto fail;
}
goto fail;
}
}
}
/* netgroups */
/*
* FIXME: load only netgroups user is member of
* FIXME: add option to disable this filter
*/
"*");
goto fail;
}
SDAP_SUDO_DEFAULTS, /* FIXME: add option for this */
filter);
return output;
fail:
return NULL;
}