sdap_sudo_shared.c revision e085a79acfcd5331b6f99748e21765579a9a99f2
112fd4f283bc07af680c305545d6e31dcde4b943gryzor/*
112fd4f283bc07af680c305545d6e31dcde4b943gryzor Authors:
112fd4f283bc07af680c305545d6e31dcde4b943gryzor Pavel Březina <pbrezina@redhat.com>
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor Copyright (C) 2015 Red Hat
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor This program is free software; you can redistribute it and/or modify
112fd4f283bc07af680c305545d6e31dcde4b943gryzor it under the terms of the GNU General Public License as published by
112fd4f283bc07af680c305545d6e31dcde4b943gryzor the Free Software Foundation; either version 3 of the License, or
112fd4f283bc07af680c305545d6e31dcde4b943gryzor (at your option) any later version.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor This program is distributed in the hope that it will be useful,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor but WITHOUT ANY WARRANTY; without even the implied warranty of
112fd4f283bc07af680c305545d6e31dcde4b943gryzor MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
112fd4f283bc07af680c305545d6e31dcde4b943gryzor GNU General Public License for more details.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor You should have received a copy of the GNU General Public License
112fd4f283bc07af680c305545d6e31dcde4b943gryzor along with this program. If not, see <http://www.gnu.org/licenses/>.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor*/
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include <errno.h>
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include <time.h>
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include <talloc.h>
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include "util/util.h"
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include "providers/dp_ptask.h"
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include "providers/ldap/sdap.h"
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include "providers/ldap/sdap_sudo_shared.h"
112fd4f283bc07af680c305545d6e31dcde4b943gryzor#include "db/sysdb_sudo.h"
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzorerrno_t
112fd4f283bc07af680c305545d6e31dcde4b943gryzorsdap_sudo_ptask_setup_generic(struct be_ctx *be_ctx,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor struct dp_option *opts,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor be_ptask_send_t full_send_fn,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor be_ptask_recv_t full_recv_fn,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor be_ptask_send_t smart_send_fn,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor be_ptask_recv_t smart_recv_fn,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor void *pvt)
112fd4f283bc07af680c305545d6e31dcde4b943gryzor{
112fd4f283bc07af680c305545d6e31dcde4b943gryzor time_t smart;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor time_t full;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor time_t delay;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor time_t last_refresh;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor errno_t ret;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor smart = dp_opt_get_int(opts, SDAP_SUDO_SMART_REFRESH_INTERVAL);
112fd4f283bc07af680c305545d6e31dcde4b943gryzor full = dp_opt_get_int(opts, SDAP_SUDO_FULL_REFRESH_INTERVAL);
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor if (smart == 0 && full == 0) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* We don't allow both types to be disabled. At least smart refresh
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * needs to be enabled. In this case smart refresh will catch up new
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * and modified rules and deleted rules are caught when expired. */
112fd4f283bc07af680c305545d6e31dcde4b943gryzor smart = opts[SDAP_SUDO_SMART_REFRESH_INTERVAL].def_val.number;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor DEBUG(SSSDBG_CONF_SETTINGS, "At least smart refresh needs to be "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "enabled. Setting smart refresh interval to default value "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "(%ld) seconds.\n", smart);
112fd4f283bc07af680c305545d6e31dcde4b943gryzor } else if (full <= smart) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* In this case it does not make any sense to run smart refresh. */
112fd4f283bc07af680c305545d6e31dcde4b943gryzor smart = 0;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor DEBUG(SSSDBG_CONF_SETTINGS, "Smart refresh interval has to be lower "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "than full refresh interval. Periodical smart refresh will be "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "disabled.\n");
112fd4f283bc07af680c305545d6e31dcde4b943gryzor }
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor ret = sysdb_sudo_get_last_full_refresh(be_ctx->domain, &last_refresh);
112fd4f283bc07af680c305545d6e31dcde4b943gryzor if (ret != EOK) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor DEBUG(SSSDBG_MINOR_FAILURE, "Unable to obtain time of last full "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "refresh. Assuming none was performed so far.\n");
112fd4f283bc07af680c305545d6e31dcde4b943gryzor last_refresh = 0;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor }
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor if (last_refresh == 0) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* If this is the first startup, we need to kick off an refresh
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * immediately, to close a window where clients requesting sudo
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * information won't get an immediate reply with no entries */
112fd4f283bc07af680c305545d6e31dcde4b943gryzor delay = 0;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor } else {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* At least one update has previously run, so clients will get cached
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * data. We will delay the refresh so we don't slow down the startup
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * process if this is happening during system boot. */
112fd4f283bc07af680c305545d6e31dcde4b943gryzor delay = 10;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor }
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* Full refresh.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor *
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * Disable when offline and run immediately when SSSD goes back online.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * Since we have periodical online check we don't have to run this task
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * when offline. */
112fd4f283bc07af680c305545d6e31dcde4b943gryzor if (full > 0) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor ret = be_ptask_create(be_ctx, be_ctx, full, delay, 0, 0, full,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor BE_PTASK_OFFLINE_DISABLE, 0,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor full_send_fn, full_recv_fn, pvt,
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "SUDO Full Refresh", NULL);
112fd4f283bc07af680c305545d6e31dcde4b943gryzor if (ret != EOK) {
112fd4f283bc07af680c305545d6e31dcde4b943gryzor DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup full refresh ptask "
112fd4f283bc07af680c305545d6e31dcde4b943gryzor "[%d]: %s\n", ret, sss_strerror(ret));
112fd4f283bc07af680c305545d6e31dcde4b943gryzor return ret;
112fd4f283bc07af680c305545d6e31dcde4b943gryzor }
112fd4f283bc07af680c305545d6e31dcde4b943gryzor }
112fd4f283bc07af680c305545d6e31dcde4b943gryzor
112fd4f283bc07af680c305545d6e31dcde4b943gryzor /* Smart refresh.
112fd4f283bc07af680c305545d6e31dcde4b943gryzor *
112fd4f283bc07af680c305545d6e31dcde4b943gryzor * Disable when offline and reschedule normally when SSSD goes back online.
* Since we have periodical online check we don't have to run this task
* when offline. */
if (smart > 0) {
ret = be_ptask_create(be_ctx, be_ctx, smart, delay + smart, smart, 0,
smart, BE_PTASK_OFFLINE_DISABLE, 0,
smart_send_fn, smart_recv_fn, pvt,
"SUDO Smart Refresh", NULL);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup smart refresh ptask "
"[%d]: %s\n", ret, sss_strerror(ret));
return ret;
}
}
return EOK;
}
void
sdap_sudo_set_usn(struct sdap_server_opts *srv_opts,
char *usn)
{
unsigned int usn_number;
char *endptr = NULL;
if (srv_opts == NULL) {
DEBUG(SSSDBG_TRACE_FUNC, "Bug: srv_opts is NULL\n");
return;
}
if (usn == NULL) {
DEBUG(SSSDBG_TRACE_FUNC, "Bug: usn is NULL\n");
return;
}
if (sysdb_compare_usn(usn, srv_opts->max_sudo_value) > 0) {
talloc_zfree(srv_opts->max_sudo_value);
srv_opts->max_sudo_value = talloc_steal(srv_opts, usn);
}
usn_number = strtoul(usn, &endptr, 10);
if ((endptr == NULL || (*endptr == '\0' && endptr != usn))
&& (usn_number > srv_opts->last_usn)) {
srv_opts->last_usn = usn_number;
}
DEBUG(SSSDBG_FUNC_DATA, "SUDO higher USN value: [%s]\n",
srv_opts->max_sudo_value);
}