3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb#include "providers/dp_backend.h"

3568de757bac0b47256647504c186d17ca272f85rbb#include "providers/simple/simple_access.h"

3568de757bac0b47256647504c186d17ca272f85rbb#include "util/sss_utf8.h"

3568de757bac0b47256647504c186d17ca272f85rbb#include "db/sysdb.h"

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbbstatic bool

3568de757bac0b47256647504c186d17ca272f85rbbis_posix(const struct ldb_message *group)

3568de757bac0b47256647504c186d17ca272f85rbb{

3568de757bac0b47256647504c186d17ca272f85rbb const char *val;

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb val = ldb_msg_find_attr_as_string(group, SYSDB_POSIX, NULL);

3568de757bac0b47256647504c186d17ca272f85rbb if (!val || /* Groups are posix by default */

3568de757bac0b47256647504c186d17ca272f85rbb strcasecmp(val, "TRUE") == 0) {

3568de757bac0b47256647504c186d17ca272f85rbb return true;

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb return false;

3568de757bac0b47256647504c186d17ca272f85rbb}

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbbstatic errno_t

3568de757bac0b47256647504c186d17ca272f85rbbsimple_check_users(struct simple_ctx *ctx, const char *username,

3568de757bac0b47256647504c186d17ca272f85rbb bool *access_granted)

3568de757bac0b47256647504c186d17ca272f85rbb{

3568de757bac0b47256647504c186d17ca272f85rbb struct sss_domain_info *domain = NULL;

3568de757bac0b47256647504c186d17ca272f85rbb int i;

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb /* First, check whether the user is in the allowed users list */

3568de757bac0b47256647504c186d17ca272f85rbb if (ctx->allow_users != NULL) {

3568de757bac0b47256647504c186d17ca272f85rbb for(i = 0; ctx->allow_users[i] != NULL; i++) {

3568de757bac0b47256647504c186d17ca272f85rbb domain = find_subdomain_by_object_name(ctx->domain,

3568de757bac0b47256647504c186d17ca272f85rbb ctx->allow_users[i]);

3568de757bac0b47256647504c186d17ca272f85rbb if (domain == NULL) {

3568de757bac0b47256647504c186d17ca272f85rbb DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid user %s!\n",

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ctx->allow_users[i]));

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return EINVAL;

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding

3568de757bac0b47256647504c186d17ca272f85rbb if (sss_string_equal(domain->case_sensitive, username,

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick ctx->allow_users[i])) {

3568de757bac0b47256647504c186d17ca272f85rbb DEBUG(SSSDBG_TRACE_LIBS,

3568de757bac0b47256647504c186d17ca272f85rbb ("User [%s] found in allow list, access granted.\n",

3568de757bac0b47256647504c186d17ca272f85rbb username));

3568de757bac0b47256647504c186d17ca272f85rbb

98fb535f829e2a95aabd82420931f476661fa8e3jorton /* Do not return immediately on explicit allow

333eac96e4fb7d6901cb75e6ca7bb22b2ccb84cetrawick *access_granted = true;

333eac96e4fb7d6901cb75e6ca7bb22b2ccb84cetrawick }

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem }

3568de757bac0b47256647504c186d17ca272f85rbb } else if (!ctx->allow_groups) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz /* If neither allow rule is in place, we'll assume allowed

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_TRACE_LIBS,

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ("No allow rule, assumuing allow unless explicitly denied\n"));

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *access_granted = true;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding /* Next check whether this user has been specifically denied */

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (ctx->deny_users != NULL) {

8f3ec4772d2aeb347cf40e87c77627bb784dd018rbb for(i = 0; ctx->deny_users[i] != NULL; i++) {

8f3ec4772d2aeb347cf40e87c77627bb784dd018rbb domain = find_subdomain_by_object_name(ctx->domain,

3d96ee83babeec32482c9082c9426340cee8c44dwrowe ctx->deny_users[i]);

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (domain == NULL) {

b6e310e482c42cc323a28fa6fec653e11e0552e5jorton DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid user %s!\n",

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick ctx->deny_users[i]));

98fb535f829e2a95aabd82420931f476661fa8e3jorton return EINVAL;

f0e395a55abfcad3d2bd7c63470003b08a93d567nd }

f0e395a55abfcad3d2bd7c63470003b08a93d567nd

f0e395a55abfcad3d2bd7c63470003b08a93d567nd if (sss_string_equal(domain->case_sensitive, username,

f0e395a55abfcad3d2bd7c63470003b08a93d567nd ctx->deny_users[i])) {

98fb535f829e2a95aabd82420931f476661fa8e3jorton DEBUG(SSSDBG_TRACE_LIBS,

7cd5419264796cfeaf8215383cf0f89130a81fectrawick ("User [%s] found in deny list, access denied.\n",

7cd5419264796cfeaf8215383cf0f89130a81fectrawick ctx->deny_users[i]));

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawick /* Return immediately on explicit denial */

7cd5419264796cfeaf8215383cf0f89130a81fectrawick *access_granted = false;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick return EOK;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick }

7cd5419264796cfeaf8215383cf0f89130a81fectrawick }

3568de757bac0b47256647504c186d17ca272f85rbb }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

3568de757bac0b47256647504c186d17ca272f85rbb return EAGAIN;

3568de757bac0b47256647504c186d17ca272f85rbb}

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

3568de757bac0b47256647504c186d17ca272f85rbbstatic errno_t

3568de757bac0b47256647504c186d17ca272f85rbbsimple_check_groups(struct simple_ctx *ctx, const char **group_names,

3568de757bac0b47256647504c186d17ca272f85rbb bool *access_granted)

3568de757bac0b47256647504c186d17ca272f85rbb{

3568de757bac0b47256647504c186d17ca272f85rbb struct sss_domain_info *domain = NULL;

3568de757bac0b47256647504c186d17ca272f85rbb bool matched;

3568de757bac0b47256647504c186d17ca272f85rbb int i, j;

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb /* Now process allow and deny group rules

936a4025e45887d9f366bf54360c51937b6bcacejim if (ctx->allow_groups && !*access_granted) {

936a4025e45887d9f366bf54360c51937b6bcacejim matched = false;

936a4025e45887d9f366bf54360c51937b6bcacejim for (i = 0; ctx->allow_groups[i]; i++) {

936a4025e45887d9f366bf54360c51937b6bcacejim domain = find_subdomain_by_object_name(ctx->domain,

936a4025e45887d9f366bf54360c51937b6bcacejim ctx->allow_groups[i]);

936a4025e45887d9f366bf54360c51937b6bcacejim if (domain == NULL) {

936a4025e45887d9f366bf54360c51937b6bcacejim DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid group %s!\n",

936a4025e45887d9f366bf54360c51937b6bcacejim ctx->allow_groups[i]));

3568de757bac0b47256647504c186d17ca272f85rbb return EINVAL;

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb for(j = 0; group_names[j]; j++) {

936a4025e45887d9f366bf54360c51937b6bcacejim if (sss_string_equal(domain->case_sensitive,

936a4025e45887d9f366bf54360c51937b6bcacejim group_names[j], ctx->allow_groups[i])) {

936a4025e45887d9f366bf54360c51937b6bcacejim matched = true;

3568de757bac0b47256647504c186d17ca272f85rbb break;

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb

41634f717c623556a16b27b25d7d909a66fe20f8wrowe /* If any group has matched, we can skip out on the

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz if (matched) {

3568de757bac0b47256647504c186d17ca272f85rbb DEBUG(SSSDBG_TRACE_LIBS,

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ("Group [%s] found in allow list, access granted.\n",

3568de757bac0b47256647504c186d17ca272f85rbb group_names[j]));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz *access_granted = true;

3568de757bac0b47256647504c186d17ca272f85rbb break;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

3568de757bac0b47256647504c186d17ca272f85rbb }

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }

41634f717c623556a16b27b25d7d909a66fe20f8wrowe

3568de757bac0b47256647504c186d17ca272f85rbb /* Finally, process the deny group rules */

3568de757bac0b47256647504c186d17ca272f85rbb if (ctx->deny_groups) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz matched = false;

3568de757bac0b47256647504c186d17ca272f85rbb for (i = 0; ctx->deny_groups[i]; i++) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz domain = find_subdomain_by_object_name(ctx->domain,

3568de757bac0b47256647504c186d17ca272f85rbb ctx->deny_groups[i]);

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz if (domain == NULL) {

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid group %s!\n",

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ctx->deny_groups[i]));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz return EINVAL;

3568de757bac0b47256647504c186d17ca272f85rbb }

fc1efab92032301e317f07e1b3a00082d9d71f3frbb

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz for(j = 0; group_names[j]; j++) {

24b534291150023e6b68eca89ddd33e475ccddc0wrowe if (sss_string_equal(domain->case_sensitive,

3568de757bac0b47256647504c186d17ca272f85rbb group_names[j], ctx->deny_groups[i])) {

24b534291150023e6b68eca89ddd33e475ccddc0wrowe matched = true;

3568de757bac0b47256647504c186d17ca272f85rbb break;

24b534291150023e6b68eca89ddd33e475ccddc0wrowe }

24b534291150023e6b68eca89ddd33e475ccddc0wrowe }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

3568de757bac0b47256647504c186d17ca272f85rbb /* If any group has matched, we can skip out on the

3568de757bac0b47256647504c186d17ca272f85rbb if (matched) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_TRACE_LIBS,

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ("Group [%s] found in deny list, access denied.\n",

3568de757bac0b47256647504c186d17ca272f85rbb group_names[j]));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz *access_granted = false;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz break;

3568de757bac0b47256647504c186d17ca272f85rbb }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb return EOK;

3568de757bac0b47256647504c186d17ca272f85rbb}

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbbstruct simple_resolve_group_state {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct sss_domain_info *domain;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz gid_t gid;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct simple_ctx *ctx;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

3568de757bac0b47256647504c186d17ca272f85rbb const char *name;

3568de757bac0b47256647504c186d17ca272f85rbb};

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbbstatic errno_t

3568de757bac0b47256647504c186d17ca272f85rbbsimple_resolve_group_check(struct simple_resolve_group_state *state);

3568de757bac0b47256647504c186d17ca272f85rbbstatic void simple_resolve_group_done(struct tevent_req *subreq);

3568de757bac0b47256647504c186d17ca272f85rbb

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantzstatic struct tevent_req *

3568de757bac0b47256647504c186d17ca272f85rbbsimple_resolve_group_send(TALLOC_CTX *mem_ctx,

3568de757bac0b47256647504c186d17ca272f85rbb struct tevent_context *ev,

3568de757bac0b47256647504c186d17ca272f85rbb struct simple_ctx *ctx,

3568de757bac0b47256647504c186d17ca272f85rbb struct sss_domain_info *domain,

3568de757bac0b47256647504c186d17ca272f85rbb gid_t gid)

3568de757bac0b47256647504c186d17ca272f85rbb{

3568de757bac0b47256647504c186d17ca272f85rbb errno_t ret;

3568de757bac0b47256647504c186d17ca272f85rbb struct tevent_req *req;

3568de757bac0b47256647504c186d17ca272f85rbb struct tevent_req *subreq;

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding struct simple_resolve_group_state *state;

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding struct be_acct_req *ar;

3568de757bac0b47256647504c186d17ca272f85rbb

239f998fbee5ac5b114b965bb76e217cce0003edstoddard req = tevent_req_create(mem_ctx, &state,

78ae889ffe0fdfab72f56c6993b0f302cb48da55rbb struct simple_resolve_group_state);

3568de757bac0b47256647504c186d17ca272f85rbb if (!req) return NULL;

6653a33e820463abd4f81915b7a1eba0f602e200brianp

6653a33e820463abd4f81915b7a1eba0f602e200brianp state->domain = domain;

6653a33e820463abd4f81915b7a1eba0f602e200brianp state->gid = gid;

41634f717c623556a16b27b25d7d909a66fe20f8wrowe state->ctx = ctx;

41634f717c623556a16b27b25d7d909a66fe20f8wrowe

6653a33e820463abd4f81915b7a1eba0f602e200brianp /* First check if the group was updated already. If it was (maybe its

ad83978f20c7d1a4323059d9af122e56fcd353bdstoddard ret = simple_resolve_group_check(state);

6653a33e820463abd4f81915b7a1eba0f602e200brianp if (ret == EOK) {

7cd5419264796cfeaf8215383cf0f89130a81fectrawick DEBUG(SSSDBG_TRACE_LIBS, ("Group already updated\n"));

3568de757bac0b47256647504c186d17ca272f85rbb ret = EOK;

6653a33e820463abd4f81915b7a1eba0f602e200brianp goto done;

6653a33e820463abd4f81915b7a1eba0f602e200brianp } else if (ret != EAGAIN) {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm DEBUG(SSSDBG_OP_FAILURE,

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm ("Cannot check if group was already updated [%d]: %s\n",

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick ret, sss_strerror(ret)));

36c8049de63c446926139936c3d195330a0539cetrawick goto done;

3568de757bac0b47256647504c186d17ca272f85rbb }

dd028aa8111afb6534fece555e8c2d408894671etrawick /* EAGAIN - still needs update */

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding

e8f95a682820a599fe41b22977010636be5c2717jim ar = talloc(state, struct be_acct_req);

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz if (!ar) {

ca53a74f4012a45cbad48e940eddf27d866981f9dougm ret = ENOMEM;

ca53a74f4012a45cbad48e940eddf27d866981f9dougm goto done;

ca53a74f4012a45cbad48e940eddf27d866981f9dougm }

dd028aa8111afb6534fece555e8c2d408894671etrawick

dd028aa8111afb6534fece555e8c2d408894671etrawick ar->entry_type = BE_REQ_GROUP;

6653a33e820463abd4f81915b7a1eba0f602e200brianp ar->attr_type = BE_ATTR_CORE;

6653a33e820463abd4f81915b7a1eba0f602e200brianp ar->filter_type = BE_FILTER_IDNUM;

6653a33e820463abd4f81915b7a1eba0f602e200brianp ar->filter_value = talloc_asprintf(ar, "%llu", (unsigned long long) gid);

6653a33e820463abd4f81915b7a1eba0f602e200brianp ar->domain = talloc_strdup(ar, state->domain->name);

6653a33e820463abd4f81915b7a1eba0f602e200brianp if (!ar->domain || !ar->filter_value) {

6653a33e820463abd4f81915b7a1eba0f602e200brianp ret = ENOMEM;

6653a33e820463abd4f81915b7a1eba0f602e200brianp goto done;

6653a33e820463abd4f81915b7a1eba0f602e200brianp }

6653a33e820463abd4f81915b7a1eba0f602e200brianp

6653a33e820463abd4f81915b7a1eba0f602e200brianp subreq = be_get_account_info_send(state, ev, NULL, ctx->be_ctx, ar);

6653a33e820463abd4f81915b7a1eba0f602e200brianp if (!subreq) {

6653a33e820463abd4f81915b7a1eba0f602e200brianp ret = ENOMEM;

6653a33e820463abd4f81915b7a1eba0f602e200brianp goto done;

6653a33e820463abd4f81915b7a1eba0f602e200brianp }

6653a33e820463abd4f81915b7a1eba0f602e200brianp tevent_req_set_callback(subreq, simple_resolve_group_done, req);

6653a33e820463abd4f81915b7a1eba0f602e200brianp

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick return req;

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawickdone:

239f998fbee5ac5b114b965bb76e217cce0003edstoddard if (ret == EOK) {

3568de757bac0b47256647504c186d17ca272f85rbb tevent_req_done(req);

3568de757bac0b47256647504c186d17ca272f85rbb } else {

3568de757bac0b47256647504c186d17ca272f85rbb tevent_req_error(req, ret);

12901074f5d6b36d08be84d8637b6f2c21e0da26trawick }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_post(req, ev);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return req;

3568de757bac0b47256647504c186d17ca272f85rbb}

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

48d2edbfb84e5559b5da0f8d614ccab805cc67a8rbbstatic errno_t

0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingsimple_resolve_group_check(struct simple_resolve_group_state *state)

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard{

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding errno_t ret;

f2e009134c7e279f99dfca5bd421f721bf1f7840jorton struct ldb_message *group;

0f081398cf0eef8cc7c66a535d450110a92dc8aefielding const char *group_attrs[] = { SYSDB_NAME, SYSDB_POSIX,

3568de757bac0b47256647504c186d17ca272f85rbb SYSDB_GIDNUM, NULL };

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb /* Check the cache by GID again and fetch the name */

3568de757bac0b47256647504c186d17ca272f85rbb ret = sysdb_search_group_by_gid(state, state->domain->sysdb,

3568de757bac0b47256647504c186d17ca272f85rbb state->domain, state->gid,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard group_attrs, &group);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (ret == ENOENT) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz /* The group is missing, we will try to update it. */

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz return EAGAIN;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard } else if (ret != EOK) {

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem DEBUG(SSSDBG_OP_FAILURE,

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem ("Could not look up group by gid [%"SPRIgid"]: [%d][%s]\n",

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem state->gid, ret, sss_strerror(ret)));

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem return ret;

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem }

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem state->name = ldb_msg_find_attr_as_string(group, SYSDB_NAME, NULL);

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem if (!state->name) {

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem DEBUG(SSSDBG_OP_FAILURE, ("No group name\n"));

83a5021aef5ebb67395b93f75df4fd0f0b4fc8c8fuankg return ERR_ACCOUNT_UNKNOWN;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

9f979f5c8061f6f6f560d1824e0e378ff5b91931rpluem

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (is_posix(group) == false) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_TRACE_LIBS,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ("The group is still non-POSIX\n"));

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return EAGAIN;

f2e009134c7e279f99dfca5bd421f721bf1f7840jorton }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_TRACE_LIBS, ("Got POSIX group\n"));

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return EOK;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard}

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddardstatic void simple_resolve_group_done(struct tevent_req *subreq)

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard{

3568de757bac0b47256647504c186d17ca272f85rbb struct tevent_req *req;

3568de757bac0b47256647504c186d17ca272f85rbb struct simple_resolve_group_state *state;

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick int err_maj;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick int err_min;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick errno_t ret;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick const char *err_msg;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

e8f95a682820a599fe41b22977010636be5c2717jim req = tevent_req_callback_data(subreq, struct tevent_req);

98cd3186185bb28ae6c95a3f159899fcf56a663ftrawick state = tevent_req_data(req, struct simple_resolve_group_state);

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick ret = be_get_account_info_recv(subreq, state,

3568de757bac0b47256647504c186d17ca272f85rbb &err_maj, &err_min, &err_msg);

a72ba68ecbbc61e4b513e50d6000245c33f753dcwrowe talloc_zfree(subreq);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm if (ret) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_OP_FAILURE, ("be_get_account_info_recv failed\n"));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz tevent_req_error(req, ret);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm return;

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm }

3cbd177a6c885562f9ad0cf11695f044489c881dgregames

dd028aa8111afb6534fece555e8c2d408894671etrawick if (err_maj) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_MINOR_FAILURE,

3cbd177a6c885562f9ad0cf11695f044489c881dgregames ("Cannot refresh data from DP: %u,%u: %s\n",

3cbd177a6c885562f9ad0cf11695f044489c881dgregames err_maj, err_min, err_msg));

3cbd177a6c885562f9ad0cf11695f044489c881dgregames tevent_req_error(req, EIO);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return;

5a0f707b48da7703cbe6bc087f13a6735b1c742dgregames }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

5a0f707b48da7703cbe6bc087f13a6735b1c742dgregames /* Check the cache by GID again and fetch the name */

5a0f707b48da7703cbe6bc087f13a6735b1c742dgregames ret = simple_resolve_group_check(state);

5a0f707b48da7703cbe6bc087f13a6735b1c742dgregames if (ret != EOK) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_OP_FAILURE, ("Refresh failed\n"));

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm tevent_req_error(req, ret);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm return;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

ad83978f20c7d1a4323059d9af122e56fcd353bdstoddard tevent_req_done(req);

7cd5419264796cfeaf8215383cf0f89130a81fectrawick}

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawickstatic errno_t

7cd5419264796cfeaf8215383cf0f89130a81fectrawicksimple_resolve_group_recv(struct tevent_req *req,

7cd5419264796cfeaf8215383cf0f89130a81fectrawick TALLOC_CTX *mem_ctx,

7cd5419264796cfeaf8215383cf0f89130a81fectrawick const char **name)

7cd5419264796cfeaf8215383cf0f89130a81fectrawick{

7cd5419264796cfeaf8215383cf0f89130a81fectrawick struct simple_resolve_group_state *state;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawick state = tevent_req_data(req, struct simple_resolve_group_state);

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawick TEVENT_REQ_RETURN_ON_ERROR(req);

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawick *name = talloc_strdup(mem_ctx, state->name);

7cd5419264796cfeaf8215383cf0f89130a81fectrawick return EOK;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick}

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawickstruct simple_group {

7cd5419264796cfeaf8215383cf0f89130a81fectrawick struct sss_domain_info *domain;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick gid_t gid;

7cd5419264796cfeaf8215383cf0f89130a81fectrawick};

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

ad83978f20c7d1a4323059d9af122e56fcd353bdstoddardstruct simple_check_groups_state {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct tevent_context *ev;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct simple_ctx *ctx;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct sss_domain_info *domain;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct simple_group *lookup_groups;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard size_t num_groups;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard size_t giter;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard const char **group_names;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard size_t num_names;

3568de757bac0b47256647504c186d17ca272f85rbb};

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawickstatic void simple_check_get_groups_next(struct tevent_req *subreq);

7cd5419264796cfeaf8215383cf0f89130a81fectrawick

7cd5419264796cfeaf8215383cf0f89130a81fectrawickstatic errno_t

7cd5419264796cfeaf8215383cf0f89130a81fectrawicksimple_check_get_groups_primary(struct simple_check_groups_state *state,

7cd5419264796cfeaf8215383cf0f89130a81fectrawick gid_t gid);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougmstatic errno_t

3568de757bac0b47256647504c186d17ca272f85rbbsimple_check_process_group(struct simple_check_groups_state *state,

3568de757bac0b47256647504c186d17ca272f85rbb struct ldb_message *group);

74fd6d9aeadb9022086259c5c1ae00bc0dda9c9astoddard

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianpstatic struct tevent_req *

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianpsimple_check_get_groups_send(TALLOC_CTX *mem_ctx,

3568de757bac0b47256647504c186d17ca272f85rbb struct tevent_context *ev,

3568de757bac0b47256647504c186d17ca272f85rbb struct simple_ctx *ctx,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard const char *username)

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard{

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard errno_t ret;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct tevent_req *req;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct tevent_req *subreq;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct simple_check_groups_state *state;

1ce78cf71b5baaf2c1ab48e818cb1f2397df5010trawick const char *attrs[] = { SYSDB_NAME, SYSDB_POSIX, SYSDB_GIDNUM,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard SYSDB_SID_STR, NULL };

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard size_t group_count;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct ldb_message *user;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct ldb_message **groups;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz int i;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard gid_t gid;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz req = tevent_req_create(mem_ctx, &state,

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct simple_check_groups_state);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (!req) return NULL;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

dd028aa8111afb6534fece555e8c2d408894671etrawick state->ev = ev;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->ctx = ctx;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_TRACE_LIBS, ("Looking up groups for user %s\n", username));

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb /* get domain from username */

3568de757bac0b47256647504c186d17ca272f85rbb state->domain = find_subdomain_by_object_name(ctx->domain, username);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (state->domain == NULL) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid user %s!\n", username));

f714f1a7002928d785e53e70349700a7f595fee3trawick ret = EINVAL;

f714f1a7002928d785e53e70349700a7f595fee3trawick goto done;

3568de757bac0b47256647504c186d17ca272f85rbb }

ad83978f20c7d1a4323059d9af122e56fcd353bdstoddard

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh ret = sysdb_search_user_by_name(state, state->domain->sysdb, state->domain,

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh username, attrs, &user);

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh if (ret == ENOENT) {

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh DEBUG(SSSDBG_MINOR_FAILURE, ("No such user %s\n", username));

3568de757bac0b47256647504c186d17ca272f85rbb ret = ERR_ACCOUNT_UNKNOWN;

3568de757bac0b47256647504c186d17ca272f85rbb goto done;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard } else if (ret != EOK) {

663237d6bcc59ac0997d71d48a1baa55fa29a3d8jim DEBUG(SSSDBG_OP_FAILURE,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ("Could not look up username [%s]: [%d][%s]\n",

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard username, ret, sss_strerror(ret)));

3568de757bac0b47256647504c186d17ca272f85rbb goto done;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

663237d6bcc59ac0997d71d48a1baa55fa29a3d8jim ret = sysdb_asq_search(state, state->domain->sysdb,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard user->dn, NULL, SYSDB_MEMBEROF,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard attrs, &group_count, &groups);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (ret != EOK) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard goto done;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard DEBUG(SSSDBG_TRACE_FUNC,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ("User %s is a member of %zu supplemental groups\n",

3568de757bac0b47256647504c186d17ca272f85rbb username, group_count));

ad83978f20c7d1a4323059d9af122e56fcd353bdstoddard

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh /* One extra space for terminator, one extra space for private group */

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->group_names = talloc_zero_array(state, const char *, group_count + 2);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->lookup_groups = talloc_zero_array(state, struct simple_group,

3568de757bac0b47256647504c186d17ca272f85rbb group_count + 2);

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh if (!state->group_names || !state->lookup_groups) {

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh ret = ENOMEM;

4a13940dc2990df0a798718d3a3f9cf1566c2217bjh goto done;

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb

663237d6bcc59ac0997d71d48a1baa55fa29a3d8jim for (i=0; i < group_count; i++) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard /* Some providers (like the AD provider) might perform initgroups

3568de757bac0b47256647504c186d17ca272f85rbb ret = simple_check_process_group(state, groups[i]);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (ret != EOK) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz goto done;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

3568de757bac0b47256647504c186d17ca272f85rbb gid = ldb_msg_find_attr_as_uint64(user, SYSDB_GIDNUM, 0);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (!gid) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_MINOR_FAILURE, ("User %s has no gid?\n", username));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ret = EINVAL;

3568de757bac0b47256647504c186d17ca272f85rbb goto done;

3568de757bac0b47256647504c186d17ca272f85rbb }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ret = simple_check_get_groups_primary(state, gid);

3568de757bac0b47256647504c186d17ca272f85rbb if (ret != EOK) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard goto done;

3568de757bac0b47256647504c186d17ca272f85rbb }

3568de757bac0b47256647504c186d17ca272f85rbb

3568de757bac0b47256647504c186d17ca272f85rbb if (state->num_groups == 0) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard /* If all groups could have been resolved by name, we are

3568de757bac0b47256647504c186d17ca272f85rbb DEBUG(SSSDBG_TRACE_FUNC, ("All groups had name attribute\n"));

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick ret = EOK;

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick goto done;

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_TRACE_FUNC, ("Need to resolve %zu groups\n",

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz state->num_groups));

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->giter = 0;

beb70d51e435dc36c56a72b6cd83556c04db9283wrowe subreq = simple_resolve_group_send(req, state->ev, state->ctx,

fe6baec9bbcd36f932b71a355120cd7b5a685d6cfielding state->lookup_groups[state->giter].domain,

3568de757bac0b47256647504c186d17ca272f85rbb state->lookup_groups[state->giter].gid);

3568de757bac0b47256647504c186d17ca272f85rbb if (!subreq) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ret = ENOMEM;

3568de757bac0b47256647504c186d17ca272f85rbb goto done;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_set_callback(subreq, simple_check_get_groups_next, req);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return req;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddarddone:

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (ret == EOK) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_done(req);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard } else {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_error(req, ret);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe tevent_req_post(req, ev);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return req;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard}

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddardstatic void simple_check_get_groups_next(struct tevent_req *subreq)

8e9734d1a4af74c141e2a0f880bb51bb061fa03atrawick{

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct tevent_req *req =

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_callback_data(subreq, struct tevent_req);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard struct simple_check_groups_state *state =

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick tevent_req_data(req, struct simple_check_groups_state);

cd8f8c995d415473f3bfb0b329b2450f2a722c3atrawick errno_t ret;

3568de757bac0b47256647504c186d17ca272f85rbb

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ret = simple_resolve_group_recv(subreq, state->group_names,

cb97ae2ff6969c2789b8e03f1bc4187fa73b6bafwrowe &state->group_names[state->num_names]);

0f113d7123e8bd3e3e2e9b6373461a1a773bfccatrawick talloc_zfree(subreq);

0f113d7123e8bd3e3e2e9b6373461a1a773bfccatrawick if (ret != EOK) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_OP_FAILURE,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard ("Could not resolve name of group with GID %"SPRIgid"\n",

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->lookup_groups[state->giter].gid));

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard tevent_req_error(req, ret);

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard return;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard }

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard

3568de757bac0b47256647504c186d17ca272f85rbb state->num_names++;

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->giter++;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard if (state->giter < state->num_groups) {

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard subreq = simple_resolve_group_send(req, state->ev, state->ctx,

c0659e61002e9d6ff77b2dca72540e0af1b2ca64stoddard state->lookup_groups[state->giter].domain,

3568de757bac0b47256647504c186d17ca272f85rbb state->lookup_groups[state->giter].gid);

3568de757bac0b47256647504c186d17ca272f85rbb if (!subreq) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_error(req, ENOMEM);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_set_callback(subreq, simple_check_get_groups_next, req);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

f886987cd0bd4220c14043c4d9be77ec22902e73trawick DEBUG(SSSDBG_TRACE_INTERNAL, ("All groups resolved. Done.\n"));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_done(req);

f886987cd0bd4220c14043c4d9be77ec22902e73trawick}

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawickstatic errno_t

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawicksimple_check_process_group(struct simple_check_groups_state *state,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct ldb_message *group)

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz{

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz const char *name;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz const char *group_sid;

a72ba68ecbbc61e4b513e50d6000245c33f753dcwrowe struct sss_domain_info *domain;

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick gid_t gid;

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm bool posix;

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm posix = is_posix(group);

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick name = ldb_msg_find_attr_as_string(group, SYSDB_NAME, NULL);

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick gid = ldb_msg_find_attr_as_uint64(group, SYSDB_GIDNUM, 0);

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm /* With the current sysdb layout, every group has a name */

3568de757bac0b47256647504c186d17ca272f85rbb if (name == NULL) {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm return EINVAL;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz if (gid == 0) {

e8f95a682820a599fe41b22977010636be5c2717jim if (posix == true) {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm DEBUG(SSSDBG_CRIT_FAILURE, ("POSIX group without GID\n"));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz return EINVAL;

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz }

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm /* Non-posix group with a name. Still can be used for access

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm state->group_names[state->num_names] = talloc_strdup(state->group_names,

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm name);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm if (!state->group_names[state->num_names]) {

36c8049de63c446926139936c3d195330a0539cetrawick return ENOMEM;

36c8049de63c446926139936c3d195330a0539cetrawick }

36c8049de63c446926139936c3d195330a0539cetrawick DEBUG(SSSDBG_TRACE_INTERNAL, ("Adding group %s\n", name));

36c8049de63c446926139936c3d195330a0539cetrawick state->num_names++;

36c8049de63c446926139936c3d195330a0539cetrawick return EOK;

36c8049de63c446926139936c3d195330a0539cetrawick }

36c8049de63c446926139936c3d195330a0539cetrawick

36c8049de63c446926139936c3d195330a0539cetrawick /* Here are only groups with a name and gid. POSIX group can already

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (posix) {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm state->group_names[state->num_names] = talloc_strdup(state->group_names,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick name);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (!state->group_names[state->num_names]) {

36c8049de63c446926139936c3d195330a0539cetrawick return ENOMEM;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_TRACE_INTERNAL, ("Adding group %s\n", name));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->num_names++;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return EOK;

cb97ae2ff6969c2789b8e03f1bc4187fa73b6bafwrowe }

36c8049de63c446926139936c3d195330a0539cetrawick

36c8049de63c446926139936c3d195330a0539cetrawick /* Try to get group SID and assign it a domain */

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick group_sid = ldb_msg_find_attr_as_string(group, SYSDB_SID_STR, NULL);

e8f95a682820a599fe41b22977010636be5c2717jim if (group_sid == NULL) {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm /* We will look it up in main domain. */

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick domain = state->ctx->domain;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick } else {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick domain = find_subdomain_by_sid(state->ctx->domain, group_sid);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (domain == NULL) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_CRIT_FAILURE, ("There is no domain information for "

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick "SID %s\n", group_sid));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return ENOENT;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick /* It is a non-posix group with a GID. Needs resolving */

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->lookup_groups[state->num_groups].domain = domain;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->lookup_groups[state->num_groups].gid = gid;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_TRACE_INTERNAL, ("Adding GID %"SPRIgid"\n", gid));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->num_groups++;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return EOK;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick}

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawickstatic errno_t

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawicksimple_check_get_groups_primary(struct simple_check_groups_state *state,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick gid_t gid)

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick{

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick errno_t ret;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick const char *group_attrs[] = { SYSDB_NAME, SYSDB_POSIX,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick SYSDB_GIDNUM, SYSDB_SID_STR, NULL };

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct ldb_message *msg;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = sysdb_search_group_by_gid(state, state->domain->sysdb, state->domain,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick gid, group_attrs, &msg);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (ret != EOK) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_OP_FAILURE,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ("Could not look up primary group [%"SPRIgid"]: [%d][%s]\n",

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick gid, ret, sss_strerror(ret)));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick /* We have to treat this as non-fatal, because the primary

e8f95a682820a599fe41b22977010636be5c2717jim } else {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = simple_check_process_group(state, msg);

f886987cd0bd4220c14043c4d9be77ec22902e73trawick if (ret != EOK) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_OP_FAILURE, ("Cannot process primary group\n"));

f886987cd0bd4220c14043c4d9be77ec22902e73trawick return ret;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

f886987cd0bd4220c14043c4d9be77ec22902e73trawick }

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm return EOK;

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm}

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

3568de757bac0b47256647504c186d17ca272f85rbbstatic errno_t

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianpsimple_check_get_groups_recv(struct tevent_req *req,

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianp TALLOC_CTX *mem_ctx,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick const char ***_group_names)

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick{

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct simple_check_groups_state *state;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state = tevent_req_data(req, struct simple_check_groups_state);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick TEVENT_REQ_RETURN_ON_ERROR(req);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick *_group_names = talloc_steal(mem_ctx, state->group_names);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick return EOK;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick}

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawickstruct simple_access_check_state {

f2e009134c7e279f99dfca5bd421f721bf1f7840jorton bool access_granted;

f2e009134c7e279f99dfca5bd421f721bf1f7840jorton struct simple_ctx *ctx;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick const char *username;

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick const char **group_names;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick};

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawickstatic void simple_access_check_done(struct tevent_req *subreq);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

36c8049de63c446926139936c3d195330a0539cetrawickstruct tevent_req *simple_access_check_send(TALLOC_CTX *mem_ctx,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct tevent_context *ev,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct simple_ctx *ctx,

f886987cd0bd4220c14043c4d9be77ec22902e73trawick const char *username)

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick{

cb97ae2ff6969c2789b8e03f1bc4187fa73b6bafwrowe errno_t ret;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct tevent_req *req;

36c8049de63c446926139936c3d195330a0539cetrawick struct tevent_req *subreq;

36c8049de63c446926139936c3d195330a0539cetrawick struct simple_access_check_state *state;

36c8049de63c446926139936c3d195330a0539cetrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick req = tevent_req_create(mem_ctx, &state,

e8f95a682820a599fe41b22977010636be5c2717jim struct simple_access_check_state);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm if (!req) return NULL;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->access_granted = false;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->ctx = ctx;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick state->username = talloc_strdup(state, username);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (!state->username) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = ENOMEM;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick goto immediate;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_FUNC_DATA, ("Simple access check for %s\n", username));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = simple_check_users(ctx, username, &state->access_granted);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (ret == EOK) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick goto immediate;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick } else if (ret != EAGAIN) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = ERR_INTERNAL;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick goto immediate;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick /* EAGAIN -- check groups */

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (!ctx->allow_groups && !ctx->deny_groups) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick /* There are no group restrictions, so just return

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick DEBUG(SSSDBG_TRACE_LIBS, ("No group restrictions, end request\n"));

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = EOK;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick goto immediate;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick /* The group names might not be available. Fire a request to

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick subreq = simple_check_get_groups_send(state, ev, ctx, username);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (!subreq) {

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ret = ENOMEM;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick goto immediate;

e8f95a682820a599fe41b22977010636be5c2717jim }

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_set_callback(subreq, simple_access_check_done, req);

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

f886987cd0bd4220c14043c4d9be77ec22902e73trawick return req;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

f886987cd0bd4220c14043c4d9be77ec22902e73trawickimmediate:

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick if (ret == EOK) {

f886987cd0bd4220c14043c4d9be77ec22902e73trawick tevent_req_done(req);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm } else {

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm tevent_req_error(req, ret);

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm }

64c351fd973428b5bb4c28e983fa86875ea4e60fdougm tevent_req_post(req, ev);

3568de757bac0b47256647504c186d17ca272f85rbb return req;

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianp}

72b6f1cf3e616473e1c26464b3193b13c2c09e87brianp

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick

e8f95a682820a599fe41b22977010636be5c2717jimstatic void simple_access_check_done(struct tevent_req *subreq)

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick{

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick struct tevent_req *req =

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_callback_data(subreq, struct tevent_req);

e8f95a682820a599fe41b22977010636be5c2717jim struct simple_access_check_state *state =

44d2e75323651320b480d8bc2f098448a08de4fcwrowe tevent_req_data(req, struct simple_access_check_state);

44d2e75323651320b480d8bc2f098448a08de4fcwrowe errno_t ret;

44d2e75323651320b480d8bc2f098448a08de4fcwrowe

44d2e75323651320b480d8bc2f098448a08de4fcwrowe /* We know the names now. Run the check. */

44d2e75323651320b480d8bc2f098448a08de4fcwrowe ret = simple_check_get_groups_recv(subreq, state, &state->group_names);

44d2e75323651320b480d8bc2f098448a08de4fcwrowe talloc_zfree(subreq);

44d2e75323651320b480d8bc2f098448a08de4fcwrowe if (ret == ENOENT) {

44d2e75323651320b480d8bc2f098448a08de4fcwrowe /* If the user wasn't found, just shortcut */

44d2e75323651320b480d8bc2f098448a08de4fcwrowe state->access_granted = false;

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick tevent_req_done(req);

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick return;

2e7f1d7da527c09e717251e186deffe55e6fbd0ftrawick } else if (ret != EOK) {

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_OP_FAILURE,

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick ("Could not collect groups of user %s\n", state->username));

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz tevent_req_error(req, ret);

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe return;

3568de757bac0b47256647504c186d17ca272f85rbb }

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe ret = simple_check_groups(state->ctx, state->group_names,

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe &state->access_granted);

f886987cd0bd4220c14043c4d9be77ec22902e73trawick if (ret != EOK) {

f886987cd0bd4220c14043c4d9be77ec22902e73trawick DEBUG(SSSDBG_OP_FAILURE, ("Could not check group access [%d]: %s\n",

f886987cd0bd4220c14043c4d9be77ec22902e73trawick ret, sss_strerror(ret)));

f886987cd0bd4220c14043c4d9be77ec22902e73trawick tevent_req_error(req, ERR_INTERNAL);

f886987cd0bd4220c14043c4d9be77ec22902e73trawick return;

f886987cd0bd4220c14043c4d9be77ec22902e73trawick }

f886987cd0bd4220c14043c4d9be77ec22902e73trawick

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe /* Now just return whatever we decided */

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe DEBUG(SSSDBG_TRACE_INTERNAL, ("Group check done\n"));

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe tevent_req_done(req);

1ec8bd0373f11c07688ec9afbbf778cf78a0bc52wrowe}

3568de757bac0b47256647504c186d17ca272f85rbb

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantzerrno_t simple_access_check_recv(struct tevent_req *req, bool *access_granted)

8bfe865d8d61be4ba4a89e45427a3c4211ebabdctrawick{

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz struct simple_access_check_state *state =

3568de757bac0b47256647504c186d17ca272f85rbb tevent_req_data(req, struct simple_access_check_state);

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz TEVENT_REQ_RETURN_ON_ERROR(req);

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz DEBUG(SSSDBG_TRACE_LIBS,

28c170ac8e99644de58cad454c6e0f9b4b359be6jerenkrantz ("Access %sgranted\n", state->access_granted ? "" : "not "));

3568de757bac0b47256647504c186d17ca272f85rbb if (access_granted) {

3568de757bac0b47256647504c186d17ca272f85rbb *access_granted = state->access_granted;

98fb535f829e2a95aabd82420931f476661fa8e3jorton }

98fb535f829e2a95aabd82420931f476661fa8e3jorton

e8f95a682820a599fe41b22977010636be5c2717jim return EOK;

e8f95a682820a599fe41b22977010636be5c2717jim}

98fb535f829e2a95aabd82420931f476661fa8e3jorton