IFP: Per-attribute ACL for users

Introduces a new option called user_attributes that allows to specify
which user attributes are allowed to be queried from the IFP responder.

By default only the default POSIX set is allowed, this option allows to
either add other attributes (+attrname) or remove them from the default
set (-attrname).

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
(cherry picked from commit 770dc892f867639f36f84455d65be6287935a529)

4 files changed, 194 insertions, 2 deletions

diff --git a/src/responder/ifp/ifp_private.h b/src/responder/ifp/ifp_private.h
index 52c480bb4..c03cf6ccc 100644
--- a/src/responder/ifp/ifp_private.h
+++ b/src/responder/ifp/ifp_private.h
@@ -43,6 +43,7 @@ struct ifp_ctx {
     int neg_timeout;
 
     struct sysbus_ctx *sysbus;
+    const char **user_whitelist;
 };
 
 /* This is a throwaway method to ease the review of the patch.
@@ -68,4 +69,6 @@ const char *ifp_path_strip_prefix(const char *path, const char *prefix);
 errno_t ifp_add_ldb_el_to_dict(DBusMessageIter *iter_dict,
                                struct ldb_message_element *el);
 
+const char **ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str);
+bool ifp_attr_allowed(const char *whitelist[], const char *attr);
 #endif /* _IFPSRV_PRIVATE_H_ */
diff --git a/src/responder/ifp/ifpsrv.c b/src/responder/ifp/ifpsrv.c
index 978f3614a..e02b5f08a 100644
--- a/src/responder/ifp/ifpsrv.c
+++ b/src/responder/ifp/ifpsrv.c
@@ -205,6 +205,7 @@ int ifp_process_init(TALLOC_CTX *mem_ctx,
     int ret;
     int max_retries;
     char *uid_str;
+    char *attr_list_str;
 
     ifp_cmds = get_ifp_cmds();
     ret = sss_process_init(mem_ctx, ev, cdb,
@@ -271,6 +272,22 @@ int ifp_process_init(TALLOC_CTX *mem_ctx,
         goto fail;
     }
 
+    ret = confdb_get_string(ifp_ctx->rctx->cdb, ifp_ctx->rctx,
+                            CONFDB_IFP_CONF_ENTRY, CONFDB_IFP_USER_ATTR_LIST,
+                            NULL, &attr_list_str);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE, ("Failed to get allowed UIDs.\n"));
+        goto fail;
+    }
+
+    ifp_ctx->user_whitelist = ifp_parse_attr_list(ifp_ctx, attr_list_str);
+    talloc_free(attr_list_str);
+    if (ifp_ctx->user_whitelist == NULL) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              ("Failed to parse the allowed attribute list\n"));
+        goto fail;
+    }
+
     /* Enable automatic reconnection to the Data Provider */
     ret = confdb_get_int(ifp_ctx->rctx->cdb,
                          CONFDB_IFP_CONF_ENTRY,
diff --git a/src/responder/ifp/ifpsrv_cmd.c b/src/responder/ifp/ifpsrv_cmd.c
index 933b249df..7a200aab8 100644
--- a/src/responder/ifp/ifpsrv_cmd.c
+++ b/src/responder/ifp/ifpsrv_cmd.c
@@ -96,17 +96,43 @@ static errno_t
 ifp_user_get_attr_unpack_msg(struct ifp_attr_req *attr_req)
 {
     bool parsed;
+    char **attrs;
+    int nattrs;
+    int i, ai;
+    const char **whitelist = attr_req->ireq->ifp_ctx->user_whitelist;
 
     parsed = sbus_request_parse_or_finish(attr_req->ireq->dbus_req,
                                           DBUS_TYPE_STRING, &attr_req->name,
                                           DBUS_TYPE_ARRAY, DBUS_TYPE_STRING,
-                                          &attr_req->attrs,
-                                          &attr_req->nattrs,
+                                          &attrs, &nattrs,
                                           DBUS_TYPE_INVALID);
     if (parsed == false) {
+        DEBUG(SSSDBG_OP_FAILURE, "Could not parse arguments\n");
         return EOK; /* handled */
     }
 
+    /* Copy the attributes to maintain memory hierarchy with talloc */
+    attr_req->attrs = talloc_zero_array(attr_req, const char *, nattrs+1);
+    if (attr_req->attrs == NULL) {
+        return ENOMEM;
+    }
+
+    ai = 0;
+    for (i = 0; i < nattrs; i++) {
+        if (ifp_attr_allowed(whitelist, attrs[i]) == false) {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  "Attribute %s not present in the whitelist, skipping\n",
+                  attrs[i]);
+            continue;
+        }
+
+        attr_req->attrs[ai] = talloc_strdup(attr_req->attrs, attrs[i]);
+        if (attr_req->attrs[ai] == NULL) {
+            return ENOMEM;
+        }
+        ai++;
+    }
+
     return EOK;
 }
 
diff --git a/src/responder/ifp/ifpsrv_util.c b/src/responder/ifp/ifpsrv_util.c
index 2bce20186..4ef0be6af 100644
--- a/src/responder/ifp/ifpsrv_util.c
+++ b/src/responder/ifp/ifpsrv_util.c
@@ -24,6 +24,11 @@
 #include "db/sysdb.h"
 #include "responder/ifp/ifp_private.h"
 
+#define IFP_DEFAULT_ATTRS {SYSDB_NAME, SYSDB_UIDNUM,   \
+                           SYSDB_GIDNUM, SYSDB_GECOS,  \
+                           SYSDB_HOMEDIR, SYSDB_SHELL, \
+                           NULL}
+
 errno_t ifp_req_create(struct sbus_request *dbus_req,
                        struct ifp_ctx *ifp_ctx,
                        struct ifp_req **_ifp_req)
@@ -178,3 +183,144 @@ errno_t ifp_add_ldb_el_to_dict(DBusMessageIter *iter_dict,
 
     return EOK;
 }
+
+static inline bool
+attr_in_list(const char **list, size_t nlist, const char *str)
+{
+    size_t i;
+
+    for (i = 0; i < nlist; i++) {
+        if (strcasecmp(list[i], str) == 0) {
+            break;
+        }
+    }
+
+    return (i < nlist) ? true : false;
+}
+
+const char **
+ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
+{
+    TALLOC_CTX *tmp_ctx;
+    errno_t ret;
+    const char **list = NULL;
+    const char **res = NULL;
+    int list_size;
+    char **conf_list = NULL;
+    int conf_list_size = 0;
+    const char **allow = NULL;
+    const char **deny = NULL;
+    int ai = 0, di = 0, li = 0;
+    int i;
+    const char *defaults[] = IFP_DEFAULT_ATTRS;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        return NULL;
+    }
+
+    if (conf_str) {
+        ret = split_on_separator(tmp_ctx, conf_str, ',', true, true,
+                                 &conf_list, &conf_list_size);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Cannot parse attribute ACL list  %s: %d\n", conf_str, ret);
+            goto done;
+        }
+
+        allow = talloc_zero_array(tmp_ctx, const char *, conf_list_size);
+        deny = talloc_zero_array(tmp_ctx, const char *, conf_list_size);
+        if (allow == NULL || deny == NULL) {
+            goto done;
+        }
+    }
+
+    for (i = 0; i < conf_list_size; i++) {
+        switch (conf_list[i][0]) {
+            case '+':
+                allow[ai] = conf_list[i] + 1;
+                ai++;
+                continue;
+            case '-':
+                deny[di] = conf_list[i] + 1;
+                di++;
+                continue;
+            default:
+                DEBUG(SSSDBG_CRIT_FAILURE, "ACL values must start with "
+                      "either '+' (allow) or '-' (deny), got '%s'\n",
+                      conf_list[i]);
+                goto done;
+        }
+    }
+
+    /* Assume the output will have to hold defauls and all the configured,
+     * values, resize later
+     */
+    list_size = 0;
+    while (defaults[list_size]) {
+        list_size++;
+    }
+    list_size += conf_list_size;
+
+    list = talloc_zero_array(tmp_ctx, const char *, list_size + 1);
+    if (list == NULL) {
+        goto done;
+    }
+
+    /* Start by copying explicitly allowed attributes */
+    for (i = 0; i < ai; i++) {
+        /* if the attribute is explicitly denied, skip it */
+        if (attr_in_list(deny, di, allow[i])) {
+            continue;
+        }
+
+        list[li] = talloc_strdup(list, allow[i]);
+        if (list[li] == NULL) {
+            goto done;
+        }
+        li++;
+
+        DEBUG(SSSDBG_TRACE_INTERNAL,
+              "Added allowed attr %s to whitelist\n", allow[i]);
+    }
+
+    /* Add defaults */
+    for (i = 0; defaults[i]; i++) {
+        /* if the attribute is explicitly denied, skip it */
+        if (attr_in_list(deny, di, defaults[i])) {
+            continue;
+        }
+
+        list[li] = talloc_strdup(list, defaults[i]);
+        if (list[li] == NULL) {
+            goto done;
+        }
+        li++;
+
+        DEBUG(SSSDBG_TRACE_INTERNAL,
+              "Added default attr %s to whitelist\n", defaults[i]);
+    }
+
+    res = talloc_steal(mem_ctx, list);
+done:
+    talloc_free(tmp_ctx);
+    return res;
+}
+
+bool
+ifp_attr_allowed(const char *whitelist[], const char *attr)
+{
+    size_t i;
+
+    if (whitelist == NULL) {
+        return false;
+    }
+
+    for (i = 0; whitelist[i]; i++) {
+        if (strcasecmp(whitelist[i], attr) == 0) {
+            break;
+        }
+    }
+
+    return (whitelist[i]) ? true : false;
+}