summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/providers/ipa/ipa_access.c658
-rw-r--r--src/providers/ipa/ipa_access.h4
2 files changed, 641 insertions, 21 deletions
diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index 56bb269da..bd324518e 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -31,7 +31,8 @@
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_timerules.h"
-#define IPA_HOST_MEMBEROF "memberOf"
+#define OBJECTCLASS "objectclass"
+#define IPA_MEMBEROF "memberOf"
#define IPA_HOST_SERVERHOSTNAME "serverHostName"
#define IPA_HOST_FQDN "fqdn"
#define IPA_ACCESS_RULE_TYPE "accessRuleType"
@@ -47,14 +48,21 @@
#define IPA_MEMBER_HOST "memberHost"
#define IPA_HOST_CATEGORY "hostCategory"
#define IPA_CN "cn"
+#define IPA_MEMBER_SERVICE "memberService"
+#define IPA_SERVICE_CATEGORY "serviceCategory"
+#define IPA_SERVICEGROUP_MEMBER "member"
#define IPA_HOST_BASE_TMPL "cn=computers,cn=accounts,%s"
#define IPA_HBAC_BASE_TMPL "cn=hbac,%s"
+#define IPA_SERVICES_BASE_TMPL "cn=hbacservices,cn=accounts,%s"
+#define IPA_SERVICEGROUPS_BASE_TMPL "cn=hbacservicegroups,cn=accounts,%s"
#define SYSDB_HBAC_BASE_TMPL "cn=hbac,"SYSDB_TMPL_CUSTOM_BASE
#define HBAC_RULES_SUBDIR "hbac_rules"
#define HBAC_HOSTS_SUBDIR "hbac_hosts"
+#define HBAC_SERVICES_SUBDIR "hbac_services"
+#define HBAC_SERVICEGROUPS_SUBDIR "hbac_servicegroups"
static errno_t msgs2attrs_array(TALLOC_CTX *mem_ctx, size_t count,
struct ldb_message **msgs,
@@ -98,6 +106,490 @@ static void ipa_access_reply(struct be_req *be_req, int pam_status)
}
}
+struct hbac_get_service_data_state {
+ struct tevent_context *ev;
+ struct sdap_id_ctx *sdap_ctx;
+ struct sysdb_ctx *sysdb;
+ struct sysdb_handle *handle;
+ const char *basedn;
+ bool offline;
+
+ char *services_filter;
+ char *services_search_base;
+ const char **services_attrs;
+ struct sysdb_attrs **services_reply_list;
+ size_t services_reply_count;
+
+ char *servicegroups_filter;
+ char *servicegroups_search_base;
+ const char **servicegroups_attrs;
+ struct sysdb_attrs **servicegroups_reply_list;
+ size_t servicegroups_reply_count;
+
+ size_t current_item;
+};
+
+static void hbac_get_services_connect_done(struct tevent_req *subreq);
+static void hbac_services_get_done(struct tevent_req *subreq);
+static void hbac_get_servicegroups(struct tevent_req *req);
+static void hbac_servicegroups_get_done(struct tevent_req *subreq);
+
+struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
+ struct tevent_context *ev,
+ bool offline,
+ struct sdap_id_ctx *sdap_ctx,
+ struct sysdb_ctx *sysdb,
+ const char *basedn)
+{
+ struct tevent_req *req = NULL;
+ struct tevent_req *subreq = NULL;
+ struct hbac_get_service_data_state *state;
+ int ret;
+ struct ldb_message **msgs;
+
+ req = tevent_req_create(memctx, &state, struct hbac_get_service_data_state);
+ if (req == NULL) {
+ DEBUG(1, ("tevent_req_create failed.\n"));
+ return NULL;
+ }
+
+ state->ev = ev;
+ state->offline = offline;
+ state->sdap_ctx = sdap_ctx;
+ state->sysdb = sysdb;
+ state->handle = NULL;
+ state->basedn = basedn;
+
+ state->services_reply_list = NULL;
+ state->services_reply_count = 0;
+
+ state->servicegroups_filter = NULL;
+ state->servicegroups_search_base = NULL;
+ state->servicegroups_attrs = NULL;
+ state->servicegroups_reply_list = NULL;
+ state->servicegroups_reply_count = 0;
+
+ state->current_item = 0;
+
+ state->services_search_base = talloc_asprintf(state, IPA_SERVICES_BASE_TMPL,
+ basedn);
+ if (state->services_search_base == NULL) {
+ DEBUG(1, ("Failed to create service search base.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ state->services_attrs = talloc_array(state, const char *, 7);
+ if (state->services_attrs == NULL) {
+ DEBUG(1, ("Failed to allocate service attribute list.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+ state->services_attrs[0] = IPA_CN;
+ state->services_attrs[1] = SYSDB_ORIG_DN;
+ state->services_attrs[2] = IPA_UNIQUE_ID;
+ state->services_attrs[3] = IPA_MEMBEROF;
+ state->services_attrs[4] = SYSDB_ORIG_MEMBEROF;
+ state->services_attrs[5] = OBJECTCLASS;
+ state->services_attrs[6] = NULL;
+
+ state->services_filter = talloc_asprintf(state,
+ "(objectclass=ipaHBACService)");
+ if (state->services_filter == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ DEBUG(9, ("Services filter: [%s].\n", state->services_filter));
+
+ if (offline) {
+ ret = sysdb_search_custom(state, state->sysdb,
+ state->sdap_ctx->be->domain,
+ state->services_filter, HBAC_SERVICES_SUBDIR,
+ state->services_attrs,
+ &state->services_reply_count, &msgs);
+ if (ret) {
+ DEBUG(1, ("sysdb_search_custom failed.\n"));
+ goto fail;
+ }
+
+ ret = msgs2attrs_array(state, state->services_reply_count, msgs,
+ &state->services_reply_list);
+ talloc_zfree(msgs);
+ if (ret != EOK) {
+ DEBUG(1, ("msgs2attrs_array failed.\n"));
+ goto fail;
+ }
+ hbac_get_servicegroups(req);
+ tevent_req_post(req, ev);
+ return req;
+ }
+
+ if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
+ subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts,
+ sdap_ctx->be, sdap_ctx->service, NULL);
+ if (!subreq) {
+ DEBUG(1, ("sdap_cli_connect_send failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ tevent_req_set_callback(subreq, hbac_get_services_connect_done, req);
+
+ return req;
+ }
+
+ subreq = sdap_get_generic_send(state, state->ev,
+ state->sdap_ctx->opts,
+ state->sdap_ctx->gsh,
+ state->services_search_base,
+ LDAP_SCOPE_SUB,
+ state->services_filter,
+ state->services_attrs,
+ NULL, 0);
+
+ if (subreq == NULL) {
+ DEBUG(1, ("sdap_get_generic_send failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ tevent_req_set_callback(subreq, hbac_services_get_done, req);
+
+ return req;
+
+fail:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, ev);
+ return req;
+}
+
+static void hbac_get_services_connect_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct hbac_get_service_data_state *state = tevent_req_data(req,
+ struct hbac_get_service_data_state);
+ int ret;
+
+ ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh,
+ NULL);
+ talloc_zfree(subreq);
+ if (ret) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ subreq = sdap_get_generic_send(state, state->ev,
+ state->sdap_ctx->opts,
+ state->sdap_ctx->gsh,
+ state->services_search_base,
+ LDAP_SCOPE_SUB,
+ state->services_filter,
+ state->services_attrs,
+ NULL, 0);
+
+ if (subreq == NULL) {
+ DEBUG(1, ("sdap_get_generic_send failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ tevent_req_set_callback(subreq, hbac_services_get_done, req);
+ return;
+
+fail:
+ tevent_req_error(req, ret);
+ return;
+}
+
+static void hbac_services_get_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct hbac_get_service_data_state *state = tevent_req_data(req,
+ struct hbac_get_service_data_state);
+ int ret;
+
+ ret = sdap_get_generic_recv(subreq, state, &state->services_reply_count,
+ &state->services_reply_list);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ hbac_get_servicegroups(req);
+ return;
+}
+
+static void hbac_get_servicegroups(struct tevent_req *req)
+{
+ struct hbac_get_service_data_state *state = tevent_req_data(req,
+ struct hbac_get_service_data_state);
+ int ret;
+ struct ldb_message **msgs;
+ struct tevent_req *subreq;
+
+ state->servicegroups_search_base = talloc_asprintf(state,
+ IPA_SERVICEGROUPS_BASE_TMPL,
+ state->basedn);
+ if (state->servicegroups_search_base == NULL) {
+ DEBUG(1, ("Failed to create service groups search base.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ state->servicegroups_attrs = talloc_array(state, const char *, 8);
+ if (state->servicegroups_attrs == NULL) {
+ DEBUG(1, ("Failed to allocate servicegroup attribute list.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+ state->servicegroups_attrs[0] = IPA_CN;
+ state->servicegroups_attrs[1] = IPA_SERVICEGROUP_MEMBER;
+ state->servicegroups_attrs[2] = SYSDB_ORIG_DN;
+ state->servicegroups_attrs[3] = IPA_UNIQUE_ID;
+ state->servicegroups_attrs[4] = IPA_MEMBEROF;
+ state->servicegroups_attrs[5] = SYSDB_ORIG_MEMBEROF;
+ state->servicegroups_attrs[6] = OBJECTCLASS;
+ state->servicegroups_attrs[7] = NULL;
+
+ state->servicegroups_filter = talloc_asprintf(state,
+ "(objectclass=ipaHBACServiceGroup)");
+ if (state->servicegroups_filter == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ DEBUG(9, ("Services filter: [%s].\n", state->servicegroups_filter));
+
+ if (state->offline) {
+ ret = sysdb_search_custom(state, state->sysdb,
+ state->sdap_ctx->be->domain,
+ state->servicegroups_filter,
+ HBAC_SERVICEGROUPS_SUBDIR,
+ state->servicegroups_attrs,
+ &state->servicegroups_reply_count, &msgs);
+ if (ret) {
+ DEBUG(1, ("sysdb_search_custom failed.\n"));
+ goto fail;
+ }
+
+ ret = msgs2attrs_array(state, state->servicegroups_reply_count, msgs,
+ &state->servicegroups_reply_list);
+ talloc_zfree(msgs);
+ if (ret != EOK) {
+ DEBUG(1, ("msgs2attrs_array failed.\n"));
+ goto fail;
+ }
+ tevent_req_done(req);
+ return;
+ }
+
+ subreq = sdap_get_generic_send(state, state->ev,
+ state->sdap_ctx->opts,
+ state->sdap_ctx->gsh,
+ state->servicegroups_search_base,
+ LDAP_SCOPE_SUB,
+ state->servicegroups_filter,
+ state->servicegroups_attrs,
+ NULL, 0);
+
+ if (subreq == NULL) {
+ DEBUG(1, ("sdap_get_generic_send failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ tevent_req_set_callback(subreq, hbac_servicegroups_get_done, req);
+ return;
+
+fail:
+ tevent_req_error(req, ret);
+ return;
+}
+
+static void hbac_servicegroups_get_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct hbac_get_service_data_state *state = tevent_req_data(req,
+ struct hbac_get_service_data_state);
+ int ret;
+ bool in_transaction = false;
+ struct ldb_dn *base_dn;
+ int i;
+ struct ldb_message_element *el;
+ char *object_name;
+
+ ret = sdap_get_generic_recv(subreq, state,
+ &state->servicegroups_reply_count,
+ &state->servicegroups_reply_list);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ if ((state->services_reply_count == 0 &&
+ state->servicegroups_reply_count == 0)|| state->offline) {
+ tevent_req_done(req);
+ return;
+ }
+
+ ret = sysdb_transaction_start(state->sysdb);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_transaction_start failed.\n"));
+ tevent_req_error(req, ret);
+ return;
+ }
+ in_transaction = true;
+
+ base_dn = sysdb_custom_subtree_dn(state->sysdb, state,
+ state->sdap_ctx->be->domain->name,
+ HBAC_SERVICES_SUBDIR);
+ if (base_dn == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ ret = sysdb_delete_recursive(state, state->sysdb, base_dn, true);
+ if (ret) {
+ DEBUG(1, ("sysdb_delete_recursive failed.\n"));
+ goto fail;
+ }
+
+ base_dn = sysdb_custom_subtree_dn(state->sysdb, state,
+ state->sdap_ctx->be->domain->name,
+ HBAC_SERVICEGROUPS_SUBDIR);
+ if (base_dn == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ ret = sysdb_delete_recursive(state, state->sysdb, base_dn, true);
+ if (ret) {
+ DEBUG(1, ("sysdb_delete_recursive failed.\n"));
+ goto fail;
+ }
+
+ for (i = 0; i < state->services_reply_count; i++) {
+ ret = sysdb_attrs_get_el(state->services_reply_list[i], IPA_UNIQUE_ID,
+ &el);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+ goto fail;
+ }
+ if (el->num_values == 0) {
+ ret = EINVAL;
+ goto fail;
+ }
+ object_name = talloc_strndup(state, (const char *)el->values[0].data,
+ el->values[0].length);
+ if (object_name == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+ DEBUG(9, ("Object name: [%s].\n", object_name));
+
+ ret = sysdb_attrs_replace_name(state->services_reply_list[i],
+ IPA_MEMBEROF, SYSDB_ORIG_MEMBEROF);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_replace_name failed.\n"));
+ goto fail;
+ }
+
+ ret = sysdb_store_custom(state, state->sysdb,
+ state->sdap_ctx->be->domain, object_name,
+ HBAC_SERVICES_SUBDIR,
+ state->services_reply_list[i]);
+ if (ret) {
+ DEBUG(1, ("sysdb_store_custom failed.\n"));
+ goto fail;
+ }
+ }
+ for (i = 0; i < state->servicegroups_reply_count; i++) {
+ ret = sysdb_attrs_get_el(state->servicegroups_reply_list[i],
+ IPA_UNIQUE_ID, &el);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+ goto fail;
+ }
+ if (el->num_values == 0) {
+ ret = EINVAL;
+ goto fail;
+ }
+ object_name = talloc_strndup(state, (const char *)el->values[0].data,
+ el->values[0].length);
+ if (object_name == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+ DEBUG(9, ("Object name: [%s].\n", object_name));
+
+ ret = sysdb_attrs_replace_name(state->servicegroups_reply_list[i],
+ IPA_MEMBEROF, SYSDB_ORIG_MEMBEROF);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_replace_name failed.\n"));
+ goto fail;
+ }
+
+ ret = sysdb_store_custom(state, state->sysdb,
+ state->sdap_ctx->be->domain, object_name,
+ HBAC_SERVICEGROUPS_SUBDIR,
+ state->servicegroups_reply_list[i]);
+ if (ret) {
+ DEBUG(1, ("sysdb_store_custom failed.\n"));
+ goto fail;
+ }
+ }
+
+ ret = sysdb_transaction_commit(state->sysdb);
+ if (ret) {
+ DEBUG(1, ("sysdb_transaction_commit failed.\n"));
+ goto fail;
+ }
+ in_transaction = false;
+
+ tevent_req_done(req);
+ return;
+
+fail:
+ if (in_transaction) {
+ sysdb_transaction_cancel(state->sysdb);
+ }
+ tevent_req_error(req, ret);
+ return;
+}
+
+static int hbac_get_service_data_recv(struct tevent_req *req,
+ TALLOC_CTX *memctx,
+ size_t *hbac_services_count,
+ struct sysdb_attrs ***hbac_services_list,
+ size_t *hbac_servicegroups_count,
+ struct sysdb_attrs ***hbac_servicegroups_list)
+{
+ struct hbac_get_service_data_state *state = tevent_req_data(req,
+ struct hbac_get_service_data_state);
+ int i;
+
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ *hbac_services_count = state->services_reply_count;
+ *hbac_services_list = talloc_steal(memctx, state->services_reply_list);
+ for (i = 0; i < state->services_reply_count; i++) {
+ talloc_steal(memctx, state->services_reply_list[i]);
+ }
+
+ *hbac_servicegroups_count = state->servicegroups_reply_count;
+ *hbac_servicegroups_list = talloc_steal(memctx,
+ state->servicegroups_reply_list);
+ for (i = 0; i < state->servicegroups_reply_count; i++) {
+ talloc_steal(memctx, state->servicegroups_reply_list[i]);
+ }
+ return EOK;
+}
static int hbac_get_user_info(TALLOC_CTX *memctx,
struct be_ctx *be_ctx,
@@ -299,7 +791,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
ret = ENOMEM;
goto fail;
}
- state->host_attrs[0] = IPA_HOST_MEMBEROF;
+ state->host_attrs[0] = IPA_MEMBEROF;
state->host_attrs[1] = IPA_HOST_SERVERHOSTNAME;
state->host_attrs[2] = IPA_HOST_FQDN;
state->host_attrs[3] = "objectClass";
@@ -579,7 +1071,7 @@ static void hbac_get_host_memberof(struct tevent_req *req,
ret = sysdb_attrs_replace_name(state->host_reply_list[i],
- IPA_HOST_MEMBEROF, SYSDB_ORIG_MEMBEROF);
+ IPA_MEMBEROF, SYSDB_ORIG_MEMBEROF);
if (ret != EOK) {
DEBUG(1, ("sysdb_attrs_replace_name failed.\n"));
goto fail;
@@ -697,7 +1189,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
goto fail;
}
- state->hbac_attrs = talloc_array(state, const char *, 16);
+ state->hbac_attrs = talloc_array(state, const char *, 18);
if (state->hbac_attrs == NULL) {
DEBUG(1, ("Failed to allocate HBAC attribute list.\n"));
ret = ENOMEM;
@@ -714,11 +1206,13 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
state->hbac_attrs[8] = IPA_UNIQUE_ID;
state->hbac_attrs[9] = IPA_ENABLED_FLAG;
state->hbac_attrs[10] = IPA_CN;
- state->hbac_attrs[11] = "objectclass";
+ state->hbac_attrs[11] = OBJECTCLASS;
state->hbac_attrs[12] = IPA_MEMBER_HOST;
state->hbac_attrs[13] = IPA_HOST_CATEGORY;
- state->hbac_attrs[14] = SYSDB_ORIG_DN;
- state->hbac_attrs[15] = NULL;
+ state->hbac_attrs[14] = IPA_MEMBER_SERVICE;
+ state->hbac_attrs[15] = IPA_SERVICE_CATEGORY;
+ state->hbac_attrs[16] = SYSDB_ORIG_DN;
+ state->hbac_attrs[17] = NULL;
state->hbac_filter = talloc_asprintf(state,
"(&(objectclass=ipaHBACRule)"
@@ -1004,41 +1498,129 @@ enum check_result {
RULE_ERROR
};
-enum check_result check_service(struct pam_data *pd,
+static errno_t get_service_data(const char *cn, size_t count,
+ struct sysdb_attrs **list, const char **dn,
+ struct ldb_message_element **mof)
+{
+ int ret;
+ int i;
+ int j;
+ struct ldb_message_element *el;
+
+ for (i = 0; i < count; i++) {
+ ret = sysdb_attrs_get_el(list[i], IPA_CN, &el);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+ return ENOENT;
+ }
+ if (el->num_values == 0) {
+ DEBUG(9, ("No cn found.\n"));
+ return ENOENT;
+ } else {
+ for (j = 0; j < el->num_values; j++) {
+ if (strncmp(cn, (const char *) el->values[j].data,
+ el->values[j].length) == 0) {
+
+ ret = sysdb_attrs_get_string(list[i], SYSDB_ORIG_DN, dn);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_string failed.\n"));
+ return ret;
+ }
+
+ ret = sysdb_attrs_get_el(list[i], SYSDB_ORIG_MEMBEROF, mof);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+ return ret;
+ }
+
+ return EOK;
+ }
+ }
+ }
+ }
+
+ return ENOENT;
+}
+
+enum check_result check_service(struct hbac_ctx *hbac_ctx,
struct sysdb_attrs *rule_attrs)
{
int ret;
int i;
+ int g;
struct ldb_message_element *el;
+ const char *service_dn;
+ struct ldb_message_element *service_memberof;
- if (pd->service == NULL) {
+ if (hbac_ctx->pd->service == NULL) {
DEBUG(1, ("No service in pam data, assuming error.\n"));
return RULE_ERROR;
}
- ret = sysdb_attrs_get_el(rule_attrs, IPA_SERVICE_NAME, &el);
+ ret = sysdb_attrs_get_el(rule_attrs, IPA_SERVICE_CATEGORY, &el);
if (ret != EOK) {
DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
return RULE_ERROR;
}
if (el->num_values == 0) {
- DEBUG(9, ("No services in rule specified, assuming rule applies.\n"));
- return RULE_APPLICABLE;
+ DEBUG(9, ("Service category is not set.\n"));
} else {
for (i = 0; i < el->num_values; i++) {
- if (strlen(pd->service) == el->values[i].length &&
- strncasecmp(pd->service, (const char *) el->values[i].data,
+ if (strncasecmp("all", (const char *) el->values[i].data,
el->values[i].length) == 0) {
- DEBUG(9, ("Service [%s] found, rule applies.\n",
- pd->service));
+ DEBUG(9, ("Service category is set to 'all', rule applies.\n"));
return RULE_APPLICABLE;
}
+ DEBUG(9, ("Unsupported service category [%.*s].\n",
+ el->values[i].length,
+ (char *) el->values[i].data));
}
- DEBUG(9, ("No matching service found, rule does not apply.\n"));
+ }
+
+ ret = get_service_data(hbac_ctx->pd->service, hbac_ctx->hbac_services_count,
+ hbac_ctx->hbac_services_list, &service_dn,
+ &service_memberof);
+ if (ret != EOK) {
+ DEBUG(1, ("Cannot find original DN for service [%s].\n",
+ hbac_ctx->pd->service));
+ return RULE_ERROR;
+ }
+ DEBUG(9, ("OriginalDN for service [%s]: [%s].\n", hbac_ctx->pd->service,
+ service_dn));
+
+ ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_SERVICE, &el);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+ return RULE_ERROR;
+ }
+ if (el->num_values == 0) {
+ DEBUG(9, ("No service or service group specified, rule does not apply.\n"));
return RULE_NOT_APPLICABLE;
}
- return RULE_ERROR;
+ for (i = 0; i < el->num_values; i++) {
+ if (strncmp(service_dn, (const char *) el->values[i].data,
+ el->values[i].length) == 0) {
+ DEBUG(9, ("Service [%s] found in the list of allowed "
+ "services.\n", hbac_ctx->pd->service));
+ return RULE_APPLICABLE;
+ }
+
+ for (g = 0; g < service_memberof->num_values; g++) {
+ if (service_memberof->values[g].length == el->values[i].length &&
+ strncmp((const char *) service_memberof->values[g].data,
+ (const char *) el->values[i].data,
+ el->values[i].length) == 0) {
+ DEBUG(9, ("Service [%s] is a member of a group in the list of "
+ "allowed service groups.\n", hbac_ctx->pd->service));
+ return RULE_APPLICABLE;
+ }
+ }
+ }
+
+ DEBUG(9, ("Service [%s] was not found in the list of allowed services and "
+ "service groups.\n", hbac_ctx->pd->service));
+ return RULE_NOT_APPLICABLE;
}
enum check_result check_access_time(struct time_rules_ctx *tr_ctx,
@@ -1325,7 +1907,7 @@ static errno_t check_if_rule_applies(struct hbac_ctx *hbac_ctx,
return EINVAL;
}
- ret = check_service(pd, rule_attrs);
+ ret = check_service(hbac_ctx, rule_attrs);
if (ret != RULE_APPLICABLE) {
goto not_applicable;
}
@@ -1399,6 +1981,7 @@ static int evaluate_ipa_hbac_rules(struct hbac_ctx *hbac_ctx,
static void hbac_get_host_info_done(struct tevent_req *req);
static void hbac_get_rules_done(struct tevent_req *req);
+static void hbac_get_service_data_done(struct tevent_req *req);
void ipa_access_handler(struct be_req *be_req)
{
@@ -1533,11 +2116,9 @@ fail:
static void hbac_get_rules_done(struct tevent_req *req)
{
struct hbac_ctx *hbac_ctx = tevent_req_callback_data(req, struct hbac_ctx);
- struct pam_data *pd = hbac_ctx->pd;
struct be_req *be_req = hbac_ctx->be_req;
int ret;
int pam_status = PAM_SYSTEM_ERR;
- bool access_allowed = false;
ret = hbac_get_rules_recv(req, hbac_ctx, &hbac_ctx->hbac_rule_count,
&hbac_ctx->hbac_rule_list);
@@ -1546,6 +2127,41 @@ static void hbac_get_rules_done(struct tevent_req *req)
goto failed;
}
+ req = hbac_get_service_data_send(hbac_ctx, be_req->be_ctx->ev,
+ hbac_ctx->offline, hbac_ctx->sdap_ctx,
+ be_req->be_ctx->sysdb,
+ hbac_ctx->ldap_basedn);
+ if (req == NULL) {
+ DEBUG(1, ("hbac_get_service_data_send failed.\n"));
+ goto failed;
+ }
+
+ tevent_req_set_callback(req, hbac_get_service_data_done, hbac_ctx);
+ return;
+
+failed:
+ ipa_access_reply(be_req, pam_status);
+}
+
+static void hbac_get_service_data_done(struct tevent_req *req)
+{
+ struct hbac_ctx *hbac_ctx = tevent_req_callback_data(req, struct hbac_ctx);
+ struct pam_data *pd = hbac_ctx->pd;
+ struct be_req *be_req = hbac_ctx->be_req;
+ int ret;
+ int pam_status = PAM_SYSTEM_ERR;
+ bool access_allowed = false;
+
+ ret = hbac_get_service_data_recv(req, hbac_ctx,
+ &hbac_ctx->hbac_services_count,
+ &hbac_ctx->hbac_services_list,
+ &hbac_ctx->hbac_servicegroups_count,
+ &hbac_ctx->hbac_servicegroups_list);
+ talloc_zfree(req);
+ if (ret != EOK) {
+ goto failed;
+ }
+
ret = hbac_get_user_info(hbac_ctx, be_req->be_ctx,
pd->user, &hbac_ctx->user_dn,
&hbac_ctx->groups_count, &hbac_ctx->groups);
diff --git a/src/providers/ipa/ipa_access.h b/src/providers/ipa/ipa_access.h
index e3ba5c30c..e3e0c4ff5 100644
--- a/src/providers/ipa/ipa_access.h
+++ b/src/providers/ipa/ipa_access.h
@@ -60,6 +60,10 @@ struct hbac_ctx {
const char **groups;
bool offline;
char *ldap_basedn;
+ struct sysdb_attrs **hbac_services_list;
+ size_t hbac_services_count;
+ struct sysdb_attrs **hbac_servicegroups_list;
+ size_t hbac_servicegroups_count;
};
void ipa_access_handler(struct be_req *be_req);