summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/providers/ipa/ipa_session.c74
1 files changed, 27 insertions, 47 deletions
diff --git a/src/providers/ipa/ipa_session.c b/src/providers/ipa/ipa_session.c
index 385b00908..38f0acd74 100644
--- a/src/providers/ipa/ipa_session.c
+++ b/src/providers/ipa/ipa_session.c
@@ -46,9 +46,10 @@ struct ipa_get_selinux_state {
struct sysdb_attrs *user;
struct sysdb_attrs *defaults;
+ struct sysdb_attrs **selinuxmaps;
+ size_t nmaps;
struct sysdb_attrs **possible_match;
- struct sysdb_attrs **confirmed_match;
};
static struct
@@ -118,6 +119,13 @@ static void ipa_session_handler_done(struct tevent_req *req)
if (ret != EOK) goto fail;
in_transaction = true;
+ ret = sysdb_delete_usermaps(breq->sysdb);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("Cannot delete existing maps from sysdb\n"));
+ goto fail;
+ }
+
if (default_user != NULL && map_order != NULL) {
ret = sysdb_store_selinux_config(sysdb, default_user, map_order);
if (ret != EOK) {
@@ -369,10 +377,7 @@ static void ipa_get_selinux_maps_done(struct tevent_req *subreq)
struct be_ctx *bctx;
struct ipa_id_ctx *id_ctx;
- struct sysdb_attrs **results;
- size_t count;
const char *tmp_str;
- size_t conf_cnt = 0;
size_t pos_cnt = 0;
uint32_t priority = 0;
errno_t ret;
@@ -383,7 +388,8 @@ static void ipa_get_selinux_maps_done(struct tevent_req *subreq)
bctx = state->be_req->be_ctx;
id_ctx = state->session_ctx->id_ctx;
- ret = ipa_selinux_get_maps_recv(subreq, state, &count, &results);
+ ret = ipa_selinux_get_maps_recv(subreq, state,
+ &state->nmaps, &state->selinuxmaps);
talloc_free(subreq);
if (ret != EOK) {
if (ret == ENOENT) {
@@ -395,62 +401,46 @@ static void ipa_get_selinux_maps_done(struct tevent_req *subreq)
goto done;
}
- DEBUG(SSSDBG_TRACE_FUNC, ("Found %d SELinux user maps in total, "
- "filtering ...\n", count));
- state->confirmed_match = talloc_zero_array(state, struct sysdb_attrs *,
- count + 1);
+ DEBUG(SSSDBG_TRACE_FUNC,
+ ("Found %d SELinux user maps\n", state->nmaps));
state->possible_match = talloc_zero_array(state, struct sysdb_attrs *,
- count + 1);
- if (state->confirmed_match == NULL || state->possible_match == NULL) {
+ state->nmaps + 1);
+ if (state->possible_match == NULL) {
ret = ENOMEM;
goto done;
}
- for (i = 0; i < count; i++) {
- if (sss_selinux_match(results[i], state->user, state->host, &priority)) {
+ for (i = 0; i < state->nmaps; i++) {
+ if (sss_selinux_match(state->selinuxmaps[i], state->user,
+ state->host, &priority)) {
priority &= ~(SELINUX_PRIORITY_USER_NAME |
SELINUX_PRIORITY_USER_GROUP |
SELINUX_PRIORITY_USER_CAT);
- ret = sysdb_attrs_add_uint32(results[i],
+ ret = sysdb_attrs_add_uint32(state->selinuxmaps[i],
SYSDB_SELINUX_HOST_PRIORITY,
priority);
if (ret != EOK) {
goto done;
}
-
- state->confirmed_match[conf_cnt] = talloc_steal(state->confirmed_match,
- results[i]);
- conf_cnt++;
continue;
}
- ret = sysdb_attrs_get_string(results[i], SYSDB_SELINUX_SEEALSO, &tmp_str);
+ ret = sysdb_attrs_get_string(state->selinuxmaps[i],
+ SYSDB_SELINUX_SEEALSO, &tmp_str);
if (ret == ENOENT) {
continue;
}
- state->possible_match[pos_cnt] = talloc_steal(state->possible_match,
- results[i]);
+ state->possible_match[pos_cnt] = state->selinuxmaps[i];
pos_cnt++;
}
- DEBUG(SSSDBG_TRACE_FUNC, ("Filtering done. Results: %d confirmed and %d "
- "possible maps remained.\n", conf_cnt, pos_cnt));
-
- /* Don't shrink the confirmed list, it could be later filled by HBAC rules */
- state->possible_match = talloc_realloc(state, state->possible_match,
- struct sysdb_attrs *, pos_cnt + 1);
- if (state->possible_match == NULL) {
- ret = ENOMEM;
- goto done;
- }
-
- /* This will free all rules that are neither confirmed nor possible */
- talloc_free(results);
if (pos_cnt) {
/* FIXME: detect if HBAC is configured
* - if yes, we can skip HBAC retrieval and get it directly from sysdb
*/
+ DEBUG(SSSDBG_TRACE_FUNC, ("%d SELinux maps referenced an HBAC rule. "
+ "Need to refresh HBAC rules\n", pos_cnt));
subreq = ipa_hbac_rule_info_send(state, false, bctx->ev,
sdap_id_op_handle(state->op),
id_ctx->sdap_id_ctx->opts,
@@ -485,8 +475,6 @@ static void ipa_get_selinux_hbac_done(struct tevent_req *subreq)
const char *hbac_dn;
const char *seealso_dn;
size_t rule_count;
- size_t conf_cnt;
- size_t pos_cnt;
uint32_t priority = 0;
errno_t ret;
int i, j;
@@ -497,8 +485,6 @@ static void ipa_get_selinux_hbac_done(struct tevent_req *subreq)
if (ret != EOK) {
goto done;
}
- for (conf_cnt = 0 ; state->confirmed_match[conf_cnt]; conf_cnt++) ;
- for (pos_cnt = 0 ; state->possible_match[pos_cnt]; pos_cnt++) ;
for (i = 0; i < rule_count; i++) {
if (!sss_selinux_match(rules[i], state->user, state->host, &priority)) {
@@ -543,9 +529,6 @@ static void ipa_get_selinux_hbac_done(struct tevent_req *subreq)
goto done;
}
- state->confirmed_match[conf_cnt++] = talloc_steal(
- state->confirmed_match,
- usermap);
/* Just to boost the following lookup */
state->possible_match[j] = NULL;
@@ -586,7 +569,6 @@ ipa_get_selinux_recv(struct tevent_req *req,
tevent_req_data(req, struct ipa_get_selinux_state);
const char *tmp_str;
errno_t ret;
- int i;
TEVENT_REQ_RETURN_ON_ERROR(req);
@@ -618,11 +600,9 @@ ipa_get_selinux_recv(struct tevent_req *req,
*default_user = NULL;
}
- if (state->confirmed_match != NULL) {
- for (i = 0; state->confirmed_match[i]; i++) ;
-
- *count = i;
- *maps = talloc_steal(mem_ctx, state->confirmed_match);
+ if (state->selinuxmaps != NULL) {
+ *count = state->nmaps;
+ *maps = talloc_steal(mem_ctx, state->selinuxmaps);
} else {
*count = 0;
*maps = NULL;