From 83a3317cb6acd44adad338a6fe4987f0ad3b4d64 Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Fri, 20 Jul 2012 11:06:20 -0400
Subject: Extend category support in SELinux user maps

This patch adds the possibility for user/host category attributes to
have more than one value. It also fixes semantically wrong evaluation of
SELinux map priority.
---
 src/util/sss_selinux.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

(limited to 'src/util')

diff --git a/src/util/sss_selinux.c b/src/util/sss_selinux.c
index b749b236d..b933d9fc8 100644
--- a/src/util/sss_selinux.c
+++ b/src/util/sss_selinux.c
@@ -62,6 +62,7 @@ bool sss_selinux_match(struct sysdb_attrs *usermap,
     uint32_t priority = 0;
     bool matched_name;
     bool matched_group;
+    bool matched_category;
     errno_t ret;
 
     if (usermap == NULL) {
@@ -100,8 +101,17 @@ bool sss_selinux_match(struct sysdb_attrs *usermap,
          * The rule won't match if user category != "all" and user map doesn't
          * contain neither user nor any of his groups in memberUser attribute
          */
-        if (usercat == NULL || usercat->num_values == 0 ||
-            strcasecmp((char *)usercat->values[0].data, "all") != 0) {
+        matched_category = false;
+        if (usercat != NULL) {
+            for (i = 0; i < usercat->num_values; i++) {
+                if (strcasecmp((char *)usercat->values[i].data, "all") == 0) {
+                    matched_category = true;
+                    break;
+                }
+            }
+        }
+
+        if (!matched_category) {
             if (users_el == NULL) {
                 DEBUG(SSSDBG_TRACE_ALL, ("No users specified in the rule!\n"));
                 return false;
@@ -140,8 +150,16 @@ bool sss_selinux_match(struct sysdb_attrs *usermap,
          * The rule won't match if host category != "all" and user map doesn't
          * contain neither host nor any of its groups in memberHost attribute
          */
-        if (hostcat == NULL || hostcat->num_values == 0 ||
-            strcasecmp((char *)hostcat->values[0].data, "all") != 0) {
+        matched_category = false;
+        if (hostcat != NULL) {
+            for (i = 0; i < hostcat->num_values; i++) {
+                if (strcasecmp((char *)hostcat->values[i].data, "all") == 0) {
+                    matched_category = true;
+                    break;
+                }
+            }
+        }
+        if (!matched_category) {
             if (hosts_el == NULL) {
                 DEBUG(SSSDBG_TRACE_ALL, ("No users specified in the rule!\n"));
                 return false;
@@ -157,9 +175,9 @@ bool sss_selinux_match(struct sysdb_attrs *usermap,
                     return false;
                 }
             }
+        } else {
+            priority |= SELINUX_PRIORITY_HOST_CAT;
         }
-    } else {
-        priority |= SELINUX_PRIORITY_HOST_CAT;
     }
 
     if (_priority != NULL) {
-- 
cgit