summaryrefslogtreecommitdiffstats
path: root/src/db/sysdb_sudo.c
Commit message (Collapse)AuthorAgeFilesLines
* SUDO: Only store lowercased attribute value onceJakub Hrozek2017-02-101-14/+3
| | | | | | | | | | | | | | | | | | | The current code doesn't handle the situation where lowercasing the sudoUser attribute would yield the same value again. For example: sudoUser: TUSER sudoUser tuser would break. This patch switches to using the utility function sysdb_attrs_add_lower_case_string() which already checks for duplicates. Resolves: https://fedorahosted.org/sssd/ticket/3301 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Fixing of sudorule without a sudoUserPetr Čech2016-11-231-0/+5
| | | | | | | | | | | | | | This patch solved a regression caused by the recent patches to lowercase sudoUser -- in case sudoUser is missing completely, we abort the processing of this rule and all others. With this patch, we return ERR_MALFORMED_ENTRY and gracefully skip the malformed rule instead. Resolves: https://fedorahosted.org/sssd/ticket/3241 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Adding lowercase sudoUser formPetr Čech2016-11-081-0/+64
| | | | | | | | | | | If domain is not case sensitive we add lowercase form of usernames to sudoUser attributes. So we actually able to apply sudoRule on user Administrator@... with login admnistrator@... Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sudo: solve problems with fully qualified namesPavel Březina2016-07-071-67/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | sudo expects the same name in sudo rule as login name. Therefore if fully qualified name is used or even enforced by setting use_fully_qualified_names to true or by forcing default domain with default_domain_suffix sssd is able to correctly return the rules but sudo can't match the user with contect of sudoUser attribute since it is not qualified. This patch changes the rules on the fly to avoid using names at all. We do this in two steps: 1. We fetch all rules that match current user name, id or groups and replace sudoUser attribute with sudoUser: #uid. 2. We fetch complementry rules that contain netgroups since it is expected we don't have infromation about existing netgroups in cache, sudo still needs to evaluate it for us if needed. This patch also remove test for sysdb_get_sudo_filter since it wasn't sufficient anyway and I did not rewrite it since I don't thing it is a good thing to have filter tests that depends on exact filter order. Resolves: https://fedorahosted.org/sssd/ticket/2919 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Add new funtions into sysdb_sudoPetr Cech2016-04-201-0/+97
| | | | | | | | | | | | This patch adds two new functions into public API of sysdb_sudo: * sysdb_search_sudo_rules * sysdb_set_sudo_rule_attr Resolves: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB_SUDO: Remove useless testLukas Slebodnik2016-04-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The function sysdb_search_custom cannot return EOK and together set output argument count to zero. This case is already handled in function sysdb_search_entry which is used inside sysdb_search_custom. Such useless test can just cause read of unitialized variable in case of other errors returned from sysdb_search_custom. Error: UNINIT (CWE-457): [#def1] sssd-1.13.4/src/db/sysdb_sudo.c:678: var_decl: Declaring variable "count" without initializer. sssd-1.13.4/src/db/sysdb_sudo.c:698: uninit_use: Using uninitialized value "count". # 696| SUDORULE_SUBDIR, attrs, # 697| &count, &msgs); # 698|-> if (ret == ENOENT || count == 0) { # 699| DEBUG(SSSDBG_TRACE_FUNC, "No rules matched\n"); # 700| ret = EOK; Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-191-60/+226
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sudo: sanitize filter valuesPavel Březina2015-04-131-2/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2613 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-171-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Log reason in debug message why ldb_modify failedLukas Slebodnik2015-03-111-0/+5
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* Don't use macro _XOPEN_SOURCE for function strptimeLukas Slebodnik2014-05-271-1/+1
| | | | | | | | | We detect all necessary feature macros in configure script using AC_USE_SYSTEM_EXTENSIONS or AC_GNU_SOURCE. This patch replaces all definitions of macro _XOPEN_SOURCE with header file config.h Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-30/+30
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sudo: memset tm when converting time attributesPavel Březina2014-01-291-0/+2
| | | | | | | | | | strptime() which is used to parse LDAP time value does not initialize all fields of tm structure (especially tm_isdst). This results in random behavior - when the tm is converted into timestamp via mktime(), the result depends on current value of tm_isdst. Resolves: https://fedorahosted.org/sssd/ticket/2213
* SYSDB: Drop redundant sysdb_ctx parameter from sysdb.cMichal Zidek2013-11-151-1/+1
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)Michal Zidek2013-11-151-3/+3
|
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_sudo.c moduleJakub Hrozek2013-11-151-36/+30
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)Michal Zidek2013-11-151-4/+3
|
* SYSDB: Fix incorrect DEBUG messageStephen Gallagher2013-10-041-1/+1
| | | | | | | | A bad comparison resulted in the sysdb_sudo_check_time() function always printing a debug message saying that the time matched. Resolves: Coverity Issue #12031
* sudo: improve time restrictions debug messagesPavel Březina2013-10-011-0/+8
|
* sudo: allow specifying only one time restrictionPavel Březina2013-10-011-47/+34
| | | | https://fedorahosted.org/sssd/ticket/2100
* sudo responder: change num_rules type from size_t to uint32_tPavel Březina2013-01-221-3/+3
| | | | | | | | https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
* Add domain arguments to sysdb sudo functionsSimo Sorce2013-01-151-18/+27
|
* Add domain to sysdb_delete_customSimo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_search_custom()Simo Sorce2013-01-151-1/+1
| | | | Also changes sysdb_search_custom_by_name()
* Add domain argument to sysdb_store_custom()Simo Sorce2013-01-151-1/+1
|
* Add domain to sysdb_search_group_by_gid()Simo Sorce2013-01-151-1/+1
| | | | Also remove unused sysdb_search_domgroup_by_gid()
* Add domain to sysdb_search_user_by_name()Simo Sorce2013-01-151-2/+2
| | | | Also remove unused sysdb_search_domuser_by_name()
* Make sysdb_custom_subtree_dn() require a domain.Simo Sorce2013-01-151-3/+5
|
* Fix a 'shadows a global declaration' warningSumit Bose2012-12-191-2/+2
|
* sudo: support generalized time formatPavel Březina2012-12-131-11/+34
| | | | | | | https://fedorahosted.org/sssd/ticket/1712 The timestamp doesn't have to be in the form yyyymmddHHMMSSZ any more. It can be in any form of generalized time format.
* sudo: include primary group in user group listPavel Březina2012-12-131-1/+41
| | | | https://fedorahosted.org/sssd/ticket/1677
* sysdb_get_sudo_user_info() initialize attrs on declarationPavel Březina2012-12-131-4/+3
|
* SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2012-09-241-2/+1
| | | | | The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
* Unify usage of sysdb transactions (part 2).Michal Zidek2012-09-041-2/+5
|
* Remove SYSDB_SUDO_CACHE_OC from attribute listsPavel Březina2012-08-071-1/+0
| | | | It is not an attribute.
* Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina2012-08-071-3/+3
| | | | | It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
* Fix uninitialized valuesNick Guay2012-07-181-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1379
* sudo: clean upPavel Březina2012-06-291-206/+0
|
* sudo sysdb: add expiration time to the filterPavel Březina2012-06-291-0/+8
|
* sysdb: remove sudo_set/get_refreshedPavel Březina2012-06-291-57/+0
|
* sysdb: add getter/setter for last sudo full refresh timePavel Březina2012-06-291-0/+143
|
* sudo sysdb: make sysdb_get_sudo_user_info more configurablePavel Březina2012-06-291-25/+35
|
* sysdb: return proper error code from sysdb_sudo_purge_allJakub Hrozek2012-05-101-1/+1
|
* SUDO: Return ret, not EOKJakub Hrozek2012-05-021-1/+1
| | | | | | | This patch fixes bad refactoring - the function used to return value directly on error and EOK as the last statement. If was then converted into using goto label, but the last statement was still returning EOK instead of the value it should.
* Redesign purging of the sudo cachePavel Březina2012-02-171-71/+301
| | | | https://fedorahosted.org/sssd/ticket/1173
* Improve debug messages in sysdb_sudo_check_time()Pavel Březina2012-02-101-4/+16
|
* SUDO Integration - sysdb_sudo_check_time() fixPavel Březina2012-02-061-6/+8
|
* Fixes for sudo_timedJakub Hrozek2012-02-041-23/+40
| | | | https://fedorahosted.org/sssd/ticket/1116
* SUDO Integration - responder 'sudo_timed' optionPavel Březina2012-02-041-36/+123
| | | | https://fedorahosted.org/sssd/ticket/1116
* SUDO Integration - make sysdb_get_sudo_filter() more configurablePavel Březina2012-01-271-42/+57
| | | | https://fedorahosted.org/sssd/ticket/1143
generated by cgit (git 2.34.1) at 2025-09-02 18:42:48 +0000