summaryrefslogtreecommitdiffstats
path: root/src/db/sysdb_sudo.h
Commit message (Collapse)AuthorAgeFilesLines
* SUDO: Use initgr_with_views when looking up a sudo userJakub Hrozek2017-09-081-2/+4
| | | | | | | | | | | | | The sudo responder code didn't take views into account when looking for rules, which resulted in sudo rules being ignored if the user's name was overriden. Please see the ticket for a detailed info on how to reproduce the bug. Resolves: https://pagure.io/SSSD/sssd/issue/3488 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Remove unused prototype from header fileLukas Slebodnik2016-11-251-5/+0
| | | | | | | The function sysdb_get_sudo_filter was removed as part of ticket #2919 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sudo: solve problems with fully qualified namesPavel Březina2016-07-071-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | sudo expects the same name in sudo rule as login name. Therefore if fully qualified name is used or even enforced by setting use_fully_qualified_names to true or by forcing default domain with default_domain_suffix sssd is able to correctly return the rules but sudo can't match the user with contect of sudoUser attribute since it is not qualified. This patch changes the rules on the fly to avoid using names at all. We do this in two steps: 1. We fetch all rules that match current user name, id or groups and replace sudoUser attribute with sudoUser: #uid. 2. We fetch complementry rules that contain netgroups since it is expected we don't have infromation about existing netgroups in cache, sudo still needs to evaluate it for us if needed. This patch also remove test for sysdb_get_sudo_filter since it wasn't sufficient anyway and I did not rewrite it since I don't thing it is a good thing to have filter tests that depends on exact filter order. Resolves: https://fedorahosted.org/sssd/ticket/2919 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Add new funtions into sysdb_sudoPetr Cech2016-04-201-0/+14
| | | | | | | | | | | | This patch adds two new functions into public API of sysdb_sudo: * sysdb_search_sudo_rules * sysdb_set_sudo_rule_attr Resolves: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-091-0/+1
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmd mappingPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmdgrp mappingPavel Březina2016-01-191-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudorule mappingPavel Březina2016-01-191-0/+20
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-191-9/+8
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-151-0/+1
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_sudo.c moduleJakub Hrozek2013-11-151-11/+6
|
* sudo responder: change num_rules type from size_t to uint32_tPavel Březina2013-01-221-2/+2
| | | | | | | | https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
* Add domain arguments to sysdb sudo functionsSimo Sorce2013-01-151-8/+15
|
* Make sysdb_custom_subtree_dn() require a domain.Simo Sorce2013-01-151-2/+1
|
* sudo: support generalized time formatPavel Březina2012-12-131-2/+0
| | | | | | | https://fedorahosted.org/sssd/ticket/1712 The timestamp doesn't have to be in the form yyyymmddHHMMSSZ any more. It can be in any form of generalized time format.
* Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina2012-08-071-1/+1
| | | | | It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
* sudo: clean upPavel Březina2012-06-291-6/+0
|
* sudo sysdb: add expiration time to the filterPavel Březina2012-06-291-0/+1
|
* sysdb: remove sudo_set/get_refreshedPavel Březina2012-06-291-6/+0
|
* sysdb: add getter/setter for last sudo full refresh timePavel Březina2012-06-291-0/+4
|
* Redesign purging of the sudo cachePavel Březina2012-02-171-4/+14
| | | | https://fedorahosted.org/sssd/ticket/1173
* SUDO Integration - responder 'sudo_timed' optionPavel Březina2012-02-041-1/+9
| | | | https://fedorahosted.org/sssd/ticket/1116
* SUDO Integration - make sysdb_get_sudo_filter() more configurablePavel Březina2012-01-271-4/+11
| | | | https://fedorahosted.org/sssd/ticket/1143
* SUDO Integration - functions for manipulating with 'refreshed' attributePavel Březina2012-01-171-0/+10
| | | | https://fedorahosted.org/sssd/ticket/1110
* SUDO Integration - sysdb interfaceJakub Hrozek2011-12-161-0/+69
generated by cgit (git 2.34.1) at 2025-09-02 13:49:22 +0000