HBAC: Use originalMember for identifying servicegroups

3 files changed, 169 insertions, 41 deletions

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 56c851b1..7a614c31 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -405,7 +405,7 @@ static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sysdb_ctx *sysdb,
                           struct sss_domain_info *domain,
-                          const char *hostname,
+                          const char *servicename,
                           struct hbac_request_element **svc_element);
 
 static errno_t
@@ -588,18 +588,18 @@ static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sysdb_ctx *sysdb,
                           struct sss_domain_info *domain,
-                          const char *hostname,
+                          const char *servicename,
                           struct hbac_request_element **svc_element)
 {
     errno_t ret;
-    size_t i, count;
+    size_t i, j, count;
     TALLOC_CTX *tmp_ctx;
     struct hbac_request_element *svc;
     struct ldb_message **msgs;
-    const char *group_name;
+    struct ldb_message_element *el;
     struct ldb_dn *svc_dn;
-    const char *attrs[] = { IPA_CN, NULL };
-    const char *service_filter;
+    const char *memberof_attrs[] = { SYSDB_ORIG_MEMBEROF, NULL };
+    char *name;
 
     tmp_ctx = talloc_new(mem_ctx);
     if (tmp_ctx == NULL) return ENOMEM;
@@ -610,15 +610,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    svc->name = hostname;
-
-    service_filter = talloc_asprintf(tmp_ctx,
-                                     "(objectClass=%s)",
-                                     IPA_HBAC_SERVICE_GROUP);
-    if (service_filter == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
+    svc->name = servicename;
 
     svc_dn = sysdb_custom_dn(sysdb, tmp_ctx, domain->name,
                              svc->name, HBAC_SERVICES_SUBDIR);
@@ -627,46 +619,68 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    /* Find the service groups */
-    ret = sysdb_asq_search(tmp_ctx, sysdb, domain, svc_dn,
-                           service_filter, SYSDB_MEMBEROF,
-                           attrs, &count, &msgs);
-    if (ret != EOK && ret != ENOENT) {
-        DEBUG(1, ("Could not look up servicegroups\n"));
+    /* Look up the service to get its originalMemberOf entries */
+    ret = sysdb_search_entry(tmp_ctx, sysdb, svc_dn,
+                             LDB_SCOPE_BASE, NULL,
+                             memberof_attrs,
+                             &count, &msgs);
+    if (ret == ENOENT || count == 0) {
+        /* We won't be able to identify any groups
+         * This rule will only match the name or
+         * a service category of ALL
+         */
+        svc->groups = NULL;
+        ret = EOK;
         goto done;
-    } else if (ret == ENOENT) {
-        count = 0;
+    } else if (ret != EOK) {
+        goto done;
+    } else if (count > 1) {
+        DEBUG(1, ("More than one result for a BASE search!\n"));
+        ret = EIO;
+        goto done;
+    }
+
+    el = ldb_msg_find_element(msgs[0], SYSDB_ORIG_MEMBEROF);
+    if (!el) {
+        /* Service is not a member of any groups
+         * This rule will only match the name or
+         * a service category of ALL
+         */
+        svc->groups = NULL;
+        ret = EOK;
     }
 
-    svc->groups = talloc_array(svc, const char *, count + 1);
+
+    svc->groups = talloc_array(svc, const char *, el->num_values + 1);
     if (svc->groups == NULL) {
         ret = ENOMEM;
         goto done;
     }
 
-    for (i = 0; i < count; i++) {
-        group_name = ldb_msg_find_attr_as_string(msgs[i], IPA_CN, NULL);
-        if (group_name == NULL) {
-            DEBUG(1, ("Group with no name?\n"));
-            ret = EINVAL;
-            goto done;
-        }
-        svc->groups[i] = talloc_strdup(svc->groups,
-                                       group_name);
-        if (svc->groups[i] == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
+    for (i = j = 0; i < el->num_values; i++) {
+        ret = get_ipa_servicegroupname(tmp_ctx, sysdb,
+                                       (const char *)el->values[i].data,
+                                       &name);
+        if (ret != EOK && ret != ENOENT) goto done;
 
-        DEBUG(6, ("Added service group [%s] to the eval request\n",
-                  svc->groups[i]));
+        /* ENOENT means we had a memberOf entry that wasn't a
+         * service group. We'll just ignore those (could be
+         * HBAC rules)
+         */
+
+        if (ret == EOK) {
+            svc->groups[j] = talloc_steal(svc->groups, name);
+            j++;
+        }
     }
-    svc->groups[i] = NULL;
+    svc->groups[j] = NULL;
 
-    *svc_element = talloc_steal(mem_ctx, svc);
     ret = EOK;
 
 done:
+    if (ret == EOK) {
+        *svc_element = talloc_steal(mem_ctx, svc);
+    }
     talloc_free(tmp_ctx);
     return ret;
 }
diff --git a/src/providers/ipa/ipa_hbac_private.h b/src/providers/ipa/ipa_hbac_private.h
index 7289a042..4c637aa5 100644
--- a/src/providers/ipa/ipa_hbac_private.h
+++ b/src/providers/ipa/ipa_hbac_private.h
@@ -157,6 +157,11 @@ hbac_service_attrs_to_rule(TALLOC_CTX *mem_ctx,
                            const char *rule_name,
                            struct sysdb_attrs *rule_attrs,
                            struct hbac_rule_element **services);
+errno_t
+get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
+                         struct sysdb_ctx *sysdb,
+                         const char *service_dn,
+                         char **servicename);
 
 /* From ipa_hbac_rules.c */
 struct tevent_req *
diff --git a/src/providers/ipa/ipa_hbac_services.c b/src/providers/ipa/ipa_hbac_services.c
index df276b86..d5390e51 100644
--- a/src/providers/ipa/ipa_hbac_services.c
+++ b/src/providers/ipa/ipa_hbac_services.c
@@ -449,3 +449,112 @@ done:
     talloc_free(tmp_ctx);
     return ret;
 }
+
+errno_t
+get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
+                         struct sysdb_ctx *sysdb,
+                         const char *service_dn,
+                         char **servicegroupname)
+{
+    errno_t ret;
+    struct ldb_dn *dn;
+    const char *rdn_name;
+    const char *svc_comp_name;
+    const char *hbac_comp_name;
+    const struct ldb_val *rdn_val;
+    const struct ldb_val *svc_comp_val;
+    const struct ldb_val *hbac_comp_val;
+
+    /* This is an IPA-specific hack. It may not
+     * work for non-IPA servers and will need to
+     * be changed if SSSD ever supports HBAC on
+     * a non-IPA server.
+     */
+    *servicegroupname = NULL;
+
+    dn = ldb_dn_new(mem_ctx, sysdb_ctx_get_ldb(sysdb), service_dn);
+    if (dn == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    if (!ldb_dn_validate(dn)) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    if (ldb_dn_get_comp_num(dn) < 4) {
+        /* RDN, services, hbac, and at least one DC= */
+        /* If it's fewer, it's not a group DN */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* If the RDN name is 'cn' */
+    rdn_name = ldb_dn_get_rdn_name(dn);
+    if (rdn_name == NULL) {
+        /* Shouldn't happen if ldb_dn_validate()
+         * passed, but we'll be careful.
+         */
+        ret = EINVAL;
+        goto done;
+    }
+
+    if (strcasecmp("cn", rdn_name) != 0) {
+        /* RDN has the wrong attribute name.
+         * It's not a service.
+         */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* and the second component is "cn=hbacservicegroups" */
+    svc_comp_name = ldb_dn_get_component_name(dn, 1);
+    if (strcasecmp("cn", svc_comp_name) != 0) {
+        /* The second component name is not "cn" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    svc_comp_val = ldb_dn_get_component_val(dn, 1);
+    if (strncasecmp("hbacservicegroups",
+                    (const char *) svc_comp_val->data,
+                    svc_comp_val->length) != 0) {
+        /* The second component value is not "hbacservicegroups" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* and the third component is "hbac" */
+    hbac_comp_name = ldb_dn_get_component_name(dn, 2);
+    if (strcasecmp("cn", hbac_comp_name) != 0) {
+        /* The third component name is not "cn" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    hbac_comp_val = ldb_dn_get_component_val(dn, 2);
+    if (strncasecmp("hbac",
+                    (const char *) hbac_comp_val->data,
+                    hbac_comp_val->length) != 0) {
+        /* The third component value is not "hbac" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* Then the value of the RDN is the group name */
+    rdn_val = ldb_dn_get_rdn_val(dn);
+    *servicegroupname = talloc_strndup(mem_ctx,
+                                       (const char *)rdn_val->data,
+                                       rdn_val->length);
+    if (*servicegroupname == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = EOK;
+
+done:
+    talloc_free(dn);
+    return ret;
+}