sssd.git/src/db/sysdb_sudo.h, branch jhrozek_sysdb_fqdn

sudo: solve problems with fully qualified names

2016-07-06T15:40:23+00:00

sudo expects the same name in sudo rule as login name. Therefore
if fully qualified name is used or even enforced by setting
use_fully_qualified_names to true or by forcing default domain
with default_domain_suffix sssd is able to correctly return the
rules but sudo can't match the user with contect of sudoUser
attribute since it is not qualified.

This patch changes the rules on the fly to avoid using names at all.
We do this in two steps:
1. We fetch all rules that match current user name, id or groups and
   replace sudoUser attribute with sudoUser: #uid.
2. We fetch complementry rules that contain netgroups since it is
   expected we don't have infromation about existing netgroups in
   cache, sudo still needs to evaluate it for us if needed.

This patch also remove test for sysdb_get_sudo_filter since it wasn't
sufficient anyway and I did not rewrite it since I don't thing it
is a good thing to have filter tests that depends on exact filter
order.

Resolves:
https://fedorahosted.org/sssd/ticket/2919

Reviewed-by: Jakub Hrozek

SYSDB: Add new funtions into sysdb_sudo

2016-04-20T18:26:40+00:00

This patch adds two new functions into public
API of sysdb_sudo:
* sysdb_search_sudo_rules
* sysdb_set_sudo_rule_attr

Resolves:
https://fedorahosted.org/sssd/ticket/2081

Reviewed-by: Pavel Březina

IPA SUDO: download externalUser attribute

2016-03-09T14:24:43+00:00

This allows configuration with id_provider = proxy
and sudo_provider = ipa when someone needs to fetch
rules for local users.

https://fedorahosted.org/sssd/ticket/2972

Reviewed-by: Jakub Hrozek

IPA SUDO: Add support for ipaSudoRunAsExt* attributes

2016-01-19T13:34:02+00:00

Reviewed-by: Sumit Bose

IPA SUDO: Add ipasudocmd mapping

2016-01-19T13:33:30+00:00

Reviewed-by: Sumit Bose

IPA SUDO: Add ipasudocmdgrp mapping

2016-01-19T13:33:28+00:00

Reviewed-by: Sumit Bose

IPA SUDO: Add ipasudorule mapping

2016-01-19T13:33:24+00:00

Reviewed-by: Sumit Bose

SUDO: make sudo sysdb interface more reusable

2016-01-19T13:33:04+00:00

Reviewed-by: Sumit Bose

sudo: fetch sudoRunAs attribute

2014-07-15T14:45:05+00:00

This attribute was used in pre 1.7 versions of sudo and it is now
deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users
still use this attribute so we need to support it to ensure backward
compatibility.

This patch makes sure that this attribute is downloaded if present and
provided to sudo. Sudo than decides how to handle it.

The new mapping option is not present in a man page since this
attribute is deprecated in sudo for a very long time.

Resolves:
https://fedorahosted.org/sssd/ticket/2212

Reviewed-by: Jakub Hrozek

SYSDB: Drop the sysdb_ctx parameter from the sysdb_sudo.c module

2013-11-15T19:20:18+00:00