IPA SUDO: Implement rules refresh

Reviewed-by: Sumit Bose <sbose@redhat.com>

5 files changed, 186 insertions, 5 deletions

diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c
index 3e73bd30f..b4633858f 100644
--- a/src/providers/ipa/ipa_sudo.c
+++ b/src/providers/ipa/ipa_sudo.c
@@ -211,6 +211,7 @@ ipa_sudo_reply(struct tevent_req *req)
 {
     struct be_sudo_req *sudo_req;
     struct be_req *be_req;
+    bool deleted;
     int dp_error;
     int ret;
 
@@ -221,6 +222,12 @@ ipa_sudo_reply(struct tevent_req *req)
     case BE_REQ_SUDO_FULL:
         ret = ipa_sudo_full_refresh_recv(req, &dp_error);
         break;
+    case BE_REQ_SUDO_RULES:
+        ret = ipa_sudo_rules_refresh_recv(req, &dp_error, &deleted);
+        if (ret == EOK && deleted == true) {
+            ret = ENOENT;
+        }
+        break;
     default:
         DEBUG(SSSDBG_CRIT_FAILURE, "Invalid request type: %d\n",
                                     sudo_req->type);
@@ -256,6 +263,10 @@ ipa_sudo_handler(struct be_req *be_req)
     case BE_REQ_SUDO_FULL:
         req = ipa_sudo_full_refresh_send(be_req, be_ctx->ev, sudo_ctx);
         break;
+    case BE_REQ_SUDO_RULES:
+        req = ipa_sudo_rules_refresh_send(be_req, be_ctx->ev, sudo_ctx,
+                                          sudo_req->rules);
+        break;
     default:
         DEBUG(SSSDBG_CRIT_FAILURE, "Invalid request type: %d\n",
                                     sudo_req->type);
diff --git a/src/providers/ipa/ipa_sudo.h b/src/providers/ipa/ipa_sudo.h
index 1ef50a7f3..9dd729487 100644
--- a/src/providers/ipa/ipa_sudo.h
+++ b/src/providers/ipa/ipa_sudo.h
@@ -50,6 +50,11 @@ int
 ipa_sudo_full_refresh_recv(struct tevent_req *req,
                            int *dp_error);
 
+int
+ipa_sudo_rules_refresh_recv(struct tevent_req *req,
+                            int *dp_error,
+                            bool *deleted);
+
 struct tevent_req *
 ipa_sudo_refresh_send(TALLOC_CTX *mem_ctx,
                       struct tevent_context *ev,
@@ -57,6 +62,12 @@ ipa_sudo_refresh_send(TALLOC_CTX *mem_ctx,
                       const char *search_filter,
                       const char *delete_filter);
 
+struct tevent_req *
+ipa_sudo_rules_refresh_send(TALLOC_CTX *mem_ctx,
+                            struct tevent_context *ev,
+                            struct ipa_sudo_ctx *sudo_ctx,
+                            char **rules);
+
 errno_t
 ipa_sudo_refresh_recv(struct tevent_req *req,
                       int *dp_error,
diff --git a/src/providers/ipa/ipa_sudo_async.c b/src/providers/ipa/ipa_sudo_async.c
index 9ddda1b41..cea85cdbf 100644
--- a/src/providers/ipa/ipa_sudo_async.c
+++ b/src/providers/ipa/ipa_sudo_async.c
@@ -140,6 +140,7 @@ struct ipa_sudo_fetch_state {
     struct sdap_options *sdap_opts;
     struct ipa_hostinfo *host;
     struct sdap_handle *sh;
+    const char *search_filter;
 
     struct sdap_attr_map *map_cmdgroup;
     struct sdap_attr_map *map_rule;
@@ -169,7 +170,8 @@ ipa_sudo_fetch_send(TALLOC_CTX *mem_ctx,
                     struct sdap_attr_map *map_group,
                     struct sdap_attr_map *map_host,
                     struct sdap_attr_map *map_hostgroup,
-                    struct sdap_handle *sh)
+                    struct sdap_handle *sh,
+                    const char *search_filter)
 {
     struct ipa_sudo_fetch_state *state = NULL;
     struct tevent_req *req = NULL;
@@ -188,6 +190,7 @@ ipa_sudo_fetch_send(TALLOC_CTX *mem_ctx,
     state->sdap_opts = sudo_ctx->sdap_opts;
     state->host = host;
     state->sh = sh;
+    state->search_filter = search_filter == NULL ? "" : search_filter;
 
     state->map_cmdgroup = sudo_ctx->sudocmdgroup_map;
     state->map_rule = sudo_ctx->sudorule_map;
@@ -241,10 +244,10 @@ ipa_sudo_fetch_rules(struct tevent_req *req)
         return ENOMEM;
     }
 
-    filter = talloc_asprintf(state, "(&(objectClass=%s)(%s=TRUE)%s)",
+    filter = talloc_asprintf(state, "(&(objectClass=%s)(%s=TRUE)%s%s)",
                              map[IPA_OC_SUDORULE].name,
                              map[IPA_AT_SUDORULE_ENABLED].name,
-                             host_filter);
+                             host_filter, state->search_filter);
     talloc_zfree(host_filter);
     if (filter == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Unable to build filter\n");
@@ -678,7 +681,8 @@ ipa_sudo_refresh_host_done(struct tevent_req *subreq)
                                  state->sdap_opts->user_map,
                                  state->sdap_opts->group_map,
                                  state->ipa_opts->host_map,
-                                 state->ipa_opts->hostgroup_map, state->sh);
+                                 state->ipa_opts->hostgroup_map, state->sh,
+                                 state->search_filter);
     if (subreq == NULL) {
         state->dp_error = DP_ERR_FATAL;
         tevent_req_error(req, ENOMEM);
diff --git a/src/providers/ipa/ipa_sudo_conversion.c b/src/providers/ipa/ipa_sudo_conversion.c
index 2f28f837e..195e40f24 100644
--- a/src/providers/ipa/ipa_sudo_conversion.c
+++ b/src/providers/ipa/ipa_sudo_conversion.c
@@ -1124,7 +1124,7 @@ ipa_sudo_conv_result(TALLOC_CTX *mem_ctx,
     }
 
     if (ctx.ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand command grousp "
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand command groups "
               "[%d]: %s\n", ctx.ret, sss_strerror(ctx.ret));
         return ctx.ret;
     }
diff --git a/src/providers/ipa/ipa_sudo_refresh.c b/src/providers/ipa/ipa_sudo_refresh.c
index 6fb8f66af..f1b99c0de 100644
--- a/src/providers/ipa/ipa_sudo_refresh.c
+++ b/src/providers/ipa/ipa_sudo_refresh.c
@@ -141,6 +141,161 @@ ipa_sudo_full_refresh_recv(struct tevent_req *req,
     return EOK;
 }
 
+struct ipa_sudo_rules_refresh_state {
+    size_t num_rules;
+    int dp_error;
+    bool deleted;
+};
+
+static void ipa_sudo_rules_refresh_done(struct tevent_req *subreq);
+
+struct tevent_req *
+ipa_sudo_rules_refresh_send(TALLOC_CTX *mem_ctx,
+                            struct tevent_context *ev,
+                            struct ipa_sudo_ctx *sudo_ctx,
+                            char **rules)
+{
+    TALLOC_CTX *tmp_ctx;
+    struct ipa_sudo_rules_refresh_state *state;
+    struct tevent_req *subreq;
+    struct tevent_req *req;
+    char *search_filter;
+    char *delete_filter;
+    char *safe_rule;
+    errno_t ret;
+    int i;
+
+    req = tevent_req_create(mem_ctx, &state, struct ipa_sudo_rules_refresh_state);
+    if (req == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");
+        return NULL;
+    }
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");
+        ret = ENOMEM;
+        goto immediately;
+    }
+
+    if (rules == NULL || rules[0] == NULL) {
+        state->dp_error = DP_ERR_OK;
+        state->num_rules = 0;
+        state->deleted = false;
+        ret = EOK;
+        goto immediately;
+    }
+
+    search_filter = talloc_zero(tmp_ctx, char); /* assign to tmp_ctx */
+    delete_filter = talloc_zero(tmp_ctx, char); /* assign to tmp_ctx */
+
+    /* Download only selected rules from LDAP. */
+    /* Remove all selected rules from cache. */
+    for (i = 0; rules[i] != NULL; i++) {
+        ret = sss_filter_sanitize(tmp_ctx, rules[i], &safe_rule);
+        if (ret != EOK) {
+            ret = ENOMEM;
+            goto immediately;
+        }
+
+        search_filter = talloc_asprintf_append_buffer(search_filter, "(%s=%s)",
+                             sudo_ctx->sudorule_map[IPA_AT_SUDORULE_NAME].name,
+                             safe_rule);
+        if (search_filter == NULL) {
+            ret = ENOMEM;
+            goto immediately;
+        }
+
+        delete_filter = talloc_asprintf_append_buffer(delete_filter, "(%s=%s)",
+                                                      SYSDB_NAME, safe_rule);
+        if (delete_filter == NULL) {
+            ret = ENOMEM;
+            goto immediately;
+        }
+    }
+
+    state->num_rules = i;
+
+    search_filter = talloc_asprintf(tmp_ctx, "(|%s)", search_filter);
+    if (search_filter == NULL) {
+        ret = ENOMEM;
+        goto immediately;
+    }
+
+    delete_filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(|%s))",
+                                    SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_OC,
+                                    delete_filter);
+    if (delete_filter == NULL) {
+        ret = ENOMEM;
+        goto immediately;
+    }
+
+    subreq = ipa_sudo_refresh_send(req, ev, sudo_ctx, search_filter,
+                                   delete_filter);
+    if (subreq == NULL) {
+        ret = ENOMEM;
+        goto immediately;
+    }
+
+    tevent_req_set_callback(subreq, ipa_sudo_rules_refresh_done, req);
+
+    ret = EOK;
+
+immediately:
+    talloc_free(tmp_ctx);
+
+    if (ret != EOK) {
+        tevent_req_error(req, ret);
+        tevent_req_post(req, ev);
+    }
+
+    return req;
+}
+
+static void
+ipa_sudo_rules_refresh_done(struct tevent_req *subreq)
+{
+    struct ipa_sudo_rules_refresh_state *state;
+    struct tevent_req *req = NULL;
+    size_t downloaded_rules_num;
+    int ret;
+
+    req = tevent_req_callback_data(subreq, struct tevent_req);
+    state = tevent_req_data(req, struct ipa_sudo_rules_refresh_state);
+
+    ret = ipa_sudo_refresh_recv(subreq, &state->dp_error, &downloaded_rules_num);
+    talloc_zfree(subreq);
+    if (ret != EOK || state->dp_error != DP_ERR_OK) {
+        goto done;
+    }
+
+    state->deleted = downloaded_rules_num != state->num_rules ? true : false;
+
+done:
+    if (ret != EOK) {
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    tevent_req_done(req);
+}
+
+int
+ipa_sudo_rules_refresh_recv(struct tevent_req *req,
+                            int *dp_error,
+                            bool *deleted)
+{
+    struct ipa_sudo_rules_refresh_state *state;
+    state = tevent_req_data(req, struct ipa_sudo_rules_refresh_state);
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+
+    *dp_error = state->dp_error;
+    *deleted = state->deleted;
+
+    return EOK;
+}
+
 static struct tevent_req *
 ipa_sudo_ptask_full_refresh_send(TALLOC_CTX *mem_ctx,
                                  struct tevent_context *ev,