1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/*
* lib/kadm5/srv/server_acl.h
*
* Copyright 1995-2004, 2007, 2008 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. Furthermore if you modify this software you must label
* your software as modified software and not distribute it in such a
* fashion that it might be confused with the original M.I.T. software.
* M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
*/
#ifndef SERVER_ACL_H__
#define SERVER_ACL_H__
/*
* Debug definitions.
*/
#define DEBUG_SPROC 1
#define DEBUG_OPERATION 2
#define DEBUG_HOST 4
#define DEBUG_REALM 8
#define DEBUG_REQUESTS 16
#define DEBUG_ACL 32
#define DEBUG_PROTO 64
#define DEBUG_CALLS 128
#define DEBUG_NOSLAVES 256
#ifdef DEBUG
#define DPRINT(l1, cl, al) if ((cl & l1) != 0) xprintf al
#else /* DEBUG */
#define DPRINT(l1, cl, al)
#endif /* DEBUG */
/*
* Access control bits.
*/
#define ACL_ADD 1
#define ACL_DELETE 2
#define ACL_MODIFY 4
#define ACL_CHANGEPW 8
/* #define ACL_CHANGE_OWN_PW 16 */
#define ACL_INQUIRE 32
/* #define ACL_EXTRACT 64 */
#define ACL_LIST 128
#define ACL_SETKEY 256
#define ACL_IPROP 512
#define ACL_RENAME (ACL_ADD+ACL_DELETE)
#define ACL_ALL_MASK (ACL_ADD | \
ACL_DELETE | \
ACL_MODIFY | \
ACL_CHANGEPW | \
ACL_INQUIRE | \
ACL_LIST | \
ACL_IPROP | \
ACL_SETKEY)
typedef struct _restriction {
long mask;
krb5_flags require_attrs;
krb5_flags forbid_attrs;
krb5_deltat princ_lifetime;
krb5_deltat pw_lifetime;
krb5_deltat max_life;
krb5_deltat max_renewable_life;
long aux_attributes;
char *policy;
} restriction_t;
krb5_error_code kadm5int_acl_init(krb5_context, int, char *);
void kadm5int_acl_finish(krb5_context, int);
krb5_boolean kadm5int_acl_check(krb5_context,
gss_name_t,
krb5_int32,
krb5_principal,
restriction_t **);
krb5_boolean kadm5int_acl_check_krb(krb5_context,
krb5_const_principal,
krb5_int32,
krb5_const_principal,
restriction_t **);
krb5_error_code kadm5int_acl_impose_restrictions(krb5_context,
kadm5_principal_ent_rec *,
long *,
restriction_t *);
#endif /* SERVER_ACL_H__ */
|
