summaryrefslogtreecommitdiffstats
path: root/src/providers
diff options
context:
space:
mode:
Diffstat (limited to 'src/providers')
-rw-r--r--src/providers/krb5/krb5_auth.c18
-rw-r--r--src/providers/krb5/krb5_auth.h4
-rw-r--r--src/providers/krb5/krb5_utils.c213
-rw-r--r--src/providers/krb5/krb5_utils.h14
4 files changed, 169 insertions, 80 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 6df34a8a..7937ec7e 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -293,7 +293,7 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
{
const char *ccname_template;
const char *realm;
- bool private_path = false;
+ char *public_dir = NULL;
errno_t ret;
if (!kr->is_offline) {
@@ -301,11 +301,11 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
}
ccname_template = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
- kr->ccname = expand_ccname_template(kr, kr, ccname_template, true,
- be_ctx->domain->case_sensitive,
- &private_path);
- if (kr->ccname == NULL) {
- DEBUG(1, ("expand_ccname_template failed.\n"));
+ ret = expand_ccname_template(kr, kr, ccname_template,
+ be_ctx->domain->case_sensitive,
+ &public_dir, &kr->ccname);
+ if (ret != EOK) {
+ DEBUG(1, ("expand_ccname_template failed.\n"));
return ENOMEM;
}
@@ -354,9 +354,9 @@ static errno_t krb5_auth_prepare_ccache_name(struct krb5child_req *kr,
kr->valid_tgt ? "" : "not"));
/* always recreate the ccache directory path */
- ret = sss_krb5_precreate_ccache(kr->ccname,
+ ret = sss_krb5_precreate_ccache(kr->ccname, public_dir,
kr->krb5_ctx->illegal_path_re,
- kr->uid, kr->gid, private_path);
+ kr->uid, kr->gid);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, ("ccache precreation failed.\n"));
return ret;
@@ -626,7 +626,7 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
NULL);
if (ccache_file != NULL) {
kr->old_ccname = talloc_strdup(kr, ccache_file);
- if (kr->old_ccname == NULL) {
+ if (kr->ccname == NULL || kr->old_ccname == NULL) {
DEBUG(1, ("talloc_strdup failed.\n"));
ret = ENOMEM;
goto done;
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
index 022dc9b7..b2ad0946 100644
--- a/src/providers/krb5/krb5_auth.h
+++ b/src/providers/krb5/krb5_auth.h
@@ -41,8 +41,8 @@ struct krb5child_req {
struct pam_data *pd;
struct krb5_ctx *krb5_ctx;
- const char *ccname;
- const char *old_ccname;
+ char *ccname;
+ char *old_ccname;
const char *homedir;
char *upn;
uid_t uid;
diff --git a/src/providers/krb5/krb5_utils.c b/src/providers/krb5/krb5_utils.c
index bd5a38fd..21730d68 100644
--- a/src/providers/krb5/krb5_utils.c
+++ b/src/providers/krb5/krb5_utils.c
@@ -166,41 +166,36 @@ done:
#define S_EXP_USERNAME "{username}"
#define L_EXP_USERNAME (sizeof(S_EXP_USERNAME) - 1)
-char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
- const char *template, bool file_mode,
- bool case_sensitive, bool *private_path)
+static errno_t expand_template(TALLOC_CTX *tmp_ctx, struct krb5child_req *kr,
+ const char *template, bool case_sensitive,
+ bool dir_mode, char **pubdir, char **ccname)
{
char *copy;
char *p;
char *n;
char *result = NULL;
- char *dummy;
char *name;
- char *res = NULL;
const char *cache_dir_tmpl;
- TALLOC_CTX *tmp_ctx = NULL;
char action;
bool rerun;
+ errno_t ret;
+ bool public_path = true;
+ char *dirname;
- *private_path = false;
-
- if (template == NULL) {
- DEBUG(1, ("Missing template.\n"));
- return NULL;
- }
-
- tmp_ctx = talloc_new(NULL);
- if (!tmp_ctx) return NULL;
+ *pubdir = NULL;
+ *ccname = NULL;
copy = talloc_strdup(tmp_ctx, template);
if (copy == NULL) {
DEBUG(1, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
goto done;
}
result = talloc_strdup(tmp_ctx, "");
if (result == NULL) {
DEBUG(1, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
goto done;
}
@@ -210,6 +205,7 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
n++;
if ( *n == '\0' ) {
DEBUG(1, ("format error, single %% at the end of the template.\n"));
+ ret = EINVAL;
goto done;
}
@@ -222,6 +218,7 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
if (kr->pd->user == NULL) {
DEBUG(1, ("Cannot expand user name template "
"because user name is empty.\n"));
+ ret = EINVAL;
goto done;
}
name = sss_get_cased_name(tmp_ctx, kr->pd->user,
@@ -229,12 +226,13 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
if (!name) {
DEBUG(SSSDBG_CRIT_FAILURE,
("sss_get_cased_name failed\n"));
+ ret = ENOMEM;
goto done;
}
result = talloc_asprintf_append(result, "%s%s", p,
name);
- if (!file_mode) *private_path = true;
+ public_path = false;
break;
case 'U':
if (kr->uid <= 0) {
@@ -244,7 +242,7 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
}
result = talloc_asprintf_append(result, "%s%"SPRIuid, p,
kr->uid);
- if (!file_mode) *private_path = true;
+ public_path = false;
break;
case 'p':
if (kr->upn == NULL) {
@@ -253,60 +251,75 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
goto done;
}
result = talloc_asprintf_append(result, "%s%s", p, kr->upn);
- if (!file_mode) *private_path = true;
+ public_path = false;
break;
case '%':
result = talloc_asprintf_append(result, "%s%%", p);
break;
case 'r':
- dummy = dp_opt_get_string(kr->krb5_ctx->opts, KRB5_REALM);
- if (dummy == NULL) {
+ name = dp_opt_get_string(kr->krb5_ctx->opts, KRB5_REALM);
+ if (name == NULL) {
DEBUG(1, ("Missing kerberos realm.\n"));
+ ret = EINVAL;
goto done;
}
- result = talloc_asprintf_append(result, "%s%s", p, dummy);
+ result = talloc_asprintf_append(result, "%s%s", p, name);
break;
case 'h':
if (kr->homedir == NULL) {
DEBUG(1, ("Cannot expand home directory template "
"because the path is not available.\n"));
+ ret = EINVAL;
goto done;
}
result = talloc_asprintf_append(result, "%s%s", p, kr->homedir);
- if (!file_mode) *private_path = true;
+ public_path = false;
break;
case 'd':
- if (file_mode) {
- cache_dir_tmpl = dp_opt_get_string(kr->krb5_ctx->opts,
- KRB5_CCACHEDIR);
- if (cache_dir_tmpl == NULL) {
- DEBUG(1, ("Missing credential cache directory.\n"));
- goto done;
- }
+ if (dir_mode) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("'%%d' is not allowed in this template.\n"));
+ ret = EINVAL;
+ goto done;
+ }
- dummy = expand_ccname_template(tmp_ctx, kr, cache_dir_tmpl,
- false, case_sensitive,
- private_path);
- if (dummy == NULL) {
- DEBUG(1, ("Expanding credential cache directory "
- "template failed.\n"));
+ cache_dir_tmpl = dp_opt_get_string(kr->krb5_ctx->opts,
+ KRB5_CCACHEDIR);
+ if (cache_dir_tmpl == NULL) {
+ DEBUG(1, ("Missing credential cache directory.\n"));
+ ret = EINVAL;
+ goto done;
+ }
+
+ ret = expand_template(tmp_ctx, kr, cache_dir_tmpl,
+ case_sensitive, true, &dirname, &name);
+ if (ret) {
+ DEBUG(1, ("Expanding credential cache directory "
+ "template failed.\n"));
+ goto done;
+ }
+ if (dirname) {
+ *pubdir = talloc_asprintf(tmp_ctx, "%s%s%s",
+ result, p, dirname);
+ if (*pubdir == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("talloc_asprintf failed.\n"));
+ ret = ENOMEM;
goto done;
}
- result = talloc_asprintf_append(result, "%s%s", p, dummy);
- talloc_zfree(dummy);
- } else {
- DEBUG(1, ("'%%d' is not allowed in this template.\n"));
- goto done;
}
+ result = talloc_asprintf_append(result, "%s%s", p, name);
break;
case 'P':
- if (!file_mode) {
+ if (dir_mode) {
DEBUG(1, ("'%%P' is not allowed in this template.\n"));
+ ret = EINVAL;
goto done;
}
if (kr->pd->cli_pid == 0) {
DEBUG(1, ("Cannot expand PID template "
"because PID is not available.\n"));
+ ret = EINVAL;
goto done;
}
result = talloc_asprintf_append(result, "%s%d", p,
@@ -355,12 +368,14 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
break;
default:
DEBUG(1, ("format error, unknown template [%%%c].\n", *n));
+ ret = EINVAL;
goto done;
}
}
if (result == NULL) {
DEBUG(1, ("talloc_asprintf_append failed.\n"));
+ ret = ENOMEM;
goto done;
}
@@ -370,13 +385,71 @@ char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
result = talloc_asprintf_append(result, "%s", p);
if (result == NULL) {
DEBUG(1, ("talloc_asprintf_append failed.\n"));
+ ret = ENOMEM;
goto done;
}
+ if (dir_mode && public_path) {
+ *pubdir = talloc_strdup(tmp_ctx, result);
+ if (*pubdir == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+ }
+ *ccname = result;
+done:
+ return ret;
+}
+
+errno_t expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
+ const char *template, bool case_sensitive,
+ char **public_dir, char **cc_name)
+{
+ TALLOC_CTX *tmp_ctx = NULL;
+ const char *residual;
+ char *pubdir = NULL;
+ char *ccname = NULL;
+ errno_t ret;
+
+ *public_dir = NULL;
+ *cc_name = NULL;
+
+ if (template == NULL) {
+ DEBUG(1, ("Missing template.\n"));
+ return EINVAL;
+ }
+
+ residual = strchr(template, ':');
+ if (!residual) residual = template;
+ else residual++;
+
+ tmp_ctx = talloc_new(mem_ctx);
+ if (!tmp_ctx) return ENOMEM;
+
+ ret = expand_template(tmp_ctx, kr, residual,
+ case_sensitive, false, &pubdir, &ccname);
+ if (ret) {
+ goto done;
+ }
+
+ if (residual == template) {
+ *cc_name = talloc_move(mem_ctx, &ccname);
+ } else {
+ *cc_name = talloc_asprintf(mem_ctx, "%.*s%s",
+ (int)(residual - template), template,
+ ccname);
+ if (*cc_name == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ }
+ if (pubdir) {
+ *public_dir = talloc_move(mem_ctx, &pubdir);
+ }
- res = talloc_move(mem_ctx, &result);
done:
talloc_zfree(tmp_ctx);
- return res;
+ return ret;
}
static errno_t check_parent_stat(bool private_path, struct stat *parent_stat,
@@ -424,6 +497,7 @@ static errno_t check_parent_stat(bool private_path, struct stat *parent_stat,
struct string_list {
struct string_list *next;
struct string_list *prev;
+ size_t len_s;
char *s;
};
@@ -468,10 +542,16 @@ static errno_t find_ccdir_parent_data(TALLOC_CTX *mem_ctx,
("talloc_strdup failed.\n"));
return ENOMEM;
}
+ li->len_s = strlen(li->s);
+ /* no trailing slashes */
+ while (li->s[li->len_s - 1] == '/') {
+ li->len_s--;
+ li->s[li->len_s] = '\0';
+ }
DLIST_ADD(*missing_parents, li);
- parent = talloc_strdup(mem_ctx, ccdirname);
+ parent = talloc_strdup(mem_ctx, li->s);
if (parent == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE,
("talloc_strdup failed.\n"));
@@ -480,7 +560,7 @@ static errno_t find_ccdir_parent_data(TALLOC_CTX *mem_ctx,
/* We'll remove all trailing slashes from the back so that
* we only pass /some/path to find_ccdir_parent_data, not
- * /some/path */
+ * /some/path/ */
do {
end = strrchr(parent, '/');
if (end == NULL || end == parent) {
@@ -522,9 +602,8 @@ check_ccache_re(const char *filename, pcre *illegal_re)
return EFAULT;
}
-errno_t
-create_ccache_dir(const char *ccdirname, pcre *illegal_re,
- uid_t uid, gid_t gid, bool private_path)
+errno_t create_ccache_dir(const char *ccdirname, const char *pubdir,
+ pcre *illegal_re, uid_t uid, gid_t gid)
{
int ret = EFAULT;
struct stat parent_stat;
@@ -533,6 +612,9 @@ create_ccache_dir(const char *ccdirname, pcre *illegal_re,
mode_t old_umask;
mode_t new_dir_mode;
TALLOC_CTX *tmp_ctx = NULL;
+ size_t len_pubdir = 0;
+ bool in_pubdir;
+ bool is_pubdir;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
@@ -563,26 +645,35 @@ create_ccache_dir(const char *ccdirname, pcre *illegal_re,
goto done;
}
- ret = check_parent_stat(private_path, &parent_stat, uid, gid);
+ ret = check_parent_stat((pubdir == NULL), &parent_stat, uid, gid);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE,
("check_parent_stat failed for %s directory [%s].\n",
- private_path ? "private" : "public", ccdirname));
+ (pubdir == NULL) ? "private" : "public", ccdirname));
goto done;
}
+ if (pubdir) {
+ len_pubdir = strlen(pubdir);
+ while (pubdir[len_pubdir - 1] == '/') len_pubdir--;
+ }
+
DLIST_FOR_EACH(li, missing_parents) {
DEBUG(SSSDBG_TRACE_INTERNAL,
("Creating directory [%s].\n", li->s));
- if (li->next == NULL) {
- new_dir_mode = private_path ? 0700 : 01777;
- } else {
- if (private_path &&
- parent_stat.st_uid == uid && parent_stat.st_gid == gid) {
- new_dir_mode = 0700;
+ in_pubdir = false;
+ if (len_pubdir && (strncmp(pubdir, li->s, li->len_s) == 0)) {
+ in_pubdir = true;
+ if (len_pubdir == li->len_s) is_pubdir = true;
+ }
+ if (in_pubdir) {
+ if (is_pubdir) {
+ new_dir_mode = 01777;
} else {
new_dir_mode = 0755;
}
+ } else {
+ new_dir_mode = 0700;
}
old_umask = umask(0000);
@@ -595,9 +686,7 @@ create_ccache_dir(const char *ccdirname, pcre *illegal_re,
strerror(ret)));
goto done;
}
- if (private_path &&
- ((parent_stat.st_uid == uid && parent_stat.st_gid == gid) ||
- li->next == NULL)) {
+ if (!in_pubdir) {
ret = chown(li->s, uid, gid);
if (ret != EOK) {
ret = errno;
@@ -722,8 +811,8 @@ done:
return EOK;
}
-errno_t sss_krb5_precreate_ccache(const char *ccname, pcre *illegal_re,
- uid_t uid, gid_t gid, bool private_path)
+errno_t sss_krb5_precreate_ccache(const char *ccname, const char *pubdir,
+ pcre *illegal_re, uid_t uid, gid_t gid)
{
TALLOC_CTX *tmp_ctx = NULL;
const char *filename;
@@ -767,7 +856,7 @@ errno_t sss_krb5_precreate_ccache(const char *ccname, pcre *illegal_re,
*end = '\0';
} while (*(end+1) == '\0');
- ret = create_ccache_dir(ccdirname, illegal_re, uid, gid, private_path);
+ ret = create_ccache_dir(ccdirname, pubdir, illegal_re, uid, gid);
done:
talloc_free(tmp_ctx);
return ret;
diff --git a/src/providers/krb5/krb5_utils.h b/src/providers/krb5/krb5_utils.h
index 33cc6112..1a0fd080 100644
--- a/src/providers/krb5/krb5_utils.h
+++ b/src/providers/krb5/krb5_utils.h
@@ -42,12 +42,12 @@ errno_t check_if_cached_upn_needs_update(struct sysdb_ctx *sysdb,
const char *user,
const char *upn);
-errno_t create_ccache_dir(const char *dirname, pcre *illegal_re,
- uid_t uid, gid_t gid, bool private_path);
+errno_t create_ccache_dir(const char *ccdirname, const char *pubdir,
+ pcre *illegal_re, uid_t uid, gid_t gid);
-char *expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
- const char *template, bool file_mode,
- bool case_sensitive, bool *private_path);
+errno_t expand_ccname_template(TALLOC_CTX *mem_ctx, struct krb5child_req *kr,
+ const char *template, bool case_sensitive,
+ char **public_dir, char **ccname);
errno_t become_user(uid_t uid, gid_t gid);
struct sss_creds;
@@ -57,8 +57,8 @@ errno_t switch_creds(TALLOC_CTX *mem_ctx,
struct sss_creds **saved_creds);
errno_t restore_creds(struct sss_creds *saved_creds);
-errno_t sss_krb5_precreate_ccache(const char *ccname, pcre *illegal_re,
- uid_t uid, gid_t gid, bool private_path);
+errno_t sss_krb5_precreate_ccache(const char *ccname, const char *pubdir,
+ pcre *illegal_re, uid_t uid, gid_t gid);
errno_t sss_krb5_cc_destroy(const char *ccname, uid_t uid, gid_t gid);
errno_t sss_krb5_check_ccache_princ(uid_t uid, gid_t gid,
const char *ccname, const char *principal);
generated by cgit (git 2.34.1) at 2025-07-04 19:51:42 +0000