errno_t sss_mc_refresh_nested_group(struct tools_ctx *tctx,
const char *name)
{
errno_t ret;
struct ldb_message *msg;
struct ldb_message_element *el;
const char *attrs[] = { SYSDB_MEMBEROF,
SYSDB_NAME,
NULL };
size_t i;
char *parent_name;
ret = sss_mc_refresh_group(name);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE,
("Cannot refresh group %s from memory cache\n", name));
/* try to carry on */
}
ret = sysdb_search_group_by_name(tctx, tctx->sysdb, tctx->local,
name, attrs, &msg);
if (ret) {
DEBUG(SSSDBG_OP_FAILURE,
("Search failed: %s (%d)\n", strerror(ret), ret));
return ret;
}
el = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
if (!el || el->num_values == 0) {
DEBUG(SSSDBG_TRACE_INTERNAL, ("Group %s has no parents\n", name));
talloc_free(msg);
return EOK;
}
/* This group is nested. We need to invalidate all its parents, too */
for (i=0; i < el->num_values; i++) {
ret = sysdb_group_dn_name(tctx->sysdb, tctx,
(const char *) el->values[i].data,
&parent_name);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE, ("Malformed DN [%s]? Skipping\n",
(const char *) el->values[i].data));
talloc_free(parent_name);
continue;
}
ret = sss_mc_refresh_group(parent_name);
talloc_free(parent_name);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE,
("Cannot refresh group %s from memory cache\n", name));
/* try to carry on */
}
}
talloc_free(msg);
return EOK;
}
static errno_t sss_mc_refresh_nested_group(struct tools_ctx *tctx,
const char *shortname)
{
errno_t ret;
struct ldb_message *msg = NULL;
struct ldb_message_element *el;
const char *attrs[] = { SYSDB_MEMBEROF,
SYSDB_NAME,
NULL };
size_t i;
char *parent_internal_name;
char *parent_outname;
char *internal_name;
TALLOC_CTX *tmpctx;
tmpctx = talloc_new(tctx);
if (tmpctx == NULL) {
return ENOMEM;
}
internal_name = sss_create_internal_fqname(tmpctx, shortname,
tctx->local->name);
if (internal_name == NULL) {
ret = ENOMEM;
goto done;
}
ret = sss_mc_refresh_group(shortname);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE,
"Cannot refresh group %s from memory cache\n", shortname);
/* try to carry on */
}
ret = sysdb_search_group_by_name(tmpctx, tctx->local, internal_name, attrs,
&msg);
if (ret) {
DEBUG(SSSDBG_OP_FAILURE,
"Search failed: %s (%d)\n", strerror(ret), ret);
goto done;
}
el = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
if (!el || el->num_values == 0) {
DEBUG(SSSDBG_TRACE_INTERNAL, "Group %s has no parents\n",
internal_name);
ret = EOK;
goto done;
}
/* This group is nested. We need to invalidate all its parents, too */
for (i=0; i < el->num_values; i++) {
ret = sysdb_group_dn_name(tctx->sysdb, tmpctx,
(const char *) el->values[i].data,
&parent_internal_name);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE, "Malformed DN [%s]? Skipping\n",
(const char *) el->values[i].data);
talloc_free(parent_internal_name);
continue;
}
parent_outname = sss_output_name(tmpctx, parent_internal_name,
tctx->local->case_preserve, 0);
if (parent_outname == NULL) {
ret = ENOMEM;
goto done;
}
ret = sss_mc_refresh_group(parent_outname);
talloc_free(parent_internal_name);
talloc_free(parent_outname);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE,
"Cannot refresh group %s from memory cache\n", parent_outname);
/* try to carry on */
}
}
ret = EOK;
done:
talloc_free(tmpctx);
return ret;
}
errno_t
sysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx,
struct sss_domain_info *domain,
const char *username, uid_t *_uid,
char ***groupnames)
{
TALLOC_CTX *tmp_ctx;
errno_t ret;
struct ldb_message *msg;
struct ldb_message *group_msg = NULL;
char **sysdb_groupnames = NULL;
const char *primary_group = NULL;
struct ldb_message_element *groups;
uid_t uid = 0;
gid_t gid = 0;
size_t num_groups = 0;
int i;
const char *attrs[] = { SYSDB_MEMBEROF,
SYSDB_GIDNUM,
SYSDB_UIDNUM,
NULL };
const char *group_attrs[] = { SYSDB_NAME,
NULL };
tmp_ctx = talloc_new(NULL);
NULL_CHECK(tmp_ctx, ret, done);
ret = sysdb_search_user_by_name(tmp_ctx, domain, username, attrs, &msg);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE, "Error looking up user %s\n", username);
goto done;
}
if (_uid != NULL) {
uid = ldb_msg_find_attr_as_uint64(msg, SYSDB_UIDNUM, 0);
if (!uid) {
DEBUG(SSSDBG_CRIT_FAILURE, "A user with no UID?\n");
ret = EIO;
goto done;
}
}
/* resolve secondary groups */
if (groupnames != NULL) {
groups = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
if (!groups || groups->num_values == 0) {
/* No groups for this user in sysdb currently */
sysdb_groupnames = NULL;
num_groups = 0;
} else {
num_groups = groups->num_values;
sysdb_groupnames = talloc_array(tmp_ctx, char *, num_groups + 1);
NULL_CHECK(sysdb_groupnames, ret, done);
/* Get a list of the groups by groupname only */
for (i = 0; i < groups->num_values; i++) {
ret = sysdb_group_dn_name(domain->sysdb,
sysdb_groupnames,
(const char *)groups->values[i].data,
&sysdb_groupnames[i]);
if (ret != EOK) {
ret = ENOMEM;
goto done;
}
}
sysdb_groupnames[groups->num_values] = NULL;
}
}
errno_t simple_access_check(struct simple_ctx *ctx, const char *username,
bool *access_granted)
{
int i, j;
errno_t ret;
TALLOC_CTX *tmp_ctx = NULL;
const char *user_attrs[] = { SYSDB_MEMBEROF,
SYSDB_GIDNUM,
NULL };
const char *group_attrs[] = { SYSDB_NAME,
NULL };
struct ldb_message *msg;
struct ldb_message_element *el;
char **groups;
const char *primary_group;
gid_t gid;
bool matched;
*access_granted = false;
/* First, check whether the user is in the allowed users list */
if (ctx->allow_users != NULL) {
for(i = 0; ctx->allow_users[i] != NULL; i++) {
if (strcmp(username, ctx->allow_users[i]) == 0) {
DEBUG(9, ("User [%s] found in allow list, access granted.\n",
username));
/* Do not return immediately on explicit allow
* We need to make sure none of the user's groups
* are denied.
*/
*access_granted = true;
}
}
} else if (!ctx->allow_groups) {
/* If neither allow rule is in place, we'll assume allowed
* unless a deny rule disables us below.
*/
*access_granted = true;
}
/* Next check whether this user has been specifically denied */
if (ctx->deny_users != NULL) {
for(i = 0; ctx->deny_users[i] != NULL; i++) {
if (strcmp(username, ctx->deny_users[i]) == 0) {
DEBUG(9, ("User [%s] found in deny list, access denied.\n",
username));
/* Return immediately on explicit denial */
*access_granted = false;
return EOK;
}
}
}
if (!ctx->allow_groups && !ctx->deny_groups) {
/* There are no group restrictions, so just return
* here with whatever we've decided.
*/
return EOK;
}
/* Now get a list of this user's groups and check those against the
* simple_allow_groups list.
*/
tmp_ctx = talloc_new(NULL);
if (!tmp_ctx) {
ret = ENOMEM;
goto done;
}
ret = sysdb_search_user_by_name(tmp_ctx, ctx->sysdb,
username, user_attrs, &msg);
if (ret != EOK) {
DEBUG(1, ("Could not look up username [%s]: [%d][%s]\n",
username, ret, strerror(ret)));
goto done;
}
/* Construct a list of the user's groups */
el = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
if (el && el->num_values) {
/* Get the groups from the memberOf entries
* Allocate the array with room for both the NULL
* terminator and the primary group
*/
groups = talloc_array(tmp_ctx, char *, el->num_values + 2);
if (!groups) {
ret = ENOMEM;
goto done;
}
for (j = 0; j < el->num_values; j++) {
ret = sysdb_group_dn_name(
ctx->sysdb, tmp_ctx,
(char *)el->values[j].data,
&groups[j]);
if (ret != EOK) {
goto done;
}
}
} else {
