906 lines
31 KiB
Diff
906 lines
31 KiB
Diff
diff -rup original/configure.in new/configure.in
|
|
--- original/configure.in 2012-07-19 12:13:15.872301022 +0200
|
|
+++ new/configure.in 2012-07-23 11:31:42.821466529 +0200
|
|
@@ -101,6 +101,7 @@ AC_SUBST([root_sudo])
|
|
AC_SUBST([path_info])
|
|
AC_SUBST([ldap_conf])
|
|
AC_SUBST([ldap_secret])
|
|
+AC_SUBST([sssd_lib])
|
|
AC_SUBST([nsswitch_conf])
|
|
AC_SUBST([netsvc_conf])
|
|
AC_SUBST([secure_path])
|
|
@@ -290,8 +291,6 @@ dnl
|
|
AC_ARG_WITH(sssd, [AS_HELP_STRING([--with-sssd], [enable SSSD support])],
|
|
[case $with_sssd in
|
|
yes)
|
|
- SUDO_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
|
|
- SUDOERS_LIBS="${SUDO_LIBS} `pkg-config libsss_sudo --libs`"
|
|
SUDOERS_OBJS="${SUDOERS_OBJS} sssd.lo"
|
|
AC_DEFINE(HAVE_SSSD)
|
|
;;
|
|
@@ -300,6 +299,11 @@ AC_ARG_WITH(sssd, [AS_HELP_STRING([--wit
|
|
;;
|
|
esac])
|
|
|
|
+AC_ARG_WITH(sssd-lib, [AS_HELP_STRING([--with-sssd-lib], [path to the SSSD library])])
|
|
+sssd_lib="\"LIBDIR\""
|
|
+test -n "$with_sssd_lib" && sssd_lib="$with_sssd_lib"
|
|
+SUDO_DEFINE_UNQUOTED(_PATH_SSSD_LIB, "$sssd_lib", [Path to the SSSD library])
|
|
+
|
|
AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],
|
|
[case $with_incpath in
|
|
yes) AC_MSG_ERROR(["must give --with-incpath an argument."])
|
|
diff -rup original/pathnames.h.in new/pathnames.h.in
|
|
--- original/pathnames.h.in 2012-07-19 12:13:15.779299949 +0200
|
|
+++ new/pathnames.h.in 2012-07-19 15:58:49.454653685 +0200
|
|
@@ -157,6 +157,10 @@
|
|
#undef _PATH_LDAP_SECRET
|
|
#endif /* _PATH_LDAP_SECRET */
|
|
|
|
+#ifndef _PATH_SSSD_LIB
|
|
+#undef _PATH_SSSD_LIB
|
|
+#endif /* _PATH_SSSD_LIB */
|
|
+
|
|
#ifndef _PATH_NSSWITCH_CONF
|
|
#undef _PATH_NSSWITCH_CONF
|
|
#endif /* _PATH_NSSWITCH_CONF */
|
|
diff -rup original/plugins/sudoers/Makefile.in new/plugins/sudoers/Makefile.in
|
|
--- original/plugins/sudoers/Makefile.in 2012-07-19 12:13:15.756299680 +0200
|
|
+++ new/plugins/sudoers/Makefile.in 2012-07-23 11:31:56.084610531 +0200
|
|
@@ -32,6 +32,7 @@ top_srcdir = @top_srcdir@
|
|
incdir = $(top_srcdir)/include
|
|
docdir = @docdir@
|
|
timedir = @timedir@
|
|
+libdir = @libdir@
|
|
|
|
# Compiler & tools to use
|
|
CC = @CC@
|
|
@@ -51,7 +52,7 @@ SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@
|
|
REPLAY_LIBS = @REPLAY_LIBS@ @ZLIB@
|
|
|
|
# C preprocessor flags
|
|
-CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
|
|
+CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) -DLIBDIR=\"$(libdir)\" @CPPFLAGS@
|
|
|
|
# Usually -O and/or -g
|
|
CFLAGS = @CFLAGS@
|
|
diff -rup original/plugins/sudoers/sssd.c new/plugins/sudoers/sssd.c
|
|
--- original/plugins/sudoers/sssd.c 2012-07-19 12:13:15.667298652 +0200
|
|
+++ new/plugins/sudoers/sssd.c 2012-07-23 11:32:04.260699269 +0200
|
|
@@ -44,23 +44,70 @@
|
|
#if TIME_WITH_SYS_TIME
|
|
# include <time.h>
|
|
#endif
|
|
+#ifdef HAVE_DLOPEN
|
|
+# include <dlfcn.h>
|
|
+#else
|
|
+# include "compat/dlfcn.h"
|
|
+#endif
|
|
#include <ctype.h>
|
|
#include <pwd.h>
|
|
#include <grp.h>
|
|
|
|
-#include <sss_sudo.h>
|
|
#include <errno.h>
|
|
+#include <stdint.h>
|
|
|
|
#include "sudoers.h"
|
|
#include "parse.h"
|
|
#include "lbuf.h"
|
|
#include "sudo_debug.h"
|
|
|
|
+/* SSSD <--> SUDO interface - do not change */
|
|
+struct sss_sudo_attr {
|
|
+ char *name;
|
|
+ char **values;
|
|
+ unsigned int num_values;
|
|
+};
|
|
+
|
|
+struct sss_sudo_rule {
|
|
+ unsigned int num_attrs;
|
|
+ struct sss_sudo_attr *attrs;
|
|
+};
|
|
+
|
|
+struct sss_sudo_result {
|
|
+ unsigned int num_rules;
|
|
+ struct sss_sudo_rule *rules;
|
|
+};
|
|
+
|
|
+typedef int (*sss_sudo_send_recv_t)(uid_t, const char*, const char*,
|
|
+ uint32_t*, struct sss_sudo_result**);
|
|
+
|
|
+typedef int (*sss_sudo_send_recv_defaults_t)(uid_t, const char*, uint32_t*,
|
|
+ char**, struct sss_sudo_result**);
|
|
+
|
|
+typedef void (*sss_sudo_free_result_t)(struct sss_sudo_result*);
|
|
+
|
|
+typedef int (*sss_sudo_get_values_t)(struct sss_sudo_rule*, const char*,
|
|
+ char***);
|
|
+
|
|
+typedef void (*sss_sudo_free_values_t)(char**);
|
|
+
|
|
/* sudo_nss implementation */
|
|
+
|
|
+struct sudo_sss_handle {
|
|
+ char *domainname;
|
|
+ struct passwd *pw;
|
|
+ void *ssslib;
|
|
+ sss_sudo_send_recv_t fn_send_recv;
|
|
+ sss_sudo_send_recv_defaults_t fn_send_recv_defaults;
|
|
+ sss_sudo_free_result_t fn_free_result;
|
|
+ sss_sudo_get_values_t fn_get_values;
|
|
+ sss_sudo_free_values_t fn_free_values;
|
|
+};
|
|
+
|
|
static int sudo_sss_open(struct sudo_nss *nss);
|
|
static int sudo_sss_close(struct sudo_nss *nss);
|
|
static int sudo_sss_parse(struct sudo_nss *nss);
|
|
-static void sudo_sss_parse_options(struct sss_sudo_rule *rule);
|
|
+static void sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule);
|
|
static int sudo_sss_setdefs(struct sudo_nss *nss);
|
|
static int sudo_sss_lookup(struct sudo_nss *nss, int ret, int pwflag);
|
|
static int sudo_sss_display_cmnd(struct sudo_nss *nss, struct passwd *pw);
|
|
@@ -121,7 +168,7 @@ static void sudo_sss_rulecpy(struct sss_
|
|
#define _SUDO_SSS_STATE_HOSTMATCH 0x01
|
|
#define _SUDO_SSS_STATE_USERMATCH 0x02
|
|
|
|
-static struct sss_sudo_result *sudo_sss_filter_result(struct sss_sudo_result *in_res, int (*filterp)(struct sss_sudo_rule *, void *), int act, void *filterp_arg)
|
|
+static struct sss_sudo_result *sudo_sss_filter_result(struct sudo_sss_handle *handle, struct sss_sudo_result *in_res, int (*filterp)(struct sudo_sss_handle *, struct sss_sudo_rule *, void *), int act, void *filterp_arg)
|
|
{
|
|
struct sss_sudo_result *out_res;
|
|
int i, l, r;
|
|
@@ -140,7 +187,7 @@ static struct sss_sudo_result *sudo_sss_
|
|
out_res->num_rules = 0;
|
|
|
|
for (i = l = 0; i < in_res->num_rules; ++i) {
|
|
- r = filterp(in_res->rules + i, filterp_arg);
|
|
+ r = filterp(handle, in_res->rules + i, filterp_arg);
|
|
|
|
if (( r && act == _SUDO_SSS_FILTER_INCLUDE) ||
|
|
(!r && act == _SUDO_SSS_FILTER_EXCLUDE))
|
|
@@ -164,11 +211,6 @@ static struct sss_sudo_result *sudo_sss_
|
|
debug_return_ptr(out_res);
|
|
}
|
|
|
|
-struct sudo_sss_handle {
|
|
- char *domainname;
|
|
- struct passwd *pw;
|
|
-};
|
|
-
|
|
struct sudo_nss sudo_nss_sss = {
|
|
&sudo_nss_sss,
|
|
NULL,
|
|
@@ -188,10 +230,50 @@ struct sudo_nss sudo_nss_sss = {
|
|
static int sudo_sss_open(struct sudo_nss *nss)
|
|
{
|
|
struct sudo_sss_handle *handle;
|
|
+ static const char path[] = _PATH_SSSD_LIB"/libsss_sudo.so";
|
|
debug_decl(sudo_sss_open, SUDO_DEBUG_SSSD);
|
|
|
|
/* Create a handle container. */
|
|
handle = emalloc(sizeof(struct sudo_sss_handle));
|
|
+
|
|
+ /* Load symbols */
|
|
+ handle->ssslib = dlopen(path, RTLD_LAZY);
|
|
+ if (handle->ssslib == NULL) {
|
|
+ warningx(_("Unable to dlopen %s: %s"), path, dlerror());
|
|
+ warningx(_("Unable to initialize SSS source. Is SSSD installed on your machine?"));
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
+ handle->fn_send_recv = dlsym(handle->ssslib, "sss_sudo_send_recv");
|
|
+ if (handle->fn_send_recv == NULL) {
|
|
+ warningx(_("unable to find symbol \"sss_sudo_send_recv\" in %s"), path);
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
+ handle->fn_send_recv_defaults = dlsym(handle->ssslib, "sss_sudo_send_recv_defaults");
|
|
+ if (handle->fn_send_recv_defaults == NULL) {
|
|
+ warningx(_("unable to find symbol \"sss_sudo_send_recv_defaults\" in %s"), path);
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
+ handle->fn_free_result = dlsym(handle->ssslib, "sss_sudo_free_result");
|
|
+ if (handle->fn_free_result == NULL) {
|
|
+ warningx(_("unable to find symbol \"sss_sudo_free_result\" in %s"), path);
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
+ handle->fn_get_values = dlsym(handle->ssslib, "sss_sudo_get_values");
|
|
+ if (handle->fn_get_values == NULL) {
|
|
+ warningx(_("unable to find symbol \"sss_sudo_get_values\" in %s"), path);
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
+ handle->fn_free_values = dlsym(handle->ssslib, "sss_sudo_free_values");
|
|
+ if (handle->fn_free_values == NULL) {
|
|
+ warningx(_("unable to find symbol \"sss_sudo_free_values\" in %s"), path);
|
|
+ debug_return_int(EFAULT);
|
|
+ }
|
|
+
|
|
handle->domainname = NULL;
|
|
handle->pw = sudo_user.pw;
|
|
nss->handle = handle;
|
|
@@ -204,7 +286,14 @@ static int sudo_sss_open(struct sudo_nss
|
|
// ok
|
|
static int sudo_sss_close(struct sudo_nss *nss)
|
|
{
|
|
+ struct sudo_sss_handle *handle;
|
|
debug_decl(sudo_sss_close, SUDO_DEBUG_SSSD);
|
|
+
|
|
+ if (nss && nss->handle) {
|
|
+ handle = nss->handle;
|
|
+ dlclose(handle->ssslib);
|
|
+ }
|
|
+
|
|
efree(nss->handle);
|
|
debug_return_int(0);
|
|
}
|
|
@@ -231,11 +320,11 @@ static int sudo_sss_setdefs(struct sudo_
|
|
|
|
sudo_debug_printf(1, "Looking for cn=defaults");
|
|
|
|
- if (sss_sudo_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
|
|
+ if (handle->fn_send_recv_defaults(handle->pw->pw_uid, handle->pw->pw_name,
|
|
&sss_error, &handle->domainname,
|
|
&sss_result) != 0)
|
|
{
|
|
- sudo_debug_printf(2, "sss_sudo_send_recv_defaults: != 0, sss_error=%u", sss_error);
|
|
+ sudo_debug_printf(2, "handle->fn_send_recv_defaults: != 0, sss_error=%u", sss_error);
|
|
debug_return_int(-1);
|
|
}
|
|
|
|
@@ -250,10 +339,10 @@ static int sudo_sss_setdefs(struct sudo_
|
|
for (i = 0; i < sss_result->num_rules; ++i) {
|
|
sudo_debug_printf(1, "Parsing cn=defaults, %d/%d", i, sss_result->num_rules);
|
|
sss_rule = sss_result->rules + i;
|
|
- sudo_sss_parse_options(sss_rule);
|
|
+ sudo_sss_parse_options(handle, sss_rule);
|
|
}
|
|
|
|
- sss_sudo_free_result(sss_result);
|
|
+ handle->fn_free_result(sss_result);
|
|
debug_return_int(0);
|
|
}
|
|
|
|
@@ -276,7 +365,7 @@ static int sudo_sss_checkpw(struct sudo_
|
|
}
|
|
|
|
static int
|
|
-sudo_sss_check_runas_user(struct sss_sudo_rule *sss_rule)
|
|
+sudo_sss_check_runas_user(struct sudo_sss_handle *handle, struct sss_sudo_rule *sss_rule)
|
|
{
|
|
char **val_array = NULL;
|
|
char *val;
|
|
@@ -287,7 +376,7 @@ sudo_sss_check_runas_user(struct sss_sud
|
|
debug_return_int(UNSPEC);
|
|
|
|
/* get the runas user from the entry */
|
|
- switch (sss_sudo_get_values(sss_rule, "sudoRunAsUser", &val_array))
|
|
+ switch (handle->fn_get_values(sss_rule, "sudoRunAsUser", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -295,7 +384,7 @@ sudo_sss_check_runas_user(struct sss_sud
|
|
sudo_debug_printf(2, "No result. Trying old style (sudoRunAs)");
|
|
|
|
/* try old style */
|
|
- switch (sss_sudo_get_values(sss_rule, "sudoRunAs", &val_array))
|
|
+ switch (handle->fn_get_values(sss_rule, "sudoRunAs", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -307,12 +396,12 @@ sudo_sss_check_runas_user(struct sss_sud
|
|
*/
|
|
return !strcasecmp(runas_pw->pw_name, def_runas_default);
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
|
|
debug_return_int(UNSPEC);
|
|
}
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
|
|
debug_return_int(UNSPEC);
|
|
}
|
|
|
|
@@ -373,13 +462,13 @@ sudo_sss_check_runas_user(struct sss_sud
|
|
sudo_debug_printf(2, "sssd/ldap sudoRunAsUser '%s' ... %s", val, ret ? "MATCH!" : "not");
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array); /* cleanup */
|
|
+ handle->fn_free_values(val_array); /* cleanup */
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
static int
|
|
-sudo_sss_check_runas_group(struct sss_sudo_rule *rule)
|
|
+sudo_sss_check_runas_group(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
|
|
{
|
|
char **val_array = NULL;
|
|
char *val;
|
|
@@ -391,7 +480,7 @@ sudo_sss_check_runas_group(struct sss_su
|
|
debug_return_int(UNSPEC);
|
|
|
|
/* get the values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -399,7 +488,7 @@ sudo_sss_check_runas_group(struct sss_su
|
|
sudo_debug_printf(2, "No result.");
|
|
debug_return_int(false);
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
|
|
debug_return_int(UNSPEC);
|
|
}
|
|
|
|
@@ -414,7 +503,7 @@ sudo_sss_check_runas_group(struct sss_su
|
|
sudo_debug_printf(2, "sssd/ldap sudoRunAsGroup '%s' ... %s", val, ret ? "MATCH!" : "not");
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
@@ -424,7 +513,7 @@ sudo_sss_check_runas_group(struct sss_su
|
|
* else false. RunAs info is optional.
|
|
*/
|
|
static int
|
|
-sudo_sss_check_runas(struct sss_sudo_rule *rule)
|
|
+sudo_sss_check_runas(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
|
|
{
|
|
int ret;
|
|
debug_decl(sudo_sss_check_runas, SUDO_DEBUG_SSSD);
|
|
@@ -432,13 +521,13 @@ sudo_sss_check_runas(struct sss_sudo_rul
|
|
if (rule == NULL)
|
|
debug_return_int(false);
|
|
|
|
- ret = sudo_sss_check_runas_user(rule) != false &&
|
|
- sudo_sss_check_runas_group(rule) != false;
|
|
+ ret = sudo_sss_check_runas_user(handle, rule) != false &&
|
|
+ sudo_sss_check_runas_group(handle, rule) != false;
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
-static int sudo_sss_check_host(struct sss_sudo_rule *rule)
|
|
+static int sudo_sss_check_host(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
|
|
{
|
|
char **val_array, *val;
|
|
int ret = false, i;
|
|
@@ -448,7 +537,7 @@ static int sudo_sss_check_host(struct ss
|
|
debug_return_int(ret);
|
|
|
|
/* get the values from the rule */
|
|
- switch (sss_sudo_get_values(rule, "sudoHost", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoHost", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -456,7 +545,7 @@ static int sudo_sss_check_host(struct ss
|
|
sudo_debug_printf(2, "No result.");
|
|
debug_return_int(false);
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoHost): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoHost): != 0");
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
@@ -474,17 +563,17 @@ static int sudo_sss_check_host(struct ss
|
|
sudo_debug_printf(2, "sssd/ldap sudoHost '%s' ... %s", val, ret ? "MATCH!" : "not");
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
-static int sudo_sss_result_filterp(struct sss_sudo_rule *rule, void *unused)
|
|
+static int sudo_sss_result_filterp(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, void *unused)
|
|
{
|
|
(void)unused;
|
|
debug_decl(sudo_sss_result_filterp, SUDO_DEBUG_SSSD);
|
|
|
|
- if (sudo_sss_check_host(rule))
|
|
+ if (sudo_sss_check_host(handle, rule))
|
|
debug_return_int(1);
|
|
else
|
|
debug_return_int(0);
|
|
@@ -505,7 +594,7 @@ static struct sss_sudo_result *sudo_sss_
|
|
|
|
u_sss_result = f_sss_result = NULL;
|
|
|
|
- switch (ret = sss_sudo_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
|
|
+ switch (ret = handle->fn_send_recv(handle->pw->pw_uid, handle->pw->pw_name,
|
|
handle->domainname, &sss_error, &u_sss_result))
|
|
{
|
|
case 0:
|
|
@@ -530,11 +619,11 @@ static struct sss_sudo_result *sudo_sss_
|
|
}
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_send_recv: != 0: ret=%d", ret);
|
|
+ sudo_debug_printf(2, "handle->fn_send_recv: != 0: ret=%d", ret);
|
|
debug_return_ptr(NULL);
|
|
}
|
|
|
|
- f_sss_result = sudo_sss_filter_result(u_sss_result, sudo_sss_result_filterp,
|
|
+ f_sss_result = sudo_sss_filter_result(handle, u_sss_result, sudo_sss_result_filterp,
|
|
_SUDO_SSS_FILTER_INCLUDE, NULL);
|
|
|
|
if (f_sss_result != NULL)
|
|
@@ -547,7 +636,7 @@ static struct sss_sudo_result *sudo_sss_
|
|
sudo_debug_printf(3, "u_sss_result=(%p, %u) => f_sss_result=(%p, %u)",
|
|
u_sss_result, u_sss_result->num_rules, f_sss_result, f_sss_result->num_rules);
|
|
|
|
- sss_sudo_free_result(u_sss_result);
|
|
+ handle->fn_free_result(u_sss_result);
|
|
|
|
debug_return_ptr(f_sss_result);
|
|
}
|
|
@@ -557,7 +646,7 @@ static struct sss_sudo_result *sudo_sss_
|
|
* Returns true if found and allowed, false if negated, else UNSPEC.
|
|
*/
|
|
static int
|
|
-sudo_sss_check_bool(struct sss_sudo_rule *rule, char *option)
|
|
+sudo_sss_check_bool(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, char *option)
|
|
{
|
|
char ch, *var, **val_array = NULL;
|
|
int i, ret = UNSPEC;
|
|
@@ -566,7 +655,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
|
|
if (rule == NULL)
|
|
debug_return_int(ret);
|
|
|
|
- switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoOption", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -574,7 +663,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
|
|
sudo_debug_printf(2, "No result.");
|
|
debug_return_int(ret);
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values: != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values: != 0");
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
@@ -589,7 +678,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
|
|
ret = (ch != '!');
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
@@ -599,7 +688,7 @@ sudo_sss_check_bool(struct sss_sudo_rule
|
|
* false if disallowed and UNSPEC if not matched.
|
|
*/
|
|
static int
|
|
-sudo_sss_check_command(struct sss_sudo_rule *rule, int *setenv_implied)
|
|
+sudo_sss_check_command(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, int *setenv_implied)
|
|
{
|
|
char **val_array = NULL, *val;
|
|
char *allowed_cmnd, *allowed_args;
|
|
@@ -609,7 +698,7 @@ sudo_sss_check_command(struct sss_sudo_r
|
|
if (rule == NULL)
|
|
debug_return_int(ret);
|
|
|
|
- switch (sss_sudo_get_values(rule, "sudoCommand", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoCommand", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -617,7 +706,7 @@ sudo_sss_check_command(struct sss_sudo_r
|
|
sudo_debug_printf(2, "No result.");
|
|
debug_return_int(ret);
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values: != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values: != 0");
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
@@ -662,13 +751,13 @@ sudo_sss_check_command(struct sss_sudo_r
|
|
efree(allowed_cmnd); /* cleanup */
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array); /* more cleanup */
|
|
+ handle->fn_free_values(val_array); /* more cleanup */
|
|
|
|
debug_return_int(ret);
|
|
}
|
|
|
|
static void
|
|
-sudo_sss_parse_options(struct sss_sudo_rule *rule)
|
|
+sudo_sss_parse_options(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule)
|
|
{
|
|
int i;
|
|
char op, *v, *val;
|
|
@@ -678,7 +767,7 @@ sudo_sss_parse_options(struct sss_sudo_r
|
|
if (rule == NULL)
|
|
debug_return;
|
|
|
|
- switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoOption", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -686,7 +775,7 @@ sudo_sss_parse_options(struct sss_sudo_r
|
|
sudo_debug_printf(2, "No result.");
|
|
debug_return;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
|
|
debug_return;
|
|
}
|
|
|
|
@@ -718,7 +807,7 @@ sudo_sss_parse_options(struct sss_sudo_r
|
|
efree(v);
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
debug_return;
|
|
}
|
|
|
|
@@ -726,6 +815,7 @@ static int sudo_sss_lookup(struct sudo_n
|
|
{
|
|
int rc, setenv_implied;
|
|
|
|
+ struct sudo_sss_handle *handle = nss->handle;
|
|
struct sss_sudo_result *sss_result = NULL;
|
|
struct sss_sudo_rule *rule;
|
|
uint32_t i, state = 0;
|
|
@@ -750,12 +840,12 @@ static int sudo_sss_lookup(struct sudo_n
|
|
rule = sss_result->rules + i;
|
|
if ((pwcheck == any && doauth != false) ||
|
|
(pwcheck == all && doauth == false)) {
|
|
- doauth = sudo_sss_check_bool(rule, "authenticate");
|
|
+ doauth = sudo_sss_check_bool(handle, rule, "authenticate");
|
|
}
|
|
/* Only check the command when listing another user. */
|
|
if (user_uid == 0 || list_pw == NULL ||
|
|
user_uid == list_pw->pw_uid ||
|
|
- sudo_sss_check_command(rule, NULL)) {
|
|
+ sudo_sss_check_command(handle, rule, NULL)) {
|
|
matched = true;
|
|
break;
|
|
}
|
|
@@ -791,9 +881,9 @@ static int sudo_sss_lookup(struct sudo_n
|
|
if (sss_result != NULL) {
|
|
for (i = 0; i < sss_result->num_rules; i++) {
|
|
rule = sss_result->rules + i;
|
|
- if (!sudo_sss_check_runas(rule))
|
|
+ if (!sudo_sss_check_runas(handle, rule))
|
|
continue;
|
|
- rc = sudo_sss_check_command(rule, &setenv_implied);
|
|
+ rc = sudo_sss_check_command(handle, rule, &setenv_implied);
|
|
if (rc != UNSPEC) {
|
|
/* We have a match. */
|
|
sudo_debug_printf(1, "Command %sallowed", rc == true ? "" : "NOT ");
|
|
@@ -802,7 +892,7 @@ static int sudo_sss_lookup(struct sudo_n
|
|
/* Apply entry-specific options. */
|
|
if (setenv_implied)
|
|
def_setenv = true;
|
|
- sudo_sss_parse_options(rule);
|
|
+ sudo_sss_parse_options(handle, rule);
|
|
#ifdef HAVE_SELINUX
|
|
/* Set role and type if not specified on command line. */
|
|
if (user_role == NULL)
|
|
@@ -865,8 +955,8 @@ static int sudo_sss_display_cmnd(struct
|
|
|
|
for (i = 0; i < sss_result->num_rules; i++) {
|
|
rule = sss_result->rules + i;
|
|
- if (sudo_sss_check_command(rule, NULL) &&
|
|
- sudo_sss_check_runas(rule)) {
|
|
+ if (sudo_sss_check_command(handle, rule, NULL) &&
|
|
+ sudo_sss_check_runas(handle, rule)) {
|
|
found = true;
|
|
goto done;
|
|
}
|
|
@@ -878,7 +968,7 @@ done:
|
|
user_args ? " " : "", user_args ? user_args : "");
|
|
|
|
if (sss_result != NULL)
|
|
- sss_sudo_free_result(sss_result);
|
|
+ handle->fn_free_result(sss_result);
|
|
|
|
debug_return_int(!found);
|
|
}
|
|
@@ -901,11 +991,11 @@ static int sudo_sss_display_defaults(str
|
|
if (handle == NULL)
|
|
goto done;
|
|
|
|
- if (sss_sudo_send_recv_defaults(pw->pw_uid, pw->pw_name,
|
|
+ if (handle->fn_send_recv_defaults(pw->pw_uid, pw->pw_name,
|
|
&sss_error, &handle->domainname,
|
|
&sss_result) != 0)
|
|
{
|
|
- sudo_debug_printf(2, "sss_sudo_send_recv_defaults: !=0, sss_error=%u", sss_error);
|
|
+ sudo_debug_printf(2, "handle->fn_send_recv_defaults: !=0, sss_error=%u", sss_error);
|
|
goto done;
|
|
}
|
|
|
|
@@ -922,7 +1012,7 @@ static int sudo_sss_display_defaults(str
|
|
for (i = 0; i < sss_result->num_rules; ++i) {
|
|
rule = sss_result->rules + i;
|
|
|
|
- switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoOption", &val_array))
|
|
{
|
|
case 0:
|
|
break;
|
|
@@ -930,7 +1020,7 @@ static int sudo_sss_display_defaults(str
|
|
sudo_debug_printf(2, "No result.");
|
|
continue;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values: != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values: != 0");
|
|
continue;
|
|
}
|
|
|
|
@@ -946,11 +1036,11 @@ static int sudo_sss_display_defaults(str
|
|
count++;
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
val_array = NULL;
|
|
}
|
|
|
|
- sss_sudo_free_result(sss_result);
|
|
+ handle->fn_free_result(sss_result);
|
|
done:
|
|
debug_return_int(count);
|
|
}
|
|
@@ -963,7 +1053,7 @@ static int sudo_sss_display_bound_defaul
|
|
debug_return_int(0);
|
|
}
|
|
|
|
-static int sudo_sss_display_entry_long(struct sss_sudo_rule *rule, struct lbuf *lbuf)
|
|
+static int sudo_sss_display_entry_long(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
|
|
{
|
|
char **val_array = NULL;
|
|
int count = 0, i;
|
|
@@ -971,94 +1061,94 @@ static int sudo_sss_display_entry_long(s
|
|
|
|
/* get the RunAsUser Values from the entry */
|
|
lbuf_append(lbuf, " RunAsUsers: ");
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
|
|
{
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
|
|
{
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
lbuf_append(lbuf, "%s", def_runas_default);
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
lbuf_append(lbuf, "\n");
|
|
|
|
/* get the RunAsGroup Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
{
|
|
case 0:
|
|
lbuf_append(lbuf, " RunAsGroups: ");
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
lbuf_append(lbuf, "\n");
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
/* get the Option Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoOption", &val_array))
|
|
{
|
|
case 0:
|
|
lbuf_append(lbuf, " Options: ");
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
lbuf_append(lbuf, "\n");
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
/* Get the command values from the entry. */
|
|
- switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
|
|
+ switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
|
|
case 0:
|
|
lbuf_append(lbuf, _(" Commands:\n"));
|
|
for (i = 0; val_array[i] != NULL; ++i) {
|
|
lbuf_append(lbuf, "\t%s\n", val_array[i]);
|
|
count++;
|
|
}
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
debug_return_int(count);
|
|
}
|
|
|
|
-static int sudo_sss_display_entry_short(struct sss_sudo_rule *rule, struct lbuf *lbuf)
|
|
+static int sudo_sss_display_entry_short(struct sudo_sss_handle *handle, struct sss_sudo_rule *rule, struct lbuf *lbuf)
|
|
{
|
|
char **val_array = NULL;
|
|
int count = 0, i;
|
|
@@ -1067,58 +1157,58 @@ static int sudo_sss_display_entry_short(
|
|
lbuf_append(lbuf, " (");
|
|
|
|
/* get the RunAsUser Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAsUser", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAsUser", &val_array))
|
|
{
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result. Trying old style (sudoRunAs).");
|
|
/* try old style */
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAs", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAs", &val_array))
|
|
{
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
lbuf_append(lbuf, "%s", def_runas_default);
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAs): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAs): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsUser): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsUser): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
/* get the RunAsGroup Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoRunAsGroup", &val_array))
|
|
{
|
|
case 0:
|
|
lbuf_append(lbuf, " : ");
|
|
for (i = 0; val_array[i] != NULL; ++i)
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoRunAsGroup): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoRunAsGroup): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
lbuf_append(lbuf, ") ");
|
|
|
|
/* get the Option Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoOption", &val_array))
|
|
+ switch (handle->fn_get_values(rule, "sudoOption", &val_array))
|
|
{
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i) {
|
|
@@ -1136,30 +1226,30 @@ static int sudo_sss_display_entry_short(
|
|
"NOSETENV: " : "SETENV: ");
|
|
}
|
|
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoOption): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoOption): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
|
|
/* get the Command Values from the entry */
|
|
- switch (sss_sudo_get_values(rule, "sudoCommand", &val_array)) {
|
|
+ switch (handle->fn_get_values(rule, "sudoCommand", &val_array)) {
|
|
case 0:
|
|
for (i = 0; val_array[i] != NULL; ++i) {
|
|
lbuf_append(lbuf, "%s%s", i != 0 ? ", " : "", val_array[i]);
|
|
count++;
|
|
}
|
|
- sss_sudo_free_values(val_array);
|
|
+ handle->fn_free_values(val_array);
|
|
break;
|
|
case ENOENT:
|
|
sudo_debug_printf(2, "No result.");
|
|
break;
|
|
default:
|
|
- sudo_debug_printf(2, "sss_sudo_get_values(sudoCommand): != 0");
|
|
+ sudo_debug_printf(2, "handle->fn_get_values(sudoCommand): != 0");
|
|
debug_return_int(count);
|
|
}
|
|
lbuf_append(lbuf, "\n");
|
|
@@ -1193,13 +1283,13 @@ static int sudo_sss_display_privs(struct
|
|
for (i = 0; i < sss_result->num_rules; ++i) {
|
|
rule = sss_result->rules + i;
|
|
if (long_list)
|
|
- count += sudo_sss_display_entry_long(rule, lbuf);
|
|
+ count += sudo_sss_display_entry_long(handle, rule, lbuf);
|
|
else
|
|
- count += sudo_sss_display_entry_short(rule, lbuf);
|
|
+ count += sudo_sss_display_entry_short(handle, rule, lbuf);
|
|
}
|
|
|
|
if (sss_result != NULL)
|
|
- sss_sudo_free_result(sss_result);
|
|
+ handle->fn_free_result(sss_result);
|
|
|
|
debug_return_int(count);
|
|
}
|