summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStephen Gallagher <sgallagh@redhat.com>2011-07-01 16:34:03 -0400
committerStephen Gallagher <sgallagh@redhat.com>2011-07-08 15:12:25 -0400
commit9b72b00ebcfd6225a4e139619c8e18d44a448f87 (patch)
treedc324d9ff8a9bc5d561fd5151c56bd9822813e2e
parent98fc4cbc838615a88b9725a13ab7491e89cbac32 (diff)
downloadsssd-9b72b00ebcfd6225a4e139619c8e18d44a448f87.tar.gz
sssd-9b72b00ebcfd6225a4e139619c8e18d44a448f87.tar.bz2
sssd-9b72b00ebcfd6225a4e139619c8e18d44a448f87.zip
Treat NULL or empty rhost as unknown
Previously, we were assuming this meant it was coming from the localhost, but this is not a safe assumption. We will now treat it as unknown and it will fail to match any rule that requires a specified srchost or group of srchosts.
-rw-r--r--src/providers/ipa/hbac_evaluator.c6
-rw-r--r--src/providers/ipa/ipa_hbac_common.c30
2 files changed, 25 insertions, 11 deletions
diff --git a/src/providers/ipa/hbac_evaluator.c b/src/providers/ipa/hbac_evaluator.c
index 949f0aef..e120d51e 100644
--- a/src/providers/ipa/hbac_evaluator.c
+++ b/src/providers/ipa/hbac_evaluator.c
@@ -155,8 +155,10 @@ static bool hbac_evaluate_element(struct hbac_rule_element *rule_el,
/* First check the name list */
if (rule_el->names) {
for (i = 0; rule_el->names[i]; i++) {
- if (strcmp(rule_el->names[i], req_el->name) == 0) {
- return true;
+ if (req_el->name != NULL) {
+ if (strcmp(rule_el->names[i], req_el->name) == 0) {
+ return true;
+ }
}
}
}
diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index f05c3e2e..0ed08b83 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -558,18 +558,15 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
/* Get the source host */
if (pd->rhost == NULL || pd->rhost[0] == '\0') {
- /* If we haven't been passed an rhost, we
- * have to assume it's coming from the
- * target host
+ /* If we haven't been passed an rhost,
+ * the rhost is unknown. This will fail
+ * to match any rule requiring the
+ * source host.
*/
- rhost = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);
+ rhost = NULL;
} else {
rhost = pd->rhost;
}
- if (rhost == NULL) {
- ret = EINVAL;
- goto done;
- }
ret = hbac_eval_host_element(eval_req, sysdb, domain,
rhost, &eval_req->srchost);
@@ -808,6 +805,19 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
host->name = hostname;
+ if (host->name == NULL) {
+ /* We don't know the host (probably an rhost)
+ * So we can't determine it's groups either.
+ */
+ host->groups = talloc_array(host, const char *, 1);
+ if (host->groups == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ host->groups[0] = NULL;
+ ret = EOK;
+ goto done;
+ }
host_filter = talloc_asprintf(tmp_ctx,
"(objectClass=%s)",
@@ -862,10 +872,12 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
}
host->groups[i] = NULL;
- *host_element = talloc_steal(mem_ctx, host);
ret = EOK;
done:
+ if (ret == EOK) {
+ *host_element = talloc_steal(mem_ctx, host);
+ }
talloc_free(tmp_ctx);
return ret;
}