diff options
author | Sumit Bose <sbose@redhat.com> | 2012-07-05 10:50:08 +0200 |
---|---|---|
committer | Stephen Gallagher <sgallagh@redhat.com> | 2012-07-10 09:07:26 -0400 |
commit | 2d257ccf620ce1b611f89cec8f0a94c88c2f2881 (patch) | |
tree | 6e3c67e2922c366d3b60ae477d2e2dd8fbbd6763 /src/responder/common/responder.h | |
parent | a56156c13c71a96166b0a8f3921e67f36470f8d7 (diff) | |
download | sssd-2d257ccf620ce1b611f89cec8f0a94c88c2f2881.tar.gz sssd-2d257ccf620ce1b611f89cec8f0a94c88c2f2881.tar.bz2 sssd-2d257ccf620ce1b611f89cec8f0a94c88c2f2881.zip |
pac responder: limit access by checking UIDs
A check for allowed UIDs is added in the common responder code directly
after accept(). If the platform does not support reading the UID of the
peer but allowed UIDs are configured, access is denied.
Currently only the PAC responder sets the allowed UIDs for a socket. The
default is that only root is allowed to access the socket of the PAC
responder.
Fixes: https://fedorahosted.org/sssd/ticket/1382
Diffstat (limited to 'src/responder/common/responder.h')
-rw-r--r-- | src/responder/common/responder.h | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h index 43a4fa02..c09262d1 100644 --- a/src/responder/common/responder.h +++ b/src/responder/common/responder.h @@ -98,6 +98,9 @@ struct resp_ctx { struct timeval get_domains_last_call; + size_t allowed_uids_count; + uid_t *allowed_uids; + void *pvt_ctx; }; @@ -289,4 +292,11 @@ struct tevent_req *sss_dp_get_domains_send(TALLOC_CTX *mem_ctx, const char *hint); errno_t sss_dp_get_domains_recv(struct tevent_req *req); + +errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *cvs_string, + bool allow_sss_loop, + size_t *_uid_count, uid_t **_uids); + +errno_t check_allowed_uids(uid_t uid, size_t allowed_uids_count, + uid_t *allowed_uids); #endif /* __SSS_RESPONDER_H__ */ |