summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/confdb/confdb.h1
-rw-r--r--src/providers/data_provider.h1
-rw-r--r--src/providers/data_provider_be.c158
-rw-r--r--src/providers/dp_backend.h6
4 files changed, 166 insertions, 0 deletions
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 2ebbf4f4..5b935c41 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -101,6 +101,7 @@
#define CONFDB_DOMAIN_AUTH_PROVIDER "auth_provider"
#define CONFDB_DOMAIN_ACCESS_PROVIDER "access_provider"
#define CONFDB_DOMAIN_CHPASS_PROVIDER "chpass_provider"
+#define CONFDB_DOMAIN_SUDO_PROVIDER "sudo_provider"
#define CONFDB_DOMAIN_COMMAND "command"
#define CONFDB_DOMAIN_TIMEOUT "timeout"
#define CONFDB_DOMAIN_ATTR "cn"
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index bf595472..1b055e39 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -50,6 +50,7 @@
#define DP_METHOD_REGISTER "RegisterService"
#define DP_METHOD_GETACCTINFO "getAccountInfo"
+#define DP_METHOD_SUDOHANDLER "sudoHandler"
/**
* @defgroup pamHandler PAM DBUS request
* @ingroup sss_pam
diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
index 6557f9bc..2de986cc 100644
--- a/src/providers/data_provider_be.c
+++ b/src/providers/data_provider_be.c
@@ -80,11 +80,13 @@ struct sbus_interface monitor_be_interface = {
static int client_registration(DBusMessage *message, struct sbus_connection *conn);
static int be_get_account_info(DBusMessage *message, struct sbus_connection *conn);
static int be_pam_handler(DBusMessage *message, struct sbus_connection *conn);
+static int be_sudo_handler(DBusMessage *message, struct sbus_connection *conn);
struct sbus_method be_methods[] = {
{ DP_METHOD_REGISTER, client_registration },
{ DP_METHOD_GETACCTINFO, be_get_account_info },
{ DP_METHOD_PAMHANDLER, be_pam_handler },
+ { DP_METHOD_SUDOHANDLER, be_sudo_handler },
{ NULL, NULL }
};
@@ -102,6 +104,7 @@ static struct bet_data bet_data[] = {
{BET_AUTH, CONFDB_DOMAIN_AUTH_PROVIDER, "sssm_%s_auth_init"},
{BET_ACCESS, CONFDB_DOMAIN_ACCESS_PROVIDER, "sssm_%s_access_init"},
{BET_CHPASS, CONFDB_DOMAIN_CHPASS_PROVIDER, "sssm_%s_chpass_init"},
+ {BET_SUDO, CONFDB_DOMAIN_SUDO_PROVIDER, "sssm_%s_sudo_init"},
{BET_MAX, NULL, NULL}
};
@@ -593,6 +596,141 @@ done:
return EOK;
}
+static void be_sudo_handler_callback(struct be_req *req,
+ int dp_err_type,
+ int errnum,
+ const char *errstr)
+{
+ DBusMessage *reply = NULL;
+ DBusConnection *dbus_conn = NULL;
+ dbus_bool_t dbret;
+ dbus_uint16_t err_maj = 0;
+ dbus_uint32_t err_min = 0;
+ const char *err_msg = NULL;
+
+ reply = (DBusMessage*)(req->pvt);
+
+ err_maj = dp_err_type;
+ err_min = errnum;
+ err_msg = errstr ? errstr : talloc_strdup(req, "No errmsg set\n");
+ if (!err_msg) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to set err_msg\n"));
+ err_msg = "OOM";
+ }
+
+ dbret = dbus_message_append_args(reply,
+ DBUS_TYPE_UINT16, &err_maj,
+ DBUS_TYPE_UINT32, &err_min,
+ DBUS_TYPE_STRING, &err_msg,
+ DBUS_TYPE_INVALID);
+ if (!dbret) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to generate dbus reply\n"));
+ return;
+ }
+
+ DEBUG(SSSDBG_FUNC_DATA, ("SUDO Backend returned: (%d, %d, %s)\n",
+ dp_err_type, errnum, errstr ? errstr : "<NULL>"));
+
+ dbus_conn = sbus_get_connection(req->becli->conn);
+ dbus_connection_send(dbus_conn, reply, NULL);
+ dbus_message_unref(reply);
+
+ talloc_free(req);
+}
+
+static int be_sudo_handler(DBusMessage *message, struct sbus_connection *conn)
+{
+ dbus_bool_t dbus_ret;
+ DBusError dbus_error;
+ DBusMessageIter iter;
+ DBusMessage *reply = NULL;
+ struct be_client *be_cli = NULL;
+ struct be_req *be_req = NULL;
+ struct be_sudo_req *be_sudo_req = NULL;
+ void *user_data = NULL;
+ int ret = 0;
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Entering be_sudo_handler()\n"));
+
+ user_data = sbus_conn_get_private_data(conn);
+ if (user_data == NULL) {
+ return EINVAL;
+ }
+
+ be_cli = talloc_get_type(user_data, struct be_client);
+ if (be_cli == NULL) {
+ return EINVAL;
+ }
+
+ reply = dbus_message_new_method_return(message);
+ if (!reply) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ ("dbus_message_new_method_return failed, cannot send reply.\n"));
+ return ENOMEM;
+ }
+
+ /* create be request */
+ be_req = talloc_zero(be_cli, struct be_req);
+ if (be_req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero failed.\n"));
+ dbus_message_unref(reply);
+ return ENOMEM;
+ }
+
+ be_req->becli = be_cli;
+ be_req->be_ctx = be_cli->bectx;
+ be_req->pvt = reply;
+ be_req->fn = be_sudo_handler_callback;
+
+ /* get and set sudo request data */
+ be_sudo_req = talloc_zero(be_req, struct be_sudo_req);
+ if (be_sudo_req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero failed.\n"));
+ goto fail;
+ }
+
+ if (dbus_message_iter_init(message, &iter)) {
+ dbus_error_init(&dbus_error);
+ dbus_ret = dbus_message_get_args(message, &dbus_error,
+ DBUS_TYPE_STRING, &(be_sudo_req->username),
+ DBUS_TYPE_INVALID);
+
+ if (dbus_error_is_set(&dbus_error)) {
+ dbus_error_free(&dbus_error);
+ }
+
+ if (!dbus_ret) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("dbus_message_get_args failed.\n"));
+ ret = EINVAL;
+ goto fail;
+ }
+ }
+ be_req->req_data = be_sudo_req;
+
+ /* return an error if corresponding backend target is not configured */
+ if (!be_cli->bectx->bet_info[BET_SUDO].bet_ops) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Undefined backend target.\n"));
+ ret = ENODEV;
+ goto fail;
+ }
+
+ ret = be_file_request(be_cli->bectx,
+ be_cli->bectx->bet_info[BET_SUDO].bet_ops->handler,
+ be_req);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("be_file_request failed.\n"));
+ goto fail;
+ }
+
+ return EOK;
+
+fail:
+ /* send reply back immediately */
+ be_sudo_handler_callback(be_req, DP_ERR_FATAL, ret, strerror(ret));
+
+ return EOK;
+}
+
static int be_client_destructor(void *ctx)
{
struct be_client *becli = talloc_get_type(ctx, struct be_client);
@@ -603,6 +741,9 @@ static int be_client_destructor(void *ctx)
} else if (becli->bectx->pam_cli == becli) {
DEBUG(4, ("Removed PAM client\n"));
becli->bectx->pam_cli = NULL;
+ } else if (becli->bectx->sudo_cli == becli) {
+ DEBUG(4, ("Removed SUDO client\n"));
+ becli->bectx->sudo_cli = NULL;
} else {
DEBUG(2, ("Unknown client removed ...\n"));
}
@@ -651,6 +792,8 @@ static int client_registration(DBusMessage *message,
becli->bectx->nss_cli = becli;
} else if (strcasecmp(cli_name, "PAM") == 0) {
becli->bectx->pam_cli = becli;
+ } else if (strcasecmp(cli_name, "SUDO") == 0) {
+ becli->bectx->sudo_cli = becli;
} else {
DEBUG(1, ("Unknown client! [%s]\n", cli_name));
}
@@ -1168,6 +1311,21 @@ int be_process_init(TALLOC_CTX *mem_ctx,
"from provider [%s].\n", ctx->bet_info[BET_CHPASS].mod_name));
}
+ ret = load_backend_module(ctx, BET_SUDO,
+ &ctx->bet_info[BET_SUDO],
+ ctx->bet_info[BET_ID].mod_name);
+ if (ret != EOK) {
+ if (ret != ENOENT) {
+ DEBUG(0, ("fatal error initializing data providers\n"));
+ return ret;
+ }
+ DEBUG(1, ("No SUDO module provided for [%s] !!\n",
+ be_domain));
+ } else {
+ DEBUG(9, ("SUDO backend target successfully loaded "
+ "from provider [%s].\n", ctx->bet_info[BET_SUDO].mod_name));
+ }
+
/* Handle SIGUSR1 to force offline behavior */
BlockSignals(false, SIGUSR1);
tes = tevent_add_signal(ctx->ev, ctx, SIGUSR1, 0,
diff --git a/src/providers/dp_backend.h b/src/providers/dp_backend.h
index 3d5e40ba..ef9fe0d4 100644
--- a/src/providers/dp_backend.h
+++ b/src/providers/dp_backend.h
@@ -48,6 +48,7 @@ enum bet_type {
BET_AUTH,
BET_ACCESS,
BET_CHPASS,
+ BET_SUDO,
BET_MAX
};
@@ -108,6 +109,7 @@ struct be_ctx {
struct be_client *nss_cli;
struct be_client *pam_cli;
+ struct be_client *sudo_cli;
struct loaded_be loaded_be[BET_MAX];
struct bet_info bet_info[BET_MAX];
@@ -141,6 +143,10 @@ struct be_acct_req {
char *filter_value;
};
+struct be_sudo_req {
+ char *username;
+};
+
bool be_is_offline(struct be_ctx *ctx);
void be_mark_offline(struct be_ctx *ctx);
generated by cgit (git 2.34.1) at 2024-12-17 09:59:15 +0000