Blame SOURCES/0213-ccpp-add-AllowedUsers-and-AllowedGroups-feature.patch

baab13
From 29e8577ae1d7252513883941cae1c576f30c2d75 Mon Sep 17 00:00:00 2001
baab13
From: Matej Habrnal <mhabrnal@redhat.com>
baab13
Date: Tue, 22 Mar 2016 12:35:55 +0100
baab13
Subject: [PATCH] ccpp: add AllowedUsers and AllowedGroups feature
baab13
baab13
The feature allows dump core only for allowed users.
baab13
baab13
The logic is the following:
baab13
 - if both options are not-defined or empty keep all core dumps
baab13
 - else if crashed UID is in the list of users keep the core dump
baab13
 - else if crashed UID belongs to a group in the list of groups keep the core dump
baab13
baab13
Related to rhbz#1277849
baab13
baab13
Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>
baab13
---
baab13
 doc/abrt-CCpp.conf.txt     | 10 ++++++++
baab13
 src/hooks/CCpp.conf        |  7 ++++++
baab13
 src/hooks/abrt-hook-ccpp.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++
baab13
 3 files changed, 80 insertions(+)
baab13
baab13
diff --git a/doc/abrt-CCpp.conf.txt b/doc/abrt-CCpp.conf.txt
baab13
index 4db4b54..dffa45d 100644
baab13
--- a/doc/abrt-CCpp.conf.txt
baab13
+++ b/doc/abrt-CCpp.conf.txt
baab13
@@ -43,6 +43,16 @@ IgnoredPaths = /path/to/ignore/*, */another/ignored/path* ...::
baab13
    ABRT will ignore crashes in executables whose absolute path matches one of
baab13
    specified patterns.
baab13
 
baab13
+AllowedUsers = root, ...::
baab13
+   ABRT will process only crashes of either allowed users 'AllowedUsers' or
baab13
+   users who are members of allowed group 'AllowedGroups'. If no allowed users
baab13
+   nor allowed group are specified ABRT will process crashes of all users.
baab13
+
baab13
+AllowedGroups = root, ...::
baab13
+   ABRT will process only crashes of either allowed users 'AllowedUsers' or
baab13
+   users who are members of allowed group 'AllowedGroups'. If no allowed users
baab13
+   nor allowed group are specified ABRT will process crashes of all users.
baab13
+
baab13
 VerboseLog = NUM::
baab13
    Used to make the hook more verbose
baab13
 
baab13
diff --git a/src/hooks/CCpp.conf b/src/hooks/CCpp.conf
baab13
index be55e05..af31ed5 100644
baab13
--- a/src/hooks/CCpp.conf
baab13
+++ b/src/hooks/CCpp.conf
baab13
@@ -37,3 +37,10 @@ SaveFullCore = yes
baab13
 # specified patterns.
baab13
 #
baab13
 #IgnoredPaths =
baab13
+
baab13
+# ABRT will process only crashes of either allowed users or users who are
baab13
+# members of allowed group. If no allowed users nor allowed group are specified
baab13
+# ABRT will process crashes of all users.
baab13
+#
baab13
+#AllowedUsers =
baab13
+#AllowedGroups =
baab13
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
baab13
index 18cd608..c9fbf68 100644
baab13
--- a/src/hooks/abrt-hook-ccpp.c
baab13
+++ b/src/hooks/abrt-hook-ccpp.c
baab13
@@ -645,6 +645,44 @@ static bool is_path_ignored(const GList *list, const char *path)
baab13
     return false;
baab13
 }
baab13
 
baab13
+static bool is_user_allowed(uid_t uid, const GList *list)
baab13
+{
baab13
+    const GList *li;
baab13
+    for (li = list; li != NULL; li = g_list_next(li))
baab13
+    {
baab13
+        const char *username = (const char*)li->data;
baab13
+        struct passwd *pw = getpwnam(username);
baab13
+        if (pw == NULL)
baab13
+        {
baab13
+            log_warning("can't get uid of user '%s' (listed in 'AllowedUsers')", username);
baab13
+            continue;
baab13
+        }
baab13
+
baab13
+        if(pw->pw_uid == uid)
baab13
+            return true;
baab13
+    }
baab13
+    return false;
baab13
+}
baab13
+
baab13
+static bool is_user_in_allowed_group(uid_t uid, const GList *list)
baab13
+{
baab13
+    const GList *li;
baab13
+    for (li = list; li != NULL; li = g_list_next(li))
baab13
+    {
baab13
+        const char *groupname = (const char*)li->data;
baab13
+        struct group *gr = getgrnam(groupname);
baab13
+        if (gr == NULL)
baab13
+        {
baab13
+            log_warning("can't get gid of group '%s' (listed in 'AllowedGroups')", groupname);
baab13
+            continue;
baab13
+        }
baab13
+
baab13
+        if(uid_in_group(uid, gr->gr_gid))
baab13
+            return true;
baab13
+    }
baab13
+    return false;
baab13
+}
baab13
+
baab13
 static int test_configuration(bool setting_SaveFullCore, bool setting_CreateCoreBacktrace)
baab13
 {
baab13
     if (!setting_SaveFullCore && !setting_CreateCoreBacktrace)
baab13
@@ -701,6 +739,8 @@ int main(int argc, char** argv)
baab13
     bool setting_SaveFullCore;
baab13
     bool setting_CreateCoreBacktrace;
baab13
     GList *setting_ignored_paths = NULL;
baab13
+    GList *setting_allowed_users = NULL;
baab13
+    GList *setting_allowed_groups = NULL;
baab13
     {
baab13
         map_string_t *settings = new_map_string();
baab13
         load_abrt_plugin_conf_file("CCpp.conf", settings);
baab13
@@ -716,6 +756,13 @@ int main(int argc, char** argv)
baab13
         if (value)
baab13
             setting_ignored_paths = parse_list(value);
baab13
 
baab13
+        value = get_map_string_item_or_NULL(settings, "AllowedUsers");
baab13
+        if (value)
baab13
+            setting_allowed_users = parse_list(value);
baab13
+        value = get_map_string_item_or_NULL(settings, "AllowedGroups");
baab13
+        if (value)
baab13
+            setting_allowed_groups = parse_list(value);
baab13
+
baab13
         setting_CreateCoreBacktrace = value ? string_to_bool(value) : true;
baab13
         value = get_map_string_item_or_NULL(settings, "VerboseLog");
baab13
         if (value)
baab13
@@ -803,6 +850,22 @@ int main(int argc, char** argv)
baab13
         return 0;
baab13
     }
baab13
 
baab13
+    /* dumping core for user, if allowed */
baab13
+    if (setting_allowed_users || setting_allowed_groups)
baab13
+    {
baab13
+        if (setting_allowed_users && is_user_allowed(uid, setting_allowed_users))
baab13
+            log_debug("User %lu is listed in 'AllowedUsers'", (long unsigned)uid);
baab13
+        else if (setting_allowed_groups && is_user_in_allowed_group(uid, setting_allowed_groups))
baab13
+            log_debug("User %lu is member of group listed in 'AllowedGroups'", (long unsigned)uid);
baab13
+        else
baab13
+        {
baab13
+            error_msg_not_process_crash(pid_str, last_slash + 1, (long unsigned)uid, signal_no,
baab13
+                signame, "ignoring (not allowed in 'AllowedUsers' nor 'AllowedGroups')");
baab13
+
baab13
+            xfunc_die();
baab13
+        }
baab13
+    }
baab13
+
baab13
     user_pwd = get_cwd(pid);
baab13
     log_notice("user_pwd:'%s'", user_pwd);
baab13
 
baab13
-- 
baab13
1.8.3.1
baab13