Blame SOURCES/0213-ccpp-add-AllowedUsers-and-AllowedGroups-feature.patch

b225ea
From 29e8577ae1d7252513883941cae1c576f30c2d75 Mon Sep 17 00:00:00 2001
b225ea
From: Matej Habrnal <mhabrnal@redhat.com>
b225ea
Date: Tue, 22 Mar 2016 12:35:55 +0100
b225ea
Subject: [PATCH] ccpp: add AllowedUsers and AllowedGroups feature
b225ea
b225ea
The feature allows dump core only for allowed users.
b225ea
b225ea
The logic is the following:
b225ea
 - if both options are not-defined or empty keep all core dumps
b225ea
 - else if crashed UID is in the list of users keep the core dump
b225ea
 - else if crashed UID belongs to a group in the list of groups keep the core dump
b225ea
b225ea
Related to rhbz#1277849
b225ea
b225ea
Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>
b225ea
---
b225ea
 doc/abrt-CCpp.conf.txt     | 10 ++++++++
b225ea
 src/hooks/CCpp.conf        |  7 ++++++
b225ea
 src/hooks/abrt-hook-ccpp.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++
b225ea
 3 files changed, 80 insertions(+)
b225ea
b225ea
diff --git a/doc/abrt-CCpp.conf.txt b/doc/abrt-CCpp.conf.txt
b225ea
index 4db4b54..dffa45d 100644
b225ea
--- a/doc/abrt-CCpp.conf.txt
b225ea
+++ b/doc/abrt-CCpp.conf.txt
b225ea
@@ -43,6 +43,16 @@ IgnoredPaths = /path/to/ignore/*, */another/ignored/path* ...::
b225ea
    ABRT will ignore crashes in executables whose absolute path matches one of
b225ea
    specified patterns.
b225ea
 
b225ea
+AllowedUsers = root, ...::
b225ea
+   ABRT will process only crashes of either allowed users 'AllowedUsers' or
b225ea
+   users who are members of allowed group 'AllowedGroups'. If no allowed users
b225ea
+   nor allowed group are specified ABRT will process crashes of all users.
b225ea
+
b225ea
+AllowedGroups = root, ...::
b225ea
+   ABRT will process only crashes of either allowed users 'AllowedUsers' or
b225ea
+   users who are members of allowed group 'AllowedGroups'. If no allowed users
b225ea
+   nor allowed group are specified ABRT will process crashes of all users.
b225ea
+
b225ea
 VerboseLog = NUM::
b225ea
    Used to make the hook more verbose
b225ea
 
b225ea
diff --git a/src/hooks/CCpp.conf b/src/hooks/CCpp.conf
b225ea
index be55e05..af31ed5 100644
b225ea
--- a/src/hooks/CCpp.conf
b225ea
+++ b/src/hooks/CCpp.conf
b225ea
@@ -37,3 +37,10 @@ SaveFullCore = yes
b225ea
 # specified patterns.
b225ea
 #
b225ea
 #IgnoredPaths =
b225ea
+
b225ea
+# ABRT will process only crashes of either allowed users or users who are
b225ea
+# members of allowed group. If no allowed users nor allowed group are specified
b225ea
+# ABRT will process crashes of all users.
b225ea
+#
b225ea
+#AllowedUsers =
b225ea
+#AllowedGroups =
b225ea
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
b225ea
index 18cd608..c9fbf68 100644
b225ea
--- a/src/hooks/abrt-hook-ccpp.c
b225ea
+++ b/src/hooks/abrt-hook-ccpp.c
b225ea
@@ -645,6 +645,44 @@ static bool is_path_ignored(const GList *list, const char *path)
b225ea
     return false;
b225ea
 }
b225ea
 
b225ea
+static bool is_user_allowed(uid_t uid, const GList *list)
b225ea
+{
b225ea
+    const GList *li;
b225ea
+    for (li = list; li != NULL; li = g_list_next(li))
b225ea
+    {
b225ea
+        const char *username = (const char*)li->data;
b225ea
+        struct passwd *pw = getpwnam(username);
b225ea
+        if (pw == NULL)
b225ea
+        {
b225ea
+            log_warning("can't get uid of user '%s' (listed in 'AllowedUsers')", username);
b225ea
+            continue;
b225ea
+        }
b225ea
+
b225ea
+        if(pw->pw_uid == uid)
b225ea
+            return true;
b225ea
+    }
b225ea
+    return false;
b225ea
+}
b225ea
+
b225ea
+static bool is_user_in_allowed_group(uid_t uid, const GList *list)
b225ea
+{
b225ea
+    const GList *li;
b225ea
+    for (li = list; li != NULL; li = g_list_next(li))
b225ea
+    {
b225ea
+        const char *groupname = (const char*)li->data;
b225ea
+        struct group *gr = getgrnam(groupname);
b225ea
+        if (gr == NULL)
b225ea
+        {
b225ea
+            log_warning("can't get gid of group '%s' (listed in 'AllowedGroups')", groupname);
b225ea
+            continue;
b225ea
+        }
b225ea
+
b225ea
+        if(uid_in_group(uid, gr->gr_gid))
b225ea
+            return true;
b225ea
+    }
b225ea
+    return false;
b225ea
+}
b225ea
+
b225ea
 static int test_configuration(bool setting_SaveFullCore, bool setting_CreateCoreBacktrace)
b225ea
 {
b225ea
     if (!setting_SaveFullCore && !setting_CreateCoreBacktrace)
b225ea
@@ -701,6 +739,8 @@ int main(int argc, char** argv)
b225ea
     bool setting_SaveFullCore;
b225ea
     bool setting_CreateCoreBacktrace;
b225ea
     GList *setting_ignored_paths = NULL;
b225ea
+    GList *setting_allowed_users = NULL;
b225ea
+    GList *setting_allowed_groups = NULL;
b225ea
     {
b225ea
         map_string_t *settings = new_map_string();
b225ea
         load_abrt_plugin_conf_file("CCpp.conf", settings);
b225ea
@@ -716,6 +756,13 @@ int main(int argc, char** argv)
b225ea
         if (value)
b225ea
             setting_ignored_paths = parse_list(value);
b225ea
 
b225ea
+        value = get_map_string_item_or_NULL(settings, "AllowedUsers");
b225ea
+        if (value)
b225ea
+            setting_allowed_users = parse_list(value);
b225ea
+        value = get_map_string_item_or_NULL(settings, "AllowedGroups");
b225ea
+        if (value)
b225ea
+            setting_allowed_groups = parse_list(value);
b225ea
+
b225ea
         setting_CreateCoreBacktrace = value ? string_to_bool(value) : true;
b225ea
         value = get_map_string_item_or_NULL(settings, "VerboseLog");
b225ea
         if (value)
b225ea
@@ -803,6 +850,22 @@ int main(int argc, char** argv)
b225ea
         return 0;
b225ea
     }
b225ea
 
b225ea
+    /* dumping core for user, if allowed */
b225ea
+    if (setting_allowed_users || setting_allowed_groups)
b225ea
+    {
b225ea
+        if (setting_allowed_users && is_user_allowed(uid, setting_allowed_users))
b225ea
+            log_debug("User %lu is listed in 'AllowedUsers'", (long unsigned)uid);
b225ea
+        else if (setting_allowed_groups && is_user_in_allowed_group(uid, setting_allowed_groups))
b225ea
+            log_debug("User %lu is member of group listed in 'AllowedGroups'", (long unsigned)uid);
b225ea
+        else
b225ea
+        {
b225ea
+            error_msg_not_process_crash(pid_str, last_slash + 1, (long unsigned)uid, signal_no,
b225ea
+                signame, "ignoring (not allowed in 'AllowedUsers' nor 'AllowedGroups')");
b225ea
+
b225ea
+            xfunc_die();
b225ea
+        }
b225ea
+    }
b225ea
+
b225ea
     user_pwd = get_cwd(pid);
b225ea
     log_notice("user_pwd:'%s'", user_pwd);
b225ea
 
b225ea
-- 
b225ea
1.8.3.1
b225ea