From d63172f1277c5ed166a22f04d144bf85ded4757c Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Fri, 9 Oct 2020 13:03:54 +0200

Subject: [PATCH 25/27] pam: add pam_gssapi_services option

:config: Added `pam_gssapi_services` to list PAM services

  that can authenticate using GSSAPI

Reviewed-by: Robbie Harwood <rharwood@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/confdb/confdb.c                  | 12 +++++++++++

 src/confdb/confdb.h                  |  4 ++++

 src/config/SSSDConfig/sssdoptions.py |  1 +

 src/config/SSSDConfigTest.py         |  6 ++++--

 src/config/cfg_rules.ini             |  3 +++

 src/config/etc/sssd.api.conf         |  2 ++

 src/db/sysdb_subdomains.c            | 13 ++++++++++++

 src/man/sssd.conf.5.xml              | 30 ++++++++++++++++++++++++++++

 src/responder/pam/pamsrv.c           | 21 +++++++++++++++++++

 src/responder/pam/pamsrv.h           |  3 +++

 10 files changed, 93 insertions(+), 2 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c

index f981ddf1e..7f1956d6d 100644

--- a/src/confdb/confdb.c

+++ b/src/confdb/confdb.c

@@ -1581,6 +1581,18 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,

         }

     }

+    tmp = ldb_msg_find_attr_as_string(res->msgs[0], CONFDB_PAM_GSSAPI_SERVICES,

+                                      "-");

+    if (tmp != NULL) {

+        ret = split_on_separator(domain, tmp, ',', true, true,

+                                 &domain->gssapi_services, NULL);

+        if (ret != 0) {

+            DEBUG(SSSDBG_FATAL_FAILURE,

+                  "Cannot parse %s\n", CONFDB_PAM_GSSAPI_SERVICES);

+            goto done;

+        }

+    }

+

     domain->has_views = false;

     domain->view_name = NULL;

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index 54e3f7380..7a3bc8bb5 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -144,6 +144,7 @@

 #define CONFDB_PAM_P11_ALLOWED_SERVICES "pam_p11_allowed_services"

 #define CONFDB_PAM_P11_URI "p11_uri"

 #define CONFDB_PAM_INITGROUPS_SCHEME "pam_initgroups_scheme"

+#define CONFDB_PAM_GSSAPI_SERVICES "pam_gssapi_services"

 /* SUDO */

 #define CONFDB_SUDO_CONF_ENTRY "config/sudo"

@@ -431,6 +432,9 @@ struct sss_domain_info {

     /* Keytab used by this domain. */

     const char *krb5_keytab;

+

+    /* List of PAM services that are allowed to authenticate with GSSAPI. */

+    char **gssapi_services;

 };

 /**

diff --git a/src/config/SSSDConfig/sssdoptions.py b/src/config/SSSDConfig/sssdoptions.py

index de96db6f4..f59fe8d9f 100644

--- a/src/config/SSSDConfig/sssdoptions.py

+++ b/src/config/SSSDConfig/sssdoptions.py

@@ -104,6 +104,7 @@ class SSSDOptions(object):

         'p11_wait_for_card_timeout': _('Additional timeout to wait for a card if requested'),

         'p11_uri': _('PKCS#11 URI to restrict the selection of devices for Smartcard authentication'),

         'pam_initgroups_scheme' : _('When shall the PAM responder force an initgroups request'),

+        'pam_gssapi_services' : _('List of PAM services that are allowed to authenticate with GSSAPI.'),

         # [sudo]

         'sudo_timed': _('Whether to evaluate the time-based attributes in sudo rules'),

diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py

index 323be5ed3..21fffe1b6 100755

--- a/src/config/SSSDConfigTest.py

+++ b/src/config/SSSDConfigTest.py

@@ -653,7 +653,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             'full_name_format',

             're_expression',

             'cached_auth_timeout',

-            'auto_private_groups']

+            'auto_private_groups',

+            'pam_gssapi_services']

         self.assertTrue(type(options) == dict,

                         "Options should be a dictionary")

@@ -1030,7 +1031,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             'full_name_format',

             're_expression',

             'cached_auth_timeout',

-            'auto_private_groups']

+            'auto_private_groups',

+            'pam_gssapi_services']

         self.assertTrue(type(options) == dict,

                         "Options should be a dictionary")

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini

index 773afd8bb..c6dfd5648 100644

--- a/src/config/cfg_rules.ini

+++ b/src/config/cfg_rules.ini

@@ -139,6 +139,7 @@ option = pam_p11_allowed_services

 option = p11_wait_for_card_timeout

 option = p11_uri

 option = pam_initgroups_scheme

+option = pam_gssapi_services

 [rule/allowed_sudo_options]

 validator = ini_allowed_options

@@ -437,6 +438,7 @@ option = wildcard_limit

 option = full_name_format

 option = re_expression

 option = auto_private_groups

+option = pam_gssapi_services

 #Entry cache timeouts

 option = entry_cache_user_timeout

@@ -831,6 +833,7 @@ option = ad_backup_server

 option = ad_site

 option = use_fully_qualified_names

 option = auto_private_groups

+option = pam_gssapi_services

 [rule/sssd_checks]

 validator = sssd_checks

diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf

index 623160ffd..f46f3c46d 100644

--- a/src/config/etc/sssd.api.conf

+++ b/src/config/etc/sssd.api.conf

@@ -80,6 +80,7 @@ pam_p11_allowed_services = str, None, false

 p11_wait_for_card_timeout = int, None, false

 p11_uri = str, None, false

 pam_initgroups_scheme = str, None, false

+pam_gssapi_services = str, None, false

 [sudo]

 # sudo service

@@ -199,6 +200,7 @@ cached_auth_timeout = int, None, false

 full_name_format = str, None, false

 re_expression = str, None, false

 auto_private_groups = str, None, false

+pam_gssapi_services = str, None, false

 #Entry cache timeouts

 entry_cache_user_timeout = int, None, false

diff --git a/src/db/sysdb_subdomains.c b/src/db/sysdb_subdomains.c

index 5b42f9bdc..bfc6df0f5 100644

--- a/src/db/sysdb_subdomains.c

+++ b/src/db/sysdb_subdomains.c

@@ -184,6 +184,8 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,

     dom->homedir_substr = parent->homedir_substr;

     dom->override_gid = parent->override_gid;

+    dom->gssapi_services = parent->gssapi_services;

+

     if (parent->sysdb == NULL) {

         DEBUG(SSSDBG_OP_FAILURE, "Missing sysdb context in parent domain.\n");

         goto fail;

@@ -241,6 +243,17 @@ check_subdom_config_file(struct confdb_ctx *confdb,

           sd_conf_path, CONFDB_DOMAIN_FQ,

           subdomain->fqnames ? "TRUE" : "FALSE");

+    /* allow to set pam_gssapi_services */

+    ret = confdb_get_string_as_list(confdb, subdomain, sd_conf_path,

+                                    CONFDB_PAM_GSSAPI_SERVICES,

+                                    &subdomain->gssapi_services);

+    if (ret != EOK && ret != ENOENT) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Failed to get %s option for the subdomain: %s\n",

+              CONFDB_PAM_GSSAPI_SERVICES, subdomain->name);

+        goto done;

+    }

+

     ret = EOK;

 done:

     talloc_free(tmp_ctx);

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml

index d247400bf..db9dd4677 100644

--- a/src/man/sssd.conf.5.xml

+++ b/src/man/sssd.conf.5.xml

@@ -1706,6 +1706,35 @@ p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2

                         </para>

                     </listitem>

                 </varlistentry>

+                <varlistentry>

+                    <term>pam_gssapi_services</term>

+                    <listitem>

+                        <para>

+                            Comma separated list of PAM services that are

+                            allowed to try GSSAPI authentication using

+                            pam_sss_gss.so module.

+                        </para>

+                        <para>

+                            To disable GSSAPI authentication, set this option

+                            to <quote>-</quote> (dash).

+                        </para>

+                        <para>

+                            Note: This option can also be set per-domain which

+                            overwrites the value in [pam] section. It can also

+                            be set for trusted domain which overwrites the value

+                            in the domain section.

+                        </para>

+                        <para>

+                            Example:

+                            <programlisting>

+pam_gssapi_services = sudo, sudo-i

+                            </programlisting>

+                        </para>

+                        <para>

+                            Default: - (GSSAPI authentication is disabled)

+                        </para>

+                    </listitem>

+                </varlistentry>

             </variablelist>

         </refsect2>

@@ -3780,6 +3809,7 @@ ldap_user_extra_attrs = phone:telephoneNumber

             <para>ad_backup_server,</para>

             <para>ad_site,</para>

             <para>use_fully_qualified_names</para>

+            <para>pam_gssapi_services</para>

         <para>

             For more details about these options see their individual description

             in the manual page.

diff --git a/src/responder/pam/pamsrv.c b/src/responder/pam/pamsrv.c

index 1f1ee608b..0492569c7 100644

--- a/src/responder/pam/pamsrv.c

+++ b/src/responder/pam/pamsrv.c

@@ -327,6 +327,27 @@ static int pam_process_init(TALLOC_CTX *mem_ctx,

         }

     }

+    ret = confdb_get_string(pctx->rctx->cdb, pctx, CONFDB_PAM_CONF_ENTRY,

+                            CONFDB_PAM_GSSAPI_SERVICES, "-", &tmpstr);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_FATAL_FAILURE,

+              "Failed to determine gssapi services.\n");

+        goto done;

+    }

+    DEBUG(SSSDBG_TRACE_INTERNAL, "Found value [%s] for option [%s].\n", tmpstr,

+                                 CONFDB_PAM_GSSAPI_SERVICES);

+

+    if (tmpstr != NULL) {

+        ret = split_on_separator(pctx, tmpstr, ',', true, true,

+                                 &pctx->gssapi_services, NULL);

+        if (ret != EOK) {

+            DEBUG(SSSDBG_MINOR_FAILURE,

+                  "split_on_separator() failed [%d]: [%s].\n", ret,

+                  sss_strerror(ret));

+            goto done;

+        }

+    }

+

     /* The responder is initialized. Now tell it to the monitor. */

     ret = sss_monitor_service_init(rctx, rctx->ev, SSS_BUS_PAM,

                                    SSS_PAM_SBUS_SERVICE_NAME,

diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h

index 24d307a14..730dee288 100644

--- a/src/responder/pam/pamsrv.h

+++ b/src/responder/pam/pamsrv.h

@@ -62,6 +62,9 @@ struct pam_ctx {

     int num_prompting_config_sections;

     enum pam_initgroups_scheme initgroups_scheme;

+

+    /* List of PAM services that are allowed to authenticate with GSSAPI. */

+    char **gssapi_services;

 };

 struct pam_auth_req {

-- 

2.21.3