From 7c3fefc9c840fd0eb46048d7d2be0a0b8347f713 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>

Date: Wed, 29 Jul 2015 14:51:30 +0200

Subject: [PATCH 53/57] sudo: use "higher value wins" when ordering rules

This commit changes the default ordering logic (lower value wins) to

a correct one that is used by native ldap support. It also adds a new

option sudo_inverse_order to switch to the original SSSD (incorrect)

behaviour if needed.

Resolves:

https://fedorahosted.org/sssd/ticket/2682

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

---

 src/confdb/confdb.h                        |  2 ++

 src/config/SSSDConfig/__init__.py.in       |  1 +

 src/config/etc/sssd.api.conf               |  1 +

 src/responder/sudo/sudosrv.c               | 11 ++++++

 src/responder/sudo/sudosrv_get_sudorules.c | 54 ++++++++++++++++++++++++------

 src/responder/sudo/sudosrv_private.h       |  1 +

 6 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index df454337ab4d89c5857e73ee0e5392c2b4bba8b4..9aa264899e789f2491b9873daf44bb55aff1c95d 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -124,6 +124,8 @@

 #define CONFDB_DEFAULT_SUDO_CACHE_TIMEOUT 180

 #define CONFDB_SUDO_TIMED "sudo_timed"

 #define CONFDB_DEFAULT_SUDO_TIMED false

+#define CONFDB_SUDO_INVERSE_ORDER "sudo_inverse_order"

+#define CONFDB_DEFAULT_SUDO_INVERSE_ORDER false

 /* autofs */

 #define CONFDB_AUTOFS_CONF_ENTRY "config/autofs"

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in

index 7d361026c09ce8fd8d6a69f6bb3f3817bc3d68ba..fed2682f121103cefa27e689b29ce29b7d28f968 100644

--- a/src/config/SSSDConfig/__init__.py.in

+++ b/src/config/SSSDConfig/__init__.py.in

@@ -92,6 +92,7 @@ option_strings = {

     # [sudo]

     'sudo_timed' : _('Whether to evaluate the time-based attributes in sudo rules'),

+    'sudo_inverse_order' : _('If true, SSSD will switch back to lower-wins ordering logic'),

     # [autofs]

     'autofs_negative_timeout' : _('Negative cache timeout length (seconds)'),

diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf

index cf6ce63012176d49f757afbc8a343b24aef869e8..2e5b02e3e30c13f805e172eab481f7501f57bb05 100644

--- a/src/config/etc/sssd.api.conf

+++ b/src/config/etc/sssd.api.conf

@@ -63,6 +63,7 @@ pam_account_expired_message = str, None, false

 [sudo]

 # sudo service

 sudo_timed = bool, None, false

+sudo_inverse_order = bool, None, false

 [autofs]

 # autofs service

diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c

index 2499586eb11e49f8652ce62e53c88d7a2e54fb32..ff5d92e7005db9f6e883c78cf1a6218e9a150e0a 100644

--- a/src/responder/sudo/sudosrv.c

+++ b/src/responder/sudo/sudosrv.c

@@ -167,6 +167,17 @@ int sudo_process_init(TALLOC_CTX *mem_ctx,

         goto fail;

     }

+    /* Get sudo_inverse_order option */

+    ret = confdb_get_bool(sudo_ctx->rctx->cdb,

+                          CONFDB_SUDO_CONF_ENTRY, CONFDB_SUDO_INVERSE_ORDER,

+                          CONFDB_DEFAULT_SUDO_INVERSE_ORDER,

+                          &sudo_ctx->inverse_order);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_FATAL_FAILURE, "Error reading from confdb (%d) [%s]\n",

+              ret, strerror(ret));

+        goto fail;

+    }

+

     ret = schedule_get_domains_task(rctx, rctx->ev, rctx, NULL);

     if (ret != EOK) {

         DEBUG(SSSDBG_FATAL_FAILURE, "schedule_get_domains_tasks failed.\n");

diff --git a/src/responder/sudo/sudosrv_get_sudorules.c b/src/responder/sudo/sudosrv_get_sudorules.c

index 34d63bd74741c3cab5168fd0b0108cb05528d218..a0b09e69b71f963c353c9c6331c0708cc364924c 100644

--- a/src/responder/sudo/sudosrv_get_sudorules.c

+++ b/src/responder/sudo/sudosrv_get_sudorules.c

@@ -325,6 +325,7 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,

                                                  const char *username,

                                                  uid_t uid,

                                                  char **groupnames,

+                                                 bool inverse_order,

                                                  struct sysdb_attrs ***_rules,

                                                  uint32_t *_count);

@@ -386,6 +387,7 @@ errno_t sudosrv_get_rules(struct sudo_cmd_ctx *cmd_ctx)

                                             cmd_ctx->domain, attrs, flags,

                                             cmd_ctx->orig_username,

                                             cmd_ctx->uid, groupnames,

+                                            cmd_ctx->sudo_ctx->inverse_order,

                                             &expired_rules, &expired_rules_num);

     if (ret != EOK) {

         DEBUG(SSSDBG_CRIT_FAILURE, "Unable to retrieve expired sudo rules "

@@ -597,6 +599,7 @@ static errno_t sudosrv_get_sudorules_from_cache(TALLOC_CTX *mem_ctx,

                                             cmd_ctx->domain, attrs, flags,

                                             cmd_ctx->orig_username,

                                             cmd_ctx->uid, groupnames,

+                                            cmd_ctx->sudo_ctx->inverse_order,

                                             &rules, &num_rules);

     if (ret != EOK) {

         DEBUG(SSSDBG_CRIT_FAILURE,

@@ -622,7 +625,7 @@ done:

 }

 static errno_t

-sort_sudo_rules(struct sysdb_attrs **rules, size_t count);

+sort_sudo_rules(struct sysdb_attrs **rules, size_t count, bool higher_wins);

 static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,

                                                  struct sss_domain_info *domain,

@@ -631,6 +634,7 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,

                                                  const char *username,

                                                  uid_t uid,

                                                  char **groupnames,

+                                                 bool inverse_order,

                                                  struct sysdb_attrs ***_rules,

                                                  uint32_t *_count)

 {

@@ -680,7 +684,7 @@ static errno_t sudosrv_get_sudorules_query_cache(TALLOC_CTX *mem_ctx,

         goto done;

     }

-    ret = sort_sudo_rules(rules, count);

+    ret = sort_sudo_rules(rules, count, inverse_order);

     if (ret != EOK) {

         DEBUG(SSSDBG_OP_FAILURE,

               "Could not sort rules by sudoOrder\n");

@@ -697,7 +701,7 @@ done:

 }

 static int

-sudo_order_cmp_fn(const void *a, const void *b)

+sudo_order_cmp(const void *a, const void *b, bool lower_wins)

 {

     struct sysdb_attrs *r1, *r2;

     uint32_t o1, o2;

@@ -730,19 +734,49 @@ sudo_order_cmp_fn(const void *a, const void *b)

         return 0;

     }

-    if (o1 > o2) {

-        return 1;

-    } else if (o1 < o2) {

-        return -1;

+    if (lower_wins) {

+        /* The lowest value takes priority. Original wrong SSSD behaviour. */

+        if (o1 > o2) {

+            return 1;

+        } else if (o1 < o2) {

+            return -1;

+        }

+    } else {

+        /* The higher value takes priority. Standard LDAP behaviour. */

+        if (o1 < o2) {

+            return 1;

+        } else if (o1 > o2) {

+            return -1;

+        }

     }

     return 0;

 }

+static int

+sudo_order_low_cmp_fn(const void *a, const void *b)

+{

+    return sudo_order_cmp(a, b, true);

+}

+

+static int

+sudo_order_high_cmp_fn(const void *a, const void *b)

+{

+    return sudo_order_cmp(a, b, false);

+}

+

 static errno_t

-sort_sudo_rules(struct sysdb_attrs **rules, size_t count)

+sort_sudo_rules(struct sysdb_attrs **rules, size_t count, bool lower_wins)

 {

-    qsort(rules, count, sizeof(struct sysdb_attrs *),

-          sudo_order_cmp_fn);

+    if (lower_wins) {

+        DEBUG(SSSDBG_TRACE_FUNC, "Sorting rules with lower-wins logic\n");

+        qsort(rules, count, sizeof(struct sysdb_attrs *),

+              sudo_order_low_cmp_fn);

+    } else {

+        DEBUG(SSSDBG_TRACE_FUNC, "Sorting rules with higher-wins logic\n");

+        qsort(rules, count, sizeof(struct sysdb_attrs *),

+              sudo_order_high_cmp_fn);

+    }

+

     return EOK;

 }

diff --git a/src/responder/sudo/sudosrv_private.h b/src/responder/sudo/sudosrv_private.h

index 3c53755f9e8ec56f3dea52021d14b50f715a54e7..186ed2cb5114d00524b41b801b5f32bac50f7153 100644

--- a/src/responder/sudo/sudosrv_private.h

+++ b/src/responder/sudo/sudosrv_private.h

@@ -50,6 +50,7 @@ struct sudo_ctx {

      * options

      */

     bool timed;

+    bool inverse_order;

 };

 struct sudo_cmd_ctx {

-- 

2.4.3