rpms/sssd
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1aff49b48c
sssd/0007-UTIL-Add-session-recording-conf-management-module.patch
Lukas Slebodnik fa4807ec45 Backport few upstream patches/fixes
2017-09-01 21:34:35 +02:00

237 lines
8.4 KiB
Diff
Raw Blame History

From 99b96048b79b0228c3f7c431ea12010f7bd5b362 Mon Sep 17 00:00:00 2001
From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Date: Fri, 17 Mar 2017 12:41:02 +0200
Subject: [PATCH 07/93] UTIL: Add session recording conf management module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add an util module for loading session recording configuration.
To be used by responders and data provider.
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
Makefile.am | 1 +
src/util/session_recording.c | 113 +++++++++++++++++++++++++++++++++++++++++++
src/util/session_recording.h | 76 +++++++++++++++++++++++++++++
3 files changed, 190 insertions(+)
create mode 100644 src/util/session_recording.c
create mode 100644 src/util/session_recording.h
diff --git a/Makefile.am b/Makefile.am
index 7f6c47c5b77f0a7348045565284525233a17e58a..e57d40fb7b1f6fa8fd2662864bcc231e5015e9d7 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -653,6 +653,7 @@ dist_noinst_HEADERS = \
src/util/io.h \
src/util/util_errors.h \
src/util/safe-format-string.h \
+ src/util/session_recording.h \
src/util/strtonum.h \
src/util/sss_cli_cmd.h \
src/util/sss_ptr_hash.h \
diff --git a/src/util/session_recording.c b/src/util/session_recording.c
new file mode 100644
index 0000000000000000000000000000000000000000..fa480c47881ba934ab01fa9acaa67ac3892ec51a
--- /dev/null
+++ b/src/util/session_recording.c
@@ -0,0 +1,113 @@
+/*
+ SSSD
+
+ Session recording utilities
+
+ Authors:
+ Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
+
+ Copyright (C) 2017 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "util/session_recording.h"
+#include "util/debug.h"
+#include <string.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+errno_t session_recording_conf_load(TALLOC_CTX *mem_ctx,
+ struct confdb_ctx *cdb,
+ struct session_recording_conf *pconf)
+{
+ int ret;
+ char *str;
+ struct stat s;
+
+ if (cdb == NULL || pconf == NULL) {
+ ret = EINVAL;
+ goto done;
+ }
+
+ /* Read session_recording/scope option */
+ ret = confdb_get_string(cdb, mem_ctx, CONFDB_SESSION_RECORDING_CONF_ENTRY,
+ CONFDB_SESSION_RECORDING_SCOPE, "none", &str);
+ if (ret != EOK) goto done;
+ if (strcasecmp(str, "none") == 0) {
+ pconf->scope = SESSION_RECORDING_SCOPE_NONE;
+ } else if (strcasecmp(str, "some") == 0) {
+ pconf->scope = SESSION_RECORDING_SCOPE_SOME;
+ } else if (strcasecmp(str, "all") == 0) {
+ pconf->scope = SESSION_RECORDING_SCOPE_ALL;
+ } else {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Unknown value for session recording scope: %s\n",
+ str);
+ ret = EINVAL;
+ goto done;
+ }
+
+ /* If session recording is enabled at all */
+ if (pconf->scope != SESSION_RECORDING_SCOPE_NONE) {
+ /* Check that the shell exists and is executable */
+ ret = stat(SESSION_RECORDING_SHELL, &s);
+ if (ret != 0) {
+ switch (errno) {
+ case ENOENT:
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Session recording shell \"%s\" not found\n",
+ SESSION_RECORDING_SHELL);
+ ret = EINVAL;
+ goto done;
+ case EOK:
+ if ((s.st_mode & 0111) != 0111) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Session recording shell \"%s\" is not executable\n",
+ SESSION_RECORDING_SHELL);
+ ret = EINVAL;
+ goto done;
+ }
+ break;
+ default:
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Failed checking for session recording shell "
+ "\"%s\": %s\n",
+ SESSION_RECORDING_SHELL, strerror(errno));
+ ret = EINVAL;
+ goto done;
+ }
+ }
+ }
+
+ /* Read session_recording/users option */
+ ret = confdb_get_string_as_list(cdb, mem_ctx,
+ CONFDB_SESSION_RECORDING_CONF_ENTRY,
+ CONFDB_SESSION_RECORDING_USERS,
+ &pconf->users);
+ if (ret != EOK && ret != ENOENT) goto done;
+
+ /* Read session_recording/groups option */
+ ret = confdb_get_string_as_list(cdb, mem_ctx,
+ CONFDB_SESSION_RECORDING_CONF_ENTRY,
+ CONFDB_SESSION_RECORDING_GROUPS,
+ &pconf->groups);
+ if (ret != EOK && ret != ENOENT) goto done;
+
+ ret = EOK;
+done:
+ return ret;
+}
diff --git a/src/util/session_recording.h b/src/util/session_recording.h
new file mode 100644
index 0000000000000000000000000000000000000000..69fb1a8bc48743ef135d8ee0f64ee758f246f9aa
--- /dev/null
+++ b/src/util/session_recording.h
@@ -0,0 +1,76 @@
+/*
+ SSSD
+
+ Session recording utilities
+
+ Authors:
+ Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
+
+ Copyright (C) 2017 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __SESSION_RECORDING_H__
+#define __SESSION_RECORDING_H__
+
+#include "confdb/confdb.h"
+#include "util/util_errors.h"
+
+/** Scope of users/groups whose session should be recorded */
+enum session_recording_scope {
+ SESSION_RECORDING_SCOPE_NONE, /**< None, no users/groups */
+ SESSION_RECORDING_SCOPE_SOME, /**< Some users/groups specified elsewhere */
+ SESSION_RECORDING_SCOPE_ALL /**< All users/groups */
+};
+
+/** Session recording configuration (from "session_recording" section) */
+struct session_recording_conf {
+ /**
+ * Session recording scope:
+ * whether to record nobody, everyone, or some users/groups
+ */
+ enum session_recording_scope scope;
+ /**
+ * NULL-terminated list of users whose session should be recorded.
+ * Can be NULL, meaning empty list. Only applicable if scope is "some".
+ */
+ char **users;
+ /**
+ * NULL-terminated list of groups, members of which should have their
+ * sessions recorded. Can be NULL, meaning empty list. Only applicable if
+ * scope is "some"
+ */
+ char **groups;
+};
+
+/**
+ * Load session recording configuration from configuration database.
+ *
+ * @param mem_ctx Memory context to allocate data with.
+ * @param cdb The configuration database connection object to retrieve
+ * data from.
+ * @param pconf Location for the loaded session recording configuration.
+ *
+ * @return Status code:
+ * ENOMEM - memory allocation failed,
+ * EINVAL - configuration was invalid,
+ * EIO - an I/O error occurred while communicating with the ConfDB.
+ */
+extern errno_t session_recording_conf_load(
+ TALLOC_CTX *mem_ctx,
+ struct confdb_ctx *cdb,
+ struct session_recording_conf *pconf);
+
+#endif /* __SESSION_RECORDING_H__ */
--
2.14.1
Reference in New Issue View Git Blame Copy Permalink