137 lines
4.4 KiB
Diff
137 lines
4.4 KiB
Diff
From 46c483c09b85cecf8d1cc72618da993d8948c894 Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Mon, 15 Oct 2018 20:05:09 +0200
|
|
Subject: [PATCH 82/83] files: add session recording flag
|
|
|
|
If session recording is configured for a group the NSS ans PAM
|
|
responder rely on a attribute in the cache set by the backend to
|
|
determine is session recording is configured for the user or not. This
|
|
flag is typically set during the initgroups request.
|
|
|
|
Since the files provider does not have a dedicated initgroups request
|
|
the attribute must be set otherwise. This patch sets is for all users
|
|
after the files are reloaded.
|
|
|
|
Related to https://pagure.io/SSSD/sssd/issue/3855
|
|
|
|
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
---
|
|
src/providers/data_provider/dp_iface.h | 3 ++
|
|
src/providers/data_provider/dp_target_id.c | 62 ++++++++++++++++++++++++++++++
|
|
src/providers/files/files_ops.c | 7 ++++
|
|
3 files changed, 72 insertions(+)
|
|
|
|
diff --git a/src/providers/data_provider/dp_iface.h b/src/providers/data_provider/dp_iface.h
|
|
index d1382cd..8635ae0 100644
|
|
--- a/src/providers/data_provider/dp_iface.h
|
|
+++ b/src/providers/data_provider/dp_iface.h
|
|
@@ -188,4 +188,7 @@ errno_t
|
|
dp_access_control_refresh_rules_recv(TALLOC_CTX *mem_ctx,
|
|
struct tevent_req *req);
|
|
|
|
+
|
|
+errno_t
|
|
+dp_add_sr_attribute(struct be_ctx *be_ctx);
|
|
#endif /* DP_IFACE_H_ */
|
|
diff --git a/src/providers/data_provider/dp_target_id.c b/src/providers/data_provider/dp_target_id.c
|
|
index 265788b..748d886 100644
|
|
--- a/src/providers/data_provider/dp_target_id.c
|
|
+++ b/src/providers/data_provider/dp_target_id.c
|
|
@@ -328,6 +328,68 @@ done:
|
|
talloc_free(tmp_ctx);
|
|
}
|
|
|
|
+errno_t dp_add_sr_attribute(struct be_ctx *be_ctx)
|
|
+{
|
|
+ int ret;
|
|
+ struct dp_initgr_ctx *dp_initgr_ctx = NULL;
|
|
+ TALLOC_CTX *tmp_ctx = NULL;
|
|
+ struct dp_id_data *data;
|
|
+ size_t msgs_count;
|
|
+ struct ldb_message **msgs = NULL;
|
|
+ const char *attrs[] = {SYSDB_NAME, NULL};
|
|
+ size_t c;
|
|
+
|
|
+ tmp_ctx = talloc_new(NULL);
|
|
+ if (tmp_ctx == NULL) {
|
|
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
|
|
+ return ENOMEM;
|
|
+ }
|
|
+
|
|
+ ret = sysdb_search_users(tmp_ctx, be_ctx->domain, "("SYSDB_NAME "=*)", attrs,
|
|
+ &msgs_count, &msgs);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_users failed.\n");
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
+ data = talloc_zero(tmp_ctx, struct dp_id_data);
|
|
+ if (data == NULL) {
|
|
+ ret = ENOMEM;
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
+ data->entry_type = BE_REQ_INITGROUPS;
|
|
+ data->filter_type = BE_FILTER_NAME;
|
|
+ data->filter_value = NULL;
|
|
+ data->extra_value = NULL;
|
|
+ data->domain = be_ctx->domain->name;
|
|
+
|
|
+ for (c = 0; c < msgs_count; c++) {
|
|
+ data->filter_value = ldb_msg_find_attr_as_string(msgs[c], SYSDB_NAME,
|
|
+ NULL);
|
|
+ if (data->filter_value == NULL) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
+ "Cache object [%s] does not have a name, skipping.\n",
|
|
+ ldb_dn_get_linearized(msgs[c]->dn));
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ talloc_free(dp_initgr_ctx);
|
|
+ ret = dp_create_initgroups_ctx(tmp_ctx, be_ctx, data, &dp_initgr_ctx);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_OP_FAILURE, "dp_create_initgroups_ctx failed.\n");
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
+ dp_req_initgr_pp_sr_overlay(be_ctx->provider, dp_initgr_ctx);
|
|
+ }
|
|
+
|
|
+done:
|
|
+ talloc_free(tmp_ctx);
|
|
+
|
|
+ return ret;
|
|
+}
|
|
+
|
|
static errno_t set_initgroups_expire_attribute(struct sss_domain_info *domain,
|
|
const char *name)
|
|
{
|
|
diff --git a/src/providers/files/files_ops.c b/src/providers/files/files_ops.c
|
|
index f5a4029..74f77b5 100644
|
|
--- a/src/providers/files/files_ops.c
|
|
+++ b/src/providers/files/files_ops.c
|
|
@@ -26,6 +26,7 @@
|
|
#include "db/sysdb.h"
|
|
#include "util/inotify.h"
|
|
#include "util/util.h"
|
|
+#include "providers/data_provider/dp_iface.h"
|
|
|
|
/* When changing this constant, make sure to also adjust the files integration
|
|
* test for reallocation branch
|
|
@@ -771,6 +772,12 @@ static errno_t sf_enum_files(struct files_id_ctx *id_ctx,
|
|
}
|
|
}
|
|
|
|
+ ret = dp_add_sr_attribute(id_ctx->be);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
+ "Failed to add session recording attribute, ignored.\n");
|
|
+ }
|
|
+
|
|
ret = sysdb_transaction_commit(id_ctx->domain->sysdb);
|
|
if (ret != EOK) {
|
|
goto done;
|
|
--
|
|
2.9.5
|
|
|