Make sure standard file descriptors are open before starting properly.

[become] / src / rule.c

/* -*-c-*-
 *
 * $Id: rule.c,v 1.7 2003/10/12 00:14:55 mdw Exp $
 *
 * Managing rule sets
 *
 * (c) 1998 EBI
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: rule.c,v $
 * Revision 1.7  2003/10/12 00:14:55  mdw
 * Major overhaul.  Now uses DSA signatures rather than the bogus symmetric
 * encrypt-and-hope thing.  Integrated with mLib and Catacomb.
 *
 * Revision 1.6  1998/04/23 13:27:31  mdw
 * Export structure of the rule list, for `bcquery's benefit.
 *
 * Revision 1.5  1998/01/12 16:46:25  mdw
 * Fix copyright date.
 *
 * Revision 1.4  1997/09/17  10:27:17  mdw
 * Use rewritten class handler.
 *
 * Revision 1.3  1997/08/20  16:22:36  mdw
 * Rename `rule_reinit' to `rule_end' for more sensible restart.  Don't try
 * to trace when tracing's turned off.
 *
 * Revision 1.2  1997/08/04 10:24:25  mdw
 * Sources placed under CVS control.
 *
 * Revision 1.1  1997/07/21  13:47:45  mdw
 * Initial revision
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* --- Unix headers --- */

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <unistd.h>

/* --- mLib headers --- */

#include <mLib/alloc.h>
#include <mLib/report.h>
#include <mLib/trace.h>

/* --- Local headers --- */

#include "become.h"
#include "class.h"
#include "rule.h"
#include "userdb.h"

/*----- Static variables --------------------------------------------------*/

static rule *rule__list;		/* List of rules */
static rule *rule__tail;		/* Pointer to last rule item */

/*----- Main code ---------------------------------------------------------*/

/* --- @rule_init@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Intialises the rule database.
 */

void rule_init(void)
{
  rule__list = 0;
  rule__tail = (rule *)&rule__list;
}

/* --- @rule_end@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Empties the rule database.
 */

void rule_end(void)
{
  rule *r = rule__list;
  rule *rr;

  while (r) {
    rr = r->next;
    class_dec(r->host);
    class_dec(r->from);
    class_dec(r->to);
    class_dec(r->cmd);
    free(r);
    r = rr;
  }
}

/* --- @rule_list@ --- *
 *
 * Arguments:	---
 *
 * Returns:	The list of rules.
 *
 * Use:		Returns the address of the first node in the rule list.
 */

rule *rule_list(void)
{
  return (rule__list);
}

/* --- @rule_add@ --- *
 *
 * Arguments:	@class_node *host@ = class of hosts this rule applies to
 *		@class_node *from@ = class of users allowed to change
 *		@class_node *to@ = class of users allowed to be changed to
 *		@class_node *cmd@ = class of commands allowed
 *
 * Returns:	---
 *
 * Use:		Registers another rule.
 */

void rule_add(class_node *host, class_node *from,
	      class_node *to, class_node *cmd)
{
  rule *r = xmalloc(sizeof(*r));

  r->host = host;
  r->from = from;
  r->to = to;
  r->cmd = cmd;
  r->next = 0;
  rule__tail->next = r;
  rule__tail = r;
}

/* --- @rule_check@ --- *
 *
 * Arguments:	@request *r@ = pointer to a request block
 *
 * Returns:	Zero if disallowed, nonzero if allowed.
 *
 * Use:		Checks a request to see if it's allowed.
 */

int rule_check(request *r)
{
  rule *rr;

  /* --- Trace out the request we're checking --- */

  IF_TRACING(TRACE_CHECK, {
    struct passwd *pw_from = userdb_userById(r->from);
    struct passwd *pw_to = userdb_userById(r->to);
    struct hostent *h = gethostbyaddr((char *)&r->host, sizeof(r->host),
				      AF_INET);

    trace(TRACE_CHECK, "check: request from %s (%li) to become %s (%li)",
	  pw_from ? pw_from->pw_name : "<unknown>", (long)r->from,
	  pw_to ? pw_to->pw_name : "<unknown>", (long)r->to);
    trace(TRACE_CHECK, "check: ... at %s (%s) for `%s'",
	  h ? h->h_name : "<unknown>", inet_ntoa(r->host), r->cmd);
  })

  /* --- Search the rule list --- */

  for (rr = rule__list; rr; rr = rr->next) {

    /* --- Trace out the rule --- */

    IF_TRACING(TRACE_RULE, {
      trace(TRACE_RULE, "rule: check against rule...");
      trace(TRACE_RULE, "rule:   from"); class_dump(rr->from, 2);
      trace(TRACE_RULE, "rule:   to"); class_dump(rr->to, 2);
      trace(TRACE_RULE, "rule:   cmd"); class_dump(rr->cmd, 2);
      trace(TRACE_RULE, "rule:   host"); class_dump(rr->host, 2);
    })

    /* --- Check the rule --- */

    if (class_matchUser(rr->from, r->from) &&
	class_matchUser(rr->to, r->to) &&
	class_matchCommand(rr->cmd, r->cmd) &&
	class_matchHost(rr->host, r->host)) {
      T( trace(TRACE_CHECK, "check: rule matched -- granting permission"); )
      return (1);
    }
  }

  /* --- Failed to match --- */

  T( trace(TRACE_CHECK, "check: no rules matched -- permission denied"); )
  return (0);
}

/* --- @rule_dump@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Dumps a map of the current ruleset to the trace output.
 */

void rule_dump(void)
{
#ifdef TRACING
  rule *rr = rule__list;

  trace(TRACE_RULE, "rule: dumping rules");
  while (rr) {
    trace(TRACE_RULE, "rule: rule dump...");
    trace(TRACE_RULE, "rule:   from"); class_dump(rr->from, 2);
    trace(TRACE_RULE, "rule:   to"); class_dump(rr->to, 2);
    trace(TRACE_RULE, "rule:   cmd"); class_dump(rr->cmd, 2);
    trace(TRACE_RULE, "rule:   host"); class_dump(rr->host, 2);
    rr = rr->next;
  }
  trace(TRACE_RULE, "rule: dump finished");
#endif
}

/*----- That's all, folks -------------------------------------------------*/