166da54466bb60fb36b215e22e3b4cb69abe10d7
3 * $Id: rule.c,v 1.7 2003/10/12 00:14:55 mdw Exp $
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of `become'
14 * `Become' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `Become' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `become'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
32 * Revision 1.7 2003/10/12 00:14:55 mdw
33 * Major overhaul. Now uses DSA signatures rather than the bogus symmetric
34 * encrypt-and-hope thing. Integrated with mLib and Catacomb.
36 * Revision 1.6 1998/04/23 13:27:31 mdw
37 * Export structure of the rule list, for `bcquery's benefit.
39 * Revision 1.5 1998/01/12 16:46:25 mdw
42 * Revision 1.4 1997/09/17 10:27:17 mdw
43 * Use rewritten class handler.
45 * Revision 1.3 1997/08/20 16:22:36 mdw
46 * Rename `rule_reinit' to `rule_end' for more sensible restart. Don't try
47 * to trace when tracing's turned off.
49 * Revision 1.2 1997/08/04 10:24:25 mdw
50 * Sources placed under CVS control.
52 * Revision 1.1 1997/07/21 13:47:45 mdw
57 /*----- Header files ------------------------------------------------------*/
59 /* --- ANSI headers --- */
65 /* --- Unix headers --- */
67 #include <sys/types.h>
68 #include <sys/socket.h>
69 #include <netinet/in.h>
70 #include <arpa/inet.h>
74 /* --- mLib headers --- */
76 #include <mLib/alloc.h>
77 #include <mLib/report.h>
78 #include <mLib/trace.h>
80 /* --- Local headers --- */
87 /*----- Static variables --------------------------------------------------*/
89 static rule
*rule__list
; /* List of rules */
90 static rule
*rule__tail
; /* Pointer to last rule item */
92 /*----- Main code ---------------------------------------------------------*/
94 /* --- @rule_init@ --- *
100 * Use: Intialises the rule database.
106 rule__tail
= (rule
*)&rule__list
;
109 /* --- @rule_end@ --- *
115 * Use: Empties the rule database.
120 rule
*r
= rule__list
;
134 /* --- @rule_list@ --- *
138 * Returns: The list of rules.
140 * Use: Returns the address of the first node in the rule list.
143 rule
*rule_list(void)
148 /* --- @rule_add@ --- *
150 * Arguments: @class_node *host@ = class of hosts this rule applies to
151 * @class_node *from@ = class of users allowed to change
152 * @class_node *to@ = class of users allowed to be changed to
153 * @class_node *cmd@ = class of commands allowed
157 * Use: Registers another rule.
160 void rule_add(class_node
*host
, class_node
*from
,
161 class_node
*to
, class_node
*cmd
)
163 rule
*r
= xmalloc(sizeof(*r
));
170 rule__tail
->next
= r
;
174 /* --- @rule_check@ --- *
176 * Arguments: @request *r@ = pointer to a request block
178 * Returns: Zero if disallowed, nonzero if allowed.
180 * Use: Checks a request to see if it's allowed.
183 int rule_check(request
*r
)
187 /* --- Trace out the request we're checking --- */
189 IF_TRACING(TRACE_CHECK
, {
190 struct passwd
*pw_from
= userdb_userById(r
->from
);
191 struct passwd
*pw_to
= userdb_userById(r
->to
);
192 struct hostent
*h
= gethostbyaddr((char *)&r
->host
, sizeof(r
->host
),
195 trace(TRACE_CHECK
, "check: request from %s (%li) to become %s (%li)",
196 pw_from ? pw_from
->pw_name
: "<unknown>", (long)r
->from
,
197 pw_to ? pw_to
->pw_name
: "<unknown>", (long)r
->to
);
198 trace(TRACE_CHECK
, "check: ... at %s (%s) for `%s'",
199 h ? h
->h_name
: "<unknown>", inet_ntoa(r
->host
), r
->cmd
);
202 /* --- Search the rule list --- */
204 for (rr
= rule__list
; rr
; rr
= rr
->next
) {
206 /* --- Trace out the rule --- */
208 IF_TRACING(TRACE_RULE
, {
209 trace(TRACE_RULE
, "rule: check against rule...");
210 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
211 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
212 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
213 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
216 /* --- Check the rule --- */
218 if (class_matchUser(rr
->from
, r
->from
) &&
219 class_matchUser(rr
->to
, r
->to
) &&
220 class_matchCommand(rr
->cmd
, r
->cmd
) &&
221 class_matchHost(rr
->host
, r
->host
)) {
222 T( trace(TRACE_CHECK
, "check: rule matched -- granting permission"); )
227 /* --- Failed to match --- */
229 T( trace(TRACE_CHECK
, "check: no rules matched -- permission denied"); )
233 /* --- @rule_dump@ --- *
239 * Use: Dumps a map of the current ruleset to the trace output.
245 rule
*rr
= rule__list
;
247 trace(TRACE_RULE
, "rule: dumping rules");
249 trace(TRACE_RULE
, "rule: rule dump...");
250 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
251 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
252 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
253 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
256 trace(TRACE_RULE
, "rule: dump finished");
260 /*----- That's all, folks -------------------------------------------------*/