[become] / src / rule.c

/* -*-c-*-
 *
 * $Id: rule.c,v 1.2 1997/08/04 10:24:25 mdw Exp $
 *
 * Managing rule sets
 *
 * (c) 1997 EBI
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: rule.c,v $
 * Revision 1.2  1997/08/04 10:24:25  mdw
 * Sources placed under CVS control.
 *
 * Revision 1.1  1997/07/21  13:47:45  mdw
 * Initial revision
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* --- Unix headers --- */

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <unistd.h>

/* --- Local headers --- */

#include "become.h"
#include "class.h"
#include "rule.h"
#include "userdb.h"
#include "utils.h"

/*----- Type definitions --------------------------------------------------*/

/* --- Rule block --- */

typedef struct rule {
  struct rule *next;                    /* Next rule in the list */
  classdef *host;                       /* Hosts this rule applies to */
  classdef *from;                       /* From users in this class */
  classdef *to;                         /* To users in this class */
  classdef *cmd;                        /* To run commands in this class */
} rule;

/*----- Static variables --------------------------------------------------*/

static rule *rule__list;                /* List of rules */
static rule *rule__tail;                /* Pointer to last rule item */

/*----- Main code ---------------------------------------------------------*/

/* --- @rule_init@ --- *
 *
 * Arguments:   ---
 *
 * Returns:     ---
 *
 * Use:         Intialises the rule database.
 */

void rule_init(void)
{
  rule__list = 0;
  rule__tail = (rule *)&rule__list;
}

/* --- @rule_reinit@ --- *
 *
 * Arguments:   ---
 *
 * Returns:     ---
 *
 * Use:         Reinitialises the rule database.
 */

void rule_reinit(void)
{
  rule *r = rule__list;
  rule *rr;

  while (r) {
    rr = r->next;
    free(r);
    r = rr;
  }

  rule_init();
}

/* --- @rule_add@ --- *
 *
 * Arguments:   @classdef *host@ = class of hosts this rule applies to
 *              @classdef *from@ = class of users allowed to change
 *              @classdef *to@ = class of users allowed to be changed to
 *              @classdef *cmd@ = class of commands allowed
 *
 * Returns:     ---
 *
 * Use:         Registers another rule.
 */

void rule_add(classdef *host, classdef *from, classdef *to, classdef *cmd)
{
  rule *r = xmalloc(sizeof(*r));

  r->host = host;
  r->from = from;
  r->to = to;
  r->cmd = cmd;
  r->next = 0;
  rule__tail->next = r;
  rule__tail = r;
}

/* --- @rule_check@ --- *
 *
 * Arguments:   @request *r@ = pointer to a request block
 *
 * Returns:     Zero if disallowed, nonzero if allowed.
 *
 * Use:         Checks a request to see if it's allowed.
 */

int rule_check(request *r)
{
  rule *rr;

  /* --- Trace out the request we're checking --- */

  IF_TRACING(TRACE_CHECK, {
    struct passwd *pw_from = userdb_userById(r->from);
    struct passwd *pw_to = userdb_userById(r->to);
    struct hostent *h = gethostbyaddr((char *)&r->host, sizeof(r->host),
                                      AF_INET);

    trace(TRACE_CHECK, "check: request from %s (%li) to become %s (%li)",
          pw_from ? pw_from->pw_name : "<unknown>", (long)r->from,
          pw_to ? pw_to->pw_name : "<unknown>", (long)r->to);
    trace(TRACE_CHECK, "check: ... at %s (%s) for `%s'",
          h ? h->h_name : "<unknown>", inet_ntoa(r->host), r->cmd);
  })

  /* --- Search the rule list --- */

  for (rr = rule__list; rr; rr = rr->next) {

    /* --- Trace out the rule --- */

    IF_TRACING(TRACE_RULE, {
      trace(TRACE_RULE, "rule: check against rule...");
      trace(TRACE_RULE, "  from"); class_dump(rr->from);
      trace(TRACE_RULE, "  to"); class_dump(rr->to);
      trace(TRACE_RULE, "  cmd"); class_dump(rr->cmd);
      trace(TRACE_RULE, "  host"); class_dump(rr->host);
    })

    /* --- Check the rule --- */

    if (class_userMatch(rr->from, r->from) &&
        class_userMatch(rr->to, r->to) &&
        class_commandMatch(rr->cmd, r->cmd) &&
        class_hostMatch(rr->host, r->host)) {
      T( trace(TRACE_CHECK, "check: rule matched -- granting permission"); )
      return (1);
    }
  }

  /* --- Failed to match --- */

  T( trace(TRACE_CHECK, "check: no rules matched -- permission denied"); )
  return (0);
}

/* --- @rule_dump@ --- *
 *
 * Arguments:   ---
 *
 * Returns:     ---
 *
 * Use:         Dumps a map of the current ruleset to the trace output.
 */

void rule_dump(void)
{
  rule *rr = rule__list;

  trace(TRACE_RULE, "rule: dumping rules");
  while (rr) {
    trace(TRACE_RULE, "rule dump...");
    trace(TRACE_RULE, "  from"); class_dump(rr->from);
    trace(TRACE_RULE, "  to"); class_dump(rr->to);
    trace(TRACE_RULE, "  cmd"); class_dump(rr->cmd);
    trace(TRACE_RULE, "  host"); class_dump(rr->host);
    rr = rr->next;
  }
  trace(TRACE_RULE, "rule: dump finished");
}

/*----- That's all, folks -------------------------------------------------*/