3 * $Id: rule.c,v 1.6 1998/04/23 13:27:31 mdw Exp $
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of `become'
14 * `Become' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `Become' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `become'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
32 * Revision 1.6 1998/04/23 13:27:31 mdw
33 * Export structure of the rule list, for `bcquery's benefit.
35 * Revision 1.5 1998/01/12 16:46:25 mdw
38 * Revision 1.4 1997/09/17 10:27:17 mdw
39 * Use rewritten class handler.
41 * Revision 1.3 1997/08/20 16:22:36 mdw
42 * Rename `rule_reinit' to `rule_end' for more sensible restart. Don't try
43 * to trace when tracing's turned off.
45 * Revision 1.2 1997/08/04 10:24:25 mdw
46 * Sources placed under CVS control.
48 * Revision 1.1 1997/07/21 13:47:45 mdw
53 /*----- Header files ------------------------------------------------------*/
55 /* --- ANSI headers --- */
61 /* --- Unix headers --- */
63 #include <sys/types.h>
64 #include <sys/socket.h>
65 #include <netinet/in.h>
66 #include <arpa/inet.h>
70 /* --- Local headers --- */
78 /*----- Static variables --------------------------------------------------*/
80 static rule
*rule__list
; /* List of rules */
81 static rule
*rule__tail
; /* Pointer to last rule item */
83 /*----- Main code ---------------------------------------------------------*/
85 /* --- @rule_init@ --- *
91 * Use: Intialises the rule database.
97 rule__tail
= (rule
*)&rule__list
;
100 /* --- @rule_end@ --- *
106 * Use: Empties the rule database.
111 rule
*r
= rule__list
;
125 /* --- @rule_list@ --- *
129 * Returns: The list of rules.
131 * Use: Returns the address of the first node in the rule list.
134 rule
*rule_list(void)
139 /* --- @rule_add@ --- *
141 * Arguments: @class_node *host@ = class of hosts this rule applies to
142 * @class_node *from@ = class of users allowed to change
143 * @class_node *to@ = class of users allowed to be changed to
144 * @class_node *cmd@ = class of commands allowed
148 * Use: Registers another rule.
151 void rule_add(class_node
*host
, class_node
*from
,
152 class_node
*to
, class_node
*cmd
)
154 rule
*r
= xmalloc(sizeof(*r
));
161 rule__tail
->next
= r
;
165 /* --- @rule_check@ --- *
167 * Arguments: @request *r@ = pointer to a request block
169 * Returns: Zero if disallowed, nonzero if allowed.
171 * Use: Checks a request to see if it's allowed.
174 int rule_check(request
*r
)
178 /* --- Trace out the request we're checking --- */
180 IF_TRACING(TRACE_CHECK
, {
181 struct passwd
*pw_from
= userdb_userById(r
->from
);
182 struct passwd
*pw_to
= userdb_userById(r
->to
);
183 struct hostent
*h
= gethostbyaddr((char *)&r
->host
, sizeof(r
->host
),
186 trace(TRACE_CHECK
, "check: request from %s (%li) to become %s (%li)",
187 pw_from ? pw_from
->pw_name
: "<unknown>", (long)r
->from
,
188 pw_to ? pw_to
->pw_name
: "<unknown>", (long)r
->to
);
189 trace(TRACE_CHECK
, "check: ... at %s (%s) for `%s'",
190 h ? h
->h_name
: "<unknown>", inet_ntoa(r
->host
), r
->cmd
);
193 /* --- Search the rule list --- */
195 for (rr
= rule__list
; rr
; rr
= rr
->next
) {
197 /* --- Trace out the rule --- */
199 IF_TRACING(TRACE_RULE
, {
200 trace(TRACE_RULE
, "rule: check against rule...");
201 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
202 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
203 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
204 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
207 /* --- Check the rule --- */
209 if (class_matchUser(rr
->from
, r
->from
) &&
210 class_matchUser(rr
->to
, r
->to
) &&
211 class_matchCommand(rr
->cmd
, r
->cmd
) &&
212 class_matchHost(rr
->host
, r
->host
)) {
213 T( trace(TRACE_CHECK
, "check: rule matched -- granting permission"); )
218 /* --- Failed to match --- */
220 T( trace(TRACE_CHECK
, "check: no rules matched -- permission denied"); )
224 /* --- @rule_dump@ --- *
230 * Use: Dumps a map of the current ruleset to the trace output.
236 rule
*rr
= rule__list
;
238 trace(TRACE_RULE
, "rule: dumping rules");
240 trace(TRACE_RULE
, "rule: rule dump...");
241 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
242 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
243 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
244 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
247 trace(TRACE_RULE
, "rule: dump finished");
251 /*----- That's all, folks -------------------------------------------------*/