3 * $Id: rule.c,v 1.5 1998/01/12 16:46:25 mdw Exp $
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of `become'
14 * `Become' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `Become' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `become'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
32 * Revision 1.5 1998/01/12 16:46:25 mdw
35 * Revision 1.4 1997/09/17 10:27:17 mdw
36 * Use rewritten class handler.
38 * Revision 1.3 1997/08/20 16:22:36 mdw
39 * Rename `rule_reinit' to `rule_end' for more sensible restart. Don't try
40 * to trace when tracing's turned off.
42 * Revision 1.2 1997/08/04 10:24:25 mdw
43 * Sources placed under CVS control.
45 * Revision 1.1 1997/07/21 13:47:45 mdw
50 /*----- Header files ------------------------------------------------------*/
52 /* --- ANSI headers --- */
58 /* --- Unix headers --- */
60 #include <sys/types.h>
61 #include <sys/socket.h>
62 #include <netinet/in.h>
63 #include <arpa/inet.h>
67 /* --- Local headers --- */
75 /*----- Type definitions --------------------------------------------------*/
77 /* --- Rule block --- */
80 struct rule
*next
; /* Next rule in the list */
81 class_node
*host
; /* Hosts this rule applies to */
82 class_node
*from
; /* From users in this class */
83 class_node
*to
; /* To users in this class */
84 class_node
*cmd
; /* To run commands in this class */
87 /*----- Static variables --------------------------------------------------*/
89 static rule
*rule__list
; /* List of rules */
90 static rule
*rule__tail
; /* Pointer to last rule item */
92 /*----- Main code ---------------------------------------------------------*/
94 /* --- @rule_init@ --- *
100 * Use: Intialises the rule database.
106 rule__tail
= (rule
*)&rule__list
;
109 /* --- @rule_end@ --- *
115 * Use: Empties the rule database.
120 rule
*r
= rule__list
;
134 /* --- @rule_add@ --- *
136 * Arguments: @class_node *host@ = class of hosts this rule applies to
137 * @class_node *from@ = class of users allowed to change
138 * @class_node *to@ = class of users allowed to be changed to
139 * @class_node *cmd@ = class of commands allowed
143 * Use: Registers another rule.
146 void rule_add(class_node
*host
, class_node
*from
, class_node
*to
, class_node
*cmd
)
148 rule
*r
= xmalloc(sizeof(*r
));
155 rule__tail
->next
= r
;
159 /* --- @rule_check@ --- *
161 * Arguments: @request *r@ = pointer to a request block
163 * Returns: Zero if disallowed, nonzero if allowed.
165 * Use: Checks a request to see if it's allowed.
168 int rule_check(request
*r
)
172 /* --- Trace out the request we're checking --- */
174 IF_TRACING(TRACE_CHECK
, {
175 struct passwd
*pw_from
= userdb_userById(r
->from
);
176 struct passwd
*pw_to
= userdb_userById(r
->to
);
177 struct hostent
*h
= gethostbyaddr((char *)&r
->host
, sizeof(r
->host
),
180 trace(TRACE_CHECK
, "check: request from %s (%li) to become %s (%li)",
181 pw_from ? pw_from
->pw_name
: "<unknown>", (long)r
->from
,
182 pw_to ? pw_to
->pw_name
: "<unknown>", (long)r
->to
);
183 trace(TRACE_CHECK
, "check: ... at %s (%s) for `%s'",
184 h ? h
->h_name
: "<unknown>", inet_ntoa(r
->host
), r
->cmd
);
187 /* --- Search the rule list --- */
189 for (rr
= rule__list
; rr
; rr
= rr
->next
) {
191 /* --- Trace out the rule --- */
193 IF_TRACING(TRACE_RULE
, {
194 trace(TRACE_RULE
, "rule: check against rule...");
195 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
196 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
197 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
198 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
201 /* --- Check the rule --- */
203 if (class_matchUser(rr
->from
, r
->from
) &&
204 class_matchUser(rr
->to
, r
->to
) &&
205 class_matchCommand(rr
->cmd
, r
->cmd
) &&
206 class_matchHost(rr
->host
, r
->host
)) {
207 T( trace(TRACE_CHECK
, "check: rule matched -- granting permission"); )
212 /* --- Failed to match --- */
214 T( trace(TRACE_CHECK
, "check: no rules matched -- permission denied"); )
218 /* --- @rule_dump@ --- *
224 * Use: Dumps a map of the current ruleset to the trace output.
230 rule
*rr
= rule__list
;
232 trace(TRACE_RULE
, "rule: dumping rules");
234 trace(TRACE_RULE
, "rule: rule dump...");
235 trace(TRACE_RULE
, "rule: from"); class_dump(rr
->from
, 2);
236 trace(TRACE_RULE
, "rule: to"); class_dump(rr
->to
, 2);
237 trace(TRACE_RULE
, "rule: cmd"); class_dump(rr
->cmd
, 2);
238 trace(TRACE_RULE
, "rule: host"); class_dump(rr
->host
, 2);
241 trace(TRACE_RULE
, "rule: dump finished");
245 /*----- That's all, folks -------------------------------------------------*/