From 29e8577ae1d7252513883941cae1c576f30c2d75 Mon Sep 17 00:00:00 2001

From: Matej Habrnal <mhabrnal@redhat.com>

Date: Tue, 22 Mar 2016 12:35:55 +0100

Subject: [PATCH] ccpp: add AllowedUsers and AllowedGroups feature

The feature allows dump core only for allowed users.

The logic is the following:

 - if both options are not-defined or empty keep all core dumps

 - else if crashed UID is in the list of users keep the core dump

 - else if crashed UID belongs to a group in the list of groups keep the core dump

Related to rhbz#1277849

Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>

---

 doc/abrt-CCpp.conf.txt     | 10 ++++++++

 src/hooks/CCpp.conf        |  7 ++++++

 src/hooks/abrt-hook-ccpp.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++

 3 files changed, 80 insertions(+)

diff --git a/doc/abrt-CCpp.conf.txt b/doc/abrt-CCpp.conf.txt

index 4db4b54..dffa45d 100644

--- a/doc/abrt-CCpp.conf.txt

+++ b/doc/abrt-CCpp.conf.txt

@@ -43,6 +43,16 @@ IgnoredPaths = /path/to/ignore/*, */another/ignored/path* ...::

    ABRT will ignore crashes in executables whose absolute path matches one of

    specified patterns.

+AllowedUsers = root, ...::

+   ABRT will process only crashes of either allowed users 'AllowedUsers' or

+   users who are members of allowed group 'AllowedGroups'. If no allowed users

+   nor allowed group are specified ABRT will process crashes of all users.

+

+AllowedGroups = root, ...::

+   ABRT will process only crashes of either allowed users 'AllowedUsers' or

+   users who are members of allowed group 'AllowedGroups'. If no allowed users

+   nor allowed group are specified ABRT will process crashes of all users.

+

 VerboseLog = NUM::

    Used to make the hook more verbose

diff --git a/src/hooks/CCpp.conf b/src/hooks/CCpp.conf

index be55e05..af31ed5 100644

--- a/src/hooks/CCpp.conf

+++ b/src/hooks/CCpp.conf

@@ -37,3 +37,10 @@ SaveFullCore = yes

 # specified patterns.

 #

 #IgnoredPaths =

+

+# ABRT will process only crashes of either allowed users or users who are

+# members of allowed group. If no allowed users nor allowed group are specified

+# ABRT will process crashes of all users.

+#

+#AllowedUsers =

+#AllowedGroups =

diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c

index 18cd608..c9fbf68 100644

--- a/src/hooks/abrt-hook-ccpp.c

+++ b/src/hooks/abrt-hook-ccpp.c

@@ -645,6 +645,44 @@ static bool is_path_ignored(const GList *list, const char *path)

     return false;

 }

+static bool is_user_allowed(uid_t uid, const GList *list)

+{

+    const GList *li;

+    for (li = list; li != NULL; li = g_list_next(li))

+    {

+        const char *username = (const char*)li->data;

+        struct passwd *pw = getpwnam(username);

+        if (pw == NULL)

+        {

+            log_warning("can't get uid of user '%s' (listed in 'AllowedUsers')", username);

+            continue;

+        }

+

+        if(pw->pw_uid == uid)

+            return true;

+    }

+    return false;

+}

+

+static bool is_user_in_allowed_group(uid_t uid, const GList *list)

+{

+    const GList *li;

+    for (li = list; li != NULL; li = g_list_next(li))

+    {

+        const char *groupname = (const char*)li->data;

+        struct group *gr = getgrnam(groupname);

+        if (gr == NULL)

+        {

+            log_warning("can't get gid of group '%s' (listed in 'AllowedGroups')", groupname);

+            continue;

+        }

+

+        if(uid_in_group(uid, gr->gr_gid))

+            return true;

+    }

+    return false;

+}

+

 static int test_configuration(bool setting_SaveFullCore, bool setting_CreateCoreBacktrace)

 {

     if (!setting_SaveFullCore && !setting_CreateCoreBacktrace)

@@ -701,6 +739,8 @@ int main(int argc, char** argv)

     bool setting_SaveFullCore;

     bool setting_CreateCoreBacktrace;

     GList *setting_ignored_paths = NULL;

+    GList *setting_allowed_users = NULL;

+    GList *setting_allowed_groups = NULL;

     {

         map_string_t *settings = new_map_string();

         load_abrt_plugin_conf_file("CCpp.conf", settings);

@@ -716,6 +756,13 @@ int main(int argc, char** argv)

         if (value)

             setting_ignored_paths = parse_list(value);

+        value = get_map_string_item_or_NULL(settings, "AllowedUsers");

+        if (value)

+            setting_allowed_users = parse_list(value);

+        value = get_map_string_item_or_NULL(settings, "AllowedGroups");

+        if (value)

+            setting_allowed_groups = parse_list(value);

+

         setting_CreateCoreBacktrace = value ? string_to_bool(value) : true;

         value = get_map_string_item_or_NULL(settings, "VerboseLog");

         if (value)

@@ -803,6 +850,22 @@ int main(int argc, char** argv)

         return 0;

     }

+    /* dumping core for user, if allowed */

+    if (setting_allowed_users || setting_allowed_groups)

+    {

+        if (setting_allowed_users && is_user_allowed(uid, setting_allowed_users))

+            log_debug("User %lu is listed in 'AllowedUsers'", (long unsigned)uid);

+        else if (setting_allowed_groups && is_user_in_allowed_group(uid, setting_allowed_groups))

+            log_debug("User %lu is member of group listed in 'AllowedGroups'", (long unsigned)uid);

+        else

+        {

+            error_msg_not_process_crash(pid_str, last_slash + 1, (long unsigned)uid, signal_no,

+                signame, "ignoring (not allowed in 'AllowedUsers' nor 'AllowedGroups')");

+

+            xfunc_die();

+        }

+    }

+

     user_pwd = get_cwd(pid);

     log_notice("user_pwd:'%s'", user_pwd);

-- 

1.8.3.1