From 21087821ab7942a54168d545ea2f96a6f7582344 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Mon, 15 Oct 2018 20:05:09 +0200

Subject: [PATCH 56/57] files: add session recording flag

If session recording is configured for a group the NSS ans PAM

responder rely on a attribute in the cache set by the backend to

determine is session recording is configured for the user or not. This

flag is typically set during the initgroups request.

Since the files provider does not have a dedicated initgroups request

the attribute must be set otherwise. This patch sets is for all users

after the files are reloaded.

Related to https://pagure.io/SSSD/sssd/issue/3855

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

---

 src/providers/data_provider/dp_iface.h     |  3 ++

 src/providers/data_provider/dp_target_id.c | 62 ++++++++++++++++++++++++++++++

 src/providers/files/files_ops.c            |  7 ++++

 3 files changed, 72 insertions(+)

diff --git a/src/providers/data_provider/dp_iface.h b/src/providers/data_provider/dp_iface.h

index 0b0855da6c62d01d523486fe65e9920578ba58e5..8f6b2076c1adb8ad046a0d03ae5ae8a0600a5707 100644

--- a/src/providers/data_provider/dp_iface.h

+++ b/src/providers/data_provider/dp_iface.h

@@ -188,4 +188,7 @@ errno_t

 dp_access_control_refresh_rules_recv(TALLOC_CTX *mem_ctx,

                                      struct tevent_req *req);

+

+errno_t

+dp_add_sr_attribute(struct be_ctx *be_ctx);

 #endif /* DP_IFACE_H_ */

diff --git a/src/providers/data_provider/dp_target_id.c b/src/providers/data_provider/dp_target_id.c

index 265788be9b032fcdf0f354f9c66a98241aa17916..748d886748f34e6b99c6bfc0f7607e048cbd2425 100644

--- a/src/providers/data_provider/dp_target_id.c

+++ b/src/providers/data_provider/dp_target_id.c

@@ -328,6 +328,68 @@ done:

     talloc_free(tmp_ctx);

 }

+errno_t dp_add_sr_attribute(struct be_ctx *be_ctx)

+{

+    int ret;

+    struct dp_initgr_ctx *dp_initgr_ctx = NULL;

+    TALLOC_CTX *tmp_ctx = NULL;

+    struct dp_id_data *data;

+    size_t msgs_count;

+    struct ldb_message **msgs = NULL;

+    const char *attrs[] = {SYSDB_NAME, NULL};

+    size_t c;

+

+    tmp_ctx = talloc_new(NULL);

+    if (tmp_ctx == NULL) {

+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");

+        return ENOMEM;

+    }

+

+    ret = sysdb_search_users(tmp_ctx, be_ctx->domain, "("SYSDB_NAME "=*)", attrs,

+                            &msgs_count, &msgs);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_users failed.\n");

+        goto done;

+    }

+

+    data = talloc_zero(tmp_ctx, struct dp_id_data);

+    if (data == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    data->entry_type = BE_REQ_INITGROUPS;

+    data->filter_type = BE_FILTER_NAME;

+    data->filter_value = NULL;

+    data->extra_value = NULL;

+    data->domain = be_ctx->domain->name;

+

+    for (c = 0; c < msgs_count; c++) {

+        data->filter_value = ldb_msg_find_attr_as_string(msgs[c], SYSDB_NAME,

+                                                         NULL);

+        if (data->filter_value == NULL) {

+            DEBUG(SSSDBG_CRIT_FAILURE,

+                  "Cache object [%s] does not have a name, skipping.\n",

+                  ldb_dn_get_linearized(msgs[c]->dn));

+            continue;

+        }

+

+        talloc_free(dp_initgr_ctx);

+        ret = dp_create_initgroups_ctx(tmp_ctx, be_ctx, data, &dp_initgr_ctx);

+        if (ret != EOK) {

+            DEBUG(SSSDBG_OP_FAILURE, "dp_create_initgroups_ctx failed.\n");

+            goto done;

+        }

+

+        dp_req_initgr_pp_sr_overlay(be_ctx->provider, dp_initgr_ctx);

+    }

+

+done:

+    talloc_free(tmp_ctx);

+

+    return ret;

+}

+

 static errno_t set_initgroups_expire_attribute(struct sss_domain_info *domain,

                                                const char *name)

 {

diff --git a/src/providers/files/files_ops.c b/src/providers/files/files_ops.c

index f5a40297a7cd1eb4ec66315250556ddaf6cc8cfc..74f77b5395285818d049eaa521b4afd8a9c89dde 100644

--- a/src/providers/files/files_ops.c

+++ b/src/providers/files/files_ops.c

@@ -26,6 +26,7 @@

 #include "db/sysdb.h"

 #include "util/inotify.h"

 #include "util/util.h"

+#include "providers/data_provider/dp_iface.h"

 /* When changing this constant, make sure to also adjust the files integration

  * test for reallocation branch

@@ -771,6 +772,12 @@ static errno_t sf_enum_files(struct files_id_ctx *id_ctx,

         }

     }

+    ret = dp_add_sr_attribute(id_ctx->be);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to add session recording attribute, ignored.\n");

+    }

+

     ret = sysdb_transaction_commit(id_ctx->domain->sysdb);

     if (ret != EOK) {

         goto done;

-- 

2.14.4