acl.c revision 55682 
1/*
2 * Copyright (c) 1997, 1999 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kadm5_locl.h"
35
36RCSID("$Id: acl.c,v 1.10 1999/12/02 17:05:05 joda Exp $");
37
38static struct units acl_units[] = {
39    { "all",		KADM5_PRIV_ALL },
40    { "change-password",KADM5_PRIV_CPW },
41    { "cpw",		KADM5_PRIV_CPW },
42    { "list",		KADM5_PRIV_LIST },
43    { "delete",		KADM5_PRIV_DELETE },
44    { "modify",		KADM5_PRIV_MODIFY },
45    { "add",		KADM5_PRIV_ADD },
46    { "get", 		KADM5_PRIV_GET },
47    { NULL }
48};
49
50kadm5_ret_t
51_kadm5_string_to_privs(const char *s, u_int32_t* privs)
52{
53    int flags;
54    flags = parse_flags(s, acl_units, 0);
55    if(flags < 0)
56	return KADM5_FAILURE;
57    *privs = flags;
58    return 0;
59}
60
61kadm5_ret_t
62_kadm5_privs_to_string(u_int32_t privs, char *string, size_t len)
63{
64    if(privs == 0)
65	strlcpy(string, "none", len);
66    else
67	unparse_flags(privs, acl_units + 1, string, len);
68    return 0;
69}
70
71kadm5_ret_t
72_kadm5_acl_init(kadm5_server_context *context)
73{
74    FILE *f;
75    char buf[128];
76    krb5_principal princ;
77    int flags;
78    krb5_error_code ret;
79
80    krb5_parse_name(context->context, KADM5_ADMIN_SERVICE, &princ);
81    ret = krb5_principal_compare(context->context, context->caller, princ);
82    krb5_free_principal(context->context, princ);
83    if(ret != 0){
84	context->acl_flags = KADM5_PRIV_ALL;
85	return 0;
86    }
87
88    flags = -1;
89    f = fopen(context->config.acl_file, "r");
90    if(f){
91	while(fgets(buf, sizeof(buf), f)){
92	    char *foo = NULL, *p;
93	    p = strtok_r(buf, " \t\n", &foo);
94	    if(p == NULL)
95		continue;
96	    ret = krb5_parse_name(context->context, p, &princ);
97	    if(ret)
98		continue;
99	    if(!krb5_principal_compare(context->context,
100				       context->caller,  princ)){
101		krb5_free_principal(context->context, princ);
102		continue;
103	    }
104	    krb5_free_principal(context->context, princ);
105	    p = strtok_r(NULL, "\n", &foo);
106	    if(p == NULL)
107		continue;
108	    ret = _kadm5_string_to_privs(p, &flags);
109	    break;
110	}
111	fclose(f);
112    }
113    if(flags == -1)
114	flags = 0;
115    context->acl_flags = flags;
116    return 0;
117}
118
119kadm5_ret_t
120_kadm5_acl_check_permission(kadm5_server_context *context, unsigned op)
121{
122    unsigned res = ~context->acl_flags & op;
123    if(res & KADM5_PRIV_GET)
124	return KADM5_AUTH_GET;
125    if(res & KADM5_PRIV_ADD)
126	return KADM5_AUTH_ADD;
127    if(res & KADM5_PRIV_MODIFY)
128	return KADM5_AUTH_MODIFY;
129    if(res & KADM5_PRIV_DELETE)
130	return KADM5_AUTH_DELETE;
131    if(res & KADM5_PRIV_CPW)
132	return KADM5_AUTH_CHANGEPW;
133    if(res & KADM5_PRIV_LIST)
134	return KADM5_AUTH_LIST;
135    if(res)
136	return KADM5_AUTH_INSUFFICIENT;
137    return 0;
138}
139