ipa_hbac
1.16.4
|
00001 /* 00002 SSSD 00003 00004 IPA Backend Module -- Access control 00005 00006 Authors: 00007 Sumit Bose <sbose@redhat.com> 00008 Stephen Gallagher <sgallagh@redhat.com> 00009 00010 Copyright (C) 2009 Red Hat 00011 00012 This program is free software; you can redistribute it and/or modify 00013 it under the terms of the GNU General Public License as published by 00014 the Free Software Foundation; either version 3 of the License, or 00015 (at your option) any later version. 00016 00017 This program is distributed in the hope that it will be useful, 00018 but WITHOUT ANY WARRANTY; without even the implied warranty of 00019 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 00020 GNU General Public License for more details. 00021 00022 You should have received a copy of the GNU General Public License 00023 along with this program. If not, see <http://www.gnu.org/licenses/>. 00024 */ 00025 00026 #ifndef IPA_HBAC_H_ 00027 #define IPA_HBAC_H_ 00028 00040 #include <stdint.h> 00041 #include <stdbool.h> 00042 #include <time.h> 00043 00045 enum hbac_debug_level { 00046 HBAC_DBG_FATAL, 00047 HBAC_DBG_ERROR, 00048 HBAC_DBG_WARNING, 00049 HBAC_DBG_INFO, 00050 HBAC_DBG_TRACE 00051 }; 00052 00053 #ifdef HAVE_FUNCTION_ATTRIBUTE_FORMAT 00054 #define HBAC_ATTRIBUTE_PRINTF(a1, a2) __attribute__((format(printf, a1, a2))) 00055 #else 00056 #define HBAC_ATTRIBUTE_PRINTF(a1, a2) 00057 #endif 00058 00062 typedef void (*hbac_debug_fn_t)(const char *file, int line, 00063 const char *function, 00064 enum hbac_debug_level, const char *format, 00065 ...) HBAC_ATTRIBUTE_PRINTF(5, 6); 00066 00071 void hbac_enable_debug(hbac_debug_fn_t external_debug_fn); 00072 00074 enum hbac_eval_result { 00078 HBAC_EVAL_ERROR = -1, 00079 00081 HBAC_EVAL_ALLOW, 00082 00084 HBAC_EVAL_DENY, 00085 00089 HBAC_EVAL_OOM 00090 }; 00091 00095 #define HBAC_CATEGORY_NULL 0x0000 00096 00100 #define HBAC_CATEGORY_ALL 0x0001 00101 00105 struct hbac_time_rules; 00106 00113 struct hbac_rule_element { 00121 uint32_t category; 00122 00130 const char **names; 00131 00139 const char **groups; 00140 }; 00141 00145 struct hbac_rule { 00146 const char *name; 00147 bool enabled; 00148 00153 struct hbac_rule_element *services; 00154 00159 struct hbac_rule_element *users; 00160 00164 struct hbac_rule_element *targethosts; 00165 00169 struct hbac_rule_element *srchosts; 00170 00174 struct hbac_time_rules *timerules; 00175 }; 00176 00180 struct hbac_request_element { 00188 const char *name; 00189 00197 const char **groups; 00198 }; 00199 00205 struct hbac_eval_req { 00211 struct hbac_request_element *service; 00212 00218 struct hbac_request_element *user; 00219 00225 struct hbac_request_element *targethost; 00226 00232 struct hbac_request_element *srchost; 00233 00235 time_t request_time; 00236 }; 00237 00241 enum hbac_error_code { 00243 HBAC_ERROR_UNKNOWN = -1, 00244 00246 HBAC_SUCCESS, 00247 00249 HBAC_ERROR_NOT_IMPLEMENTED, 00250 00252 HBAC_ERROR_OUT_OF_MEMORY, 00253 00255 HBAC_ERROR_UNPARSEABLE_RULE 00256 }; 00257 00259 struct hbac_info { 00265 enum hbac_error_code code; 00266 00271 char *rule_name; 00272 }; 00273 00274 00288 enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules, 00289 struct hbac_eval_req *hbac_req, 00290 struct hbac_info **info); 00291 00297 const char *hbac_result_string(enum hbac_eval_result result); 00298 00304 const char *hbac_error_string(enum hbac_error_code code); 00305 00310 void hbac_free_info(struct hbac_info *info); 00311 00313 #define HBAC_RULE_ELEMENT_USERS 0x01 00314 00316 #define HBAC_RULE_ELEMENT_SERVICES 0x02 00317 00319 #define HBAC_RULE_ELEMENT_TARGETHOSTS 0x04 00320 00322 #define HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08 00323 00339 bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs); 00340 00344 #endif /* IPA_HBAC_H_ */