ipa_hbac  2.2.3
ipa_hbac.h
1 /*
2  SSSD
3 
4  IPA Backend Module -- Access control
5 
6  Authors:
7  Sumit Bose <sbose@redhat.com>
8  Stephen Gallagher <sgallagh@redhat.com>
9 
10  Copyright (C) 2009 Red Hat
11 
12  This program is free software; you can redistribute it and/or modify
13  it under the terms of the GNU General Public License as published by
14  the Free Software Foundation; either version 3 of the License, or
15  (at your option) any later version.
16 
17  This program is distributed in the hope that it will be useful,
18  but WITHOUT ANY WARRANTY; without even the implied warranty of
19  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20  GNU General Public License for more details.
21 
22  You should have received a copy of the GNU General Public License
23  along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25 
26 #ifndef IPA_HBAC_H_
27 #define IPA_HBAC_H_
28 
40 #include <stdint.h>
41 #include <stdbool.h>
42 #include <time.h>
43 
46  HBAC_DBG_FATAL,
51 };
52 
53 #ifdef HAVE_FUNCTION_ATTRIBUTE_FORMAT
54 #define HBAC_ATTRIBUTE_PRINTF(a1, a2) __attribute__((format(printf, a1, a2)))
55 #else
56 #define HBAC_ATTRIBUTE_PRINTF(a1, a2)
57 #endif
58 
62 typedef void (*hbac_debug_fn_t)(const char *file, int line,
63  const char *function,
64  enum hbac_debug_level, const char *format,
65  ...) HBAC_ATTRIBUTE_PRINTF(5, 6);
66 
71 void hbac_enable_debug(hbac_debug_fn_t external_debug_fn);
72 
79 
82 
85 
90 };
91 
95 #define HBAC_CATEGORY_NULL 0x0000
96 
100 #define HBAC_CATEGORY_ALL 0x0001
101 
105 struct hbac_time_rules;
106 
121  uint32_t category;
122 
130  const char **names;
131 
139  const char **groups;
140 };
141 
145 struct hbac_rule {
146  const char *name;
147  bool enabled;
148 
154 
160 
165 
170 
174  struct hbac_time_rules *timerules;
175 };
176 
188  const char *name;
189 
197  const char **groups;
198 };
199 
212 
219 
226 
233 
235  time_t request_time;
236 };
237 
244 
247 
250 
253 
256 };
257 
259 struct hbac_info {
266 
271  char *rule_name;
272 };
273 
274 
288 enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules,
289  struct hbac_eval_req *hbac_req,
290  struct hbac_info **info);
291 
297 const char *hbac_result_string(enum hbac_eval_result result);
298 
304 const char *hbac_error_string(enum hbac_error_code code);
305 
310 void hbac_free_info(struct hbac_info *info);
311 
313 #define HBAC_RULE_ELEMENT_USERS 0x01
314 
316 #define HBAC_RULE_ELEMENT_SERVICES 0x02
317 
319 #define HBAC_RULE_ELEMENT_TARGETHOSTS 0x04
320 
322 #define HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08
323 
339 bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs);
340 
344 #endif /* IPA_HBAC_H_ */
struct hbac_rule_element * users
Users and groups for which this rule applies.
Definition: ipa_hbac.h:159
struct hbac_rule_element * targethosts
Target hosts for which this rule apples.
Definition: ipa_hbac.h:164
const char ** groups
List of group members of this rule component.
Definition: ipa_hbac.h:139
Evaluation failed due to lack of memory hbac_info is not available.
Definition: ipa_hbac.h:89
An error occurred See the hbac_info for more details.
Definition: ipa_hbac.h:78
Fatal failure (not used).
Definition: ipa_hbac.h:47
hbac_eval_result
Result of HBAC evaluation.
Definition: ipa_hbac.h:74
Evaluation grants access.
Definition: ipa_hbac.h:81
const char * hbac_result_string(enum hbac_eval_result result)
Display result of hbac evaluation in human-readable form.
hbac_debug_level
Debug levels for HBAC.
Definition: ipa_hbac.h:45
Parse error while evaluating rule.
Definition: ipa_hbac.h:255
char * rule_name
Specify the name of the rule that matched or threw an error.
Definition: ipa_hbac.h:271
void(* hbac_debug_fn_t)(const char *file, int line, const char *function, enum hbac_debug_level, const char *format,...) HBAC_ATTRIBUTE_PRINTF(5
Function pointer to HBAC external debugging function.
Definition: ipa_hbac.h:62
struct hbac_request_element * user
This is a list of user DNs to check, it must consist of the actual user requested,...
Definition: ipa_hbac.h:218
Warnings (not used).
Definition: ipa_hbac.h:49
enum hbac_error_code code
If the hbac_eval_result was HBAC_EVAL_ERROR, this will be an error code.
Definition: ipa_hbac.h:265
bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs)
Evaluate whether an HBAC rule contains all necessary elements.
void(*) voi hbac_enable_debug)(hbac_debug_fn_t external_debug_fn)
HBAC uses external_debug_fn for logging messages.
Definition: ipa_hbac.h:71
Component of an HBAC rule.
Definition: ipa_hbac.h:113
Unexpected error.
Definition: ipa_hbac.h:243
const char ** groups
List of group members of this request component.
Definition: ipa_hbac.h:197
void hbac_free_info(struct hbac_info *info)
Function to safely free hbac_info returned by hbac_evaluate.
Serious failure (out of memory, for example).
Definition: ipa_hbac.h:48
struct hbac_request_element * targethost
This is a list of target hosts to check, it must consist of the actual target host requested,...
Definition: ipa_hbac.h:225
struct hbac_rule_element * services
Services and service groups for which this rule applies.
Definition: ipa_hbac.h:153
Function is not yet implemented.
Definition: ipa_hbac.h:249
Ran out of memory during processing.
Definition: ipa_hbac.h:252
Evaluation denies access.
Definition: ipa_hbac.h:84
HBAC rule object for evaluation.
Definition: ipa_hbac.h:145
struct hbac_request_element * service
This is a list of service DNs to check, it must consist of the actual service requested,...
Definition: ipa_hbac.h:211
Component of an HBAC request.
Definition: ipa_hbac.h:180
hbac_error_code
Error code returned by the evaluator.
Definition: ipa_hbac.h:241
struct hbac_time_rules * timerules
For future use.
Definition: ipa_hbac.h:174
const char ** names
List of explicit members of this rule component.
Definition: ipa_hbac.h:130
struct hbac_rule_element * srchosts
Source hosts for which this rule applies.
Definition: ipa_hbac.h:169
time_t request_time
For future use.
Definition: ipa_hbac.h:235
const char * hbac_error_string(enum hbac_error_code code)
Display error description.
Request object for an HBAC rule evaluation.
Definition: ipa_hbac.h:205
struct hbac_request_element * srchost
This is a list of source hosts to check, it must consist of the actual source host requested,...
Definition: ipa_hbac.h:232
HBAC allow/disallow info.
Definition: ipa_hbac.h:50
const char * name
List of explicit members of this request component.
Definition: ipa_hbac.h:188
uint32_t category
Category for this element.
Definition: ipa_hbac.h:121
Successful evaluation.
Definition: ipa_hbac.h:246
enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules, struct hbac_eval_req *hbac_req, struct hbac_info **info)
Evaluate an authorization request against a set of HBAC rules.
Extended information.
Definition: ipa_hbac.h:259