ipa_hbac
1.8.3
|
00001 /* 00002 SSSD 00003 00004 IPA Backend Module -- Access control 00005 00006 Authors: 00007 Sumit Bose <sbose@redhat.com> 00008 Stephen Gallagher <sgallagh@redhat.com> 00009 00010 Copyright (C) 2009 Red Hat 00011 00012 This program is free software; you can redistribute it and/or modify 00013 it under the terms of the GNU General Public License as published by 00014 the Free Software Foundation; either version 3 of the License, or 00015 (at your option) any later version. 00016 00017 This program is distributed in the hope that it will be useful, 00018 but WITHOUT ANY WARRANTY; without even the implied warranty of 00019 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 00020 GNU General Public License for more details. 00021 00022 You should have received a copy of the GNU General Public License 00023 along with this program. If not, see <http://www.gnu.org/licenses/>. 00024 */ 00025 00026 #ifndef IPA_HBAC_H_ 00027 #define IPA_HBAC_H_ 00028 00040 #include <stdint.h> 00041 #include <stdbool.h> 00042 00044 enum hbac_eval_result { 00048 HBAC_EVAL_ERROR = -1, 00049 00051 HBAC_EVAL_ALLOW, 00052 00054 HBAC_EVAL_DENY, 00055 00059 HBAC_EVAL_OOM 00060 }; 00061 00065 #define HBAC_CATEGORY_NULL 0x0000 00066 00070 #define HBAC_CATEGORY_ALL 0x0001 00071 00075 struct hbac_time_rules; 00076 00083 struct hbac_rule_element { 00091 uint32_t category; 00092 00100 const char **names; 00101 00109 const char **groups; 00110 }; 00111 00115 struct hbac_rule { 00116 const char *name; 00117 bool enabled; 00118 00123 struct hbac_rule_element *services; 00124 00129 struct hbac_rule_element *users; 00130 00134 struct hbac_rule_element *targethosts; 00135 00139 struct hbac_rule_element *srchosts; 00140 00144 struct hbac_time_rules *timerules; 00145 }; 00146 00150 struct hbac_request_element { 00158 const char *name; 00159 00167 const char **groups; 00168 }; 00169 00175 struct hbac_eval_req { 00181 struct hbac_request_element *service; 00182 00188 struct hbac_request_element *user; 00189 00195 struct hbac_request_element *targethost; 00196 00202 struct hbac_request_element *srchost; 00203 00205 time_t request_time; 00206 }; 00207 00211 enum hbac_error_code { 00213 HBAC_ERROR_UNKNOWN = -1, 00214 00216 HBAC_SUCCESS, 00217 00219 HBAC_ERROR_NOT_IMPLEMENTED, 00220 00222 HBAC_ERROR_OUT_OF_MEMORY, 00223 00225 HBAC_ERROR_UNPARSEABLE_RULE 00226 }; 00227 00229 struct hbac_info { 00235 enum hbac_error_code code; 00236 00241 char *rule_name; 00242 }; 00243 00244 00258 enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules, 00259 struct hbac_eval_req *hbac_req, 00260 struct hbac_info **info); 00261 00267 const char *hbac_result_string(enum hbac_eval_result result); 00268 00274 const char *hbac_error_string(enum hbac_error_code code); 00275 00280 void hbac_free_info(struct hbac_info *info); 00281 00283 #define HBAC_RULE_ELEMENT_USERS 0x01 00284 00286 #define HBAC_RULE_ELEMENT_SERVICES 0x02 00287 00289 #define HBAC_RULE_ELEMENT_TARGETHOSTS 0x04 00290 00292 #define HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08 00293 00309 bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs); 00310 00311 00315 #endif /* IPA_HBAC_H_ */