2ee1dd3ec3
IO/Group/Policy Python API version is displayed instead of sudo version, because that is not very meaningful in this context. They are only displayed in verbose mode. Example plugins express it more concrete that they are displaying their version, not the API version.
279 lines
8.9 KiB
C
279 lines
8.9 KiB
C
/*
|
|
* SPDX-License-Identifier: ISC
|
|
*
|
|
* Copyright (c) 2019 Robert Manner <robert.manner@oneidentity.com>
|
|
*
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*/
|
|
|
|
/*
|
|
* This is an open source non-commercial project. Dear PVS-Studio, please check it.
|
|
* PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
|
|
*/
|
|
|
|
#include "python_plugin_common.h"
|
|
|
|
|
|
static struct PluginContext plugin_ctx;
|
|
|
|
extern struct policy_plugin python_policy;
|
|
|
|
#define PY_POLICY_PLUGIN_VERSION SUDO_API_MKVERSION(1, 0)
|
|
|
|
#define CALLBACK_PLUGINFUNC(func_name) python_policy.func_name
|
|
#define CALLBACK_CFUNC(func_name) python_plugin_policy_ ## func_name
|
|
|
|
// This also verifies compile time that the name matches the sudo plugin API.
|
|
#define CALLBACK_PYNAME(func_name) ((void)CALLBACK_PLUGINFUNC(func_name), #func_name)
|
|
|
|
#define MARK_CALLBACK_OPTIONAL(function_name) \
|
|
do { \
|
|
python_plugin_mark_callback_optional(&plugin_ctx, CALLBACK_PYNAME(function_name), \
|
|
(void **)&CALLBACK_PLUGINFUNC(function_name)); \
|
|
} while(0)
|
|
|
|
static int
|
|
python_plugin_policy_open(unsigned int version, sudo_conv_t conversation,
|
|
sudo_printf_t sudo_printf, char * const settings[],
|
|
char * const user_info[], char * const user_env[],
|
|
char * const plugin_options[])
|
|
{
|
|
debug_decl(python_plugin_policy_open, PYTHON_DEBUG_CALLBACKS);
|
|
|
|
if (version < SUDO_API_MKVERSION(1, 2)) {
|
|
sudo_printf(SUDO_CONV_ERROR_MSG,
|
|
"Error: Python policy plugin requires at least plugin API version 1.2\n");
|
|
debug_return_int(SUDO_RC_ERROR);
|
|
}
|
|
|
|
int rc = python_plugin_register_logging(conversation, sudo_printf, settings);
|
|
if (rc != SUDO_RC_OK)
|
|
debug_return_int(rc);
|
|
|
|
rc = python_plugin_init(&plugin_ctx, plugin_options);
|
|
if (rc != SUDO_RC_OK)
|
|
debug_return_int(rc);
|
|
|
|
rc = python_plugin_construct(&plugin_ctx, PY_POLICY_PLUGIN_VERSION, settings,
|
|
user_info, user_env, plugin_options);
|
|
if (rc != SUDO_RC_OK) {
|
|
debug_return_int(rc);
|
|
}
|
|
|
|
// skip plugin callbacks which are not mandatory
|
|
MARK_CALLBACK_OPTIONAL(show_version);
|
|
MARK_CALLBACK_OPTIONAL(list);
|
|
MARK_CALLBACK_OPTIONAL(validate);
|
|
MARK_CALLBACK_OPTIONAL(invalidate);
|
|
MARK_CALLBACK_OPTIONAL(init_session);
|
|
// check_policy, open and close are mandatory
|
|
|
|
debug_return_int(rc);
|
|
}
|
|
|
|
static void
|
|
python_plugin_policy_close(int exit_status, int error)
|
|
{
|
|
debug_decl(python_plugin_policy_close, PYTHON_DEBUG_CALLBACKS);
|
|
python_plugin_close(&plugin_ctx, CALLBACK_PYNAME(close), exit_status, error);
|
|
}
|
|
|
|
static int
|
|
python_plugin_policy_check(int argc, char * const argv[],
|
|
char *env_add[], char **command_info_out[],
|
|
char **argv_out[], char **user_env_out[])
|
|
{
|
|
debug_decl(python_plugin_policy_check, PYTHON_DEBUG_CALLBACKS);
|
|
int rc = SUDO_RC_ERROR;
|
|
|
|
*command_info_out = *argv_out = *user_env_out = NULL;
|
|
|
|
PyObject *py_argv = py_str_array_to_tuple_with_count(argc, argv);
|
|
|
|
PyObject *py_env_add = py_str_array_to_tuple(env_add);
|
|
PyObject *py_result = NULL;
|
|
|
|
if (py_argv == NULL || py_env_add == NULL) {
|
|
sudo_debug_printf(SUDO_DEBUG_ERROR, "Failed to create some of the arguments for the python call "
|
|
"(py_argv=%p py_env_add=%p)\n", (void *)py_argv, (void *)py_env_add);
|
|
goto cleanup;
|
|
}
|
|
|
|
py_result = python_plugin_api_call(&plugin_ctx, CALLBACK_PYNAME(check_policy),
|
|
Py_BuildValue("(OO)", py_argv, py_env_add));
|
|
if (py_result == NULL)
|
|
goto cleanup;
|
|
|
|
PyObject *py_rc = NULL,
|
|
*py_command_info_out = NULL,
|
|
*py_argv_out = NULL,
|
|
*py_user_env_out = NULL;
|
|
if (PyTuple_Check(py_result))
|
|
{
|
|
if (!PyArg_ParseTuple(py_result, "O!|O!O!O!:python_plugin.check_policy",
|
|
&PyLong_Type, &py_rc,
|
|
&PyTuple_Type, &py_command_info_out,
|
|
&PyTuple_Type, &py_argv_out,
|
|
&PyTuple_Type, &py_user_env_out))
|
|
{
|
|
rc = SUDO_RC_ERROR;
|
|
goto cleanup;
|
|
}
|
|
} else {
|
|
py_rc = py_result;
|
|
}
|
|
|
|
if (py_command_info_out != NULL)
|
|
*command_info_out = py_str_array_from_tuple(py_command_info_out);
|
|
|
|
if (py_argv_out != NULL)
|
|
*argv_out = py_str_array_from_tuple(py_argv_out);
|
|
|
|
if (py_user_env_out != NULL)
|
|
*user_env_out = py_str_array_from_tuple(py_user_env_out);
|
|
|
|
rc = python_plugin_rc_to_int(py_rc);
|
|
|
|
cleanup:
|
|
if (PyErr_Occurred()) {
|
|
py_log_last_error(NULL);
|
|
rc = SUDO_RC_ERROR;
|
|
free(*command_info_out);
|
|
free(*argv_out);
|
|
free(*user_env_out);
|
|
*command_info_out = *argv_out = *user_env_out = NULL;
|
|
}
|
|
|
|
Py_XDECREF(py_argv);
|
|
Py_XDECREF(py_env_add);
|
|
Py_XDECREF(py_result);
|
|
|
|
if (rc == SUDO_RC_ACCEPT)
|
|
plugin_ctx.call_close = 1;
|
|
|
|
debug_return_int(rc);
|
|
}
|
|
|
|
static int
|
|
python_plugin_policy_list(int argc, char * const argv[], int verbose, const char *list_user)
|
|
{
|
|
debug_decl(python_plugin_policy_list, PYTHON_DEBUG_CALLBACKS);
|
|
|
|
PyObject *py_argv = py_str_array_to_tuple_with_count(argc, argv);
|
|
if (py_argv == NULL) {
|
|
sudo_debug_printf(SUDO_DEBUG_ERROR, "%s: Failed to create argv argument for the python call\n", __PRETTY_FUNCTION__);
|
|
debug_return_int(SUDO_RC_ERROR);
|
|
}
|
|
|
|
int rc = python_plugin_api_rc_call(&plugin_ctx, CALLBACK_PYNAME(list),
|
|
Py_BuildValue("(Oiz)", py_argv, verbose, list_user));
|
|
|
|
Py_XDECREF(py_argv);
|
|
debug_return_int(rc);
|
|
}
|
|
|
|
static int
|
|
python_plugin_policy_version(int verbose)
|
|
{
|
|
debug_decl(python_plugin_policy_version, PYTHON_DEBUG_CALLBACKS);
|
|
|
|
if (verbose) {
|
|
py_sudo_log(SUDO_CONV_INFO_MSG, "Python policy plugin API version %d.%d\n", "%d.%d",
|
|
SUDO_API_VERSION_GET_MAJOR(PY_POLICY_PLUGIN_VERSION),
|
|
SUDO_API_VERSION_GET_MINOR(PY_POLICY_PLUGIN_VERSION));
|
|
}
|
|
|
|
debug_return_int(python_plugin_show_version(&plugin_ctx, CALLBACK_PYNAME(show_version), verbose));
|
|
}
|
|
|
|
int
|
|
python_plugin_policy_validate(void)
|
|
{
|
|
debug_decl(python_plugin_policy_validate, PYTHON_DEBUG_CALLBACKS);
|
|
debug_return_int(python_plugin_api_rc_call(&plugin_ctx, CALLBACK_PYNAME(validate),
|
|
Py_BuildValue("")));
|
|
}
|
|
|
|
void
|
|
python_plugin_policy_invalidate(int remove)
|
|
{
|
|
debug_decl(python_plugin_policy_invalidate, PYTHON_DEBUG_CALLBACKS);
|
|
python_plugin_api_rc_call(&plugin_ctx, CALLBACK_PYNAME(invalidate),
|
|
Py_BuildValue("(i)", remove));
|
|
debug_return;
|
|
}
|
|
|
|
int
|
|
python_plugin_policy_init_session(struct passwd *pwd, char **user_env[])
|
|
{
|
|
debug_decl(python_plugin_policy_init_session, PYTHON_DEBUG_CALLBACKS);
|
|
int rc = SUDO_RC_ERROR;
|
|
PyObject *py_pwd = NULL, *py_user_env = NULL, *py_result = NULL;
|
|
|
|
py_pwd = py_from_passwd(pwd);
|
|
if (py_pwd == NULL)
|
|
goto cleanup;
|
|
|
|
py_user_env = py_str_array_to_tuple(*user_env);
|
|
if (py_user_env == NULL)
|
|
goto cleanup;
|
|
|
|
py_result = python_plugin_api_call(&plugin_ctx, CALLBACK_PYNAME(init_session),
|
|
Py_BuildValue("(OO)", py_pwd, py_user_env));
|
|
if (py_result == NULL)
|
|
goto cleanup;
|
|
|
|
PyObject *py_user_env_out = NULL, *py_rc = NULL;
|
|
if (PyTuple_Check(py_result)) {
|
|
if (!PyArg_ParseTuple(py_result, "O!|O!:python_plugin.init_session",
|
|
&PyLong_Type, &py_rc,
|
|
&PyTuple_Type, &py_user_env_out)) {
|
|
goto cleanup;
|
|
}
|
|
} else {
|
|
py_rc = py_result;
|
|
}
|
|
|
|
if (py_user_env_out != NULL) {
|
|
str_array_free(user_env);
|
|
*user_env = py_str_array_from_tuple(py_user_env_out);
|
|
if (*user_env == NULL)
|
|
goto cleanup;
|
|
}
|
|
|
|
rc = python_plugin_rc_to_int(py_rc);
|
|
|
|
cleanup:
|
|
Py_XDECREF(py_pwd);
|
|
Py_XDECREF(py_user_env);
|
|
Py_XDECREF(py_result);
|
|
|
|
debug_return_int(rc);
|
|
}
|
|
|
|
__dso_public struct policy_plugin python_policy = {
|
|
SUDO_POLICY_PLUGIN,
|
|
SUDO_API_VERSION,
|
|
CALLBACK_CFUNC(open),
|
|
CALLBACK_CFUNC(close),
|
|
CALLBACK_CFUNC(version),
|
|
CALLBACK_CFUNC(check),
|
|
CALLBACK_CFUNC(list),
|
|
CALLBACK_CFUNC(validate),
|
|
CALLBACK_CFUNC(invalidate),
|
|
CALLBACK_CFUNC(init_session),
|
|
NULL, /* register_hooks */
|
|
NULL, /* deregister_hooks */
|
|
NULL /* event_alloc */
|
|
};
|