ipa_hbac  1.8.1
src/providers/ipa/ipa_hbac.h
00001 /*
00002     SSSD
00003 
00004     IPA Backend Module -- Access control
00005 
00006     Authors:
00007         Sumit Bose <sbose@redhat.com>
00008         Stephen Gallagher <sgallagh@redhat.com>
00009 
00010     Copyright (C) 2009 Red Hat
00011 
00012     This program is free software; you can redistribute it and/or modify
00013     it under the terms of the GNU General Public License as published by
00014     the Free Software Foundation; either version 3 of the License, or
00015     (at your option) any later version.
00016 
00017     This program is distributed in the hope that it will be useful,
00018     but WITHOUT ANY WARRANTY; without even the implied warranty of
00019     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00020     GNU General Public License for more details.
00021 
00022     You should have received a copy of the GNU General Public License
00023     along with this program.  If not, see <http://www.gnu.org/licenses/>.
00024 */
00025 
00026 #ifndef IPA_HBAC_H_
00027 #define IPA_HBAC_H_
00028 
00040 #include <stdint.h>
00041 #include <stdbool.h>
00042 
00044 enum hbac_eval_result {
00048     HBAC_EVAL_ERROR = -1,
00049 
00051     HBAC_EVAL_ALLOW,
00052 
00054     HBAC_EVAL_DENY,
00055 
00059     HBAC_EVAL_OOM
00060 };
00061 
00065 #define HBAC_CATEGORY_NULL 0x0000
00066 
00070 #define HBAC_CATEGORY_ALL  0x0001
00071 
00075 struct hbac_time_rules;
00076 
00083 struct hbac_rule_element {
00091     uint32_t category;
00092 
00100     const char **names;
00101 
00109     const char **groups;
00110 };
00111 
00115 struct hbac_rule {
00116     const char *name;
00117     bool enabled;
00118 
00123     struct hbac_rule_element *services;
00124 
00129     struct hbac_rule_element *users;
00130 
00134     struct hbac_rule_element *targethosts;
00135 
00139     struct hbac_rule_element *srchosts;
00140 
00144     struct hbac_time_rules *timerules;
00145 };
00146 
00150 struct hbac_request_element {
00158     const char *name;
00159 
00167     const char **groups;
00168 };
00169 
00175 struct hbac_eval_req {
00181     struct hbac_request_element *service;
00182 
00188     struct hbac_request_element *user;
00189 
00195     struct hbac_request_element *targethost;
00196 
00202     struct hbac_request_element *srchost;
00203 
00205     time_t request_time;
00206 };
00207 
00211 enum hbac_error_code {
00213     HBAC_ERROR_UNKNOWN = -1,
00214 
00216     HBAC_SUCCESS,
00217 
00219     HBAC_ERROR_NOT_IMPLEMENTED,
00220 
00222     HBAC_ERROR_OUT_OF_MEMORY,
00223 
00225     HBAC_ERROR_UNPARSEABLE_RULE
00226 };
00227 
00229 struct hbac_info {
00235     enum hbac_error_code code;
00236 
00241     char *rule_name;
00242 };
00243 
00244 
00258 enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules,
00259                                     struct hbac_eval_req *hbac_req,
00260                                     struct hbac_info **info);
00261 
00267 const char *hbac_result_string(enum hbac_eval_result result);
00268 
00274 const char *hbac_error_string(enum hbac_error_code code);
00275 
00280 void hbac_free_info(struct hbac_info *info);
00281 
00283 #define HBAC_RULE_ELEMENT_USERS       0x01
00284 
00286 #define HBAC_RULE_ELEMENT_SERVICES    0x02
00287 
00289 #define HBAC_RULE_ELEMENT_TARGETHOSTS 0x04
00290 
00292 #define HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08
00293 
00309 bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs);
00310 
00311 
00315 #endif /* IPA_HBAC_H_ */