src/internal/naive_policy_checker.hpp

   1 /*
   2  * Copyright (c) 2016-2019 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  * http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15 */
  16
  17 /**
  18  * \file
  19  * \ingroup Implementation
  20  */
  21
  22
  23 #ifndef _NAIVE_DECISIONER_H
  24 #define _NAIVE_DECISIONER_H
  25
  26 #include "policy.hpp"
  27 #include "global_nodestruct.hpp"
  28 #include "storage_backend_serialized.hpp"
  29 #include "serializer.hpp"
  30
  31 #include <map>
  32 #include <memory>
  33 #include <vector>
  34
  35 namespace ldp_xml_parser
  36 {
  37         typedef std::vector<gid_t> VGid;
  38
  39         /* Class which checks rights in policies retrieved from policy db
  40          * \ingroup Implementation
  41          */
  42         class NaivePolicyChecker {
  43         private:
  44
  45                 /** Policy database */
  46                 ldp_serialized::StorageBackendSerialized m_bus_db;
  47                 /** Serializer - provides serialized data in case no serialized data file is found */
  48                 std::unique_ptr<ldp_serializer::Serializer> serializer;
  49
  50                 /** Parses delivered decision. In case of Decision::CHECK calls cynara.
  51                  * \param[in] decision Decision from checkers
  52                  * \param[in] uid User id
  53                  * \param[in] label User label
  54                  * \return Returns deny=0, allow=1 or cynara error
  55                  * \ingroup Implementation
  56                  */
  57                 DecisionResult parseDecision(const DecisionItem& decision,
  58                                                    uid_t uid,
  59                                                    const char* label) const;
  60
  61                 /** Checks policy for a given own, send or receive item
  62                  * \param[in] uid User id
  63                  * \param[in] gid User group id
  64                  * \param[in] item Item to check
  65                  * \return Returns deny=0, allow=1 or cynara error
  66                  * \ingroup Implementation
  67                  */
  68                 template<typename T>
  69                 DecisionItem checkItem(uid_t uid,
  70                                            gid_t gid,
  71                                            const T& item);
  72
  73                 /** Checks policy for a given access item
  74                  * \param[in] item Item to check
  75                  * \return Returns deny=0, allow=1 or cynara error
  76                  * \ingroup Implementation
  77                  */
  78                 DecisionItem checkItemAccess(const MatchItemAccess &item);
  79
  80                 template<typename T>
  81                 DecisionItem checkGroupPolicies(uid_t uid,
  82                                                 gid_t gid,
  83                                                 const T& item);
  84
  85                 /* group maps management */
  86                 std::map<uid_t, VGid> mapGroups[MatchItemTypes::count];
  87                 /* A mutex for mapGroups */
  88                 pthread_mutex_t mutexGroup = PTHREAD_MUTEX_INITIALIZER;
  89
  90                 template <typename T>
  91                 VGid &getMapGroup(uid_t uid);
  92
  93                 void updateSupplementaryGroups(const VGid &groups, uid_t uid, gid_t gid);
  94                 void updateSupplementaryGroupsOwn(const VGid &groups, uid_t uid, gid_t gid);
  95
  96         public:
  97                 /** Retrieves policy db
  98                  * \return Returns reference to the policy db
  99                  */
 100                 const decltype(m_bus_db) &getPolicyDb() const { return m_bus_db; }
 101
 102                 /** Clears all db data, useful for reloading configuration
 103                  * during testing.
 104                  */
 105                 bool initDb(const char *config_name, const char *serialized_filename = nullptr);
 106
 107                 void updateGroupDb(uid_t uid, gid_t gid);
 108
 109                 template <typename T>
 110                 const VGid *getGroups(uid_t uid, gid_t gid);
 111
 112                 /** Prints to stderr the structures and the amount of their memory */
 113                 void printContent();
 114
 115                 /** Checks access/open policy for given item
 116                  * \param[in] uid User id
 117                  * \param[in] gid User group id
 118                  * \return Returns deny=0, allow=1 or cynara error
 119                  * \ingroup Implementation
 120                  */
 121                 DecisionResult check(uid_t bus_owner,
 122                                    uid_t uid,
 123                                    gid_t gid,
 124                                    const char* const label);
 125
 126                 /** Checks send/receive/ownership policy for given item
 127                  * \param[in] uid User id
 128                  * \param[in] gid User group id
 129                  * \param[in] label User label
 130                  * \param[in] matchItem MatchItem to check
 131                  * \return Returns deny=0, allow=1 or cynara error
 132                  * \ingroup Implementation
 133                  */
 134                 template <typename T>
 135                 DecisionResult check(uid_t uid,
 136                                    gid_t gid,
 137                                    const char* const label,
 138                                    const T &matchItem);
 139         };
 140 }
 141
 142 DCL_NODESTRUCT_GLOBAL(ldp_xml_parser::NaivePolicyChecker, policy_checker_system)
 143 DCL_NODESTRUCT_GLOBAL(ldp_xml_parser::NaivePolicyChecker, policy_checker_session)
 144
 145 #endif