Separate password_set and password_reset APIs on socket level.

[Issue#]        SSDWSSP-691
[Bug/Feature]   N/A
[Cause]         Applications should have access only to those functions they
                need.
[Solution]      Moving password_reset to new socket with different label.
[Verification]  Build and install. Run security-server password tests.

Change-Id: I318e649314fd7410ccfa065124b7d6175cf6687e

diff --git a/packaging/security-server.manifest b/packaging/security-server.manifest
index 61aa232..2c3a021 100644 (file)
--- a/packaging/security-server.manifest
+++ b/packaging/security-server.manifest
@@ -15,6 +15,7 @@
                        <label name="security-server::api-get-gid" />
                        <label name="security-server::api-password-check" />
                        <label name="security-server::api-password-set" />
+                       <label name="security-server::api-password-reset" />
                        <label name="security-server::audit-files" />
                </provide>
        </define>

diff --git a/packaging/security-server.spec b/packaging/security-server.spec
index ed63e09..161541d 100644 (file)
--- a/packaging/security-server.spec
+++ b/packaging/security-server.spec
@@ -92,6 +92,7 @@ ln -s ../security-server-app-privilege-by-name.socket %{buildroot}/usr/lib/syste
 ln -s ../security-server-open-for.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-open-for.socket
 ln -s ../security-server-password-check.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-password-check.socket
 ln -s ../security-server-password-set.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-password-set.socket
+ln -s ../security-server-password-reset.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-password-reset.socket
 
 %clean
 rm -rf %{buildroot}
@@ -155,6 +156,8 @@ fi
 %attr(-,root,root) /usr/lib/systemd/system/security-server-password-check.socket
 %attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-password-set.socket
 %attr(-,root,root) /usr/lib/systemd/system/security-server-password-set.socket
+%attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-password-reset.socket
+%attr(-,root,root) /usr/lib/systemd/system/security-server-password-reset.socket
 
 %{_datadir}/license/%{name}
 

diff --git a/src/include/security-server.h b/src/include/security-server.h
index c309175..7fb4dee 100644 (file)
--- a/src/include/security-server.h
+++ b/src/include/security-server.h
@@ -733,9 +733,8 @@ int security_server_set_pwd_max_challenge(const unsigned int max_challenge);
  * #include <security-server.h>
  * ...
  * int ret;
- * unsigned int attempt, max_attempt, expire_sec;
  *
- *      ret = security_server_set_pwd("this_is_new_pwd", 20, 365);
+ *      ret = security_server_reset_pwd("this_is_new_pwd", 20, 365);
  *      if(retval != SECURITY_SERVER_API_SUCCESS)
  *      {
  *              printf("%s", "we have error\n");
@@ -745,7 +744,7 @@ int security_server_set_pwd_max_challenge(const unsigned int max_challenge);
  *
  * \endcode
  *
- * Access to this function requires SMACK rule: "<app_label> security-server::api-password-set w"
+ * Access to this function requires SMACK rule: "<app_label> security-server::api-password-reset w"
 */
 int security_server_reset_pwd(const char *new_pwd,
                               const unsigned int max_challenge,

diff --git a/src/server/client/client-password.cpp b/src/server/client/client-password.cpp
index 48650c7..15b8c36 100644 (file)
--- a/src/server/client/client-password.cpp
+++ b/src/server/client/client-password.cpp
@@ -236,7 +236,7 @@ int security_server_reset_pwd(const char *new_pwd,
         Serialization::Serialize(send, max_challenge);
         Serialization::Serialize(send, valid_period_in_days);
 
-        int retCode = sendToServer(SERVICE_SOCKET_PASSWD_SET, send.Pop(), recv);
+        int retCode = sendToServer(SERVICE_SOCKET_PASSWD_RESET, send.Pop(), recv);
         if (SECURITY_SERVER_API_SUCCESS != retCode) {
             LogError("Error in sendToServer. Error code: " << retCode);
             return retCode;

diff --git a/src/server/common/protocols.cpp b/src/server/common/protocols.cpp
index 71c7d3c..5c219ac 100644 (file)
--- a/src/server/common/protocols.cpp
+++ b/src/server/common/protocols.cpp
@@ -51,6 +51,8 @@ char const * const SERVICE_SOCKET_PASSWD_CHECK =
     "/tmp/.security-server-api-password-check.sock";
 char const * const SERVICE_SOCKET_PASSWD_SET =
     "/tmp/.security-server-api-password-set.sock";
+char const * const SERVICE_SOCKET_PASSWD_RESET =
+    "/tmp/.security-server-api-password-reset.sock";
 
 const size_t COOKIE_SIZE = 20;
 

diff --git a/src/server/common/protocols.h b/src/server/common/protocols.h
index 56325c2..b9383ad 100644 (file)
--- a/src/server/common/protocols.h
+++ b/src/server/common/protocols.h
@@ -40,6 +40,7 @@ extern char const * const SERVICE_SOCKET_COOKIE_CHECK_TMP;
 extern char const * const SERVICE_SOCKET_OPEN_FOR;
 extern char const * const SERVICE_SOCKET_PASSWD_CHECK;
 extern char const * const SERVICE_SOCKET_PASSWD_SET;
+extern char const * const SERVICE_SOCKET_PASSWD_RESET;
 
 enum class AppPermissionsAction { ENABLE, DISABLE };
 

diff --git a/src/server/service/password.cpp b/src/server/service/password.cpp
index d0d4307..0cbc878 100644 (file)
--- a/src/server/service/password.cpp
+++ b/src/server/service/password.cpp
@@ -52,6 +52,7 @@ namespace {
 // you may ignore this ID (just pass 0)
 const InterfaceID SOCKET_ID_CHECK   = 0;
 const InterfaceID SOCKET_ID_SET     = 1;
+const InterfaceID SOCKET_ID_RESET   = 2;
 
 } // namespace anonymous
 
@@ -59,7 +60,8 @@ GenericSocketService::ServiceDescriptionVector PasswordService::GetServiceDescri
 {
     return ServiceDescriptionVector {
         {SERVICE_SOCKET_PASSWD_CHECK, "security-server::api-password-check", SOCKET_ID_CHECK},
-        {SERVICE_SOCKET_PASSWD_SET,   "security-server::api-password-set",   SOCKET_ID_SET}
+        {SERVICE_SOCKET_PASSWD_SET,   "security-server::api-password-set",   SOCKET_ID_SET},
+        {SERVICE_SOCKET_PASSWD_RESET, "security-server::api-password-reset", SOCKET_ID_RESET}
     };
 }
 
@@ -150,6 +152,27 @@ int PasswordService::processSetFunctions(PasswordHdrs hdr, MessageBuffer& buffer
             result = m_pwdManager.setPasswordMaxChallenge(rec_max_challenge);
             break;
 
+        case PasswordHdrs::HDR_SET_PWD_HISTORY:
+            Deserialization::Deserialize(buffer, rec_history);
+            result = m_pwdManager.setPasswordHistory(rec_history);
+            break;
+
+        default:
+            LogError("Unknown msg header.");
+            Throw(Exception::IncorrectHeader);
+    }
+
+    return result;
+}
+
+int PasswordService::processResetFunctions(PasswordHdrs hdr, MessageBuffer& buffer)
+{
+    int result = SECURITY_SERVER_API_ERROR_SERVER_ERROR;
+
+    std::string newPwd;
+    unsigned int rec_att = 0, rec_days = 0;
+
+    switch(hdr) {
         case PasswordHdrs::HDR_RST_PWD:
             Deserialization::Deserialize(buffer, newPwd);
             Deserialization::Deserialize(buffer, rec_att);
@@ -157,11 +180,6 @@ int PasswordService::processSetFunctions(PasswordHdrs hdr, MessageBuffer& buffer
             result = m_pwdManager.resetPassword(newPwd, rec_att, rec_days);
             break;
 
-        case PasswordHdrs::HDR_SET_PWD_HISTORY:
-            Deserialization::Deserialize(buffer, rec_history);
-            result = m_pwdManager.setPasswordHistory(rec_history);
-            break;
-
         default:
             LogError("Unknown msg header.");
             Throw(Exception::IncorrectHeader);
@@ -198,6 +216,10 @@ bool PasswordService::processOne(const ConnectionID &conn, MessageBuffer &buffer
                     retCode = processSetFunctions(hdr, buffer);
                     break;
 
+                case SOCKET_ID_RESET:
+                    retCode = processResetFunctions(hdr, buffer);
+                    break;
+
                 default:
                     LogError("Wrong interfaceID.");
                     Throw(Exception::IncorrectHeader);

diff --git a/src/server/service/password.h b/src/server/service/password.h
index 0989d81..ceab3b6 100644 (file)
--- a/src/server/service/password.h
+++ b/src/server/service/password.h
@@ -69,6 +69,7 @@ namespace SecurityServer
         int processCheckFunctions(PasswordHdrs hdr, MessageBuffer& buffer, unsigned int &cur_att,
                                    unsigned int &max_att, unsigned int &exp_time);
         int processSetFunctions(PasswordHdrs hdr, MessageBuffer& buffer);
+        int processResetFunctions(PasswordHdrs hdr, MessageBuffer& buffer);
 
         // service attributes
         PasswordManager m_pwdManager;

diff --git a/systemd/CMakeLists.txt b/systemd/CMakeLists.txt
index d3c924a..9aebdda 100644 (file)
--- a/systemd/CMakeLists.txt
+++ b/systemd/CMakeLists.txt
@@ -10,6 +10,7 @@ INSTALL(FILES
     ${CMAKE_SOURCE_DIR}/systemd/security-server-app-privilege-by-name.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-cookie-check-tmp.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-open-for.socket
+    ${CMAKE_SOURCE_DIR}/systemd/security-server-password-reset.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-password-check.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-password-set.socket
     DESTINATION

diff --git a/systemd/security-server-password-reset.socket b/systemd/security-server-password-reset.socket
new file mode 100644 (file)
index 0000000..5db1f0f
--- /dev/null
+++ b/systemd/security-server-password-reset.socket
@@ -0,0 +1,11 @@
+[Socket]
+ListenStream=/tmp/.security-server-api-password-reset.sock
+SocketMode=0777
+#SmackLabelIPIn=security-server::api-password-reset
+SmackLabelIPIn=*
+SmackLabelIPOut=@
+
+Service=security-server.service
+
+[Install]
+WantedBy=sockets.target

diff --git a/systemd/security-server.service b/systemd/security-server.service
index 6a6762a..c32dd9b 100644 (file)
--- a/systemd/security-server.service
+++ b/systemd/security-server.service
@@ -16,6 +16,7 @@ Sockets=security-server-cookie-check-tmp.socket
 Sockets=security-server-open-for.socket
 Sockets=security-server-password-check.socket
 Scokets=security-server-password-set.socket
+Scokets=security-server-password-reset.socket
 
 [Install]
 WantedBy=multi-user.target