upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-09 08:23:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

uses URL extensions to set socket permissions other than default

Browse source 
URL Syntax:

ldapi://[<path>[/????[!]x-mod=<mod>]]

where <path> is the URL-encoded path of the socket (i.e. use %2F instead
of '/' for UNIX filenames!) and <mod> is 3*[w|-] (all we need is write
permission to the socket, read/execute permissions are ignored; however,
they're set when opening the listener).  The critical flag (the optional
'!' if not used ignores the result of the chmod() operation.
This commit is contained in:
Pierangelo Masarati 2002-01-28 20:26:55 +00:00
parent 14662be692
commit 4f2ff1c108
1 changed files with 174 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

176
servers/slapd/daemon.c
View file

@ -30,6 +30,8 @@ int deny_severity = LOG_NOTICE;
#ifdef LDAP_PF_LOCAL
#include <sys/stat.h>
/* this should go in <ldap.h> as soon as it is accepted */
#define LDAPI_MOD_URLEXT "x-mod"
#endif /* LDAP_PF_LOCAL */
/* globals */
@ -303,6 +305,171 @@ static void slap_free_listener_addresses(struct sockaddr **sal)
ch_free(sal);
}
#ifdef LDAP_PF_LOCAL
static int get_url_perms(
char **exts,
mode_t *perms,
int *crit )
{
int i;
assert( exts );
assert( perms );
assert( crit );
*crit = 0;
for ( i = 0; exts[ i ]; i++ ) {
char *type = exts[ i ];
int c = 0;
if ( type[ 0 ] == '!' ) {
c = 1;
type++;
}
if ( strncasecmp( type, LDAPI_MOD_URLEXT "=", sizeof(LDAPI_MOD_URLEXT "=") - 1 ) == 0 ) {
char *value = type + sizeof(LDAPI_MOD_URLEXT "=") - 1;
mode_t p = 0;
#if 0
if ( strlen( value ) != 9 ) {
return LDAP_OTHER;
}
switch ( value[ 0 ] ) {
case 'r':
p |= S_IRUSR;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 1 ] ) {
case 'w':
p |= S_IWUSR;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 2 ] ) {
case 'x':
p |= S_IXUSR;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 3 ] ) {
case 'r':
p |= S_IRGRP;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 4 ] ) {
case 'w':
p |= S_IWGRP;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 5 ] ) {
case 'x':
p |= S_IXGRP;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 6 ] ) {
case 'r':
p |= S_IROTH;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 7 ] ) {
case 'w':
p |= S_IWOTH;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 8 ] ) {
case 'x':
p |= S_IXOTH;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
#else
if ( strlen(value) != 3 ) {
return LDAP_OTHER;
}
switch ( value[ 0 ] ) {
case 'w':
p |= S_IRWXU;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 1 ] ) {
case 'w':
p |= S_IRWXG;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
switch ( value[ 2 ] ) {
case 'w':
p |= S_IRWXO;
break;
case '-':
break;
default:
return LDAP_OTHER;
}
#endif
*crit = c;
*perms = p;
return LDAP_SUCCESS;
}
}
}
#endif /* LDAP_PF_LOCAL */
/* port = 0 indicates AF_LOCAL */
static int slap_get_listener_addresses(
const char *host,
@ -487,7 +654,8 @@ static Listener * slap_open_listener(
struct sockaddr **sal, **psal;
int socktype = SOCK_STREAM; /* default to COTS */
#ifdef LDAP_PF_LOCAL
mode_t perms = S_IRWXU;
mode_t perms = S_IRWXU;
int crit = 1;
#endif
rc = ldap_url_parse( url, &lud );
@ -542,6 +710,10 @@ static Listener * slap_open_listener(
} else {
err = slap_get_listener_addresses(lud->lud_host, 0, &sal);
}
if ( lud->lud_exts ) {
err = get_url_perms( lud->lud_exts, &perms, &crit );
}
#else
#ifdef NEW_LOGGING
@ -696,7 +868,7 @@ static Listener * slap_open_listener(
#ifdef LDAP_PF_LOCAL
case AF_LOCAL: {
char *addr = ((struct sockaddr_un *)*sal)->sun_path;
if ( chmod( addr, perms ) < 0 ) {
if ( chmod( addr, perms ) < 0 && crit ) {
int err = sock_errno();
#ifdef NEW_LOGGING
LDAP_LOG(( "connection", LDAP_LEVEL_INFO,