denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented hierarchical policy groups

Browse Source
This commit is contained in:
Andreas Steffen
2013-06-21 23:25:24 +02:00
parent b1da8368d0
commit a45a2c9291
3 changed files with 81 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imv/data.sql
+25 -103
View File
@@ -459,33 +459,45 @@ INSERT INTO versions (
/* Groups */ /* Groups */
INSERT INTO groups ( /* 1 */ INSERT INTO groups ( /* 1 */
name name, parent
) VALUES ( ) VALUES (
'Default Debian i686' 'Default Debian i686', 6
); );
INSERT INTO groups ( /* 2 */ INSERT INTO groups ( /* 2 */
name name, parent
) VALUES ( ) VALUES (
'Default Debian x86_64' 'Default Debian x86_64', 6
); );
INSERT INTO groups ( /* 3 */ INSERT INTO groups ( /* 3 */
name name, parent
) VALUES ( ) VALUES (
'Default Ubuntu i686' 'Default Ubuntu i686', 6
); );
INSERT INTO groups ( /* 4 */ INSERT INTO groups ( /* 4 */
name name, parent
) VALUES ( ) VALUES (
'Default Ubuntu x86_64' 'Default Ubuntu x86_64', 6
); );
INSERT INTO groups ( /* 5 */ INSERT INTO groups ( /* 5 */
name, parent
) VALUES (
'Default Android', 7
);
INSERT INTO groups ( /* 6 */
name, parent
) VALUES (
'Default Linux', 7
);
INSERT INTO groups ( /* 7 */
name name
) VALUES ( ) VALUES (
'Default Android' 'Default'
); );
/* Default Product Groups */ /* Default Product Groups */
@@ -684,31 +696,7 @@ INSERT INTO policies ( /* 13 */
INSERT INTO enforcements ( INSERT INTO enforcements (
policy, group_id, max_age policy, group_id, max_age
) VALUES ( ) VALUES (
1, 1, 86400 1, 7, 86400
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
1, 2, 86400
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
1, 3, 86400
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
1, 4, 86400
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
1, 5, 86400
); );
INSERT INTO enforcements ( INSERT INTO enforcements (
@@ -720,25 +708,7 @@ INSERT INTO enforcements (
INSERT INTO enforcements ( INSERT INTO enforcements (
policy, group_id, max_age policy, group_id, max_age
) VALUES ( ) VALUES (
3, 1, 0 3, 6, 0
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
3, 2, 0
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
3, 3, 0
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
3, 4, 0
); );
INSERT INTO enforcements ( INSERT INTO enforcements (
@@ -762,61 +732,13 @@ INSERT INTO enforcements (
INSERT INTO enforcements ( INSERT INTO enforcements (
policy, group_id, max_age policy, group_id, max_age
) VALUES ( ) VALUES (
8, 1, 60 8, 7, 60
); );
INSERT INTO enforcements ( INSERT INTO enforcements (
policy, group_id, max_age policy, group_id, max_age
) VALUES ( ) VALUES (
8, 2, 60 9, 7, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
8, 3, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
8, 4, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
8, 5, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
9, 1, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
9, 2, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
9, 3, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
9, 4, 60
);
INSERT INTO enforcements (
policy, group_id, max_age
) VALUES (
9, 5, 60
); );
INSERT INTO enforcements ( INSERT INTO enforcements (
src/libimcv/imv/imv_policy_manager.c
+24 -10
View File
@@ -50,7 +50,7 @@ static void stderr_dbg(debug_t group, level_t level, char *fmt, ...)
bool policy_start(database_t *db, int session_id) bool policy_start(database_t *db, int session_id)
{ {
enumerator_t *e; enumerator_t *e;
int id, gid, device_id, product_id, group_id = 0; int id, gid, device_id, product_id, group_id = 0, parent;
int type, file, dir, arg_int, rec_fail, rec_noresult; int type, file, dir, arg_int, rec_fail, rec_noresult;
char *argument; char *argument;
@@ -98,14 +98,9 @@ bool policy_start(database_t *db, int session_id)
} }
} }
/* if still no group membership found, leave */ /* get iteratively enforcements for given group */
if (!group_id) while (group_id)
{ {
fprintf(stderr, "no group membership found\n");
return TRUE;
}
/* get enforcements for given group */
e = db->query(db, e = db->query(db,
"SELECT e.id, " "SELECT e.id, "
"p.type, p.argument, p.file, p.dir, p.rec_fail, p.rec_noresult " "p.type, p.argument, p.file, p.dir, p.rec_fail, p.rec_noresult "
@@ -116,8 +111,8 @@ bool policy_start(database_t *db, int session_id)
{ {
return FALSE; return FALSE;
} }
while (e->enumerate(e, &id, &type, &argument, &file, &dir, &rec_fail, while (e->enumerate(e, &id, &type, &argument, &file, &dir,
&rec_noresult)) &rec_fail, &rec_noresult))
{ {
/* determine arg_int */ /* determine arg_int */
switch ((imv_workitem_type_t)type) switch ((imv_workitem_type_t)type)
@@ -150,6 +145,25 @@ bool policy_start(database_t *db, int session_id)
} }
e->destroy(e); e->destroy(e);
e = db->query(db,
"SELECT parent FROM groups WHERE id = ?",
DB_INT, group_id, DB_INT);
if (!e)
{
return FALSE;
}
if (e->enumerate(e, &parent))
{
group_id = parent;
}
else
{
fprintf(stderr, "group information not found\n");
group_id = 0;
}
e->destroy(e);
}
return TRUE; return TRUE;
} }
src/libimcv/imv/tables.sql
+2 -1
View File
@@ -50,7 +50,8 @@ CREATE TABLE file_hashes (
DROP TABLE IF EXISTS groups; DROP TABLE IF EXISTS groups;
CREATE TABLE groups ( CREATE TABLE groups (
id integer NOT NULL PRIMARY KEY, id integer NOT NULL PRIMARY KEY,
name varchar(50) NOT NULL UNIQUE name varchar(50) NOT NULL UNIQUE,
parent integer
); );
DROP TABLE IF EXISTS group_members; DROP TABLE IF EXISTS group_members;