sec.sml

   1 structure Sec :> SEC = struct
   2
   3 open Init Util Sql
   4
   5 structure Req = RequestH(struct
   6                          val table = "Sec"
   7                          val adminGroup = "server"
   8                          fun subject _ = "Security permissions change request"
   9                          val template = "sec"
  10                          val descr = "change"
  11                          fun body {node, mail, data = req} =
  12                              (Mail.mwrite (mail, req);
  13                               Mail.mwrite (mail, "\n"))
  14                          end)
  15
  16 fun findSubusers uname =
  17     let
  18         val uname_under = uname ^ "_"
  19         val inf = TextIO.openIn "/etc/passwd"
  20
  21         fun loop subs =
  22             case TextIO.inputLine inf of
  23                 NONE => ListMergeSort.sort (fn (x, y) => String.compare (x, y) = GREATER) subs
  24               | SOME line =>
  25                 case String.fields (fn ch => ch = #":") line of
  26                     uname'::_ =>
  27                     if size uname' >= size uname_under
  28                        andalso String.substring (uname', 0, size uname_under) = uname_under then
  29                         loop (uname' :: subs)
  30                     else
  31                         loop subs
  32                   | _ => loop subs
  33     in
  34         loop []
  35         before TextIO.closeIn inf
  36     end
  37
  38 datatype socket_perms =
  39          ANY
  40        | CLIENT_ONLY
  41        | SERVER_ONLY
  42        | NADA
  43
  44 fun socketPerms {node, uname} =
  45     let
  46         val proc = Unix.execute ("/bin/sh",
  47                                  ["-c",
  48                                   "DOMTOOL_USER=hcoop /usr/local/bin/domtool-admin sockperm "
  49                                   ^ Init.nodeName node ^ " " ^ uname])
  50
  51         val inf = Unix.textInstreamOf proc
  52
  53         val p = case TextIO.inputLine inf of
  54                     SOME "Any\n" => ANY
  55                   | SOME "Client\n" => CLIENT_ONLY
  56                   | SOME "Server\n" => SERVER_ONLY
  57                   | _ => NADA
  58     in
  59         TextIO.closeIn inf;
  60         if OS.Process.isSuccess (Unix.reap proc) then
  61             p
  62         else
  63             NADA
  64     end
  65
  66 fun checkIt cmd {node, uname} =
  67     OS.Process.isSuccess (OS.Process.system
  68                               ("DOMTOOL_USER=hcoop /usr/local/bin/domtool-admin "
  69                                ^ cmd ^ " " ^ Init.nodeName node ^ " " ^ uname ^ " >/dev/null 2>/dev/null"))
  70
  71 val isTpe = checkIt "tpe"
  72 val cronAllowed = checkIt "cron"
  73 val ftpAllowed = checkIt "ftp"
  74
  75 fun findFirewallRules {node, uname} =
  76     let
  77         val proc = Unix.execute ("/bin/sh",
  78                                  ["-c",
  79                                   "DOMTOOL_USER=hcoop /usr/local/bin/domtool-admin firewall "
  80                                   ^ Init.nodeName node ^ " " ^ uname])
  81
  82         val inf = Unix.textInstreamOf proc
  83
  84         fun readEm lines =
  85             case TextIO.inputLine inf of
  86                     SOME line => readEm (String.substring (line, 0, size line - 1) :: lines)
  87                   | NONE => rev lines
  88
  89         val lines = readEm []
  90     in
  91         TextIO.closeIn inf;
  92         if OS.Process.isSuccess (Unix.reap proc) then
  93             lines
  94         else
  95             []
  96     end
  97
  98 fun intFromString s =
  99     if CharVector.all Char.isDigit s andalso size s > 0 then
 100         Int.fromString s
 101     else
 102         NONE
 103
 104 fun validPort port =
 105     case intFromString port of
 106         NONE => false
 107       | SOME n => n > 0
 108
 109 fun validPortPiece pp =
 110     case String.fields (fn ch => ch = #":") pp of
 111         [port] => validPort port
 112       | [port1, port2] => validPort port1 andalso validPort port2
 113
 114 fun validPorts ports =
 115     List.all validPortPiece (String.fields (fn ch => ch = #",") ports)
 116
 117 fun validIp s =
 118     case map intFromString (String.fields (fn ch => ch = #".") s) of
 119         [SOME n1, SOME n2, SOME n3, SOME n4] =>
 120         n1 >= 0 andalso n1 < 256 andalso n2 >= 0 andalso n2 < 256 andalso n3 >= 0 andalso n3 < 256 andalso n4 >= 0 andalso n4 < 256
 121       | _ => false
 122
 123 fun isIdent ch = Char.isLower ch orelse Char.isDigit ch
 124
 125 fun validHost s =
 126     size s > 0 andalso size s < 20
 127     andalso CharVector.all (fn ch => isIdent ch orelse ch = #"-") s
 128
 129 fun validDomain s =
 130     size s > 0 andalso size s < 100
 131     andalso List.all validHost (String.fields (fn ch => ch = #".") s)
 132
 133 val validHosts = List.all (fn x => validIp x orelse validDomain x)
 134
 135 fun validRule rule =
 136     case String.tokens Char.isSpace rule of
 137         "Client" :: ports :: hosts => validPorts ports andalso validHosts hosts
 138       | "Server" :: ports :: hosts => validPorts ports andalso validHosts hosts
 139       | ["LocalServer", ports] => validPorts ports
 140       | _ => false
 141
 142 end