Trusted-path permission checking
[hcoop/domtool2.git] / src / main.sml
index 29d2b37..90a5e94 100644 (file)
@@ -604,6 +604,122 @@ fun requestSmtpLog domain =
        OpenSSL.close bio
     end
 
+fun requestApt {node, pkg} =
+    let
+       val (user, context) = requestContext (fn () => ())
+       val bio = OpenSSL.connect (context, if node = Config.masterNode then
+                                               dispatcher
+                                           else
+                                               Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
+
+       val _ = Msg.send (bio, MsgQuery (QApt pkg))
+
+       fun loop () =
+           case Msg.recv bio of
+               NONE => (print "Server closed connection unexpectedly.\n";
+                        OS.Process.failure)
+             | SOME m =>
+               case m of
+                   MsgYes => (print "Package is installed.\n";
+                              OS.Process.success)
+                 | MsgNo => (print "Package is not installed.\n";
+                             OS.Process.failure)
+                 | MsgError s => (print ("APT query failed: " ^ s ^ "\n");
+                                  OS.Process.failure)
+                 | _ => (print "Unexpected server reply.\n";
+                         OS.Process.failure)
+    in
+       loop ()
+       before OpenSSL.close bio
+    end
+
+fun requestCron {node, uname} =
+    let
+       val (user, context) = requestContext (fn () => ())
+       val bio = OpenSSL.connect (context, if node = Config.masterNode then
+                                               dispatcher
+                                           else
+                                               Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
+
+       val _ = Msg.send (bio, MsgQuery (QCron uname))
+
+       fun loop () =
+           case Msg.recv bio of
+               NONE => (print "Server closed connection unexpectedly.\n";
+                        OS.Process.failure)
+             | SOME m =>
+               case m of
+                   MsgYes => (print "User has cron permissions.\n";
+                              OS.Process.success)
+                 | MsgNo => (print "User does not have cron permissions.\n";
+                             OS.Process.failure)
+                 | MsgError s => (print ("Cron query failed: " ^ s ^ "\n");
+                                  OS.Process.failure)
+                 | _ => (print "Unexpected server reply.\n";
+                         OS.Process.failure)
+    in
+       loop ()
+       before OpenSSL.close bio
+    end
+
+fun requestFtp {node, uname} =
+    let
+       val (user, context) = requestContext (fn () => ())
+       val bio = OpenSSL.connect (context, if node = Config.masterNode then
+                                               dispatcher
+                                           else
+                                               Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
+
+       val _ = Msg.send (bio, MsgQuery (QFtp uname))
+
+       fun loop () =
+           case Msg.recv bio of
+               NONE => (print "Server closed connection unexpectedly.\n";
+                        OS.Process.failure)
+             | SOME m =>
+               case m of
+                   MsgYes => (print "User has FTP permissions.\n";
+                              OS.Process.success)
+                 | MsgNo => (print "User does not have FTP permissions.\n";
+                             OS.Process.failure)
+                 | MsgError s => (print ("FTP query failed: " ^ s ^ "\n");
+                                  OS.Process.failure)
+                 | _ => (print "Unexpected server reply.\n";
+                         OS.Process.failure)
+    in
+       loop ()
+       before OpenSSL.close bio
+    end
+
+fun requestTrustedPath {node, uname} =
+    let
+       val (user, context) = requestContext (fn () => ())
+       val bio = OpenSSL.connect (context, if node = Config.masterNode then
+                                               dispatcher
+                                           else
+                                               Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
+
+       val _ = Msg.send (bio, MsgQuery (QTrustedPath uname))
+
+       fun loop () =
+           case Msg.recv bio of
+               NONE => (print "Server closed connection unexpectedly.\n";
+                        OS.Process.failure)
+             | SOME m =>
+               case m of
+                   MsgYes => (print "User has trusted path restriction.\n";
+                              OS.Process.success)
+                 | MsgNo => (print "User does not have trusted path restriction.\n";
+                             OS.Process.failure)
+                 | MsgError s => (print ("Trusted path query failed: " ^ s ^ "\n");
+                                  OS.Process.failure)
+                 | _ => (print "Unexpected server reply.\n";
+                         OS.Process.failure)
+    in
+       loop ()
+       before OpenSSL.close bio
+    end
+
 fun regenerate context =
     let
        val b = basis ()
@@ -665,6 +781,7 @@ fun regenerate context =
            end
                handle IO.Io _ => ()
                     | OS.SysErr (s, _) => print ("System error processing user " ^ user ^ ": " ^ s ^ "\n")
+                    | ErrorMsg.Error => print ("User " ^ user ^ " had a compilation error.\n")
     in
        app contactNode Config.nodeIps;
        Env.pre ();
@@ -686,6 +803,20 @@ fun rmuser user =
 
 fun now () = Date.toString (Date.fromTimeUniv (Time.now ()))
 
+fun answerQuery q =
+    case q of
+       QApt pkg => if Apt.installed pkg then MsgYes else MsgNo
+      | QCron user => if Cron.allowed user then MsgYes else MsgNo
+      | QFtp user => if Ftp.allowed user then MsgYes else MsgNo
+      | QTrustedPath user => if TrustedPath.query user then MsgYes else MsgNo
+
+fun describeQuery q =
+    case q of
+       QApt pkg => "Requested installation status of package " ^ pkg
+      | QCron user => "Asked about cron permissions for user " ^ user
+      | QFtp user => "Asked about FTP permissions for user " ^ user
+      | QTrustedPath user => "Asked about trusted path settings for user " ^ user
+
 fun service () =
     let
        val () = Acl.read Config.aclFile
@@ -1029,6 +1160,12 @@ fun service () =
                                               NONE)))
                                (fn () => ())
 
+                             | MsgQuery q =>
+                               doIt (fn () => (Msg.send (bio, answerQuery q);
+                                               (describeQuery q,
+                                                NONE)))
+                               (fn () => ())
+
                              | _ =>
                                doIt (fn () => ("Unexpected command",
                                                SOME "Unexpected command"))
@@ -1099,9 +1236,14 @@ fun slave () =
                          | _ => (OpenSSL.close bio;
                                  loop ())
                    else
-                       (print "Not authorized!\n";
-                        OpenSSL.close bio;
-                        loop ())
+                       case Msg.recv bio of
+                           SOME (MsgQuery q) => (print (describeQuery q ^ "\n");
+                                                 Msg.send (bio, answerQuery q);
+                                                 ignore (OpenSSL.readChar bio);
+                                                 OpenSSL.close bio;
+                                                 loop ())
+                         | _ => (OpenSSL.close bio;
+                                 loop ())
                end handle OpenSSL.OpenSSL s =>
                           (print ("OpenSSL error: "^ s ^ "\n");
                            OpenSSL.close bio