From 30a6ab30f2451b9788328336dd937a4263f5f5c7 Mon Sep 17 00:00:00 2001 From: Andrew Deason Date: Tue, 26 Feb 2019 20:47:00 -0600 Subject: [PATCH] ptserver: Check for superuser in WhoIsThisWithName In WhoIsThisWithName, if we don't understand the rx security class being used (such as rxgk), we'll set the calling id to the anonymous user and return an error. But for SYSADMINID specifically, we don't really need to know any security-class-specific details; we just need to know that the caller is the superuser. So add a fallback case to check for that; if we don't understand the calling rx security class, just check if the calling user is RX_ID_SUPERUSER, and use SYSADMINID if so. This allows the ptserver to handle rxgk localauth requests (and theoretically, localauth requests for any future security classes), and theoretically any localauth requests for future security classes. Based on a commit from mvitale@sinenomine.net. Change-Id: Ia9bc91fb5a0d9ebf16b32659c9068aa5a9da8401 Reviewed-on: https://gerrit.openafs.org/13508 Tested-by: BuildBot Reviewed-by: Michael Meffie Reviewed-by: Benjamin Kaduk --- src/ptserver/ptprocs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c index a3ad9c5..f6fb751 100644 --- a/src/ptserver/ptprocs.c +++ b/src/ptserver/ptprocs.c @@ -62,6 +62,7 @@ #include #include #include +#include #include #include @@ -2069,6 +2070,25 @@ WhoIsThisWithName(struct rx_call *acall, struct ubik_trans *at, afs_int32 *aid, lcstring(vname, vname, sizeof(vname)); code = NameToID(at, vname, aid); } + + } else { + /* If we reached here, we don't understand the security class of the + * given call. But if the calling user is RX_ID_SUPERUSER, we can check + * that without even needing to understand the security class. Remember + * to only check for RX_ID_SUPERUSER specifically; we do not use + * SYSADMINID for other admins. */ + int is_super; + struct rx_identity *id = NULL; + is_super = afsconf_SuperIdentity(prdir, acall, &id); + if (is_super && id->kind == RX_ID_SUPERUSER) { + *aid = SYSADMINID; + code = 0; + } else { + code = -1; + } + if (id != NULL) { + rx_identity_free(&id); + } } done: if (code && !pr_noAuth) -- 1.9.4