OpenVAS Manager
7.0.3~git
|
The OpenVAS Manager management library (Access Control Layer). More...
#include "manage_acl.h"
#include "manage_sql.h"
#include "sql.h"
#include <assert.h>
#include <stdlib.h>
#include <string.h>
Go to the source code of this file.
Macros | |
#define | G_LOG_DOMAIN "md manage" |
GLib log domain. More... | |
#define | ACL_SUPER_CLAUSE(format) |
Super clause. More... | |
#define | ACL_SUPER_CLAUSE_ARGS(type, field, value, user_id, trash) |
Super clause arguments. More... | |
Functions | |
int | acl_user_may (const char *operation) |
Test whether a user may perform an operation. More... | |
int | acl_role_can_super_everyone (const char *role_id) |
Check whether a role has Super Admin capability. More... | |
int | acl_user_can_super_everyone (const char *uuid) |
Check whether a user is a Super Admin. More... | |
int | acl_user_can_everything (const char *user_id) |
Test whether a user may perform any operation. More... | |
int | acl_user_has_super (const char *super_user_id, user_t other_user) |
Test whether a user has super permission on another user. More... | |
int | acl_user_is_admin (const char *uuid) |
Check whether a user is an Admin. More... | |
int | acl_user_is_observer (const char *uuid) |
Check whether a user is an Observer. More... | |
int | user_is_super_admin (const char *uuid) |
Check whether a user is a Super Admin. More... | |
int | acl_user_is_user (const char *uuid) |
Check whether a user has the User role. More... | |
int | acl_user_has_super_on (const char *type, const char *field, const char *value, int trash) |
Test whether a user has Super permission on a resource. More... | |
int | acl_user_has_super_on_resource (const char *type, const char *field, resource_t resource, int trash) |
Test whether a user has Super permission on a resource. More... | |
int | acl_user_owns_name (const char *type, const char *value) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_is_owner (const char *type, const char *uuid) |
Test whether a user is the actual owner of a resource. More... | |
int | acl_user_owns_uuid (const char *type, const char *uuid, int trash) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_owns (const char *type, resource_t resource, int trash) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_owns_trash_uuid (const char *type, const char *uuid) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_has_access_uuid (const char *type, const char *uuid, const char *permission, int trash) |
Test whether the user may access a resource. More... | |
gchar * | acl_where_owned_user (const char *user_id, const char *user_sql, const char *type, const get_data_t *get, int owned, const gchar *owner_filter, resource_t resource, array_t *permissions) |
Generate the ownership part of an SQL WHERE clause for a given user. More... | |
gchar * | acl_where_owned (const char *type, const get_data_t *get, int owned, const gchar *owner_filter, resource_t resource, array_t *permissions) |
Generate the ownership part of an SQL WHERE clause. More... | |
gchar * | acl_where_owned_for_get (const char *type, const char *user_sql) |
Generate ownership part of WHERE, for getting a type of resource. More... | |
gchar * | acl_users_with_access_sql (const char *type, const char *resource_id, const char *users_where) |
Get an SQL values expression of users that can get a resource. More... | |
gchar * | acl_users_with_access_where (const char *type, const char *resource_id, const char *users_where, const char *user_expr) |
Get a static SQL condition selecting users that can get a resource. More... | |
The OpenVAS Manager management library (Access Control Layer).
This file isolates the access control portions of the OpenVAS manager management library.
Definition in file manage_acl.c.
#define ACL_SUPER_CLAUSE | ( | format | ) |
Super clause.
[in] | format | Value format specifier. |
Definition at line 385 of file manage_acl.c.
#define ACL_SUPER_CLAUSE_ARGS | ( | type, | |
field, | |||
value, | |||
user_id, | |||
trash | |||
) |
Super clause arguments.
[in] | type | Type of resource. |
[in] | field | Field to compare. Typically "uuid". |
[in] | value | Expected value of field. |
[in] | user_id | UUID of user. |
[in] | trash | Whether to search trash. |
Definition at line 446 of file manage_acl.c.
#define G_LOG_DOMAIN "md manage" |
GLib log domain.
Definition at line 46 of file manage_acl.c.
int acl_role_can_super_everyone | ( | const char * | role_id | ) |
Check whether a role has Super Admin capability.
[in] | role_id | ID of role. |
Definition at line 95 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
int acl_user_can_everything | ( | const char * | user_id | ) |
Test whether a user may perform any operation.
[in] | user_id | UUID of user. |
Definition at line 179 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
Referenced by acl_where_owned_user(), and sql_user_can_everything().
int acl_user_can_super_everyone | ( | const char * | uuid | ) |
Check whether a user is a Super Admin.
[in] | uuid | Uuid of user. |
Definition at line 127 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
int acl_user_has_access_uuid | ( | const char * | type, |
const char * | uuid, | ||
const char * | permission, | ||
int | trash | ||
) |
Test whether the user may access a resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
[in] | permission | Permission. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 758 of file manage_acl.c.
References acl_user_owns_uuid(), current_credentials, LOCATION_TABLE, report_task(), sql_int(), sql_int64(), sql_quote(), task_uuid(), and valid_omp_command().
Referenced by acl_users_with_access_sql(), alert_iterator_filter_readable(), find_resource_by_name_with_permission(), find_resource_with_permission(), and move_task().
int acl_user_has_super | ( | const char * | super_user_id, |
user_t | other_user | ||
) |
Test whether a user has super permission on another user.
[in] | super_user_id | UUID of user who may have super permission. |
[in] | other_user | Other user. |
Definition at line 226 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
int acl_user_has_super_on | ( | const char * | type, |
const char * | field, | ||
const char * | value, | ||
int | trash | ||
) |
Test whether a user has Super permission on a resource.
[in] | type | Type of resource. |
[in] | field | Field to compare with value. |
[in] | value | Identifier value of resource. |
[in] | trash | Whether resource is in trash. |
Definition at line 480 of file manage_acl.c.
References ACL_SUPER_CLAUSE, ACL_SUPER_CLAUSE_ARGS, current_credentials, sql_int(), and sql_quote().
Referenced by acl_user_owns_name(), acl_user_owns_trash_uuid(), and acl_user_owns_uuid().
int acl_user_has_super_on_resource | ( | const char * | type, |
const char * | field, | ||
resource_t | resource, | ||
int | trash | ||
) |
Test whether a user has Super permission on a resource.
[in] | type | Type of resource. |
[in] | field | Field to compare with resource. |
[in] | resource | Resource. |
[in] | trash | Whether resource is in trash. |
Definition at line 508 of file manage_acl.c.
References ACL_SUPER_CLAUSE, ACL_SUPER_CLAUSE_ARGS, current_credentials, and sql_int().
Referenced by acl_user_owns().
int acl_user_is_admin | ( | const char * | uuid | ) |
Check whether a user is an Admin.
[in] | uuid | Uuid of user. |
Definition at line 296 of file manage_acl.c.
References ROLE_UUID_ADMIN, sql_int(), and sql_quote().
int acl_user_is_observer | ( | const char * | uuid | ) |
Check whether a user is an Observer.
[in] | uuid | Uuid of user. |
Definition at line 319 of file manage_acl.c.
References ROLE_UUID_OBSERVER, sql_int(), and sql_quote().
int acl_user_is_owner | ( | const char * | type, |
const char * | uuid | ||
) |
Test whether a user is the actual owner of a resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
Definition at line 573 of file manage_acl.c.
References current_credentials, and sql_int().
int acl_user_is_user | ( | const char * | uuid | ) |
Check whether a user has the User role.
[in] | uuid | Uuid of user. |
Definition at line 365 of file manage_acl.c.
References ROLE_UUID_USER, sql_int(), and sql_quote().
int acl_user_may | ( | const char * | operation | ) |
Test whether a user may perform an operation.
[in] | operation | Name of operation. |
Definition at line 56 of file manage_acl.c.
References ACL_USER_MAY, current_credentials, sql_int(), and sql_quote().
Referenced by delete_alert(), init_get(), init_system_report_type_iterator(), manage_test_alert(), move_task(), resume_task(), start_task(), and stop_task().
int acl_user_owns | ( | const char * | type, |
resource_t | resource, | ||
int | trash | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | resource | Resource. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 666 of file manage_acl.c.
References acl_user_has_super_on_resource(), current_credentials, and sql_int().
Referenced by sql_user_owns().
int acl_user_owns_name | ( | const char * | type, |
const char * | value | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "report_format". |
[in] | value | Name of resource. |
Definition at line 531 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
int acl_user_owns_trash_uuid | ( | const char * | type, |
const char * | uuid | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
Definition at line 722 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
int acl_user_owns_uuid | ( | const char * | type, |
const char * | uuid, | ||
int | trash | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 606 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
Referenced by acl_user_has_access_uuid(), and find_resource().
gchar* acl_users_with_access_sql | ( | const char * | type, |
const char * | resource_id, | ||
const char * | users_where | ||
) |
Get an SQL values expression of users that can get a resource.
[in] | type | The resource type. |
[in] | resource_id | The UUID of the resource. |
[in] | users_where | Optional clause to limit users. |
Definition at line 1424 of file manage_acl.c.
References acl_user_has_access_uuid(), cleanup_iterator(), current_credentials, init_iterator(), iterator_int64(), iterator_string(), manage_session_init(), and next().
Referenced by acl_users_with_access_where().
gchar* acl_users_with_access_where | ( | const char * | type, |
const char * | resource_id, | ||
const char * | users_where, | ||
const char * | user_expr | ||
) |
Get a static SQL condition selecting users that can get a resource.
[in] | type | The resource type. |
[in] | resource_id | The UUID of the resource. |
[in] | users_where | Optional clause to limit users. |
[in] | user_expr | Expression for the user, e.g. the column name. |
Definition at line 1487 of file manage_acl.c.
References acl_users_with_access_sql().
gchar* acl_where_owned | ( | const char * | type, |
const get_data_t * | get, | ||
int | owned, | ||
const gchar * | owner_filter, | ||
resource_t | resource, | ||
array_t * | permissions | ||
) |
Generate the ownership part of an SQL WHERE clause.
[in] | type | Type of resource. |
[in] | get | GET data. |
[in] | owned | Only get items owned by the current user. |
[in] | owner_filter | Owner filter keyword. |
[in] | resource | Resource. |
[in] | permissions | Permissions. |
Definition at line 1352 of file manage_acl.c.
References acl_where_owned_user(), and current_credentials.
Referenced by init_alert_task_iterator().
gchar* acl_where_owned_for_get | ( | const char * | type, |
const char * | user_sql | ||
) |
Generate ownership part of WHERE, for getting a type of resource.
[in] | type | Type of resource. |
[in] | user_sql | SQL for getting user. If NULL SQL will be for current user. |
Definition at line 1378 of file manage_acl.c.
References acl_where_owned_user(), current_credentials, and get_data_t::trash.
Referenced by create_tables().
gchar* acl_where_owned_user | ( | const char * | user_id, |
const char * | user_sql, | ||
const char * | type, | ||
const get_data_t * | get, | ||
int | owned, | ||
const gchar * | owner_filter, | ||
resource_t | resource, | ||
array_t * | permissions | ||
) |
Generate the ownership part of an SQL WHERE clause for a given user.
[in] | user_id | UUID of user. "" can be used to rely on user_sql alone, except when type is "permission". |
[in] | user_sql | SQL to get user. |
[in] | type | Type of resource. |
[in] | get | GET data. |
[in] | owned | Only get items accessible by the given user. |
[in] | owner_filter | Owner filter keyword. |
[in] | resource | Resource. |
[in] | permissions | Permissions. |
Definition at line 948 of file manage_acl.c.
References acl_user_can_everything(), LOCATION_TABLE, LOCATION_TRASH, sql_quote(), and get_data_t::trash.
Referenced by acl_where_owned(), and acl_where_owned_for_get().
int user_is_super_admin | ( | const char * | uuid | ) |
Check whether a user is a Super Admin.
[in] | uuid | Uuid of user. |
Definition at line 342 of file manage_acl.c.
References ROLE_UUID_SUPER_ADMIN, sql_int(), and sql_quote().