Changeset 2282 for trunk

Timestamp:

09/02/19 20:11:12 (5 years ago)

Author:

nanardon

Message:

Ensure users cannot retrieve password, even encrypted

Location:

trunk/LATMOS-Accounts

Files:

• bin/la-cli (modified) (2 diffs)
• bin/la-dump (modified) (1 diff)
• bin/la-qacls (modified) (3 diffs)
• lib/LATMOS/Accounts/Acls.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Objects.pm (modified) (1 diff)
• patchset/logas_in_cli.patch (added)

trunk/LATMOS-Accounts/bin/la-cli

@@ -25 +25 @@
     'no-unexp|wo-unexp' => \my $nounexp,
     'with-unexp'        => \my $unexp,
+    'u|username=s'      => \my $username,
     'help'              => sub { pod2usage(0) },
 ) or pod2usage();
@@ -52 +53 @@
 Take into account only propagated objects (attribute 'exported'=1) (default)
 
+=item -u|--username USER
+
+Simulated access like user USER is login
+
 =back
 
 =cut
 
-my $LA = LATMOS::Accounts->new($config, noacl => 1);
+my $LA = LATMOS::Accounts->new($config, noacl => $username ? 0 : 1);
 my $labase = $LA->base($base);
 $labase && $labase->load or die "Cannot load base";

trunk/LATMOS-Accounts/bin/la-dump

@@ -81 +81 @@
 $otype ||= 'user';
 
-my $LA = LATMOS::Accounts->new($config, noacl => 1);
+my $LA = LATMOS::Accounts->new($config, noacl => $username ? 0 : 1);
 my $labase = $LA->base($base);
 $labase && $labase->load or die "Cannot load base";

trunk/LATMOS-Accounts/bin/la-qacls

@@ -66 +66 @@
 =cut
 
-my $LA = LATMOS::Accounts->new($config, noacl => 0);
+my $LA = LATMOS::Accounts->new($config, noacl => $user ? 0 : 1);
 
 my $labase = $LA->base($base);
@@ -73 +73 @@
 
 if ($user) {
-    $labase->{_user} = $user;
+    $labase->SetConnectedUser($user);
 }
 
@@ -85 +85 @@
 ) foreach(qw(@CREATE @DELETE));
 
-printf("%s%s %s\n",
-    ($labase->check_acl($obj, $_, 'r') ? 'r' : ' '),
-    ($labase->check_acl($obj, $_, 'w') ? 'w' : ' '),
-    $_,
-) foreach($labase->list_canonical_fields($otype, 'a'));
+foreach($labase->list_canonical_fields($otype, 'a')) {
+    my $attr = $labase->attribute($otype, $_);
+    printf("%s%s %s\n",
+        ($attr->readable ? ($labase->check_acl($obj, $_, 'r') ? 'r' : ' ') : '-'),
+        ($attr->ro       ? '-' : ($labase->check_acl($obj, $_, 'w') ? 'w' : ' ')),
+        $_,
+    )
+}

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Acls.pm

@@ -29 +29 @@
         }, $class
     );
-    if ($file) {
-        $acls->read_acl_file($file) or return;
-    }
 
     # Default ACLS:
-    $acls->add( '*.log', [ '$uid: read', '*: deny' ] );
+#    $acls->add( '*.log', [ '$uid: read', '*: deny' ] );
     $acls->add(
         'user.{userPasswd,userPassword,encryptedPassword,oldPassword}',
         [ '$uid: write', '*: deny' ],
     );
+
+    if ($file) {
+        $acls->read_acl_file($file) or return;
+    }
+
     $acls
 }

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases.pm

@@ -1185 +1185 @@
     my ($self, $username) = @_;
 
-    $self->{_user} = $username;
-    la_log(LA_DEBUG, "Connected as $username");
+    $self->{_user} = $username || '';
+    la_log(LA_DEBUG, "Connected as `$username'");
 }
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

@@ -240 +240 @@
     my ($self, $cfield) = @_;
     $self->base->check_acl($self, $cfield, 'r') or do {
-        $self->base->log(LA_ERR, "Permission denied to get %s/%s",
+        $self->base->log(LA_DEBUG, "Permission denied to get %s/%s",
             $self->id, $cfield
         );