OpenVAS Manager
7.0.3~git
|
The OpenVAS Manager management library (Access Control Layer). More...
#include "manage_acl.h"
#include "manage_sql.h"
#include "sql.h"
#include <assert.h>
#include <stdlib.h>
#include <string.h>
Go to the source code of this file.
Macros | |
#define | G_LOG_DOMAIN "md manage" |
GLib log domain. More... | |
#define | ACL_SUPER_CLAUSE(format) |
Super clause. More... | |
#define | ACL_SUPER_CLAUSE_ARGS(type, field, value, user_id, trash) |
Super clause arguments. More... | |
Functions | |
int | acl_user_may (const char *operation) |
Test whether a user may perform an operation. More... | |
int | acl_role_can_super_everyone (const char *role_id) |
Check whether a role has Super Admin capability. More... | |
int | acl_user_can_super_everyone (const char *uuid) |
Check whether a user is a Super Admin. More... | |
int | acl_user_can_everything (const char *user_id) |
Test whether a user may perform any operation. More... | |
int | acl_user_has_super (const char *super_user_id, user_t other_user) |
Test whether a user has super permission on another user. More... | |
int | acl_user_is_admin (const char *uuid) |
Check whether a user is an Admin. More... | |
int | acl_user_is_observer (const char *uuid) |
Check whether a user is an Observer. More... | |
int | user_is_super_admin (const char *uuid) |
Check whether a user is a Super Admin. More... | |
int | acl_user_is_user (const char *uuid) |
Check whether a user has the User role. More... | |
int | acl_user_has_super_on (const char *type, const char *field, const char *value, int trash) |
Test whether a user has Super permission on a resource. More... | |
int | acl_user_has_super_on_resource (const char *type, const char *field, resource_t resource, int trash) |
Test whether a user has Super permission on a resource. More... | |
int | acl_user_owns_name (const char *type, const char *value) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_is_owner (const char *type, const char *uuid) |
Test whether a user is the actual owner of a resource. More... | |
int | acl_user_owns_uuid (const char *type, const char *uuid, int trash) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_owns (const char *type, resource_t resource, int trash) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_owns_trash_uuid (const char *type, const char *uuid) |
Test whether a user effectively owns a resource. More... | |
int | acl_user_has_access_uuid (const char *type, const char *uuid, const char *permission, int trash) |
Test whether the user may access a resource. More... | |
gchar * | acl_where_owned_user (const char *user_id, const char *user_sql, const char *type, const get_data_t *get, int owned, const gchar *owner_filter, resource_t resource, array_t *permissions) |
Generate the ownership part of an SQL WHERE clause for a given user. More... | |
gchar * | acl_where_owned (const char *type, const get_data_t *get, int owned, const gchar *owner_filter, resource_t resource, array_t *permissions) |
Generate the ownership part of an SQL WHERE clause. More... | |
gchar * | acl_where_owned_for_get (const char *type, const char *user_sql) |
Generate ownership part of WHERE, for getting a type of resource. More... | |
gchar * | acl_users_with_access_sql (const char *type, const char *resource_id, const char *users_where) |
Get an SQL values expression of users that can get a resource. More... | |
gchar * | acl_users_with_access_where (const char *type, const char *resource_id, const char *users_where, const char *user_expr) |
Get a static SQL condition selecting users that can get a resource. More... | |
The OpenVAS Manager management library (Access Control Layer).
This file isolates the access control portions of the OpenVAS manager management library.
Definition in file manage_acl.c.
#define ACL_SUPER_CLAUSE | ( | format | ) |
Super clause.
[in] | format | Value format specifier. |
Definition at line 385 of file manage_acl.c.
Referenced by acl_user_has_super_on(), and acl_user_has_super_on_resource().
#define ACL_SUPER_CLAUSE_ARGS | ( | type, | |
field, | |||
value, | |||
user_id, | |||
trash | |||
) |
Super clause arguments.
[in] | type | Type of resource. |
[in] | field | Field to compare. Typically "uuid". |
[in] | value | Expected value of field. |
[in] | user_id | UUID of user. |
[in] | trash | Whether to search trash. |
Definition at line 446 of file manage_acl.c.
Referenced by acl_user_has_super_on(), and acl_user_has_super_on_resource().
#define G_LOG_DOMAIN "md manage" |
GLib log domain.
Definition at line 46 of file manage_acl.c.
int acl_role_can_super_everyone | ( | const char * | role_id | ) |
Check whether a role has Super Admin capability.
[in] | role_id | ID of role. |
Definition at line 95 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
Referenced by copy_role().
int acl_user_can_everything | ( | const char * | user_id | ) |
Test whether a user may perform any operation.
[in] | user_id | UUID of user. |
Definition at line 179 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
Referenced by acl_where_owned_user(), and sql_user_can_everything().
int acl_user_can_super_everyone | ( | const char * | uuid | ) |
Check whether a user is a Super Admin.
[in] | uuid | Uuid of user. |
Definition at line 127 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
Referenced by copy_user(), and modify_user().
int acl_user_has_access_uuid | ( | const char * | type, |
const char * | uuid, | ||
const char * | permission, | ||
int | trash | ||
) |
Test whether the user may access a resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
[in] | permission | Permission. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 758 of file manage_acl.c.
References acl_user_owns_uuid(), current_credentials, LOCATION_TABLE, report_task(), sql_int(), sql_int64(), sql_quote(), task_uuid(), and valid_omp_command().
Referenced by acl_users_with_access_sql(), alert_iterator_filter_readable(), find_permission_with_permission(), find_resource_by_name_with_permission(), find_resource_with_permission(), find_result_with_permission(), init_port_range_iterator(), and move_task().
int acl_user_has_super | ( | const char * | super_user_id, |
user_t | other_user | ||
) |
Test whether a user has super permission on another user.
[in] | super_user_id | UUID of user who may have super permission. |
[in] | other_user | Other user. |
Definition at line 226 of file manage_acl.c.
References LOCATION_TABLE, sql_int(), and sql_quote().
int acl_user_has_super_on | ( | const char * | type, |
const char * | field, | ||
const char * | value, | ||
int | trash | ||
) |
Test whether a user has Super permission on a resource.
[in] | type | Type of resource. |
[in] | field | Field to compare with value. |
[in] | value | Identifier value of resource. |
[in] | trash | Whether resource is in trash. |
Definition at line 480 of file manage_acl.c.
References ACL_SUPER_CLAUSE, ACL_SUPER_CLAUSE_ARGS, current_credentials, sql_int(), and sql_quote().
Referenced by acl_user_owns_name(), acl_user_owns_trash_uuid(), and acl_user_owns_uuid().
int acl_user_has_super_on_resource | ( | const char * | type, |
const char * | field, | ||
resource_t | resource, | ||
int | trash | ||
) |
Test whether a user has Super permission on a resource.
[in] | type | Type of resource. |
[in] | field | Field to compare with resource. |
[in] | resource | Resource. |
[in] | trash | Whether resource is in trash. |
Definition at line 508 of file manage_acl.c.
References ACL_SUPER_CLAUSE, ACL_SUPER_CLAUSE_ARGS, current_credentials, and sql_int().
Referenced by acl_user_owns().
int acl_user_is_admin | ( | const char * | uuid | ) |
Check whether a user is an Admin.
[in] | uuid | Uuid of user. |
Definition at line 296 of file manage_acl.c.
References ROLE_UUID_ADMIN, sql_int(), and sql_quote().
Referenced by modify_user().
int acl_user_is_observer | ( | const char * | uuid | ) |
Check whether a user is an Observer.
[in] | uuid | Uuid of user. |
Definition at line 319 of file manage_acl.c.
References ROLE_UUID_OBSERVER, sql_int(), and sql_quote().
int acl_user_is_owner | ( | const char * | type, |
const char * | uuid | ||
) |
Test whether a user is the actual owner of a resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
Definition at line 573 of file manage_acl.c.
References current_credentials, and sql_int().
int acl_user_is_user | ( | const char * | uuid | ) |
Check whether a user has the User role.
[in] | uuid | Uuid of user. |
Definition at line 365 of file manage_acl.c.
References ROLE_UUID_USER, sql_int(), and sql_quote().
int acl_user_may | ( | const char * | operation | ) |
Test whether a user may perform an operation.
[in] | operation | Name of operation. |
Definition at line 56 of file manage_acl.c.
References ACL_USER_MAY, current_credentials, sql_int(), and sql_quote().
Referenced by copy_role(), create_asset_host(), create_asset_report(), create_config(), create_config_from_scanner(), create_credential(), create_filter(), create_group(), create_note(), create_override(), create_port_list(), create_port_range(), create_role(), create_scanner(), create_schedule(), create_tag(), create_user(), delete_agent(), delete_alert(), delete_asset(), delete_config(), delete_credential(), delete_filter(), delete_group(), delete_note(), delete_override(), delete_permission(), delete_port_list(), delete_port_range(), delete_report(), delete_report_format(), delete_role(), delete_scanner(), delete_schedule(), delete_tag(), delete_target(), delete_user(), init_system_report_type_iterator(), manage_empty_trashcan(), manage_restore(), manage_run_wizard(), manage_test_alert(), modify_agent(), modify_asset(), modify_credential(), modify_filter(), modify_group(), modify_permission(), modify_port_list(), modify_report(), modify_report_format(), modify_role(), modify_scanner(), modify_schedule(), modify_tag(), modify_target(), modify_user(), move_task(), openvas_sync_feed(), request_delete_task_uuid(), resume_task(), set_credential_data(), start_task(), stop_task(), sync_config(), verify_agent(), verify_report_format(), and verify_scanner().
int acl_user_owns | ( | const char * | type, |
resource_t | resource, | ||
int | trash | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | resource | Resource. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 666 of file manage_acl.c.
References acl_user_has_super_on_resource(), current_credentials, and sql_int().
Referenced by sql_user_owns().
int acl_user_owns_name | ( | const char * | type, |
const char * | value | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "report_format". |
[in] | value | Name of resource. |
Definition at line 531 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
Referenced by lookup_report_format().
int acl_user_owns_trash_uuid | ( | const char * | type, |
const char * | uuid | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
Definition at line 722 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
int acl_user_owns_uuid | ( | const char * | type, |
const char * | uuid, | ||
int | trash | ||
) |
Test whether a user effectively owns a resource.
A Super permissions can give a user effective ownership of another user's resource.
[in] | type | Type of resource, for example "task". |
[in] | uuid | UUID of resource. |
[in] | trash | Whether the resource is in the trash. |
Definition at line 606 of file manage_acl.c.
References acl_user_has_super_on(), current_credentials, sql_int(), and sql_quote().
Referenced by acl_user_has_access_uuid(), find_config(), find_port_list(), find_resource(), and find_task().
gchar* acl_users_with_access_sql | ( | const char * | type, |
const char * | resource_id, | ||
const char * | users_where | ||
) |
Get an SQL values expression of users that can get a resource.
[in] | type | The resource type. |
[in] | resource_id | The UUID of the resource. |
[in] | users_where | Optional clause to limit users. |
Definition at line 1424 of file manage_acl.c.
References acl_user_has_access_uuid(), cleanup_iterator(), current_credentials, init_iterator(), iterator_int64(), iterator_string(), manage_session_init(), and next().
Referenced by acl_users_with_access_where(), and init_report_counts_build_iterator().
gchar* acl_users_with_access_where | ( | const char * | type, |
const char * | resource_id, | ||
const char * | users_where, | ||
const char * | user_expr | ||
) |
Get a static SQL condition selecting users that can get a resource.
[in] | type | The resource type. |
[in] | resource_id | The UUID of the resource. |
[in] | users_where | Optional clause to limit users. |
[in] | user_expr | Expression for the user, e.g. the column name. |
Definition at line 1487 of file manage_acl.c.
References acl_users_with_access_sql().
gchar* acl_where_owned | ( | const char * | type, |
const get_data_t * | get, | ||
int | owned, | ||
const gchar * | owner_filter, | ||
resource_t | resource, | ||
array_t * | permissions | ||
) |
Generate the ownership part of an SQL WHERE clause.
[in] | type | Type of resource. |
[in] | get | GET data. |
[in] | owned | Only get items owned by the current user. |
[in] | owner_filter | Owner filter keyword. |
[in] | resource | Resource. |
[in] | permissions | Permissions. |
Definition at line 1352 of file manage_acl.c.
References acl_where_owned_user(), and current_credentials.
Referenced by init_alert_task_iterator(), init_config_task_iterator(), init_credential_scanner_iterator(), init_credential_target_iterator(), init_filter_alert_iterator(), init_port_list_target_iterator(), init_report_format_alert_iterator(), init_resource_tag_iterator(), init_scanner_task_iterator(), init_schedule_task_iterator(), init_target_task_iterator(), init_user_group_iterator(), and init_user_role_iterator().
gchar* acl_where_owned_for_get | ( | const char * | type, |
const char * | user_sql | ||
) |
Generate ownership part of WHERE, for getting a type of resource.
[in] | type | Type of resource. |
[in] | user_sql | SQL for getting user. If NULL SQL will be for current user. |
Definition at line 1378 of file manage_acl.c.
References acl_where_owned_user(), and current_credentials.
Referenced by create_tables(), host_routes_xml(), report_add_result(), report_severity_data_prepare(), and report_severity_data_prepare_full().
gchar* acl_where_owned_user | ( | const char * | user_id, |
const char * | user_sql, | ||
const char * | type, | ||
const get_data_t * | get, | ||
int | owned, | ||
const gchar * | owner_filter, | ||
resource_t | resource, | ||
array_t * | permissions | ||
) |
Generate the ownership part of an SQL WHERE clause for a given user.
[in] | user_id | UUID of user. "" can be used to rely on user_sql alone, except when type is "permission". |
[in] | user_sql | SQL to get user. |
[in] | type | Type of resource. |
[in] | get | GET data. |
[in] | owned | Only get items accessible by the given user. |
[in] | owner_filter | Owner filter keyword. |
[in] | resource | Resource. |
[in] | permissions | Permissions. |
Definition at line 948 of file manage_acl.c.
References acl_user_can_everything(), LOCATION_TABLE, LOCATION_TRASH, and sql_quote().
Referenced by acl_where_owned(), acl_where_owned_for_get(), and init_task_schedule_iterator().
int user_is_super_admin | ( | const char * | uuid | ) |
Check whether a user is a Super Admin.
[in] | uuid | Uuid of user. |
Definition at line 342 of file manage_acl.c.
References ROLE_UUID_SUPER_ADMIN, sql_int(), and sql_quote().
Referenced by delete_user().