SSSD Logo

Warning

This is a design page. It was used to design and discuss the initial implementation of the change. However, the state of this document does not necessarily correspond to the current state of the implementation since we do not keep this document up to date with further changes and bug fixes.

SUDO caching rules

  • sudoHost - to what host does the rule apply

    • ALL - all hostnames

    • hostname

    • IP address

    • +netgroup

    • regular expression - contains one of “\?*[]”

  • sudoUser - to what user does the rule apply

    • username

    • #uid

    • %group

    • +netgroup

  • sudoOrder - rules ordering

  • sudoNotBefore and sudoNotAfter - time constraints

Complete LDAP schema can be found here.

Per host update returns all rules that:

  • sudoHost equals to ALL

  • direct match with sudoHost (by hostname or address)

  • contains regular expression (will be filtered by sudo)

  • contains netgroup (will be filtered by sudo)

Hostname match is performed in sudo source in plugin/sudoers/ldap.c/sudo_ldap_check_host().

Per user update returns all rules that:

  • sudoUser equals to ALL

  • direct match with username, #uid or %group names

  • contains +netgroup (will be filtered by sudo)

Username match is performed via LADP filter in sudo source in plugin/sudoers/ldap.c/sudo_ldap_result_get().

Download only rules that were modified or newly created since the last refresh.

We will be looking for modified and newly created rules in short intervals. Expiration of the rules is handled per user during the execution time of sudo. We will also do periodical full refresh to ensure consistency even if the sudo command is not used.

sudoLastSmartRefreshTime on ou=SUDOers - when the last smart refresh was performed
sudoLastFullRefreshTime on ou=SUDOers - when the last full refresh was performed
sudoNextFullRefreshTime on ou=SUDOers - when the next full is scheduled
dataExpireTimestamp on each rule - when the rule will be considered as expired

Data provider will be performing following actions:

Interval is configurable via ldap_sudo_changed_refresh_interval (default: 15 minutes)
Enable modifyTimestamp with ldap_sudo_modify_timestamp_enabled (default: false)

  1. if server has changed then do C

  2. else if entryUSN is available then

    1. refresh rules per host, where entryUSN > currentHighestUSN

    2. goto 3.2.

  3. else if modifyTimestamp is enabled then

    1. refresh rules per host, where entryUSN > currentHighestUSN

    2. sudoLastSmartRefreshTime := current time

    3. nextrefresh := (current time + ldap_sudo_changed_refresh_interval)

    4. if nextrefresh >= sudoNextFullRefreshTime AND nextrefresh < (sudoNextFullRefreshTime + ldap_sudo_changed_refresh_interval) then

      1. nextrefresh := (sudoNextFullRefreshTime + ldap_sudo_changed_refresh_interval)

    5. schedule next smart refresh

  4. else do nothing

Configurable via ldap_sudo_full_refresh_interval (default: 360 minutes)

  1. do C

  2. sudoLastFullRefreshTime := current time

  3. sudoNextFullRefreshTime := (current time + ldap_sudo_full_refresh_interval)

  4. schedule next full refresh

  1. Download all rules per host

  2. Deletes all rules from the sysdb

  3. Store downloaded rule in the sysdb

  1. Download the rules

  2. Delete them from the sysdb

  3. Store downloaded rule in the sysdb

sudo_timed (default: false) - filter rules by time constraints?

  1. search sysdb per user

  2. refresh all expired rules

  3. if any rule was deleted then

    1. schedule C (out of band)

    2. search sysdb per user

  4. if sudo_timed = false then filter rules by time constraints

  5. sort rules

  6. return rules to sudo

  1. Should we also do per user smart updates when the user runs sudo?

  2. Should we create a tool to force full refresh of the rules immediately?