Greenbone Vulnerability Manager  9.0.0
manage_acl.h
Go to the documentation of this file.
1 /* Copyright (C) 2013-2018 Greenbone Networks GmbH
2  *
3  * SPDX-License-Identifier: GPL-2.0-or-later
4  *
5  * This program is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU General Public License
7  * as published by the Free Software Foundation; either version 2
8  * of the License, or (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program; if not, write to the Free Software
17  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  */
19 
25 #ifndef _GVMD_MANAGE_ACL_H
26 #define _GVMD_MANAGE_ACL_H
27 
28 #include "manage_sql.h"
29 #include <glib.h>
30 
36 #define ACL_USER_MAY(resource) \
37  "SELECT count(*) > 0 FROM permissions" \
38  " WHERE resource = " resource \
39  " AND subject_location = " G_STRINGIFY (LOCATION_TABLE) \
40  " AND ((subject_type = 'user'" \
41  " AND subject" \
42  " = (SELECT id FROM users" \
43  " WHERE users.uuid = '%s'))" \
44  " OR (subject_type = 'group'" \
45  " AND subject" \
46  " IN (SELECT DISTINCT \"group\"" \
47  " FROM group_users" \
48  " WHERE \"user\" = (SELECT id" \
49  " FROM users" \
50  " WHERE users.uuid" \
51  " = '%s')))" \
52  " OR (subject_type = 'role'" \
53  " AND subject" \
54  " IN (SELECT DISTINCT role" \
55  " FROM role_users" \
56  " WHERE \"user\" = (SELECT id" \
57  " FROM users" \
58  " WHERE users.uuid" \
59  " = '%s'))))" \
60  /* Any permission implies GET. */ \
61  " AND ((lower (substr ('%s', 1, 3)) = 'get'" \
62  " AND name LIKE '%%'" \
63  " || lower (substr ('%s'," \
64  " 5," \
65  " length ('%s') - 5)))" \
66  " OR name = lower ('%s'))"
67 
73 #define ACL_IS_GLOBAL() \
74  "owner IS NULL"
75 
84 #define ACL_USER_OWNS() \
85  " (owner = (SELECT users.id FROM users" \
86  " WHERE users.uuid = '%s'))"
87 
96 #define ACL_GLOBAL_OR_USER_OWNS() \
97  " ((" ACL_IS_GLOBAL () ")" \
98  " OR (owner = (SELECT users.id FROM users" \
99  " WHERE users.uuid = '%s')))"
100 
101 int
102 acl_user_may (const char *);
103 
104 int
105 acl_user_can_everything (const char *);
106 
107 int
108 acl_role_can_super_everyone (const char *);
109 
110 int
111 acl_user_can_super_everyone (const char *);
112 
113 int
114 acl_user_has_super (const char *, user_t);
115 
116 int
117 acl_user_is_admin (const char *);
118 
119 int
120 acl_user_is_user (const char *);
121 
122 int
123 acl_user_is_super_admin (const char *);
124 
125 int
126 acl_user_is_observer (const char *);
127 
128 int
129 acl_user_owns (const char *, resource_t, int);
130 
131 int
132 acl_user_is_owner (const char *, const char *);
133 
134 int
135 acl_user_owns_uuid (const char *, const char *, int);
136 
137 int
138 acl_user_owns_trash_uuid (const char *resource, const char *uuid);
139 
140 int
141 acl_user_has_access_uuid (const char *, const char *, const char *, int);
142 
143 gchar *
144 acl_where_owned (const char *, const get_data_t *, int, const gchar *, resource_t,
145  array_t *, gchar **);
146 
147 gchar *
148 acl_where_owned_for_get (const char *, const char *, gchar **);
149 
150 gchar *
151 acl_users_with_access_sql (const char *, const char *, const char *);
152 
153 gchar *
154 acl_users_with_access_where (const char *, const char *, const char *,
155  const char*);
156 
157 #endif /* not _GVMD_MANAGE_ACL_H */
acl_user_is_admin
int acl_user_is_admin(const char *)
Check whether a user is an Admin.
Definition: manage_acl.c:291
acl_user_is_owner
int acl_user_is_owner(const char *, const char *)
Test whether a user is the actual owner of a resource.
Definition: manage_acl.c:526
acl_user_can_super_everyone
int acl_user_can_super_everyone(const char *)
Check whether a user is a Super Admin.
Definition: manage_acl.c:122
acl_users_with_access_where
gchar * acl_users_with_access_where(const char *, const char *, const char *, const char *)
Get a static SQL condition selecting users that can get a resource.
Definition: manage_acl.c:1526
acl_where_owned
gchar * acl_where_owned(const char *, const get_data_t *, int, const gchar *, resource_t, array_t *, gchar **)
Generate the ownership part of an SQL WHERE clause.
Definition: manage_acl.c:1387
acl_user_is_user
int acl_user_is_user(const char *)
Check whether a user has the User role.
Definition: manage_acl.c:360
acl_user_is_observer
int acl_user_is_observer(const char *)
Check whether a user is an Observer.
Definition: manage_acl.c:314
resource_t
long long int resource_t
A resource, like a task or target.
Definition: iterator.h:40
acl_user_has_access_uuid
int acl_user_has_access_uuid(const char *, const char *, const char *, int)
Test whether the user may access a resource.
Definition: manage_acl.c:722
acl_user_is_super_admin
int acl_user_is_super_admin(const char *)
Check whether a user is a Super Admin.
Definition: manage_acl.c:337
acl_role_can_super_everyone
int acl_role_can_super_everyone(const char *)
Check whether a role has Super Admin capability.
Definition: manage_acl.c:90
get_data_t
Command data for a get command.
Definition: manage.h:354
acl_users_with_access_sql
gchar * acl_users_with_access_sql(const char *, const char *, const char *)
Get an SQL values expression of users that can get a resource.
Definition: manage_acl.c:1463
acl_user_owns
int acl_user_owns(const char *, resource_t, int)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:633
acl_user_has_super
int acl_user_has_super(const char *, user_t)
Test whether a user has super permission on another user.
Definition: manage_acl.c:221
acl_where_owned_for_get
gchar * acl_where_owned_for_get(const char *, const char *, gchar **)
Generate ownership part of WHERE, for getting a type of resource.
Definition: manage_acl.c:1416
acl_user_owns_uuid
int acl_user_owns_uuid(const char *, const char *, int)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:559
acl_user_may
int acl_user_may(const char *)
Test whether a user may perform an operation.
Definition: manage_acl.c:51
acl_user_can_everything
int acl_user_can_everything(const char *)
Test whether a user may perform any operation.
Definition: manage_acl.c:174
acl_user_owns_trash_uuid
int acl_user_owns_trash_uuid(const char *resource, const char *uuid)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:687