feat: add nacm_user_groups() and nacm_group_users() lookup helpers - #697
Open
khromenokroman wants to merge 1 commit into
Open
khromenokroman wants to merge 1 commit into
khromenokroman wants to merge 1 commit into
Conversation
Add two read-only NACM query functions to lib/src/clixon_nacm.c so callers (CLI/backend plugins) can look up static group membership without parsing the NACM XML tree themselves: - nacm_user_groups(h, username, &groups, &ngroups): all groups a user is statically assigned to (groups/group[user-name=username]). - nacm_group_users(h, groupname, &users, &nusers): all users statically assigned to a group (the user-name leaf-list of groups/group[name=...]). Both resolve the currently active NACM configuration themselves via a new nacm_config_get() helper, which mirrors the tree-resolution logic at the start of nacm_access_pre() (respecting CLICON_NACM_MODE: disabled/external/internal) but is factored out so these lookups don't need to run inside an NACM RPC/data enforcement pass. Neither function resolves dynamic enable-external-groups (OS groups of a connected peer), since that needs live transport-layer peer state this standalone API does not have. Declarations added to lib/clixon/clixon_nacm.h. Verified with a standalone test against an in-memory NACM tree (CLICON_NACM_MODE=external).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@olofhagsand
Add two read-only NACM query functions to lib/src/clixon_nacm.c so callers (CLI/backend plugins) can look up static group membership without parsing the NACM XML tree themselves:
Both resolve the currently active NACM configuration themselves via a new nacm_config_get() helper, which mirrors the tree-resolution logic at the start of nacm_access_pre() (respecting CLICON_NACM_MODE: disabled/external/internal) but is factored out so these lookups don't need to run inside an NACM RPC/data enforcement pass. Neither function resolves dynamic enable-external-groups (OS groups of a connected peer), since that needs live transport-layer peer state this standalone API does not have.
Declarations added to lib/clixon/clixon_nacm.h. Verified with a standalone test against an in-memory NACM tree (CLICON_NACM_MODE=external).