Fix Stanford policy for password default owner

In Wallet::Policy::Stanford, fix the default_owner logic for password
objects that are group-based rather than host-based.  Thanks,
macrotex.

Fixes #82

diff --git a/NEWS b/NEWS
index 1a21c1ab9b3174cd7f6b93c4afbdab880aaf52ec..cb78486341212d0f3ebdb038d21a7ba5f005fe5a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ wallet 1.5 (unreleased)
     Fix the table drop order for wallet-admin destroy to avoid violating
     foreign key constraints.  Patch from macrotex.
 
+    In Wallet::Policy::Stanford, fix the default_owner logic for password
+    objects that are group-based rather than host-based.  Thanks,
+    macrotex.  (#82)
+
     Update to rra-c-util 8.2:
 
     * Implement explicit_bzero with memset if it is not available.

diff --git a/perl/lib/Wallet/Policy/Stanford.pm b/perl/lib/Wallet/Policy/Stanford.pm
index 3aeea1c531ca73ee0454554115899c116dfd9c50..309429437a25512b64e5862a1af3192c4d8688a0 100644 (file)
--- a/perl/lib/Wallet/Policy/Stanford.pm
+++ b/perl/lib/Wallet/Policy/Stanford.pm
@@ -1,7 +1,7 @@
 # Wallet::Policy::Stanford -- Stanford's wallet naming and ownership policy
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2016 Russ Allbery <eagle@eyrie.org>
+# Copyright 2016, 2021 Russ Allbery <eagle@eyrie.org>
 # Copyright 2013-2015
 #     The Board of Trustees of the Leland Stanford Junior University
 #
@@ -260,15 +260,19 @@ sub default_owner {
     }
 
     # We have no open if this is not a file object.
-    return if $type ne 'file';
+    return if ($type ne 'file' && $type ne 'password');
 
     # Parse the name of the file object only far enough to get type and group
     # (if there is a group).
     my ($file_type, $group) = split('/', $name);
 
-    # Host-based file objects should be caught by the above.  We certainly
-    # can't do anything about them here.
-    return if $FILE_TYPE{$file_type}{host};
+    # Host-based file and password objects should be caught by the above.  We
+    # certainly can't do anything about them here.
+    if ($type eq 'file') {
+        return if $FILE_TYPE{$file_type}{host};
+    } elsif ($type eq 'password') {
+        return if $PASSWORD_TYPE{$file_type}{host};
+    }
 
     # If we have a mapping for this group, retrieve the ACL contents.  We
     # would like to just return the ACL name, but wallet currently requires we