IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity
69e4397421
freeipa/ipaserver/plugins/sudocmd.py

208 lines
7.1 KiB
Python
Raw Normal View History

Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
# Authors:
# Jr Aquino <jr.aquino@citrixonline.com>
#
# Copyright (C) 2010 Red Hat
# see file 'COPYING' for use and warranty information
#
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# along with this program. If not, see <http://www.gnu.org/licenses/>.
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
Remove unused imports This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-16 09:06:03 -06:00
from ipalib import api, errors
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
from ipalib import Str
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
from ipalib.plugable import Registry
ipalib: use relative imports for cross-plugin imports This will make it possible to move the plugin modules between ipalib, ipaclient and ipaserver without having to change the imports. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-20 08:41:34 -05:00
from .baseldap import (
Remove wildcard imports Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-16 12:04:20 -06:00
LDAPObject,
LDAPCreate,
LDAPDelete,
LDAPUpdate,
LDAPSearch,
LDAPRetrieve)
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
from ipalib import _, ngettext
Remove wildcard imports Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-16 12:04:20 -06:00
from ipapython.dn import DN
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _("""
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Sudo Commands
Commands used as building blocks for sudo
EXAMPLES:
Typos in freeIPA messages and man page https://fedorahosted.org/freeipa/ticket/1128
2011-05-04 03:26:18 -05:00
Create a new command
fixed typo for description usage example https://fedorahosted.org/freeipa/ticket/704
2011-01-06 09:26:06 -06:00
ipa sudocmd-add --desc='For reading log files' /usr/bin/less
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Remove a command
ipa sudocmd-del /usr/bin/less
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
""")
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
register = Registry()
help, makeapi: specify module topic by name Specify module topic by name rather than by name and summary. A topic module of the topic name must exist. Summary is extracted from the docstring of the topic module. This changes makes topic handling more generic and consistent between modules and commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-30 23:36:55 -05:00
topic = 'sudo'
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
sudocmd: ensure command doesn't contain trailing dot before adding it Trailing dots aren't permitted in sudo commands, as enforced explicitly in `get_dn`. Performing this check before adding the command prevents the user from entering invalid commands, which would otherwise trigger errors when accessing them afterwards. RN: ipa sudocmd-* commands now validate SUDO command name to not end with a dot. RN: Previously a trailing dot was stripped away in when addressing a SUDO command's LDAP object. RN: As a result, a SUDO command was created but it was not possible to refer to it in other IPA commands. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1925410 Signed-off-by: Antonio Torres <antorres@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-02-10 09:37:12 -06:00
def command_validator(ugettext, value):
if value.endswith('.'):
return _('must not contain trailing dot: %s') % value
return None
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd(LDAPObject):
"""
Sudo Command object.
"""
container_dn = api.env.container_sudocmd
Fixed object_name and object_name_plural internationalization The object_name, object_name_plural and messages that use these attributes have been converted to support translation. The label attribute in the Param class has been modified to accept unicode string. Ticket #1435
2011-07-12 11:01:25 -05:00
object_name = _('sudo command')
object_name_plural = _('sudo commands')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
object_class = ['ipaobject', 'ipasudocmd']
Add managed read permissions to Sudo objects Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-26 08:19:44 -05:00
permission_filter_objectclasses = ['ipasudocmd']
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
# object_class_config = 'ipahostobjectclasses'
search_attributes = [
Added fixes to adjust for sudocmd attribute for sudocmds. Added fix for sudorule to allow for cmdCategory all Added fixes for xmlrpc tests to reflect sudocmd changes.
2010-11-02 11:00:40 -05:00
'sudocmd', 'description',
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
]
default_attributes = [
Collect memberof information for sudo commands. We weren't searching the cn=sudo container so all members of a sudocmdgroup looked indirect. Add a label for sudo command groups. Update the tests to include verifying that membership is done properly. ticket 1003
2011-02-23 16:10:08 -06:00
'sudocmd', 'description', 'memberof',
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
]
Collect memberof information for sudo commands. We weren't searching the cn=sudo container so all members of a sudocmdgroup looked indirect. Add a label for sudo command groups. Update the tests to include verifying that membership is done properly. ticket 1003
2011-02-23 16:10:08 -06:00
attribute_members = {
'memberof': ['sudocmdgroup'],
}
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
uuid_attribute = 'ipauniqueid'
Use ipauniqueid for the RDN of sudo commands Since sudo commands are case-sensitive, we can't use 'sudocmd' as the RDN. Tests for case-sensitive behavior included https://fedorahosted.org/freeipa/ticket/2482
2012-03-08 06:55:00 -06:00
rdn_attribute = 'ipauniqueid'
Add managed read permissions to Sudo objects Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-26 08:19:44 -05:00
managed_permissions = {
'System: Read Sudo Commands': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'description', 'ipauniqueid', 'memberof', 'objectclass',
'sudocmd',
},
},
Convert Sudo Command default permissions to managed Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-04 10:39:10 -05:00
'System: Add Sudo Command': {
'ipapermright': {'add'},
'replaces': [
'(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo command";allow (add) groupdn = "ldap:///cn=Add Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
'(targetfilter = "(objectclass=ipasudocmd)")(target = "ldap:///cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo command";allow (add) groupdn = "ldap:///cn=Add Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
],
'default_privileges': {'Sudo Administrator'},
},
'System: Delete Sudo Command': {
'ipapermright': {'delete'},
'replaces': [
'(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo command";allow (delete) groupdn = "ldap:///cn=Delete Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
'(targetfilter = "(objectclass=ipasudocmd)")(target = "ldap:///cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo command";allow (delete) groupdn = "ldap:///cn=Delete Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
],
'default_privileges': {'Sudo Administrator'},
},
'System: Modify Sudo Command': {
'ipapermright': {'write'},
'ipapermdefaultattr': {'description'},
'replaces': [
'(targetattr = "description")(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify Sudo command";allow (write) groupdn = "ldap:///cn=Modify Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
'(targetfilter = "(objectclass=ipasudocmd)")(targetattr = "description")(target = "ldap:///cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify Sudo command";allow (write) groupdn = "ldap:///cn=Modify Sudo command,cn=permissions,cn=pbac,$SUFFIX";)',
],
'default_privileges': {'Sudo Administrator'},
},
Add managed read permissions to Sudo objects Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-26 08:19:44 -05:00
}
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
label = _('Sudo Commands')
Fixed label capitalization The CSS text-transform sometimes produces incorrect capitalization, so the code has been modified to use translated labels that already contain the correct capitalization. Ticket #1424
2011-07-13 21:10:47 -05:00
label_singular = _('Sudo Command')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
takes_params = (
sudocmd: ensure command doesn't contain trailing dot before adding it Trailing dots aren't permitted in sudo commands, as enforced explicitly in `get_dn`. Performing this check before adding the command prevents the user from entering invalid commands, which would otherwise trigger errors when accessing them afterwards. RN: ipa sudocmd-* commands now validate SUDO command name to not end with a dot. RN: Previously a trailing dot was stripped away in when addressing a SUDO command's LDAP object. RN: As a result, a SUDO command was created but it was not possible to refer to it in other IPA commands. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1925410 Signed-off-by: Antonio Torres <antorres@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-02-10 09:37:12 -06:00
Str('sudocmd', command_validator,
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
cli_name='command',
label=_('Sudo Command'),
primary_key=True,
),
Str('description?',
cli_name='desc',
label=_('Description'),
doc=_('A description of this command'),
),
)
def get_dn(self, *keys, **options):
if keys[-1].endswith('.'):
sudocmd: fix unsupported assignment sudocmd.get_dn() was trying to assign in an item of a tuple which is not possible. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-08-22 07:00:07 -05:00
keys = (keys[:-1] + (keys[-1][:-1], ))
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
dn = super(sudocmd, self).get_dn(*keys, **options)
try:
self.backend.get_entry(dn, [''])
except errors.NotFound:
try:
Convert remaining frontend code to LDAPEntry API.
2013-10-31 11:54:21 -05:00
entry_attrs = self.backend.find_entry_by_attr(
Added fixes to adjust for sudocmd attribute for sudocmds. Added fix for sudorule to allow for cmdCategory all Added fixes for xmlrpc tests to reflect sudocmd changes.
2010-11-02 11:00:40 -05:00
'sudocmd', keys[-1], self.object_class, [''],
Convert remaining frontend code to LDAPEntry API.
2013-10-31 11:54:21 -05:00
DN(self.container_dn, api.env.basedn))
dn = entry_attrs.dn
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
except errors.NotFound:
pass
return dn
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd_add(LDAPCreate):
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
__doc__ = _('Create new Sudo Command.')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
msg_summary = _('Added Sudo Command "%(value)s"')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd_del(LDAPDelete):
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
__doc__ = _('Delete Sudo Command.')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
msg_summary = _('Deleted Sudo Command "%(value)s"')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Prevent a sudo command from being deleted if it is a member of a sudo rule Tests included.
2012-03-13 07:37:24 -05:00
def pre_callback(self, ldap, dn, *keys, **options):
filters = [
ldap.make_filter_from_attr(attr, dn)
for attr in ('memberallowcmd', 'memberdenycmd')]
filter = ldap.combine_filters(filters, ldap.MATCH_ANY)
filter = ldap.combine_filters(
(filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')),
ldap.MATCH_ALL)
dependent_sudorules = []
try:
Remove unused variables in the code This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-09-26 07:08:17 -05:00
entries, _truncated = ldap.find_entries(
Prevent a sudo command from being deleted if it is a member of a sudo rule Tests included.
2012-03-13 07:37:24 -05:00
filter, ['cn'],
base_dn=DN(api.env.container_sudorule, api.env.basedn))
except errors.NotFound:
pass
else:
Convert remaining frontend code to LDAPEntry API.
2013-10-31 11:54:21 -05:00
for entry_attrs in entries:
Prevent a sudo command from being deleted if it is a member of a sudo rule Tests included.
2012-03-13 07:37:24 -05:00
[cn] = entry_attrs['cn']
dependent_sudorules.append(cn)
if dependent_sudorules:
raise errors.DependentEntry(
key=keys[0], label='sudorule',
dependent=', '.join(dependent_sudorules))
return dn
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd_mod(LDAPUpdate):
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
__doc__ = _('Modify Sudo Command.')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
msg_summary = _('Modified Sudo Command "%(value)s"')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd_find(LDAPSearch):
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
__doc__ = _('Search for Sudo Commands.')
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
msg_summary = ngettext(
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
'%(count)d Sudo Command matched', '%(count)d Sudo Commands matched', 0
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
)
Update all remaining plugins to the new Registry API Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-10 10:27:51 -05:00
@register()
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
class sudocmd_show(LDAPRetrieve):
Fix sudo help and summaries 1) Add sudorule docstring headline 2) Fix naming inconsistency in Sudo plugins help and summaries, especially capitalization of Sudo objects - Sudo Rule, Sudo Command and Sudo Command Group 3) Add missing summaries for sudorule-add-option and sudorule-remove-option. To keep backward compatibility with older clients, just print the missing summary with output_for_cli(), don't expand Output. https://fedorahosted.org/freeipa/ticket/1595 https://fedorahosted.org/freeipa/ticket/1596
2011-08-30 10:10:27 -05:00
__doc__ = _('Display Sudo Command.')
Reference in New Issue Copy Permalink