From 14196891138e2f88b57d23120a4471496a3cccb6 Mon Sep 17 00:00:00 2001 From: David Hanina Date: Mon, 17 Mar 2025 09:26:44 +0100 Subject: [PATCH] Disallow removal of dogtag and ipa-dnskeysyncd services on IPA servers Also removes dogtagldap from unremovable services Fixes: https://pagure.io/freeipa/issue/9764 Signed-off-by: David Hanina Reviewed-By: Rob Crittenden --- ipaserver/plugins/service.py | 2 +- ipatests/test_xmlrpc/test_service_plugin.py | 26 +++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/ipaserver/plugins/service.py b/ipaserver/plugins/service.py index 075a1be8a..f50406472 100644 --- a/ipaserver/plugins/service.py +++ b/ipaserver/plugins/service.py @@ -323,7 +323,7 @@ def check_required_principal(ldap, principal): try: host_is_master(ldap, principal.hostname) except errors.ValidationError: - service_types = {'http', 'ldap', 'dns', 'dogtagldap'} + service_types = {'http', 'ldap', 'dns', 'dogtag', 'ipa-dnskeysyncd'} if principal.service_name.lower() in service_types: raise errors.ValidationError( name='principal', diff --git a/ipatests/test_xmlrpc/test_service_plugin.py b/ipatests/test_xmlrpc/test_service_plugin.py index a3b245679..4aeeb9d89 100644 --- a/ipatests/test_xmlrpc/test_service_plugin.py +++ b/ipatests/test_xmlrpc/test_service_plugin.py @@ -864,6 +864,32 @@ class test_service(Declarative): ), ), + dict( + desc=('Delete the current host (master?) %s dogtag service,' + ' should be caught' % api.env.host), + command=('service_del', ['dogtag/%s' % api.env.host], {}), + expected=errors.ValidationError( + name='principal', + error='dogtag/%s@%s is required by the IPA master' % ( + api.env.host, + api.env.realm + ) + ), + ), + + dict( + desc=('Delete the current host (master?) %s ipa-dnskeysyncd' + ' service, should be caught' % api.env.host), + command=('service_del', ['ipa-dnskeysyncd/%s' % api.env.host], {}), + expected=errors.ValidationError( + name='principal', + error='ipa-dnskeysyncd/%s@%s is required by the IPA master' % ( + api.env.host, + api.env.realm + ) + ), + ), + dict( desc='Disable the current host (master?) %s HTTP service, should be caught' % api.env.host,