IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-11-02 08:59:57 -06:00
Code Issues Packages Projects Releases Wiki Activity

sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute

Browse Source 
Makes sure we dereference the correct attribute. Also adds object class
checking.

https://fedorahosted.org/freeipa/ticket/4324

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
This commit is contained in:
Tomas Babej authored and Petr Viktorin committed 2014-06-25 20:14:50 +02:00
1 parent 9304b649a3
commit 3a56b155e8
2 files changed
+7 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

install/share/schema_compat.uldif
+1 -1
View File
@@ -96,7 +96,7 @@ add:schema-compat-entry-attribute: 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'
add:schema-compat-entry-attribute: 'sudoRunAsUser=%deref("ipaSudoRunAs","uid")'
add:schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixGroup)\",\"cn\")")'
add:schema-compat-entry-attribute: 'sudoRunAsGroup=%{ipaSudoRunAsExtGroup}'
add:schema-compat-entry-attribute: 'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")'
add:schema-compat-entry-attribute: 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
add:schema-compat-entry-attribute: 'sudoOption=%{ipaSudoOpt}'
dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config
install/updates/10-schema_compat.update
+6 -3
View File
@@ -1,10 +1,13 @@
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
only:schema-compat-entry-rdn:'%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'
replace: schema-compat-entry-attribute:'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")::sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
add:schema-compat-entry-attribute: 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'
add:schema-compat-entry-attribute: 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'
# Fix for #4324 (regression of #1309)
remove:schema-compat-entry-attribute:'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")'
# We need to add the value in a separate transaction
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
# Change padding for host and userCategory so the pad returns the same value
# as the original, '' or -.