IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add a new user to run the framework code

Browse Source 
Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
This commit is contained in:
Simo Sorce
2016-08-16 09:03:19 -04:00
committed by Jan Cholasta
parent c2b1b2a362
commit 4fd89833ee
18 changed files with 73 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ipaplatform/base/paths.py
View File

@@ -203,6 +203,7 @@ class BasePathNamespace(object):
DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel-pkcs11"
GETSEBOOL = "/usr/sbin/getsebool"
GROUPADD = "/usr/sbin/groupadd"
USERMOD = "/usr/sbin/usermod"
HTTPD = "/usr/sbin/httpd"
IPA_CLIENT_INSTALL = "/usr/sbin/ipa-client-install"
IPA_DNS_INSTALL = "/usr/sbin/ipa-dns-install"

15
ipaplatform/base/tasks.py
View File

@@ -181,7 +181,9 @@ class BaseTaskNamespace(object):
raise NotImplementedError()
def create_system_user(self, name, group, homedir, shell, uid=None, gid=None, comment=None, create_homedir=False):
def create_system_user(self, name, group, homedir, shell,
uid=None, gid=None, comment=None,
create_homedir=False, groups=None):
"""Create a system user with a corresponding group"""
try:
grp.getgrnam(group)
@@ -218,6 +220,8 @@ class BaseTaskNamespace(object):
args += ['-m']
else:
args += ['-M']
if groups is not None:
args += ['-G', groups.join(',')]
try:
ipautil.run(args)
log.debug('Done adding user')
@@ -261,3 +265,12 @@ class BaseTaskNamespace(object):
def is_fips_enabled(self):
return False
def add_user_to_group(self, user, group):
log.debug('Adding user %s to group %s', user, group)
args = [paths.USERMOD, '-a', '-G', group, user]
try:
ipautil.run(args)
log.debug('Done adding user to group')
except ipautil.CalledProcessError as e:
log.debug('Failed to add user to group: %s', e)

16
ipaplatform/redhat/tasks.py
View File

@@ -51,6 +51,8 @@ from ipaplatform.paths import paths
from ipaplatform.redhat.authconfig import RedHatAuthConfig
from ipaplatform.base.tasks import BaseTaskNamespace
from ipalib.constants import IPAAPI_USER
_ffi = FFI()
_ffi.cdef("""
int rpmvercmp (const char *a, const char *b);
@@ -411,7 +413,9 @@ class RedHatTaskNamespace(BaseTaskNamespace):
return True
def create_system_user(self, name, group, homedir, shell, uid=None, gid=None, comment=None, create_homedir=False):
def create_system_user(self, name, group, homedir, shell,
uid=None, gid=None, comment=None,
create_homedir=False, groups=None):
"""
Create a system user with a corresponding group
@@ -431,8 +435,9 @@ class RedHatTaskNamespace(BaseTaskNamespace):
if comment is None:
comment = 'DS System User'
super(RedHatTaskNamespace, self).create_system_user(name, group,
homedir, shell, uid, gid, comment, create_homedir)
super(RedHatTaskNamespace, self).create_system_user(
name, group, homedir, shell, uid, gid, comment, create_homedir,
groups)
def parse_ipa_version(self, version):
"""
@@ -467,7 +472,8 @@ class RedHatTaskNamespace(BaseTaskNamespace):
dict(
HTTP_KEYTAB=paths.HTTP_KEYTAB,
HTTP_CCACHE=paths.HTTP_CCACHE,
HTTPD_USER=constants.HTTPD_USER
HTTPD_USER=constants.HTTPD_USER,
IPAAPI_USER=IPAAPI_USER,
)
)
@@ -520,7 +526,7 @@ class RedHatTaskNamespace(BaseTaskNamespace):
def create_tmpfiles_dirs(self):
parent = os.path.dirname(paths.IPA_CCACHES)
pent = pwd.getpwnam(constants.HTTPD_USER)
pent = pwd.getpwnam(IPAAPI_USER)
self._create_tmpfiles_dir(parent, 0o711, 0, 0)
self._create_tmpfiles_dir(paths.IPA_CCACHES, 0o770,
pent.pw_uid, pent.pw_gid)