IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

Prevent a sudo command from being deleted if it is a member of a sudo rule

Browse Source 
Tests included.
This commit is contained in:
Petr Viktorin 2012-03-13 08:37:24 -04:00 committed by Martin Kosek
parent d66898405b
commit a694e61f42
3 changed files with 98 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
ipalib/plugins/sudocmd.py
View File

@ -109,6 +109,32 @@ class sudocmd_del(LDAPDelete):
msg_summary = _('Deleted Sudo Command "%(value)s"')
def pre_callback(self, ldap, dn, *keys, **options):
filters = [
ldap.make_filter_from_attr(attr, dn)
for attr in ('memberallowcmd', 'memberdenycmd')]
filter = ldap.combine_filters(filters, ldap.MATCH_ANY)
filter = ldap.combine_filters(
(filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')),
ldap.MATCH_ALL)
dependent_sudorules = []
try:
entries, truncated = ldap.find_entries(
filter, ['cn'],
base_dn=DN(api.env.container_sudorule, api.env.basedn))
except errors.NotFound:
pass
else:
for entry_dn, entry_attrs in entries:
[cn] = entry_attrs['cn']
dependent_sudorules.append(cn)
if dependent_sudorules:
raise errors.DependentEntry(
key=keys[0], label='sudorule',
dependent=', '.join(dependent_sudorules))
return dn
api.register(sudocmd_del)
class sudocmd_mod(LDAPUpdate):

70
tests/test_xmlrpc/test_sudocmd_plugin.py
View File

@ -29,12 +29,15 @@ from tests.test_xmlrpc import objectclasses
sudocmd1 = u'/usr/bin/sudotestcmd1'
sudocmd1_camelcase = u'/usr/bin/sudoTestCmd1'
sudorule1 = u'test_sudorule1'
class test_sudocmd(Declarative):
cleanup_commands = [
('sudocmd_del', [sudocmd1], {}),
('sudocmd_del', [sudocmd1_camelcase], {}),
('sudorule_del', [sudorule1], {}),
]
tests = [
@ -206,6 +209,73 @@ class test_sudocmd(Declarative):
),
),
dict(
desc='Create %r' % sudorule1,
command=('sudorule_add', [sudorule1], {}),
expected=lambda e, result: True,
),
dict(
desc='Add %r to %r allow list' % (sudocmd1, sudorule1),
command=('sudorule_add_allow_command', [sudorule1],
dict(sudocmd=sudocmd1)),
expected=dict(
completed=1,
failed=dict(
memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
result=lambda result: True,
),
),
dict(
desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
command=('sudocmd_del', [sudocmd1], {}),
expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
dependent=sudorule1),
),
dict(
desc='Remove %r from %r' % (sudocmd1, sudorule1),
command=('sudorule_remove_allow_command', [sudorule1],
dict(sudocmd=sudocmd1)),
expected=dict(
completed=1,
failed=dict(
memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
result=lambda result: True,
),
),
dict(
desc='Add %r to %r deny list' % (sudocmd1, sudorule1),
command=('sudorule_add_deny_command', [sudorule1],
dict(sudocmd=sudocmd1)),
expected=dict(
completed=1,
failed=dict(
memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
result=lambda result: True,
),
),
dict(
desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
command=('sudocmd_del', [sudocmd1], {}),
expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
dependent=sudorule1),
),
dict(
desc='Remove %r from %r' % (sudocmd1, sudorule1),
command=('sudorule_remove_deny_command', [sudorule1],
dict(sudocmd=sudocmd1)),
expected=dict(
completed=1,
failed=dict(
memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
result=lambda result: True,
),
),
dict(
desc='Delete %r' % sudocmd1,

2
tests/test_xmlrpc/test_sudorule_plugin.py
View File

@ -718,6 +718,8 @@ class test_sudorule(XMLRPC_test):
api.Command['group_del'](self.test_group)
api.Command['host_del'](self.test_host)
api.Command['hostgroup_del'](self.test_hostgroup)
api.Command['sudorule_remove_allow_command'](self.rule_name,
sudocmd=self.test_command)
api.Command['sudocmd_del'](self.test_command)
api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup)
api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup)