mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Add plugins for Sudo Commands, Command Groups and Rules
This commit is contained in:
Jr Aquino
Rob Crittenden
parent
c187702bfe
commit
af48654cbc
@ -46,12 +46,30 @@ objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: hbacservicegroups
|
||||
|
||||
dn: cn=sudocmds,cn=accounts,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: sudocmds
|
||||
|
||||
dn: cn=sudocmdgroups,cn=accounts,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: sudocmdgroups
|
||||
|
||||
dn: cn=hbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: hbac
|
||||
|
||||
dn: cn=sudorules,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: nsContainer
|
||||
cn: sudorules
|
||||
|
||||
dn: cn=SUDOers,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: nsContainer
|
||||
|
||||
@ -99,6 +99,9 @@ DEFAULT_CONFIG = (
|
||||
('container_hbacservicegroup', 'cn=hbacservicegroups,cn=accounts'),
|
||||
('container_dns', 'cn=dns'),
|
||||
('container_virtual', 'cn=virtual operations'),
|
||||
('container_sudorule', 'cn=sudorules'),
|
||||
('container_sudocmd', 'cn=sudocmds,cn=accounts'),
|
||||
('container_sudocmdgroup', 'cn=sudocmdgroups,cn=accounts'),
|
||||
|
||||
# Ports, hosts, and URIs:
|
||||
# FIXME: let's renamed xmlrpc_uri to rpc_xml_uri
|
||||
|
||||
137
ipalib/plugins/sudocmd.py
Normal file
137
ipalib/plugins/sudocmd.py
Normal file
@ -0,0 +1,137 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
"""
|
||||
Sudo Commands
|
||||
|
||||
Commands used as building blocks for sudo
|
||||
|
||||
EXAMPLES:
|
||||
|
||||
Create a new commnad
|
||||
ipa sudocmd-add --description='For reading log files' /usr/bin/less
|
||||
|
||||
Remove a command
|
||||
ipa sudocmd-del /usr/bin/less
|
||||
|
||||
"""
|
||||
|
||||
import platform
|
||||
import os
|
||||
import sys
|
||||
|
||||
from ipalib import api, errors, util
|
||||
from ipalib import Str
|
||||
from ipalib.plugins.baseldap import *
|
||||
from ipalib import _, ngettext
|
||||
|
||||
|
||||
class sudocmd(LDAPObject):
|
||||
"""
|
||||
Sudo Command object.
|
||||
"""
|
||||
container_dn = api.env.container_sudocmd
|
||||
object_name = 'sudocmd'
|
||||
object_name_plural = 'sudocmds'
|
||||
object_class = ['ipaobject', 'ipasudocmd']
|
||||
# object_class_config = 'ipahostobjectclasses'
|
||||
search_attributes = [
|
||||
'cn', 'description',
|
||||
]
|
||||
default_attributes = [
|
||||
'cn', 'description',
|
||||
]
|
||||
uuid_attribute = 'ipauniqueid'
|
||||
label = _('SudoCmds')
|
||||
|
||||
takes_params = (
|
||||
Str('cn',
|
||||
cli_name='command',
|
||||
label=_('Sudo Command'),
|
||||
primary_key=True,
|
||||
#normalizer=lambda value: value.lower(),
|
||||
),
|
||||
Str('description?',
|
||||
cli_name='desc',
|
||||
label=_('Description'),
|
||||
doc=_('A description of this command'),
|
||||
),
|
||||
)
|
||||
|
||||
def get_dn(self, *keys, **options):
|
||||
if keys[-1].endswith('.'):
|
||||
keys[-1] = keys[-1][:-1]
|
||||
dn = super(sudocmd, self).get_dn(*keys, **options)
|
||||
try:
|
||||
self.backend.get_entry(dn, [''])
|
||||
except errors.NotFound:
|
||||
try:
|
||||
(dn, entry_attrs) = self.backend.find_entry_by_attr(
|
||||
'cn', keys[-1], self.object_class, [''],
|
||||
self.container_dn
|
||||
)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
return dn
|
||||
|
||||
api.register(sudocmd)
|
||||
|
||||
class sudocmd_add(LDAPCreate):
|
||||
"""
|
||||
Create new sudo command.
|
||||
"""
|
||||
|
||||
msg_summary = _('Added sudo command "%(value)s"')
|
||||
|
||||
api.register(sudocmd_add)
|
||||
|
||||
class sudocmd_del(LDAPDelete):
|
||||
"""
|
||||
Delete sudo command.
|
||||
"""
|
||||
|
||||
msg_summary = _('Deleted sudo command "%(value)s"')
|
||||
|
||||
api.register(sudocmd_del)
|
||||
|
||||
class sudocmd_mod(LDAPUpdate):
|
||||
"""
|
||||
Modify command.
|
||||
"""
|
||||
|
||||
msg_summary = _('Modified sudo command "%(value)s"')
|
||||
|
||||
api.register(sudocmd_mod)
|
||||
|
||||
class sudocmd_find(LDAPSearch):
|
||||
"""
|
||||
Search for commands.
|
||||
"""
|
||||
|
||||
msg_summary = ngettext(
|
||||
'%(count)d sudo command matched', '%(count)d sudo command matched'
|
||||
)
|
||||
|
||||
api.register(sudocmd_find)
|
||||
|
||||
class sudocmd_show(LDAPRetrieve):
|
||||
"""
|
||||
Display sudo command.
|
||||
"""
|
||||
|
||||
api.register(sudocmd_show)
|
||||
157
ipalib/plugins/sudocmdgroup.py
Normal file
157
ipalib/plugins/sudocmdgroup.py
Normal file
@ -0,0 +1,157 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
"""
|
||||
Groups of sudo commands
|
||||
|
||||
Manage groups of sudo commands.
|
||||
Every group must have a description.
|
||||
|
||||
EXAMPLES:
|
||||
|
||||
Add a new sudo command group:
|
||||
ipa sudocmdgroup-add --desc='administrators commands' admincmds
|
||||
|
||||
Remove a sudo command group:
|
||||
ipa sudocmdgroup-del admincmds
|
||||
|
||||
Manage sudo command group membership, commands:
|
||||
ipa sudocmdgroup-add-member --sudocmds=/usr/bin/less,/usr/bin/vim admincmds
|
||||
|
||||
Manage sudo command group membership, commands:
|
||||
ipa group-remove-member --sudocmds=/usr/bin/less admincmds
|
||||
|
||||
Show a sudo command group:
|
||||
ipa group-show localadmins
|
||||
"""
|
||||
|
||||
from ipalib import api
|
||||
from ipalib import Str
|
||||
from ipalib.plugins.baseldap import *
|
||||
from ipalib import _, ngettext
|
||||
|
||||
|
||||
class sudocmdgroup(LDAPObject):
|
||||
"""
|
||||
Sudo Group object.
|
||||
"""
|
||||
container_dn = api.env.container_sudocmdgroup
|
||||
object_name = 'sudocmdgroup'
|
||||
object_name_plural = 'sudocmdgroups'
|
||||
object_class = ['ipaobject', 'ipasudocmdgrp']
|
||||
default_attributes = [
|
||||
'cn', 'description', 'member', 'memberof'
|
||||
]
|
||||
uuid_attribute = 'ipauniqueid'
|
||||
attribute_members = {
|
||||
'member': ['sudocmd', 'sudocmdgroup'],
|
||||
'memberof': ['sudocmdgroup'],
|
||||
}
|
||||
|
||||
label = _('Sudo Command Groups')
|
||||
|
||||
takes_params = (
|
||||
Str('cn',
|
||||
cli_name='name',
|
||||
label=_('Sudo Command Group name'),
|
||||
primary_key=True,
|
||||
normalizer=lambda value: value.lower(),
|
||||
),
|
||||
Str('description',
|
||||
cli_name='desc',
|
||||
label=_('Description'),
|
||||
doc=_('Group description'),
|
||||
),
|
||||
Str('membercmd_sudocmd?',
|
||||
label=_('Commands'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
Str('membercmd_sudocmdgroup?',
|
||||
label=_('Sudo Command Groups'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
)
|
||||
|
||||
api.register(sudocmdgroup)
|
||||
|
||||
|
||||
class sudocmdgroup_add(LDAPCreate):
|
||||
"""
|
||||
Create new sudo command group.
|
||||
"""
|
||||
|
||||
msg_summary = _('Added sudo command group "%(value)s"')
|
||||
|
||||
api.register(sudocmdgroup_add)
|
||||
|
||||
|
||||
class sudocmdgroup_del(LDAPDelete):
|
||||
"""
|
||||
Delete sudo command group.
|
||||
"""
|
||||
|
||||
msg_summary = _('Deleted sudo command group "%(value)s"')
|
||||
|
||||
api.register(sudocmdgroup_del)
|
||||
|
||||
|
||||
class sudocmdgroup_mod(LDAPUpdate):
|
||||
"""
|
||||
Modify group.
|
||||
"""
|
||||
|
||||
msg_summary = _('Modified sudo command group "%(value)s"')
|
||||
|
||||
api.register(sudocmdgroup_mod)
|
||||
|
||||
|
||||
class sudocmdgroup_find(LDAPSearch):
|
||||
"""
|
||||
Search for sudo command groups.
|
||||
"""
|
||||
|
||||
msg_summary = ngettext(
|
||||
'%(count)d sudo command group matched',
|
||||
'%(count)d sudo command groups matched', 0
|
||||
)
|
||||
|
||||
api.register(sudocmdgroup_find)
|
||||
|
||||
|
||||
class sudocmdgroup_show(LDAPRetrieve):
|
||||
"""
|
||||
Display sudo command group.
|
||||
"""
|
||||
|
||||
api.register(sudocmdgroup_show)
|
||||
|
||||
|
||||
class sudocmdgroup_add_member(LDAPAddMember):
|
||||
"""
|
||||
Add members to sudo command group.
|
||||
"""
|
||||
|
||||
api.register(sudocmdgroup_add_member)
|
||||
|
||||
|
||||
class sudocmdgroup_remove_member(LDAPRemoveMember):
|
||||
"""
|
||||
Remove members from sudo command group.
|
||||
"""
|
||||
|
||||
api.register(sudocmdgroup_remove_member)
|
||||
199
ipalib/plugins/sudorule.py
Normal file
199
ipalib/plugins/sudorule.py
Normal file
@ -0,0 +1,199 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
"""
|
||||
Sudo Rule
|
||||
"""
|
||||
|
||||
from ipalib import api, errors
|
||||
from ipalib import Str, StrEnum
|
||||
from ipalib.plugins.baseldap import *
|
||||
from ipalib import _, ngettext
|
||||
|
||||
class sudorule(LDAPObject):
|
||||
"""
|
||||
Sudo Rule.
|
||||
"""
|
||||
container_dn = api.env.container_sudorule
|
||||
object_name = 'Sudo Rule'
|
||||
object_name_plural = 'Sudo Rules'
|
||||
object_class = ['ipaassociation', 'ipasudorule']
|
||||
default_attributes = [
|
||||
'cn', 'accessruletype', 'description',
|
||||
|
||||
]
|
||||
uuid_attribute = 'ipauniqueid'
|
||||
attribute_members = {
|
||||
'memberuser': ['user', 'group'],
|
||||
'memberhost': ['host', 'hostgroup'],
|
||||
'membercmd': ['sudocmd', 'sudocmdgroup'],
|
||||
}
|
||||
|
||||
label = _('SudoRule')
|
||||
|
||||
takes_params = (
|
||||
Str('cn',
|
||||
cli_name='name',
|
||||
label=_('Rule name'),
|
||||
primary_key=True,
|
||||
),
|
||||
Str('description?',
|
||||
cli_name='desc',
|
||||
label=_('Description'),
|
||||
),
|
||||
StrEnum('accessruletype',
|
||||
cli_name='type',
|
||||
doc=_('Rule type (allow or deny)'),
|
||||
label=_('Rule type'),
|
||||
values=(u'allow', u'deny'),
|
||||
),
|
||||
Str('memberuser_user?',
|
||||
label=_('Users'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
Str('memberhost_host?',
|
||||
label=_('Hosts'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
Str('memberhost_hostgroup?',
|
||||
label=_('Host Groups'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
Str('membercmd_sudocmd?',
|
||||
label=_('Sudo Commands'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
Str('membercmd_sudocmdgroup?',
|
||||
label=_('Sudo Command Groups'),
|
||||
flags=['no_create', 'no_update', 'no_search'],
|
||||
),
|
||||
)
|
||||
|
||||
def get_dn(self, *keys, **kwargs):
|
||||
try:
|
||||
(dn, entry_attrs) = self.backend.find_entry_by_attr(
|
||||
self.primary_key.name, keys[-1], self.object_class, [''],
|
||||
self.container_dn
|
||||
)
|
||||
except errors.NotFound:
|
||||
dn = super(sudorule, self).get_dn(*keys, **kwargs)
|
||||
return dn
|
||||
|
||||
api.register(sudorule)
|
||||
|
||||
|
||||
class sudorule_add(LDAPCreate):
|
||||
"""
|
||||
Create new Sudo Rule.
|
||||
"""
|
||||
|
||||
msg_summary = _('Added sudo rule "%(value)s"')
|
||||
|
||||
api.register(sudorule_add)
|
||||
|
||||
|
||||
class sudorule_del(LDAPDelete):
|
||||
"""
|
||||
Delete Sudo Rule.
|
||||
"""
|
||||
|
||||
api.register(sudorule_del)
|
||||
|
||||
|
||||
class sudorule_mod(LDAPUpdate):
|
||||
"""
|
||||
Modify Sudo Rule.
|
||||
"""
|
||||
|
||||
api.register(sudorule_mod)
|
||||
|
||||
|
||||
class sudorule_find(LDAPSearch):
|
||||
"""
|
||||
Search for Sudo Rule.
|
||||
"""
|
||||
|
||||
api.register(sudorule_find)
|
||||
|
||||
|
||||
class sudorule_show(LDAPRetrieve):
|
||||
"""
|
||||
Dispaly Sudo Rule.
|
||||
"""
|
||||
|
||||
api.register(sudorule_show)
|
||||
|
||||
|
||||
class sudorule_add_command(LDAPAddMember):
|
||||
"""
|
||||
Add commands and sudo command groups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['membercmd']
|
||||
member_count_out = ('%i object added.', '%i objects added.')
|
||||
|
||||
api.register(sudorule_add_command)
|
||||
|
||||
|
||||
class sudorule_remove_command(LDAPRemoveMember):
|
||||
"""
|
||||
Remove commands and sudo command groups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['membercmd']
|
||||
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||
|
||||
api.register(sudorule_remove_command)
|
||||
|
||||
|
||||
class sudorule_add_user(LDAPAddMember):
|
||||
"""
|
||||
Add users and groups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['memberuser']
|
||||
member_count_out = ('%i object added.', '%i objects added.')
|
||||
|
||||
api.register(sudorule_add_user)
|
||||
|
||||
|
||||
class sudorule_remove_user(LDAPRemoveMember):
|
||||
"""
|
||||
Remove users and groups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['memberuser']
|
||||
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||
|
||||
api.register(sudorule_remove_user)
|
||||
|
||||
|
||||
class sudorule_add_host(LDAPAddMember):
|
||||
"""
|
||||
Add hosts and hostgroups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['memberhost']
|
||||
member_count_out = ('%i object added.', '%i objects added.')
|
||||
|
||||
api.register(sudorule_add_host)
|
||||
|
||||
|
||||
class sudorule_remove_host(LDAPRemoveMember):
|
||||
"""
|
||||
Remove hosts and hostgroups affected by Sudo Rule.
|
||||
"""
|
||||
member_attributes = ['memberhost']
|
||||
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||
|
||||
api.register(sudorule_remove_host)
|
||||
@ -94,3 +94,15 @@ hbacsvcgroup = [
|
||||
u'groupOfNames',
|
||||
u'top',
|
||||
]
|
||||
|
||||
sudocmd = [
|
||||
u'ipaobject',
|
||||
u'ipasudocmd',
|
||||
]
|
||||
|
||||
sudocmdgroup = [
|
||||
u'ipaobject',
|
||||
u'ipasudocmdgrp',
|
||||
u'groupOfNames',
|
||||
u'top',
|
||||
]
|
||||
|
||||
190
tests/test_xmlrpc/test_sudocmd_plugin.py
Normal file
190
tests/test_xmlrpc/test_sudocmd_plugin.py
Normal file
@ -0,0 +1,190 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
"""
|
||||
Test the `ipalib/plugins/sudocmd.py` module.
|
||||
"""
|
||||
|
||||
from ipalib import api, errors
|
||||
from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
|
||||
from tests.test_xmlrpc import objectclasses
|
||||
|
||||
|
||||
sudocmd1 = u'/usr/bin/sudotestcmd1'
|
||||
|
||||
|
||||
class test_sudocmd(Declarative):
|
||||
|
||||
cleanup_commands = [
|
||||
('sudocmd_del', [sudocmd1], {}),
|
||||
]
|
||||
|
||||
tests = [
|
||||
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_mod', [sudocmd1], dict(description=u'Nope')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_del', [sudocmd1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Create %r' % sudocmd1,
|
||||
command=('sudocmd_add', [sudocmd1],
|
||||
dict(
|
||||
description=u'Test sudo command 1',
|
||||
),
|
||||
),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=u'Added sudo command "%s"' % sudocmd1,
|
||||
result=dict(
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
cn=[sudocmd1],
|
||||
description=[u'Test sudo command 1'],
|
||||
objectclass=objectclasses.sudocmd,
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to create duplicate %r' % sudocmd1,
|
||||
command=('sudocmd_add', [sudocmd1],
|
||||
dict(
|
||||
description=u'Test sudo command 1',
|
||||
),
|
||||
),
|
||||
expected=errors.DuplicateEntry(),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=None,
|
||||
result=dict(
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
cn=[sudocmd1],
|
||||
description=[u'Test sudo command 1'],
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Search for %r' % sudocmd1,
|
||||
command=('sudocmd_find', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
count=1,
|
||||
truncated=False,
|
||||
summary=u'1 sudo command matched',
|
||||
result=[
|
||||
dict(
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
cn=[sudocmd1],
|
||||
description=[u'Test sudo command 1'],
|
||||
),
|
||||
],
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Update %r' % sudocmd1,
|
||||
command=('sudocmd_mod', [sudocmd1], dict(
|
||||
description=u'Updated sudo command 1')),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=u'Modified sudo command "%s"' % sudocmd1,
|
||||
result=dict(
|
||||
cn=[sudocmd1],
|
||||
description=[u'Updated sudo command 1'],
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r to verify update' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=None,
|
||||
result=dict(
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
cn=[sudocmd1],
|
||||
description=[u'Updated sudo command 1'],
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Delete %r' % sudocmd1,
|
||||
command=('sudocmd_del', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=u'Deleted sudo command "%s"' % sudocmd1,
|
||||
result=True,
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_mod', [sudocmd1], dict(description=u'Nope')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmd1,
|
||||
command=('sudocmd_del', [sudocmd1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
]
|
||||
535
tests/test_xmlrpc/test_sudocmdgroup_plugin.py
Normal file
535
tests/test_xmlrpc/test_sudocmdgroup_plugin.py
Normal file
@ -0,0 +1,535 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
"""
|
||||
Test the `ipalib/plugins/sudocmdgroup.py` module.
|
||||
"""
|
||||
|
||||
from ipalib import api, errors
|
||||
from tests.test_xmlrpc import objectclasses
|
||||
from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
|
||||
|
||||
sudocmdgroup1 = u'testsudocmdgroup1'
|
||||
sudocmdgroup2 = u'testsudocmdgroup2'
|
||||
sudocmd1 = u'/usr/bin/sudotestcmd1'
|
||||
|
||||
class test_sudocmdgroup(Declarative):
|
||||
cleanup_commands = [
|
||||
('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||
('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||
('sudocmd_del', [sudocmd1], {}),
|
||||
]
|
||||
|
||||
tests = [
|
||||
|
||||
################
|
||||
# create sudo command
|
||||
dict(
|
||||
desc='Create %r' % sudocmd1,
|
||||
command=(
|
||||
'sudocmd_add', [], dict(cn=sudocmd1,)
|
||||
),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=u'Added sudo command "%s"' % sudocmd1,
|
||||
result=dict(
|
||||
objectclass=objectclasses.sudocmd,
|
||||
cn=[u'/usr/bin/sudotestcmd1'],
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Verify the managed sudo command %r was created' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
value=sudocmd1,
|
||||
summary=None,
|
||||
result=dict(
|
||||
cn=[sudocmd1],
|
||||
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||
api.env.basedn),
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
################
|
||||
# create sudo command group1:
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_mod', [sudocmdgroup1],
|
||||
dict(description=u'Foo')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Create %r' % sudocmdgroup1,
|
||||
command=(
|
||||
'sudocmdgroup_add', [sudocmdgroup1],
|
||||
dict(description=u'Test desc 1')
|
||||
),
|
||||
expected=dict(
|
||||
value=sudocmdgroup1,
|
||||
summary=u'Added sudo command group "testsudocmdgroup1"',
|
||||
result=dict(
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'Test desc 1'],
|
||||
objectclass=objectclasses.sudocmdgroup,
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to create duplicate %r' % sudocmdgroup1,
|
||||
command=(
|
||||
'sudocmdgroup_add', [sudocmdgroup1],
|
||||
dict(description=u'Test desc 1')
|
||||
),
|
||||
expected=errors.DuplicateEntry(),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||
expected=dict(
|
||||
value=sudocmdgroup1,
|
||||
summary=None,
|
||||
result=dict(
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'Test desc 1'],
|
||||
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Updated %r' % sudocmdgroup1,
|
||||
command=(
|
||||
'sudocmdgroup_mod', [sudocmdgroup1],
|
||||
dict(description=u'New desc 1')
|
||||
),
|
||||
expected=dict(
|
||||
result=dict(
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'New desc 1'],
|
||||
),
|
||||
summary=u'Modified sudo command group "testsudocmdgroup1"',
|
||||
value=sudocmdgroup1,
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r to verify update' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||
expected=dict(
|
||||
value=sudocmdgroup1,
|
||||
result=dict(
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'New desc 1'],
|
||||
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
summary=None,
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Search for %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_find', [], dict(cn=sudocmdgroup1)),
|
||||
expected=dict(
|
||||
count=1,
|
||||
truncated=False,
|
||||
result=[
|
||||
dict(
|
||||
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'New desc 1'],
|
||||
),
|
||||
],
|
||||
summary=u'1 sudo command group matched',
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
|
||||
################
|
||||
# create sudocmdgroup2:
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_mod', [sudocmdgroup2],
|
||||
dict(description=u'Foo')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Create %r' % sudocmdgroup2,
|
||||
command=(
|
||||
'sudocmdgroup_add', [sudocmdgroup2],
|
||||
dict(description=u'Test desc 2')
|
||||
),
|
||||
expected=dict(
|
||||
value=sudocmdgroup2,
|
||||
summary=u'Added sudo command group "testsudocmdgroup2"',
|
||||
result=dict(
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'Test desc 2'],
|
||||
objectclass=objectclasses.sudocmdgroup,
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to create duplicate %r' % sudocmdgroup2,
|
||||
command=(
|
||||
'sudocmdgroup_add', [sudocmdgroup2],
|
||||
dict(description=u'Test desc 2')
|
||||
),
|
||||
expected=errors.DuplicateEntry(),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||
expected=dict(
|
||||
value=sudocmdgroup2,
|
||||
summary=None,
|
||||
result=dict(
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'Test desc 2'],
|
||||
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Updated %r' % sudocmdgroup2,
|
||||
command=(
|
||||
'sudocmdgroup_mod', [sudocmdgroup2],
|
||||
dict(description=u'New desc 2')
|
||||
),
|
||||
expected=dict(
|
||||
result=dict(
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'New desc 2'],
|
||||
),
|
||||
summary=u'Modified sudo command group "testsudocmdgroup2"',
|
||||
value=sudocmdgroup2,
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Retrieve %r to verify update' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||
expected=dict(
|
||||
value=sudocmdgroup2,
|
||||
result=dict(
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'New desc 2'],
|
||||
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||
api.env.basedn,
|
||||
),
|
||||
summary=None,
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Search for %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_find', [], dict(cn=sudocmdgroup2)),
|
||||
expected=dict(
|
||||
count=1,
|
||||
truncated=False,
|
||||
result=[
|
||||
dict(
|
||||
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup2, api.env.basedn),
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'New desc 2'],
|
||||
),
|
||||
],
|
||||
summary=u'1 sudo command group matched',
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Search for all sudocmdgroups',
|
||||
command=('sudocmdgroup_find', [], {}),
|
||||
expected=dict(
|
||||
summary=u'2 sudo command groups matched',
|
||||
count=2,
|
||||
truncated=False,
|
||||
result=[
|
||||
dict(
|
||||
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
cn=[sudocmdgroup1],
|
||||
description=[u'New desc 1'],
|
||||
),
|
||||
dict(
|
||||
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup2, api.env.basedn),
|
||||
cn=[sudocmdgroup2],
|
||||
description=[u'New desc 2'],
|
||||
),
|
||||
],
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
|
||||
###############
|
||||
# member stuff:
|
||||
dict(
|
||||
desc='Add member %r to %r' % (sudocmd1, sudocmdgroup1),
|
||||
command=(
|
||||
'sudocmdgroup_add_member', [sudocmdgroup1],
|
||||
dict(sudocmd=sudocmd1)
|
||||
),
|
||||
expected=dict(
|
||||
completed=1,
|
||||
failed=dict(
|
||||
member=dict(
|
||||
sudocmdgroup=tuple(),
|
||||
sudocmd=tuple(),
|
||||
),
|
||||
),
|
||||
result={
|
||||
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
'member_sudocmd': (sudocmd1,),
|
||||
'cn': [sudocmdgroup1],
|
||||
'description': [u'New desc 1'],
|
||||
},
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
# FIXME: Shouldn't this raise a NotFound instead?
|
||||
desc='Try to add non-existent member to %r' % sudocmdgroup1,
|
||||
command=(
|
||||
'sudocmdgroup_add_member', [sudocmdgroup1],
|
||||
dict(sudocmd=u'notfound')
|
||||
),
|
||||
expected=dict(
|
||||
completed=0,
|
||||
failed=dict(
|
||||
member=dict(
|
||||
sudocmdgroup=tuple(),
|
||||
sudocmd=(u'notfound',),
|
||||
),
|
||||
),
|
||||
result={
|
||||
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
'member_sudocmd': (u'/usr/bin/sudotestcmd1',),
|
||||
'cn': [sudocmdgroup1],
|
||||
'description': [u'New desc 1'],
|
||||
},
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Remove member %r from %r' % (sudocmd1, sudocmdgroup1),
|
||||
command=('sudocmdgroup_remove_member',
|
||||
[sudocmdgroup1], dict(sudocmd=sudocmd1)
|
||||
),
|
||||
expected=dict(
|
||||
completed=1,
|
||||
failed=dict(
|
||||
member=dict(
|
||||
sudocmdgroup=tuple(),
|
||||
sudocmd=tuple(),
|
||||
),
|
||||
),
|
||||
result={
|
||||
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
'cn': [sudocmdgroup1],
|
||||
'description': [u'New desc 1'],
|
||||
},
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
# FIXME: Shouldn't this raise a NotFound instead?
|
||||
desc='Try to remove non-existent member from %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_remove_member',
|
||||
[sudocmdgroup1], dict(sudocmd=u'notfound')
|
||||
),
|
||||
expected=dict(
|
||||
completed=0,
|
||||
failed=dict(
|
||||
member=dict(
|
||||
sudocmdgroup=tuple(),
|
||||
sudocmd=(u'notfound',),
|
||||
),
|
||||
),
|
||||
result={
|
||||
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||
(sudocmdgroup1, api.env.basedn),
|
||||
'cn': [sudocmdgroup1],
|
||||
'description': [u'New desc 1'],
|
||||
},
|
||||
),
|
||||
),
|
||||
|
||||
|
||||
################
|
||||
# delete sudocmdgroup1:
|
||||
dict(
|
||||
desc='Delete %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||
expected=dict(
|
||||
result=True,
|
||||
value=sudocmdgroup1,
|
||||
summary=u'Deleted sudo command group "testsudocmdgroup1"',
|
||||
)
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmdgroup1,
|
||||
command=('sudocmdgroup_mod', [sudocmdgroup1],
|
||||
dict(description=u'Foo')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
################
|
||||
# delete sudocmdgroup2:
|
||||
dict(
|
||||
desc='Delete %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||
expected=dict(
|
||||
result=True,
|
||||
value=sudocmdgroup2,
|
||||
summary=u'Deleted sudo command group "testsudocmdgroup2"',
|
||||
)
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to delete non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to retrieve non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to update non-existent %r' % sudocmdgroup2,
|
||||
command=('sudocmdgroup_mod', [sudocmdgroup2],
|
||||
dict(description=u'Foo')),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
|
||||
##### clean up test Command
|
||||
|
||||
dict(
|
||||
desc='Now delete the sudo command %r' % sudocmd1,
|
||||
command=('sudocmd_del', [sudocmd1], {}),
|
||||
expected=dict(
|
||||
result=True,
|
||||
value=sudocmd1,
|
||||
summary=u'Deleted sudo command "%s"' % sudocmd1,
|
||||
)
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Verify that %r is really gone' % sudocmd1,
|
||||
command=('sudocmd_show', [sudocmd1], {}),
|
||||
expected=errors.NotFound(reason='no such entry'),
|
||||
),
|
||||
|
||||
]
|
||||
269
tests/test_xmlrpc/test_sudorule_plugin.py
Normal file
269
tests/test_xmlrpc/test_sudorule_plugin.py
Normal file
@ -0,0 +1,269 @@
|
||||
# Authors:
|
||||
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||
# Pavel Zuna <pzuna@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; version 2 only
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
"""
|
||||
Test the `ipalib/plugins/sudorule.py` module.
|
||||
"""
|
||||
|
||||
from xmlrpc_test import XMLRPC_test, assert_attr_equal
|
||||
from ipalib import api
|
||||
from ipalib import errors
|
||||
|
||||
|
||||
class test_sudorule(XMLRPC_test):
|
||||
"""
|
||||
Test the `sudorule` plugin.
|
||||
"""
|
||||
rule_name = u'testing_sudorule1'
|
||||
rule_type = u'allow'
|
||||
rule_type_fail = u'value not allowed'
|
||||
rule_command = u'/usr/bin/testsudocmd1'
|
||||
rule_desc = u'description'
|
||||
rule_desc_mod = u'description modified'
|
||||
|
||||
test_user = u'sudorule_test_user'
|
||||
test_group = u'sudorule_test_group'
|
||||
test_host = u'sudorule._test_host'
|
||||
test_hostgroup = u'sudorule_test_hostgroup'
|
||||
test_sudocmdgroup = u'sudorule_test_cmdgroup'
|
||||
test_command = u'/usr/bin/testsudocmd1'
|
||||
|
||||
def test_0_sudorule_add(self):
|
||||
"""
|
||||
Test adding a new Sudo rule using `xmlrpc.sudorule_add`.
|
||||
"""
|
||||
ret = self.failsafe_add(api.Object.sudorule,
|
||||
self.rule_name,
|
||||
accessruletype=self.rule_type,
|
||||
description=self.rule_desc,
|
||||
)
|
||||
entry = ret['result']
|
||||
assert_attr_equal(entry, 'cn', self.rule_name)
|
||||
assert_attr_equal(entry, 'accessruletype', self.rule_type)
|
||||
assert_attr_equal(entry, 'description', self.rule_desc)
|
||||
|
||||
def test_1_sudorule_add(self):
|
||||
"""
|
||||
Test adding an duplicate Sudo rule using `xmlrpc.sudorule_add'.
|
||||
"""
|
||||
try:
|
||||
api.Command['sudorule_add'](
|
||||
self.rule_name, accessruletype=self.rule_type
|
||||
)
|
||||
except errors.DuplicateEntry:
|
||||
pass
|
||||
else:
|
||||
assert False
|
||||
|
||||
def test_2_sudorule_show(self):
|
||||
"""
|
||||
Test displaying a Sudo rule using `xmlrpc.sudorule_show`.
|
||||
"""
|
||||
entry = api.Command['sudorule_show'](self.rule_name)['result']
|
||||
assert_attr_equal(entry, 'cn', self.rule_name)
|
||||
assert_attr_equal(entry, 'accessruletype', self.rule_type)
|
||||
assert_attr_equal(entry, 'description', self.rule_desc)
|
||||
|
||||
def test_3_sudorule_mod(self):
|
||||
"""
|
||||
Test modifying a Sudo rule using `xmlrpc.sudorule_mod`.
|
||||
"""
|
||||
ret = api.Command['sudorule_mod'](
|
||||
self.rule_name, description=self.rule_desc_mod
|
||||
)
|
||||
entry = ret['result']
|
||||
assert_attr_equal(entry, 'description', self.rule_desc_mod)
|
||||
|
||||
def test_6_sudorule_find(self):
|
||||
"""
|
||||
Test searching for Sudo rules using `xmlrpc.sudorule_find`.
|
||||
"""
|
||||
ret = api.Command['sudorule_find'](
|
||||
name=self.rule_name, accessruletype=self.rule_type,
|
||||
description=self.rule_desc_mod
|
||||
)
|
||||
assert ret['truncated'] is False
|
||||
entries = ret['result']
|
||||
assert_attr_equal(entries[0], 'cn', self.rule_name)
|
||||
assert_attr_equal(entries[0], 'accessruletype', self.rule_type)
|
||||
assert_attr_equal(entries[0], 'description', self.rule_desc_mod)
|
||||
|
||||
def test_7_sudorule_init_testing_data(self):
|
||||
"""
|
||||
Initialize data for more Sudo rule plugin testing.
|
||||
"""
|
||||
self.failsafe_add(api.Object.user,
|
||||
self.test_user, givenname=u'first', sn=u'last'
|
||||
)
|
||||
self.failsafe_add(api.Object.group,
|
||||
self.test_group, description=u'description'
|
||||
)
|
||||
self.failsafe_add(api.Object.host,
|
||||
self.test_host, force=True
|
||||
)
|
||||
self.failsafe_add(api.Object.hostgroup,
|
||||
self.test_hostgroup, description=u'description'
|
||||
)
|
||||
self.failsafe_add(api.Object.sudocmdgroup,
|
||||
self.test_sudocmdgroup, description=u'desc'
|
||||
)
|
||||
self.failsafe_add(api.Object.sudocmd,
|
||||
self.test_command, description=u'desc', force=True
|
||||
)
|
||||
|
||||
def test_8_sudorule_add_user(self):
|
||||
"""
|
||||
Test adding user and group to Sudo rule using
|
||||
`xmlrpc.sudorule_add_user`.
|
||||
"""
|
||||
ret = api.Command['sudorule_add_user'](
|
||||
self.rule_name, user=self.test_user, group=self.test_group
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'memberuser' in failed
|
||||
assert 'user' in failed['memberuser']
|
||||
assert not failed['memberuser']['user']
|
||||
assert 'group' in failed['memberuser']
|
||||
assert not failed['memberuser']['group']
|
||||
entry = ret['result']
|
||||
assert_attr_equal(entry, 'memberuser_user', self.test_user)
|
||||
assert_attr_equal(entry, 'memberuser_group', self.test_group)
|
||||
|
||||
def test_9_sudorule_remove_user(self):
|
||||
"""
|
||||
Test removing user and group from Sudo rule using
|
||||
`xmlrpc.sudorule_remove_user'.
|
||||
"""
|
||||
ret = api.Command['sudorule_remove_user'](
|
||||
self.rule_name, user=self.test_user, group=self.test_group
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'memberuser' in failed
|
||||
assert 'user' in failed['memberuser']
|
||||
assert not failed['memberuser']['user']
|
||||
assert 'group' in failed['memberuser']
|
||||
assert not failed['memberuser']['group']
|
||||
entry = ret['result']
|
||||
assert 'memberuser_user' not in entry
|
||||
assert 'memberuser_group' not in entry
|
||||
|
||||
def test_a_sudorule_add_host(self):
|
||||
"""
|
||||
Test adding host and hostgroup to Sudo rule using
|
||||
`xmlrpc.sudorule_add_host`.
|
||||
"""
|
||||
ret = api.Command['sudorule_add_host'](
|
||||
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'memberhost' in failed
|
||||
assert 'host' in failed['memberhost']
|
||||
assert not failed['memberhost']['host']
|
||||
assert 'hostgroup' in failed['memberhost']
|
||||
assert not failed['memberhost']['hostgroup']
|
||||
entry = ret['result']
|
||||
assert_attr_equal(entry, 'memberhost_host', self.test_host)
|
||||
assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup)
|
||||
|
||||
def test_b_sudorule_remove_host(self):
|
||||
"""
|
||||
Test removing host and hostgroup from Sudo rule using
|
||||
`xmlrpc.sudorule_remove_host`.
|
||||
"""
|
||||
ret = api.Command['sudorule_remove_host'](
|
||||
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'memberhost' in failed
|
||||
assert 'host' in failed['memberhost']
|
||||
assert not failed['memberhost']['host']
|
||||
assert 'hostgroup' in failed['memberhost']
|
||||
assert not failed['memberhost']['hostgroup']
|
||||
entry = ret['result']
|
||||
assert 'memberhost_host' not in entry
|
||||
assert 'memberhost_hostgroup' not in entry
|
||||
|
||||
def test_a_sudorule_add_command(self):
|
||||
"""
|
||||
Test adding command and cmdgroup to Sudo rule using
|
||||
`xmlrpc.sudorule_add_command`.
|
||||
"""
|
||||
ret = api.Command['sudorule_add_command'](
|
||||
self.rule_name, sudocmd=self.test_command,
|
||||
sudocmdgroup=self.test_sudocmdgroup
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'membercmd' in failed
|
||||
assert 'sudocmd' in failed['membercmd']
|
||||
assert not failed['membercmd']['sudocmd']
|
||||
assert 'sudocmdgroup' in failed['membercmd']
|
||||
assert not failed['membercmd']['sudocmdgroup']
|
||||
entry = ret['result']
|
||||
assert_attr_equal(entry, 'membercmd_sudocmd', self.test_command)
|
||||
assert_attr_equal(entry, 'membercmd_sudocmdgroup',
|
||||
self.test_sudocmdgroup)
|
||||
|
||||
def test_a_sudorule_remove_command(self):
|
||||
"""
|
||||
Test removing command and sudocmdgroup from Sudo rule using
|
||||
`xmlrpc.sudorule_remove_command`.
|
||||
"""
|
||||
ret = api.Command['sudorule_remove_command'](
|
||||
self.rule_name, sudocmd=self.test_command,
|
||||
sudocmdgroup=self.test_sudocmdgroup
|
||||
)
|
||||
assert ret['completed'] == 2
|
||||
failed = ret['failed']
|
||||
assert 'membercmd' in failed
|
||||
assert 'sudocmd' in failed['membercmd']
|
||||
assert not failed['membercmd']['sudocmd']
|
||||
assert 'sudocmdgroup' in failed['membercmd']
|
||||
assert not failed['membercmd']['sudocmdgroup']
|
||||
entry = ret['result']
|
||||
assert 'membercmd_sudocmd' not in entry
|
||||
assert 'membercmd_sudocmdgroup' not in entry
|
||||
|
||||
def test_c_sudorule_clear_testing_data(self):
|
||||
"""
|
||||
Clear data for Sudo rule plugin testing.
|
||||
"""
|
||||
api.Command['user_del'](self.test_user)
|
||||
api.Command['group_del'](self.test_group)
|
||||
api.Command['host_del'](self.test_host)
|
||||
api.Command['hostgroup_del'](self.test_hostgroup)
|
||||
api.Command['sudocmd_del'](self.test_command)
|
||||
api.Command['sudocmdgroup_del'](self.test_sudocmdgroup)
|
||||
|
||||
def test_f_sudorule_del(self):
|
||||
"""
|
||||
Test deleting a Sudo rule using `xmlrpc.sudorule_del`.
|
||||
"""
|
||||
assert api.Command['sudorule_del'](self.rule_name)['result'] is True
|
||||
# verify that it's gone
|
||||
try:
|
||||
api.Command['sudorule_show'](self.rule_name)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
else:
|
||||
assert False
|
||||
Loading…
Reference in New Issue
Block a user