mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Add plugins for Sudo Commands, Command Groups and Rules
This commit is contained in:
parent
c187702bfe
commit
af48654cbc
@ -46,12 +46,30 @@ objectClass: top
|
|||||||
objectClass: nsContainer
|
objectClass: nsContainer
|
||||||
cn: hbacservicegroups
|
cn: hbacservicegroups
|
||||||
|
|
||||||
|
dn: cn=sudocmds,cn=accounts,$SUFFIX
|
||||||
|
changetype: add
|
||||||
|
objectClass: top
|
||||||
|
objectClass: nsContainer
|
||||||
|
cn: sudocmds
|
||||||
|
|
||||||
|
dn: cn=sudocmdgroups,cn=accounts,$SUFFIX
|
||||||
|
changetype: add
|
||||||
|
objectClass: top
|
||||||
|
objectClass: nsContainer
|
||||||
|
cn: sudocmdgroups
|
||||||
|
|
||||||
dn: cn=hbac,$SUFFIX
|
dn: cn=hbac,$SUFFIX
|
||||||
changetype: add
|
changetype: add
|
||||||
objectClass: top
|
objectClass: top
|
||||||
objectClass: nsContainer
|
objectClass: nsContainer
|
||||||
cn: hbac
|
cn: hbac
|
||||||
|
|
||||||
|
dn: cn=sudorules,$SUFFIX
|
||||||
|
changetype: add
|
||||||
|
objectClass: top
|
||||||
|
objectClass: nsContainer
|
||||||
|
cn: sudorules
|
||||||
|
|
||||||
dn: cn=SUDOers,$SUFFIX
|
dn: cn=SUDOers,$SUFFIX
|
||||||
changetype: add
|
changetype: add
|
||||||
objectClass: nsContainer
|
objectClass: nsContainer
|
||||||
|
@ -99,6 +99,9 @@ DEFAULT_CONFIG = (
|
|||||||
('container_hbacservicegroup', 'cn=hbacservicegroups,cn=accounts'),
|
('container_hbacservicegroup', 'cn=hbacservicegroups,cn=accounts'),
|
||||||
('container_dns', 'cn=dns'),
|
('container_dns', 'cn=dns'),
|
||||||
('container_virtual', 'cn=virtual operations'),
|
('container_virtual', 'cn=virtual operations'),
|
||||||
|
('container_sudorule', 'cn=sudorules'),
|
||||||
|
('container_sudocmd', 'cn=sudocmds,cn=accounts'),
|
||||||
|
('container_sudocmdgroup', 'cn=sudocmdgroups,cn=accounts'),
|
||||||
|
|
||||||
# Ports, hosts, and URIs:
|
# Ports, hosts, and URIs:
|
||||||
# FIXME: let's renamed xmlrpc_uri to rpc_xml_uri
|
# FIXME: let's renamed xmlrpc_uri to rpc_xml_uri
|
||||||
|
137
ipalib/plugins/sudocmd.py
Normal file
137
ipalib/plugins/sudocmd.py
Normal file
@ -0,0 +1,137 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
"""
|
||||||
|
Sudo Commands
|
||||||
|
|
||||||
|
Commands used as building blocks for sudo
|
||||||
|
|
||||||
|
EXAMPLES:
|
||||||
|
|
||||||
|
Create a new commnad
|
||||||
|
ipa sudocmd-add --description='For reading log files' /usr/bin/less
|
||||||
|
|
||||||
|
Remove a command
|
||||||
|
ipa sudocmd-del /usr/bin/less
|
||||||
|
|
||||||
|
"""
|
||||||
|
|
||||||
|
import platform
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
|
||||||
|
from ipalib import api, errors, util
|
||||||
|
from ipalib import Str
|
||||||
|
from ipalib.plugins.baseldap import *
|
||||||
|
from ipalib import _, ngettext
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmd(LDAPObject):
|
||||||
|
"""
|
||||||
|
Sudo Command object.
|
||||||
|
"""
|
||||||
|
container_dn = api.env.container_sudocmd
|
||||||
|
object_name = 'sudocmd'
|
||||||
|
object_name_plural = 'sudocmds'
|
||||||
|
object_class = ['ipaobject', 'ipasudocmd']
|
||||||
|
# object_class_config = 'ipahostobjectclasses'
|
||||||
|
search_attributes = [
|
||||||
|
'cn', 'description',
|
||||||
|
]
|
||||||
|
default_attributes = [
|
||||||
|
'cn', 'description',
|
||||||
|
]
|
||||||
|
uuid_attribute = 'ipauniqueid'
|
||||||
|
label = _('SudoCmds')
|
||||||
|
|
||||||
|
takes_params = (
|
||||||
|
Str('cn',
|
||||||
|
cli_name='command',
|
||||||
|
label=_('Sudo Command'),
|
||||||
|
primary_key=True,
|
||||||
|
#normalizer=lambda value: value.lower(),
|
||||||
|
),
|
||||||
|
Str('description?',
|
||||||
|
cli_name='desc',
|
||||||
|
label=_('Description'),
|
||||||
|
doc=_('A description of this command'),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
|
||||||
|
def get_dn(self, *keys, **options):
|
||||||
|
if keys[-1].endswith('.'):
|
||||||
|
keys[-1] = keys[-1][:-1]
|
||||||
|
dn = super(sudocmd, self).get_dn(*keys, **options)
|
||||||
|
try:
|
||||||
|
self.backend.get_entry(dn, [''])
|
||||||
|
except errors.NotFound:
|
||||||
|
try:
|
||||||
|
(dn, entry_attrs) = self.backend.find_entry_by_attr(
|
||||||
|
'cn', keys[-1], self.object_class, [''],
|
||||||
|
self.container_dn
|
||||||
|
)
|
||||||
|
except errors.NotFound:
|
||||||
|
pass
|
||||||
|
return dn
|
||||||
|
|
||||||
|
api.register(sudocmd)
|
||||||
|
|
||||||
|
class sudocmd_add(LDAPCreate):
|
||||||
|
"""
|
||||||
|
Create new sudo command.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Added sudo command "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmd_add)
|
||||||
|
|
||||||
|
class sudocmd_del(LDAPDelete):
|
||||||
|
"""
|
||||||
|
Delete sudo command.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Deleted sudo command "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmd_del)
|
||||||
|
|
||||||
|
class sudocmd_mod(LDAPUpdate):
|
||||||
|
"""
|
||||||
|
Modify command.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Modified sudo command "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmd_mod)
|
||||||
|
|
||||||
|
class sudocmd_find(LDAPSearch):
|
||||||
|
"""
|
||||||
|
Search for commands.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = ngettext(
|
||||||
|
'%(count)d sudo command matched', '%(count)d sudo command matched'
|
||||||
|
)
|
||||||
|
|
||||||
|
api.register(sudocmd_find)
|
||||||
|
|
||||||
|
class sudocmd_show(LDAPRetrieve):
|
||||||
|
"""
|
||||||
|
Display sudo command.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudocmd_show)
|
157
ipalib/plugins/sudocmdgroup.py
Normal file
157
ipalib/plugins/sudocmdgroup.py
Normal file
@ -0,0 +1,157 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
"""
|
||||||
|
Groups of sudo commands
|
||||||
|
|
||||||
|
Manage groups of sudo commands.
|
||||||
|
Every group must have a description.
|
||||||
|
|
||||||
|
EXAMPLES:
|
||||||
|
|
||||||
|
Add a new sudo command group:
|
||||||
|
ipa sudocmdgroup-add --desc='administrators commands' admincmds
|
||||||
|
|
||||||
|
Remove a sudo command group:
|
||||||
|
ipa sudocmdgroup-del admincmds
|
||||||
|
|
||||||
|
Manage sudo command group membership, commands:
|
||||||
|
ipa sudocmdgroup-add-member --sudocmds=/usr/bin/less,/usr/bin/vim admincmds
|
||||||
|
|
||||||
|
Manage sudo command group membership, commands:
|
||||||
|
ipa group-remove-member --sudocmds=/usr/bin/less admincmds
|
||||||
|
|
||||||
|
Show a sudo command group:
|
||||||
|
ipa group-show localadmins
|
||||||
|
"""
|
||||||
|
|
||||||
|
from ipalib import api
|
||||||
|
from ipalib import Str
|
||||||
|
from ipalib.plugins.baseldap import *
|
||||||
|
from ipalib import _, ngettext
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup(LDAPObject):
|
||||||
|
"""
|
||||||
|
Sudo Group object.
|
||||||
|
"""
|
||||||
|
container_dn = api.env.container_sudocmdgroup
|
||||||
|
object_name = 'sudocmdgroup'
|
||||||
|
object_name_plural = 'sudocmdgroups'
|
||||||
|
object_class = ['ipaobject', 'ipasudocmdgrp']
|
||||||
|
default_attributes = [
|
||||||
|
'cn', 'description', 'member', 'memberof'
|
||||||
|
]
|
||||||
|
uuid_attribute = 'ipauniqueid'
|
||||||
|
attribute_members = {
|
||||||
|
'member': ['sudocmd', 'sudocmdgroup'],
|
||||||
|
'memberof': ['sudocmdgroup'],
|
||||||
|
}
|
||||||
|
|
||||||
|
label = _('Sudo Command Groups')
|
||||||
|
|
||||||
|
takes_params = (
|
||||||
|
Str('cn',
|
||||||
|
cli_name='name',
|
||||||
|
label=_('Sudo Command Group name'),
|
||||||
|
primary_key=True,
|
||||||
|
normalizer=lambda value: value.lower(),
|
||||||
|
),
|
||||||
|
Str('description',
|
||||||
|
cli_name='desc',
|
||||||
|
label=_('Description'),
|
||||||
|
doc=_('Group description'),
|
||||||
|
),
|
||||||
|
Str('membercmd_sudocmd?',
|
||||||
|
label=_('Commands'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
Str('membercmd_sudocmdgroup?',
|
||||||
|
label=_('Sudo Command Groups'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
)
|
||||||
|
|
||||||
|
api.register(sudocmdgroup)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_add(LDAPCreate):
|
||||||
|
"""
|
||||||
|
Create new sudo command group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Added sudo command group "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_add)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_del(LDAPDelete):
|
||||||
|
"""
|
||||||
|
Delete sudo command group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Deleted sudo command group "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_del)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_mod(LDAPUpdate):
|
||||||
|
"""
|
||||||
|
Modify group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Modified sudo command group "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_mod)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_find(LDAPSearch):
|
||||||
|
"""
|
||||||
|
Search for sudo command groups.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = ngettext(
|
||||||
|
'%(count)d sudo command group matched',
|
||||||
|
'%(count)d sudo command groups matched', 0
|
||||||
|
)
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_find)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_show(LDAPRetrieve):
|
||||||
|
"""
|
||||||
|
Display sudo command group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_show)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_add_member(LDAPAddMember):
|
||||||
|
"""
|
||||||
|
Add members to sudo command group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_add_member)
|
||||||
|
|
||||||
|
|
||||||
|
class sudocmdgroup_remove_member(LDAPRemoveMember):
|
||||||
|
"""
|
||||||
|
Remove members from sudo command group.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudocmdgroup_remove_member)
|
199
ipalib/plugins/sudorule.py
Normal file
199
ipalib/plugins/sudorule.py
Normal file
@ -0,0 +1,199 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
"""
|
||||||
|
Sudo Rule
|
||||||
|
"""
|
||||||
|
|
||||||
|
from ipalib import api, errors
|
||||||
|
from ipalib import Str, StrEnum
|
||||||
|
from ipalib.plugins.baseldap import *
|
||||||
|
from ipalib import _, ngettext
|
||||||
|
|
||||||
|
class sudorule(LDAPObject):
|
||||||
|
"""
|
||||||
|
Sudo Rule.
|
||||||
|
"""
|
||||||
|
container_dn = api.env.container_sudorule
|
||||||
|
object_name = 'Sudo Rule'
|
||||||
|
object_name_plural = 'Sudo Rules'
|
||||||
|
object_class = ['ipaassociation', 'ipasudorule']
|
||||||
|
default_attributes = [
|
||||||
|
'cn', 'accessruletype', 'description',
|
||||||
|
|
||||||
|
]
|
||||||
|
uuid_attribute = 'ipauniqueid'
|
||||||
|
attribute_members = {
|
||||||
|
'memberuser': ['user', 'group'],
|
||||||
|
'memberhost': ['host', 'hostgroup'],
|
||||||
|
'membercmd': ['sudocmd', 'sudocmdgroup'],
|
||||||
|
}
|
||||||
|
|
||||||
|
label = _('SudoRule')
|
||||||
|
|
||||||
|
takes_params = (
|
||||||
|
Str('cn',
|
||||||
|
cli_name='name',
|
||||||
|
label=_('Rule name'),
|
||||||
|
primary_key=True,
|
||||||
|
),
|
||||||
|
Str('description?',
|
||||||
|
cli_name='desc',
|
||||||
|
label=_('Description'),
|
||||||
|
),
|
||||||
|
StrEnum('accessruletype',
|
||||||
|
cli_name='type',
|
||||||
|
doc=_('Rule type (allow or deny)'),
|
||||||
|
label=_('Rule type'),
|
||||||
|
values=(u'allow', u'deny'),
|
||||||
|
),
|
||||||
|
Str('memberuser_user?',
|
||||||
|
label=_('Users'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
Str('memberhost_host?',
|
||||||
|
label=_('Hosts'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
Str('memberhost_hostgroup?',
|
||||||
|
label=_('Host Groups'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
Str('membercmd_sudocmd?',
|
||||||
|
label=_('Sudo Commands'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
Str('membercmd_sudocmdgroup?',
|
||||||
|
label=_('Sudo Command Groups'),
|
||||||
|
flags=['no_create', 'no_update', 'no_search'],
|
||||||
|
),
|
||||||
|
)
|
||||||
|
|
||||||
|
def get_dn(self, *keys, **kwargs):
|
||||||
|
try:
|
||||||
|
(dn, entry_attrs) = self.backend.find_entry_by_attr(
|
||||||
|
self.primary_key.name, keys[-1], self.object_class, [''],
|
||||||
|
self.container_dn
|
||||||
|
)
|
||||||
|
except errors.NotFound:
|
||||||
|
dn = super(sudorule, self).get_dn(*keys, **kwargs)
|
||||||
|
return dn
|
||||||
|
|
||||||
|
api.register(sudorule)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_add(LDAPCreate):
|
||||||
|
"""
|
||||||
|
Create new Sudo Rule.
|
||||||
|
"""
|
||||||
|
|
||||||
|
msg_summary = _('Added sudo rule "%(value)s"')
|
||||||
|
|
||||||
|
api.register(sudorule_add)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_del(LDAPDelete):
|
||||||
|
"""
|
||||||
|
Delete Sudo Rule.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudorule_del)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_mod(LDAPUpdate):
|
||||||
|
"""
|
||||||
|
Modify Sudo Rule.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudorule_mod)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_find(LDAPSearch):
|
||||||
|
"""
|
||||||
|
Search for Sudo Rule.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudorule_find)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_show(LDAPRetrieve):
|
||||||
|
"""
|
||||||
|
Dispaly Sudo Rule.
|
||||||
|
"""
|
||||||
|
|
||||||
|
api.register(sudorule_show)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_add_command(LDAPAddMember):
|
||||||
|
"""
|
||||||
|
Add commands and sudo command groups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['membercmd']
|
||||||
|
member_count_out = ('%i object added.', '%i objects added.')
|
||||||
|
|
||||||
|
api.register(sudorule_add_command)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_remove_command(LDAPRemoveMember):
|
||||||
|
"""
|
||||||
|
Remove commands and sudo command groups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['membercmd']
|
||||||
|
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||||
|
|
||||||
|
api.register(sudorule_remove_command)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_add_user(LDAPAddMember):
|
||||||
|
"""
|
||||||
|
Add users and groups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['memberuser']
|
||||||
|
member_count_out = ('%i object added.', '%i objects added.')
|
||||||
|
|
||||||
|
api.register(sudorule_add_user)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_remove_user(LDAPRemoveMember):
|
||||||
|
"""
|
||||||
|
Remove users and groups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['memberuser']
|
||||||
|
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||||
|
|
||||||
|
api.register(sudorule_remove_user)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_add_host(LDAPAddMember):
|
||||||
|
"""
|
||||||
|
Add hosts and hostgroups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['memberhost']
|
||||||
|
member_count_out = ('%i object added.', '%i objects added.')
|
||||||
|
|
||||||
|
api.register(sudorule_add_host)
|
||||||
|
|
||||||
|
|
||||||
|
class sudorule_remove_host(LDAPRemoveMember):
|
||||||
|
"""
|
||||||
|
Remove hosts and hostgroups affected by Sudo Rule.
|
||||||
|
"""
|
||||||
|
member_attributes = ['memberhost']
|
||||||
|
member_count_out = ('%i object removed.', '%i objects removed.')
|
||||||
|
|
||||||
|
api.register(sudorule_remove_host)
|
@ -94,3 +94,15 @@ hbacsvcgroup = [
|
|||||||
u'groupOfNames',
|
u'groupOfNames',
|
||||||
u'top',
|
u'top',
|
||||||
]
|
]
|
||||||
|
|
||||||
|
sudocmd = [
|
||||||
|
u'ipaobject',
|
||||||
|
u'ipasudocmd',
|
||||||
|
]
|
||||||
|
|
||||||
|
sudocmdgroup = [
|
||||||
|
u'ipaobject',
|
||||||
|
u'ipasudocmdgrp',
|
||||||
|
u'groupOfNames',
|
||||||
|
u'top',
|
||||||
|
]
|
||||||
|
190
tests/test_xmlrpc/test_sudocmd_plugin.py
Normal file
190
tests/test_xmlrpc/test_sudocmd_plugin.py
Normal file
@ -0,0 +1,190 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
|
||||||
|
"""
|
||||||
|
Test the `ipalib/plugins/sudocmd.py` module.
|
||||||
|
"""
|
||||||
|
|
||||||
|
from ipalib import api, errors
|
||||||
|
from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
|
||||||
|
from tests.test_xmlrpc import objectclasses
|
||||||
|
|
||||||
|
|
||||||
|
sudocmd1 = u'/usr/bin/sudotestcmd1'
|
||||||
|
|
||||||
|
|
||||||
|
class test_sudocmd(Declarative):
|
||||||
|
|
||||||
|
cleanup_commands = [
|
||||||
|
('sudocmd_del', [sudocmd1], {}),
|
||||||
|
]
|
||||||
|
|
||||||
|
tests = [
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_mod', [sudocmd1], dict(description=u'Nope')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_del', [sudocmd1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Create %r' % sudocmd1,
|
||||||
|
command=('sudocmd_add', [sudocmd1],
|
||||||
|
dict(
|
||||||
|
description=u'Test sudo command 1',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=u'Added sudo command "%s"' % sudocmd1,
|
||||||
|
result=dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
cn=[sudocmd1],
|
||||||
|
description=[u'Test sudo command 1'],
|
||||||
|
objectclass=objectclasses.sudocmd,
|
||||||
|
ipauniqueid=[fuzzy_uuid],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to create duplicate %r' % sudocmd1,
|
||||||
|
command=('sudocmd_add', [sudocmd1],
|
||||||
|
dict(
|
||||||
|
description=u'Test sudo command 1',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
expected=errors.DuplicateEntry(),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=None,
|
||||||
|
result=dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
cn=[sudocmd1],
|
||||||
|
description=[u'Test sudo command 1'],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Search for %r' % sudocmd1,
|
||||||
|
command=('sudocmd_find', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
count=1,
|
||||||
|
truncated=False,
|
||||||
|
summary=u'1 sudo command matched',
|
||||||
|
result=[
|
||||||
|
dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
cn=[sudocmd1],
|
||||||
|
description=[u'Test sudo command 1'],
|
||||||
|
),
|
||||||
|
],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Update %r' % sudocmd1,
|
||||||
|
command=('sudocmd_mod', [sudocmd1], dict(
|
||||||
|
description=u'Updated sudo command 1')),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=u'Modified sudo command "%s"' % sudocmd1,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmd1],
|
||||||
|
description=[u'Updated sudo command 1'],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r to verify update' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=None,
|
||||||
|
result=dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
cn=[sudocmd1],
|
||||||
|
description=[u'Updated sudo command 1'],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Delete %r' % sudocmd1,
|
||||||
|
command=('sudocmd_del', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=u'Deleted sudo command "%s"' % sudocmd1,
|
||||||
|
result=True,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_mod', [sudocmd1], dict(description=u'Nope')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmd1,
|
||||||
|
command=('sudocmd_del', [sudocmd1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
]
|
535
tests/test_xmlrpc/test_sudocmdgroup_plugin.py
Normal file
535
tests/test_xmlrpc/test_sudocmdgroup_plugin.py
Normal file
@ -0,0 +1,535 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
"""
|
||||||
|
Test the `ipalib/plugins/sudocmdgroup.py` module.
|
||||||
|
"""
|
||||||
|
|
||||||
|
from ipalib import api, errors
|
||||||
|
from tests.test_xmlrpc import objectclasses
|
||||||
|
from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
|
||||||
|
|
||||||
|
sudocmdgroup1 = u'testsudocmdgroup1'
|
||||||
|
sudocmdgroup2 = u'testsudocmdgroup2'
|
||||||
|
sudocmd1 = u'/usr/bin/sudotestcmd1'
|
||||||
|
|
||||||
|
class test_sudocmdgroup(Declarative):
|
||||||
|
cleanup_commands = [
|
||||||
|
('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||||
|
('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||||
|
('sudocmd_del', [sudocmd1], {}),
|
||||||
|
]
|
||||||
|
|
||||||
|
tests = [
|
||||||
|
|
||||||
|
################
|
||||||
|
# create sudo command
|
||||||
|
dict(
|
||||||
|
desc='Create %r' % sudocmd1,
|
||||||
|
command=(
|
||||||
|
'sudocmd_add', [], dict(cn=sudocmd1,)
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=u'Added sudo command "%s"' % sudocmd1,
|
||||||
|
result=dict(
|
||||||
|
objectclass=objectclasses.sudocmd,
|
||||||
|
cn=[u'/usr/bin/sudotestcmd1'],
|
||||||
|
ipauniqueid=[fuzzy_uuid],
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Verify the managed sudo command %r was created' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=None,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmd1],
|
||||||
|
dn=u'cn=%s,cn=sudocmds,cn=accounts,%s' % (sudocmd1,
|
||||||
|
api.env.basedn),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
################
|
||||||
|
# create sudo command group1:
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_mod', [sudocmdgroup1],
|
||||||
|
dict(description=u'Foo')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Create %r' % sudocmdgroup1,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add', [sudocmdgroup1],
|
||||||
|
dict(description=u'Test desc 1')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup1,
|
||||||
|
summary=u'Added sudo command group "testsudocmdgroup1"',
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'Test desc 1'],
|
||||||
|
objectclass=objectclasses.sudocmdgroup,
|
||||||
|
ipauniqueid=[fuzzy_uuid],
|
||||||
|
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to create duplicate %r' % sudocmdgroup1,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add', [sudocmdgroup1],
|
||||||
|
dict(description=u'Test desc 1')
|
||||||
|
),
|
||||||
|
expected=errors.DuplicateEntry(),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup1,
|
||||||
|
summary=None,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'Test desc 1'],
|
||||||
|
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Updated %r' % sudocmdgroup1,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_mod', [sudocmdgroup1],
|
||||||
|
dict(description=u'New desc 1')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'New desc 1'],
|
||||||
|
),
|
||||||
|
summary=u'Modified sudo command group "testsudocmdgroup1"',
|
||||||
|
value=sudocmdgroup1,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r to verify update' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup1,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'New desc 1'],
|
||||||
|
dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
summary=None,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Search for %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_find', [], dict(cn=sudocmdgroup1)),
|
||||||
|
expected=dict(
|
||||||
|
count=1,
|
||||||
|
truncated=False,
|
||||||
|
result=[
|
||||||
|
dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'New desc 1'],
|
||||||
|
),
|
||||||
|
],
|
||||||
|
summary=u'1 sudo command group matched',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
################
|
||||||
|
# create sudocmdgroup2:
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_mod', [sudocmdgroup2],
|
||||||
|
dict(description=u'Foo')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Create %r' % sudocmdgroup2,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add', [sudocmdgroup2],
|
||||||
|
dict(description=u'Test desc 2')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup2,
|
||||||
|
summary=u'Added sudo command group "testsudocmdgroup2"',
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'Test desc 2'],
|
||||||
|
objectclass=objectclasses.sudocmdgroup,
|
||||||
|
ipauniqueid=[fuzzy_uuid],
|
||||||
|
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to create duplicate %r' % sudocmdgroup2,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add', [sudocmdgroup2],
|
||||||
|
dict(description=u'Test desc 2')
|
||||||
|
),
|
||||||
|
expected=errors.DuplicateEntry(),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup2,
|
||||||
|
summary=None,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'Test desc 2'],
|
||||||
|
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Updated %r' % sudocmdgroup2,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_mod', [sudocmdgroup2],
|
||||||
|
dict(description=u'New desc 2')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'New desc 2'],
|
||||||
|
),
|
||||||
|
summary=u'Modified sudo command group "testsudocmdgroup2"',
|
||||||
|
value=sudocmdgroup2,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Retrieve %r to verify update' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||||
|
expected=dict(
|
||||||
|
value=sudocmdgroup2,
|
||||||
|
result=dict(
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'New desc 2'],
|
||||||
|
dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=accounts,' + \
|
||||||
|
api.env.basedn,
|
||||||
|
),
|
||||||
|
summary=None,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Search for %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_find', [], dict(cn=sudocmdgroup2)),
|
||||||
|
expected=dict(
|
||||||
|
count=1,
|
||||||
|
truncated=False,
|
||||||
|
result=[
|
||||||
|
dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup2, api.env.basedn),
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'New desc 2'],
|
||||||
|
),
|
||||||
|
],
|
||||||
|
summary=u'1 sudo command group matched',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Search for all sudocmdgroups',
|
||||||
|
command=('sudocmdgroup_find', [], {}),
|
||||||
|
expected=dict(
|
||||||
|
summary=u'2 sudo command groups matched',
|
||||||
|
count=2,
|
||||||
|
truncated=False,
|
||||||
|
result=[
|
||||||
|
dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
cn=[sudocmdgroup1],
|
||||||
|
description=[u'New desc 1'],
|
||||||
|
),
|
||||||
|
dict(
|
||||||
|
dn=u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup2, api.env.basedn),
|
||||||
|
cn=[sudocmdgroup2],
|
||||||
|
description=[u'New desc 2'],
|
||||||
|
),
|
||||||
|
],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
###############
|
||||||
|
# member stuff:
|
||||||
|
dict(
|
||||||
|
desc='Add member %r to %r' % (sudocmd1, sudocmdgroup1),
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add_member', [sudocmdgroup1],
|
||||||
|
dict(sudocmd=sudocmd1)
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
completed=1,
|
||||||
|
failed=dict(
|
||||||
|
member=dict(
|
||||||
|
sudocmdgroup=tuple(),
|
||||||
|
sudocmd=tuple(),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
result={
|
||||||
|
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
'member_sudocmd': (sudocmd1,),
|
||||||
|
'cn': [sudocmdgroup1],
|
||||||
|
'description': [u'New desc 1'],
|
||||||
|
},
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
dict(
|
||||||
|
# FIXME: Shouldn't this raise a NotFound instead?
|
||||||
|
desc='Try to add non-existent member to %r' % sudocmdgroup1,
|
||||||
|
command=(
|
||||||
|
'sudocmdgroup_add_member', [sudocmdgroup1],
|
||||||
|
dict(sudocmd=u'notfound')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
completed=0,
|
||||||
|
failed=dict(
|
||||||
|
member=dict(
|
||||||
|
sudocmdgroup=tuple(),
|
||||||
|
sudocmd=(u'notfound',),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
result={
|
||||||
|
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
'member_sudocmd': (u'/usr/bin/sudotestcmd1',),
|
||||||
|
'cn': [sudocmdgroup1],
|
||||||
|
'description': [u'New desc 1'],
|
||||||
|
},
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Remove member %r from %r' % (sudocmd1, sudocmdgroup1),
|
||||||
|
command=('sudocmdgroup_remove_member',
|
||||||
|
[sudocmdgroup1], dict(sudocmd=sudocmd1)
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
completed=1,
|
||||||
|
failed=dict(
|
||||||
|
member=dict(
|
||||||
|
sudocmdgroup=tuple(),
|
||||||
|
sudocmd=tuple(),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
result={
|
||||||
|
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
'cn': [sudocmdgroup1],
|
||||||
|
'description': [u'New desc 1'],
|
||||||
|
},
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
dict(
|
||||||
|
# FIXME: Shouldn't this raise a NotFound instead?
|
||||||
|
desc='Try to remove non-existent member from %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_remove_member',
|
||||||
|
[sudocmdgroup1], dict(sudocmd=u'notfound')
|
||||||
|
),
|
||||||
|
expected=dict(
|
||||||
|
completed=0,
|
||||||
|
failed=dict(
|
||||||
|
member=dict(
|
||||||
|
sudocmdgroup=tuple(),
|
||||||
|
sudocmd=(u'notfound',),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
result={
|
||||||
|
'dn': u'cn=%s,cn=sudocmdgroups,cn=accounts,%s' % \
|
||||||
|
(sudocmdgroup1, api.env.basedn),
|
||||||
|
'cn': [sudocmdgroup1],
|
||||||
|
'description': [u'New desc 1'],
|
||||||
|
},
|
||||||
|
),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
################
|
||||||
|
# delete sudocmdgroup1:
|
||||||
|
dict(
|
||||||
|
desc='Delete %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||||
|
expected=dict(
|
||||||
|
result=True,
|
||||||
|
value=sudocmdgroup1,
|
||||||
|
summary=u'Deleted sudo command group "testsudocmdgroup1"',
|
||||||
|
)
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmdgroup1,
|
||||||
|
command=('sudocmdgroup_mod', [sudocmdgroup1],
|
||||||
|
dict(description=u'Foo')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
################
|
||||||
|
# delete sudocmdgroup2:
|
||||||
|
dict(
|
||||||
|
desc='Delete %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||||
|
expected=dict(
|
||||||
|
result=True,
|
||||||
|
value=sudocmdgroup2,
|
||||||
|
summary=u'Deleted sudo command group "testsudocmdgroup2"',
|
||||||
|
)
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to delete non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_del', [sudocmdgroup2], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to retrieve non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_show', [sudocmdgroup2], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Try to update non-existent %r' % sudocmdgroup2,
|
||||||
|
command=('sudocmdgroup_mod', [sudocmdgroup2],
|
||||||
|
dict(description=u'Foo')),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
##### clean up test Command
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Now delete the sudo command %r' % sudocmd1,
|
||||||
|
command=('sudocmd_del', [sudocmd1], {}),
|
||||||
|
expected=dict(
|
||||||
|
result=True,
|
||||||
|
value=sudocmd1,
|
||||||
|
summary=u'Deleted sudo command "%s"' % sudocmd1,
|
||||||
|
)
|
||||||
|
),
|
||||||
|
|
||||||
|
|
||||||
|
dict(
|
||||||
|
desc='Verify that %r is really gone' % sudocmd1,
|
||||||
|
command=('sudocmd_show', [sudocmd1], {}),
|
||||||
|
expected=errors.NotFound(reason='no such entry'),
|
||||||
|
),
|
||||||
|
|
||||||
|
]
|
269
tests/test_xmlrpc/test_sudorule_plugin.py
Normal file
269
tests/test_xmlrpc/test_sudorule_plugin.py
Normal file
@ -0,0 +1,269 @@
|
|||||||
|
# Authors:
|
||||||
|
# Jr Aquino <jr.aquino@citrixonline.com>
|
||||||
|
# Pavel Zuna <pzuna@redhat.com>
|
||||||
|
#
|
||||||
|
# Copyright (C) 2010 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation; version 2 only
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||||
|
"""
|
||||||
|
Test the `ipalib/plugins/sudorule.py` module.
|
||||||
|
"""
|
||||||
|
|
||||||
|
from xmlrpc_test import XMLRPC_test, assert_attr_equal
|
||||||
|
from ipalib import api
|
||||||
|
from ipalib import errors
|
||||||
|
|
||||||
|
|
||||||
|
class test_sudorule(XMLRPC_test):
|
||||||
|
"""
|
||||||
|
Test the `sudorule` plugin.
|
||||||
|
"""
|
||||||
|
rule_name = u'testing_sudorule1'
|
||||||
|
rule_type = u'allow'
|
||||||
|
rule_type_fail = u'value not allowed'
|
||||||
|
rule_command = u'/usr/bin/testsudocmd1'
|
||||||
|
rule_desc = u'description'
|
||||||
|
rule_desc_mod = u'description modified'
|
||||||
|
|
||||||
|
test_user = u'sudorule_test_user'
|
||||||
|
test_group = u'sudorule_test_group'
|
||||||
|
test_host = u'sudorule._test_host'
|
||||||
|
test_hostgroup = u'sudorule_test_hostgroup'
|
||||||
|
test_sudocmdgroup = u'sudorule_test_cmdgroup'
|
||||||
|
test_command = u'/usr/bin/testsudocmd1'
|
||||||
|
|
||||||
|
def test_0_sudorule_add(self):
|
||||||
|
"""
|
||||||
|
Test adding a new Sudo rule using `xmlrpc.sudorule_add`.
|
||||||
|
"""
|
||||||
|
ret = self.failsafe_add(api.Object.sudorule,
|
||||||
|
self.rule_name,
|
||||||
|
accessruletype=self.rule_type,
|
||||||
|
description=self.rule_desc,
|
||||||
|
)
|
||||||
|
entry = ret['result']
|
||||||
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
||||||
|
assert_attr_equal(entry, 'accessruletype', self.rule_type)
|
||||||
|
assert_attr_equal(entry, 'description', self.rule_desc)
|
||||||
|
|
||||||
|
def test_1_sudorule_add(self):
|
||||||
|
"""
|
||||||
|
Test adding an duplicate Sudo rule using `xmlrpc.sudorule_add'.
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
api.Command['sudorule_add'](
|
||||||
|
self.rule_name, accessruletype=self.rule_type
|
||||||
|
)
|
||||||
|
except errors.DuplicateEntry:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
assert False
|
||||||
|
|
||||||
|
def test_2_sudorule_show(self):
|
||||||
|
"""
|
||||||
|
Test displaying a Sudo rule using `xmlrpc.sudorule_show`.
|
||||||
|
"""
|
||||||
|
entry = api.Command['sudorule_show'](self.rule_name)['result']
|
||||||
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
||||||
|
assert_attr_equal(entry, 'accessruletype', self.rule_type)
|
||||||
|
assert_attr_equal(entry, 'description', self.rule_desc)
|
||||||
|
|
||||||
|
def test_3_sudorule_mod(self):
|
||||||
|
"""
|
||||||
|
Test modifying a Sudo rule using `xmlrpc.sudorule_mod`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_mod'](
|
||||||
|
self.rule_name, description=self.rule_desc_mod
|
||||||
|
)
|
||||||
|
entry = ret['result']
|
||||||
|
assert_attr_equal(entry, 'description', self.rule_desc_mod)
|
||||||
|
|
||||||
|
def test_6_sudorule_find(self):
|
||||||
|
"""
|
||||||
|
Test searching for Sudo rules using `xmlrpc.sudorule_find`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_find'](
|
||||||
|
name=self.rule_name, accessruletype=self.rule_type,
|
||||||
|
description=self.rule_desc_mod
|
||||||
|
)
|
||||||
|
assert ret['truncated'] is False
|
||||||
|
entries = ret['result']
|
||||||
|
assert_attr_equal(entries[0], 'cn', self.rule_name)
|
||||||
|
assert_attr_equal(entries[0], 'accessruletype', self.rule_type)
|
||||||
|
assert_attr_equal(entries[0], 'description', self.rule_desc_mod)
|
||||||
|
|
||||||
|
def test_7_sudorule_init_testing_data(self):
|
||||||
|
"""
|
||||||
|
Initialize data for more Sudo rule plugin testing.
|
||||||
|
"""
|
||||||
|
self.failsafe_add(api.Object.user,
|
||||||
|
self.test_user, givenname=u'first', sn=u'last'
|
||||||
|
)
|
||||||
|
self.failsafe_add(api.Object.group,
|
||||||
|
self.test_group, description=u'description'
|
||||||
|
)
|
||||||
|
self.failsafe_add(api.Object.host,
|
||||||
|
self.test_host, force=True
|
||||||
|
)
|
||||||
|
self.failsafe_add(api.Object.hostgroup,
|
||||||
|
self.test_hostgroup, description=u'description'
|
||||||
|
)
|
||||||
|
self.failsafe_add(api.Object.sudocmdgroup,
|
||||||
|
self.test_sudocmdgroup, description=u'desc'
|
||||||
|
)
|
||||||
|
self.failsafe_add(api.Object.sudocmd,
|
||||||
|
self.test_command, description=u'desc', force=True
|
||||||
|
)
|
||||||
|
|
||||||
|
def test_8_sudorule_add_user(self):
|
||||||
|
"""
|
||||||
|
Test adding user and group to Sudo rule using
|
||||||
|
`xmlrpc.sudorule_add_user`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_add_user'](
|
||||||
|
self.rule_name, user=self.test_user, group=self.test_group
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'memberuser' in failed
|
||||||
|
assert 'user' in failed['memberuser']
|
||||||
|
assert not failed['memberuser']['user']
|
||||||
|
assert 'group' in failed['memberuser']
|
||||||
|
assert not failed['memberuser']['group']
|
||||||
|
entry = ret['result']
|
||||||
|
assert_attr_equal(entry, 'memberuser_user', self.test_user)
|
||||||
|
assert_attr_equal(entry, 'memberuser_group', self.test_group)
|
||||||
|
|
||||||
|
def test_9_sudorule_remove_user(self):
|
||||||
|
"""
|
||||||
|
Test removing user and group from Sudo rule using
|
||||||
|
`xmlrpc.sudorule_remove_user'.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_remove_user'](
|
||||||
|
self.rule_name, user=self.test_user, group=self.test_group
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'memberuser' in failed
|
||||||
|
assert 'user' in failed['memberuser']
|
||||||
|
assert not failed['memberuser']['user']
|
||||||
|
assert 'group' in failed['memberuser']
|
||||||
|
assert not failed['memberuser']['group']
|
||||||
|
entry = ret['result']
|
||||||
|
assert 'memberuser_user' not in entry
|
||||||
|
assert 'memberuser_group' not in entry
|
||||||
|
|
||||||
|
def test_a_sudorule_add_host(self):
|
||||||
|
"""
|
||||||
|
Test adding host and hostgroup to Sudo rule using
|
||||||
|
`xmlrpc.sudorule_add_host`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_add_host'](
|
||||||
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'memberhost' in failed
|
||||||
|
assert 'host' in failed['memberhost']
|
||||||
|
assert not failed['memberhost']['host']
|
||||||
|
assert 'hostgroup' in failed['memberhost']
|
||||||
|
assert not failed['memberhost']['hostgroup']
|
||||||
|
entry = ret['result']
|
||||||
|
assert_attr_equal(entry, 'memberhost_host', self.test_host)
|
||||||
|
assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup)
|
||||||
|
|
||||||
|
def test_b_sudorule_remove_host(self):
|
||||||
|
"""
|
||||||
|
Test removing host and hostgroup from Sudo rule using
|
||||||
|
`xmlrpc.sudorule_remove_host`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_remove_host'](
|
||||||
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'memberhost' in failed
|
||||||
|
assert 'host' in failed['memberhost']
|
||||||
|
assert not failed['memberhost']['host']
|
||||||
|
assert 'hostgroup' in failed['memberhost']
|
||||||
|
assert not failed['memberhost']['hostgroup']
|
||||||
|
entry = ret['result']
|
||||||
|
assert 'memberhost_host' not in entry
|
||||||
|
assert 'memberhost_hostgroup' not in entry
|
||||||
|
|
||||||
|
def test_a_sudorule_add_command(self):
|
||||||
|
"""
|
||||||
|
Test adding command and cmdgroup to Sudo rule using
|
||||||
|
`xmlrpc.sudorule_add_command`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_add_command'](
|
||||||
|
self.rule_name, sudocmd=self.test_command,
|
||||||
|
sudocmdgroup=self.test_sudocmdgroup
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'membercmd' in failed
|
||||||
|
assert 'sudocmd' in failed['membercmd']
|
||||||
|
assert not failed['membercmd']['sudocmd']
|
||||||
|
assert 'sudocmdgroup' in failed['membercmd']
|
||||||
|
assert not failed['membercmd']['sudocmdgroup']
|
||||||
|
entry = ret['result']
|
||||||
|
assert_attr_equal(entry, 'membercmd_sudocmd', self.test_command)
|
||||||
|
assert_attr_equal(entry, 'membercmd_sudocmdgroup',
|
||||||
|
self.test_sudocmdgroup)
|
||||||
|
|
||||||
|
def test_a_sudorule_remove_command(self):
|
||||||
|
"""
|
||||||
|
Test removing command and sudocmdgroup from Sudo rule using
|
||||||
|
`xmlrpc.sudorule_remove_command`.
|
||||||
|
"""
|
||||||
|
ret = api.Command['sudorule_remove_command'](
|
||||||
|
self.rule_name, sudocmd=self.test_command,
|
||||||
|
sudocmdgroup=self.test_sudocmdgroup
|
||||||
|
)
|
||||||
|
assert ret['completed'] == 2
|
||||||
|
failed = ret['failed']
|
||||||
|
assert 'membercmd' in failed
|
||||||
|
assert 'sudocmd' in failed['membercmd']
|
||||||
|
assert not failed['membercmd']['sudocmd']
|
||||||
|
assert 'sudocmdgroup' in failed['membercmd']
|
||||||
|
assert not failed['membercmd']['sudocmdgroup']
|
||||||
|
entry = ret['result']
|
||||||
|
assert 'membercmd_sudocmd' not in entry
|
||||||
|
assert 'membercmd_sudocmdgroup' not in entry
|
||||||
|
|
||||||
|
def test_c_sudorule_clear_testing_data(self):
|
||||||
|
"""
|
||||||
|
Clear data for Sudo rule plugin testing.
|
||||||
|
"""
|
||||||
|
api.Command['user_del'](self.test_user)
|
||||||
|
api.Command['group_del'](self.test_group)
|
||||||
|
api.Command['host_del'](self.test_host)
|
||||||
|
api.Command['hostgroup_del'](self.test_hostgroup)
|
||||||
|
api.Command['sudocmd_del'](self.test_command)
|
||||||
|
api.Command['sudocmdgroup_del'](self.test_sudocmdgroup)
|
||||||
|
|
||||||
|
def test_f_sudorule_del(self):
|
||||||
|
"""
|
||||||
|
Test deleting a Sudo rule using `xmlrpc.sudorule_del`.
|
||||||
|
"""
|
||||||
|
assert api.Command['sudorule_del'](self.rule_name)['result'] is True
|
||||||
|
# verify that it's gone
|
||||||
|
try:
|
||||||
|
api.Command['sudorule_show'](self.rule_name)
|
||||||
|
except errors.NotFound:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
assert False
|
Loading…
Reference in New Issue
Block a user