mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 23:50:03 -06:00
d4a0fa34af
- add missing closing parenthesis in idnsRecord declaration - remove extra dollar sign from ipaSudoRule declaration - handle missing/extraneous X-ORIGIN lines in 10-selinuxusermap.update This does not use the schema updater because the syntax needs to be fixed in the files themselves, otherwise 389 1.3.2+ will fail to start. Older DS versions transparently fix the syntax errors. The existing ldap-updater directive for ipaSudoRule is fixed (ldap-updater runs after upgradeconfig). https://fedorahosted.org/freeipa/ticket/3578
56 lines
3.4 KiB
Plaintext
56 lines
3.4 KiB
Plaintext
# Add the SELinux User map config schema
|
|
dn: cn=schema
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.3.26
|
|
NAME 'ipaSELinuxUserMapDefault'
|
|
DESC 'Default SELinux user'
|
|
EQUALITY caseIgnoreMatch
|
|
ORDERING caseIgnoreMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
|
|
X-ORIGIN 'IPA v3')
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.3.27
|
|
NAME 'ipaSELinuxUserMapOrder'
|
|
DESC 'Available SELinux user context ordering'
|
|
EQUALITY caseIgnoreMatch
|
|
ORDERING caseIgnoreMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
|
|
X-ORIGIN 'IPA v3')
|
|
replace:objectClasses:( 2.16.840.1.113730.3.8.2.1 NAME 'ipaGuiConfig' AUXILIARY MAY ( ipaUserSearchFields $$ ipaGroupSearchFields $$ ipaSearchTimeLimit $$ ipaSearchRecordsLimit $$ ipaCustomFields $$ ipaHomesRootDir $$ ipaDefaultLoginShell $$ ipaDefaultPrimaryGroup $$ ipaMaxUsernameLength $$ ipaPwdExpAdvNotify $$ ipaUserObjectClasses $$ ipaGroupObjectClasses $$ ipaDefaultEmailDomain $$ ipaMigrationEnabled $$ ipaCertificateSubjectBase ) )::( 2.16.840.1.113730.3.8.2.1 NAME 'ipaGuiConfig' AUXILIARY MAY ( ipaUserSearchFields $$ ipaGroupSearchFields $$ ipaSearchTimeLimit $$ ipaSearchRecordsLimit $$ ipaCustomFields $$ ipaHomesRootDir $$ ipaDefaultLoginShell $$ ipaDefaultPrimaryGroup $$ ipaMaxUsernameLength $$ ipaPwdExpAdvNotify $$ ipaUserObjectClasses $$ ipaGroupObjectClasses $$ ipaDefaultEmailDomain $$ ipaMigrationEnabled $$ ipaCertificateSubjectBase $$ ipaSELinuxUserMapDefault $$ ipaSELinuxUserMapOrder) )
|
|
|
|
# Add the default PAC service type relies on the new SELinux user map
|
|
# values being there so add it here.
|
|
dn: cn=schema
|
|
replace:objectClasses:( 2.16.840.1.113730.3.8.2.1 NAME 'ipaGuiConfig' AUXILIARY MAY ( ipaUserSearchFields $$ ipaGroupSearchFields $$ ipaSearchTimeLimit $$ ipaSearchRecordsLimit $$ ipaCustomFields $$ ipaHomesRootDir $$ ipaDefaultLoginShell $$ ipaDefaultPrimaryGroup $$ ipaMaxUsernameLength $$ ipaPwdExpAdvNotify $$ ipaUserObjectClasses $$ ipaGroupObjectClasses $$ ipaDefaultEmailDomain $$ ipaMigrationEnabled $$ ipaCertificateSubjectBase $$ ipaSELinuxUserMapDefault $$ ipaSELinuxUserMapOrder ) )::( 2.16.840.1.113730.3.8.2.1 NAME 'ipaGuiConfig' AUXILIARY MAY ( ipaUserSearchFields $$ ipaGroupSearchFields $$ ipaSearchTimeLimit $$ ipaSearchRecordsLimit $$ ipaCustomFields $$ ipaHomesRootDir $$ ipaDefaultLoginShell $$ ipaDefaultPrimaryGroup $$ ipaMaxUsernameLength $$ ipaPwdExpAdvNotify $$ ipaUserObjectClasses $$ ipaGroupObjectClasses $$ ipaDefaultEmailDomain $$ ipaMigrationEnabled $$ ipaCertificateSubjectBase $$ ipaSELinuxUserMapDefault $$ ipaSELinuxUserMapOrder $$ ipaKrbAuthzData) )
|
|
|
|
# Add the SELinux User map schema
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.11.30
|
|
NAME 'ipaSELinuxUser'
|
|
DESC 'An SELinux user'
|
|
EQUALITY caseIgnoreMatch
|
|
ORDERING caseIgnoreOrderingMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
|
|
X-ORIGIN 'IPA v3')
|
|
add:objectClasses:
|
|
( 2.16.840.1.113730.3.8.12.10
|
|
NAME 'ipaSELinuxUserMap' SUP ipaAssociation
|
|
STRUCTURAL MUST ipaSELinuxUser
|
|
MAY ( accessTime $$ seeAlso )
|
|
X-ORIGIN 'IPA v3')
|
|
|
|
# Create the SELinux User map container
|
|
dn: cn=selinux,$SUFFIX
|
|
default:objectClass: top
|
|
default:objectClass: nsContainer
|
|
default:cn: selinux
|
|
|
|
dn: cn=usermap,cn=selinux,$SUFFIX
|
|
default:objectClass: top
|
|
default:objectClass: nsContainer
|
|
default:cn: usermap
|
|
|