mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 08:00:02 -06:00
965181362a
2ef6e14c5a added an invalid HBAC rule that
encoded the service wrongly.
See: https://bugzilla.redhat.com/show_bug.cgi?id=1643928
Fixes: https://pagure.io/freeipa/issue/7831
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
28 lines
805 B
Plaintext
28 lines
805 B
Plaintext
# default HBAC policy that grants permission to all services
|
|
dn: ipauniqueid=autogenerate,cn=hbac,$SUFFIX
|
|
changetype: add
|
|
objectclass: ipaassociation
|
|
objectclass: ipahbacrule
|
|
cn: allow_all
|
|
accessruletype: allow
|
|
usercategory: all
|
|
hostcategory: all
|
|
servicecategory: all
|
|
ipaenabledflag: TRUE
|
|
description: Allow all users to access any host from any host
|
|
ipauniqueid: autogenerate
|
|
|
|
# default HBAC policy for pam_systemd
|
|
dn: ipauniqueid=autogenerate,cn=hbac,$SUFFIX
|
|
changetype: add
|
|
objectclass: ipaassociation
|
|
objectclass: ipahbacrule
|
|
cn: allow_systemd-user
|
|
accessruletype: allow
|
|
usercategory: all
|
|
hostcategory: all
|
|
memberService: cn=systemd-user,cn=hbacservices,cn=hbac,$SUFFIX
|
|
ipaenabledflag: TRUE
|
|
description: Allow pam_systemd to run user@.service to create a system user session
|
|
ipauniqueid: autogenerate
|