summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-02-17 17:19:24 -0500
committerRob Crittenden <rcritten@redhat.com>2011-02-18 15:29:51 -0500
commit496ab3f738d55e9356142048dcfef2caa46c121f (patch)
tree988cfc48e76564cc16fbb8935f46a97ed71f4d9b
parent6943acc1615da141d86dc9a84c7f86629199516f (diff)
downloadfreeipa-496ab3f738d55e9356142048dcfef2caa46c121f.zip
freeipa-496ab3f738d55e9356142048dcfef2caa46c121f.tar.gz
freeipa-496ab3f738d55e9356142048dcfef2caa46c121f.tar.xz
Add aci to make managed netgroups immutable.
ticket 962
-rw-r--r--install/updates/20-aci.update4
-rw-r--r--install/updates/Makefile.am3
2 files changed, 6 insertions, 1 deletions
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update
new file mode 100644
index 0000000..42f1e9f
--- /dev/null
+++ b/install/updates/20-aci.update
@@ -0,0 +1,4 @@
+# Don't allow managed netgroups to be modified
+dn: cn=ng,cn=alt,$SUFFIX
+add:aci: '(targetfilter = "(objectClass=mepManagedEntry)")(targetattr = "*")(version 3.0; acl "Managed netgroups cannot be modified"; deny (write) userdn = "ldap:///all";)'
+
diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am
index 26318e1..c3473ac 100644
--- a/install/updates/Makefile.am
+++ b/install/updates/Makefile.am
@@ -4,13 +4,14 @@ appdir = $(IPA_DATA_DIR)/updates
app_DATA = \
10-RFC2307bis.update \
10-RFC4876.update \
+ 20-aci.update \
20-dna.update \
20-indices.update \
20-nss_ldap.update \
20-replication.update \
20-winsync_index.update \
40-delegation.update \
- 50-lockout-policy.update \
+ 50-lockout-policy.update \
$(NULL)
EXTRA_DIST = \