diff options
author | Rob Crittenden <rcritten@redhat.com> | 2010-12-17 15:04:47 -0500 |
---|---|---|
committer | Adam Young <ayoung@redhat.com> | 2010-12-17 17:16:25 -0500 |
commit | 1207a7c83f89fccbd38c28e2c0c2307a55956a9d (patch) | |
tree | 0572b05bc80f2749847348e7d7578d574ba4dc09 | |
parent | b66c680f862e1dd2ff788ec593fb2f5dee7e43ab (diff) | |
download | freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.tar.gz freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.tar.xz freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.zip |
Fix the change_password permissions and the DNS access controls.
The change_password permission was too broad, limit it to users.
The DNS access controls rolled everything into a single ACI. I broke
it out into separate ACIs for add, delete and add. I also added a new
dns type for the permission plugin.
ticket 628
-rw-r--r-- | install/share/delegation.ldif | 2 | ||||
-rw-r--r-- | install/share/dns.ldif | 32 | ||||
-rw-r--r-- | ipalib/plugins/aci.py | 3 | ||||
-rw-r--r-- | ipalib/plugins/permission.py | 2 |
4 files changed, 32 insertions, 7 deletions
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index 7881a029d..d87b6c260 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -493,7 +493,7 @@ dn: $SUFFIX changetype: modify add: aci aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=permissions,cn=accounts,$SUFFIX";) -aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";) +aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";) aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Add user to default group";allow (write) groupdn = "ldap:///cn=add_user_to_default_group,cn=permissions,cn=accounts,$SUFFIX";) aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=permissions,cn=accounts,$SUFFIX";) aci: (targetattr = "givenName || sn || cn || displayName || title || initials || loginShell || gecos || homePhone || mobile || pager || facsimileTelephoneNumber || telephoneNumber || street || roomNumber || l || st || postalCode || manager || secretary || description || carLicense || labeledURI || inetUserHTTPURL || seeAlso || employeeType || businessCategory || ou || mepManagedEntry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Users";allow (write) groupdn = "ldap:///cn=modifyusers,cn=permissions,cn=accounts,$SUFFIX";) diff --git a/install/share/dns.ldif b/install/share/dns.ldif index da58955f5..f9ea4958d 100644 --- a/install/share/dns.ldif +++ b/install/share/dns.ldif @@ -3,17 +3,41 @@ changetype: add objectClass: nsContainer objectClass: top cn: dns -aci: (targetfilter = "(objectClass=idnsRecord)")(targetattr != "aci")(version 3.0; acl "DNS Servers Updates"; allow (add,write,delete) groupdn = "ldap:///cn=update_dns,cn=permissions,cn=accounts,$SUFFIX";) -dn: cn=update_dns,cn=permissions,cn=accounts,$SUFFIX +dn: cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX changetype: add +objectClass: groupofnames objectClass: top +cn: add dns entries +description: Add DNS entries +member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX +member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX + +dn: cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX +changetype: add objectClass: groupofnames -cn: update_dns -description: DNS Servers Updates +objectClass: top +cn: remove dns entries +description: Remove DNS entries member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX +dn: cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX +changetype: add +objectClass: groupofnames +objectClass: top +cn: update dns entries +description: Update DNS entries +member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX +member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX + +dn: $SUFFIX +changetype: modify +add: aci +aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX";) +aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX";) +aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX";) + dn: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX changetype: add objectClass: top diff --git a/ipalib/plugins/aci.py b/ipalib/plugins/aci.py index 5a57a309a..1dcba926c 100644 --- a/ipalib/plugins/aci.py +++ b/ipalib/plugins/aci.py @@ -135,6 +135,7 @@ _type_map = { 'hostgroup': 'ldap:///cn=*,%s,%s' % (api.env.container_hostgroup, api.env.basedn), 'service': 'ldap:///krbprincipalname=*,%s,%s' % (api.env.container_service, api.env.basedn), 'netgroup': 'ldap:///ipauniqueid=*,%s,%s' % (api.env.container_netgroup, api.env.basedn), + 'dns': 'ldap:///idnsname=*,%s,%s' % (api.env.container_dns, api.env.basedn), } _valid_permissions_values = [ @@ -378,7 +379,7 @@ class aci(Object): cli_name='type', label=_('Type'), doc=_('type of IPA object (user, group, host, hostgroup, service, netgroup)'), - values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup'), + values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup', u'dns',), ), Str('memberof?', cli_name='memberof', diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py index 18dd577e7..0587564ed 100644 --- a/ipalib/plugins/permission.py +++ b/ipalib/plugins/permission.py @@ -120,7 +120,7 @@ class permission(LDAPObject): cli_name='type', label=_('Type'), doc=_('Type of IPA object (user, group, host, hostgroup, service, netgroup)'), - values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup'), + values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup', u'dns',), ), Str('memberof?', cli_name='memberof', |