summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPetr Viktorin <pviktori@redhat.com>2012-03-13 08:37:24 -0400
committerMartin Kosek <mkosek@redhat.com>2013-02-20 17:35:16 +0100
commita694e61f42092cc75585c42238e158bc85edc31f (patch)
treecd5fd822e94a96df625304643a09de251897c522
parentd66898405b2a38244723555c5d9e1b8510919baa (diff)
downloadfreeipa-a694e61f42092cc75585c42238e158bc85edc31f.tar.gz
freeipa-a694e61f42092cc75585c42238e158bc85edc31f.tar.xz
freeipa-a694e61f42092cc75585c42238e158bc85edc31f.zip
Prevent a sudo command from being deleted if it is a member of a sudo rule
Tests included.
-rw-r--r--ipalib/plugins/sudocmd.py26
-rw-r--r--tests/test_xmlrpc/test_sudocmd_plugin.py70
-rw-r--r--tests/test_xmlrpc/test_sudorule_plugin.py2
3 files changed, 98 insertions, 0 deletions
diff --git a/ipalib/plugins/sudocmd.py b/ipalib/plugins/sudocmd.py
index f27a58cad..f6ea88a25 100644
--- a/ipalib/plugins/sudocmd.py
+++ b/ipalib/plugins/sudocmd.py
@@ -109,6 +109,32 @@ class sudocmd_del(LDAPDelete):
msg_summary = _('Deleted Sudo Command "%(value)s"')
+ def pre_callback(self, ldap, dn, *keys, **options):
+ filters = [
+ ldap.make_filter_from_attr(attr, dn)
+ for attr in ('memberallowcmd', 'memberdenycmd')]
+ filter = ldap.combine_filters(filters, ldap.MATCH_ANY)
+ filter = ldap.combine_filters(
+ (filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')),
+ ldap.MATCH_ALL)
+ dependent_sudorules = []
+ try:
+ entries, truncated = ldap.find_entries(
+ filter, ['cn'],
+ base_dn=DN(api.env.container_sudorule, api.env.basedn))
+ except errors.NotFound:
+ pass
+ else:
+ for entry_dn, entry_attrs in entries:
+ [cn] = entry_attrs['cn']
+ dependent_sudorules.append(cn)
+
+ if dependent_sudorules:
+ raise errors.DependentEntry(
+ key=keys[0], label='sudorule',
+ dependent=', '.join(dependent_sudorules))
+ return dn
+
api.register(sudocmd_del)
class sudocmd_mod(LDAPUpdate):
diff --git a/tests/test_xmlrpc/test_sudocmd_plugin.py b/tests/test_xmlrpc/test_sudocmd_plugin.py
index 0ea8e10b8..7b355072b 100644
--- a/tests/test_xmlrpc/test_sudocmd_plugin.py
+++ b/tests/test_xmlrpc/test_sudocmd_plugin.py
@@ -29,12 +29,15 @@ from tests.test_xmlrpc import objectclasses
sudocmd1 = u'/usr/bin/sudotestcmd1'
sudocmd1_camelcase = u'/usr/bin/sudoTestCmd1'
+sudorule1 = u'test_sudorule1'
+
class test_sudocmd(Declarative):
cleanup_commands = [
('sudocmd_del', [sudocmd1], {}),
('sudocmd_del', [sudocmd1_camelcase], {}),
+ ('sudorule_del', [sudorule1], {}),
]
tests = [
@@ -206,6 +209,73 @@ class test_sudocmd(Declarative):
),
),
+ dict(
+ desc='Create %r' % sudorule1,
+ command=('sudorule_add', [sudorule1], {}),
+ expected=lambda e, result: True,
+ ),
+
+ dict(
+ desc='Add %r to %r allow list' % (sudocmd1, sudorule1),
+ command=('sudorule_add_allow_command', [sudorule1],
+ dict(sudocmd=sudocmd1)),
+ expected=dict(
+ completed=1,
+ failed=dict(
+ memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
+ result=lambda result: True,
+ ),
+ ),
+
+ dict(
+ desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
+ command=('sudocmd_del', [sudocmd1], {}),
+ expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
+ dependent=sudorule1),
+ ),
+
+ dict(
+ desc='Remove %r from %r' % (sudocmd1, sudorule1),
+ command=('sudorule_remove_allow_command', [sudorule1],
+ dict(sudocmd=sudocmd1)),
+ expected=dict(
+ completed=1,
+ failed=dict(
+ memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
+ result=lambda result: True,
+ ),
+ ),
+
+ dict(
+ desc='Add %r to %r deny list' % (sudocmd1, sudorule1),
+ command=('sudorule_add_deny_command', [sudorule1],
+ dict(sudocmd=sudocmd1)),
+ expected=dict(
+ completed=1,
+ failed=dict(
+ memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
+ result=lambda result: True,
+ ),
+ ),
+
+ dict(
+ desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
+ command=('sudocmd_del', [sudocmd1], {}),
+ expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
+ dependent=sudorule1),
+ ),
+
+ dict(
+ desc='Remove %r from %r' % (sudocmd1, sudorule1),
+ command=('sudorule_remove_deny_command', [sudorule1],
+ dict(sudocmd=sudocmd1)),
+ expected=dict(
+ completed=1,
+ failed=dict(
+ memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
+ result=lambda result: True,
+ ),
+ ),
dict(
desc='Delete %r' % sudocmd1,
diff --git a/tests/test_xmlrpc/test_sudorule_plugin.py b/tests/test_xmlrpc/test_sudorule_plugin.py
index 9b44065af..ec5d16d62 100644
--- a/tests/test_xmlrpc/test_sudorule_plugin.py
+++ b/tests/test_xmlrpc/test_sudorule_plugin.py
@@ -718,6 +718,8 @@ class test_sudorule(XMLRPC_test):
api.Command['group_del'](self.test_group)
api.Command['host_del'](self.test_host)
api.Command['hostgroup_del'](self.test_hostgroup)
+ api.Command['sudorule_remove_allow_command'](self.rule_name,
+ sudocmd=self.test_command)
api.Command['sudocmd_del'](self.test_command)
api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup)
api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup)