summaryrefslogtreecommitdiffstats
path: root/install/updates/40-delegation.update
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2010-11-17 15:04:33 -0500
committerRob Crittenden <rcritten@redhat.com>2010-11-30 14:30:52 -0500
commitd644d17adf117321747db1e4e22a771fbea3b09e (patch)
tree8a7a5fa1b1ae82fee66ae01f5fa281125141ef70 /install/updates/40-delegation.update
parent88133ab43cecc68248bb95014d1716aa5b74bc75 (diff)
downloadfreeipa-d644d17adf117321747db1e4e22a771fbea3b09e.tar.gz
freeipa-d644d17adf117321747db1e4e22a771fbea3b09e.tar.xz
freeipa-d644d17adf117321747db1e4e22a771fbea3b09e.zip
Reduce the number of attributes a host is allowed to write.
The list of attributes that a host bound as itself could write was overly broad. A host can now only update its description, information about itself such as OS release, etc, its certificate, password and keytab. ticket 416
Diffstat (limited to 'install/updates/40-delegation.update')
-rw-r--r--install/updates/40-delegation.update4
1 files changed, 2 insertions, 2 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 085cd1f81..7dc12d8c9 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -241,7 +241,7 @@ add:aci: '(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version
add:aci: '(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn=removehosts,cn=
taskgroups,cn=accounts,$SUFFIX";)'
-add:aci: '(targetattr = "cn || description || l || nshostlocation ||
+add:aci: '(targetattr = "description || l || nshostlocation ||
nshardwareplatform || nsosversion")
(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;
acl "Modify Hosts";allow (write) groupdn = "ldap:///cn=modifyhosts,
@@ -501,7 +501,7 @@ add:member:'cn=enrollhost,cn=rolegroups,cn=accounts,$SUFFIX'
# set the krbPrincipalName, add krbPrincipalAux to objectClass and
# set enrolledBy to whoever ran join.
dn: $SUFFIX
-add:aci: '(targetattr = "krbPrincipalName || enrolledBy || objectClass")
+add:aci: '(targetattr = "enrolledBy || objectClass")
(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")
(version 3.0;acl "Enroll a host";
allow (write) groupdn = "ldap:///cn=enroll_host,cn=taskgroups,