Add several CRUD default permissions

Add missing Add, Modify, Removedefault permissions to:
- automountlocation (Add/Remove only; locations have
   no data to modify)
- privilege
- sudocmdgroup (Modify only; the others were present)

Related to: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>

3 files changed, 30 insertions, 0 deletions

diff --git a/ipalib/plugins/automount.py b/ipalib/plugins/automount.py
index 02f0a3f60..0a5c121ca 100644
--- a/ipalib/plugins/automount.py
+++ b/ipalib/plugins/automount.py
@@ -212,6 +212,7 @@ class automountlocation(LDAPObject):
     default_attributes = ['cn']
     label = _('Automount Locations')
     label_singular = _('Automount Location')
+    permission_filter_objectclasses = ['nscontainer']
     managed_permissions = {
         'System: Read Automount Configuration': {
             # Single permission for all automount-related entries
@@ -226,6 +227,14 @@ class automountlocation(LDAPObject):
                 'automountmapname', 'description',
             },
         },
+        'System: Add Automount Locations': {
+            'ipapermright': {'add'},
+            'default_privileges': {'Automount Administrators'},
+        },
+        'System: Remove Automount Locations': {
+            'ipapermright': {'delete'},
+            'default_privileges': {'Automount Administrators'},
+        },
     }
 
     takes_params = (
diff --git a/ipalib/plugins/privilege.py b/ipalib/plugins/privilege.py
index cff6fe197..6a503709e 100644
--- a/ipalib/plugins/privilege.py
+++ b/ipalib/plugins/privilege.py
@@ -75,6 +75,22 @@ class privilege(LDAPObject):
             },
             'default_privileges': {'RBAC Readers'},
         },
+        'System: Add Privileges': {
+            'ipapermright': {'add'},
+            'default_privileges': {'Delegation Administrator'},
+        },
+        'System: Modify Privileges': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {
+                'businesscategory',  'cn', 'description', 'o', 'ou', 'owner',
+                'seealso',
+            },
+            'default_privileges': {'Delegation Administrator'},
+        },
+        'System: Remove Privileges': {
+            'ipapermright': {'delete'},
+            'default_privileges': {'Delegation Administrator'},
+        },
     }
 
     label = _('Privileges')
diff --git a/ipalib/plugins/sudocmdgroup.py b/ipalib/plugins/sudocmdgroup.py
index b443dd41b..40ff294bb 100644
--- a/ipalib/plugins/sudocmdgroup.py
+++ b/ipalib/plugins/sudocmdgroup.py
@@ -92,6 +92,11 @@ class sudocmdgroup(LDAPObject):
             ],
             'default_privileges': {'Sudo Administrator'},
         },
+        'System: Modify Sudo Command Group': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {'description'},
+            'default_privileges': {'Sudo Administrator'},
+        },
         'System: Manage Sudo Command Group Membership': {
             'ipapermright': {'write'},
             'ipapermdefaultattr': {'member'},