diff options
author | Petr Viktorin <pviktori@redhat.com> | 2012-03-13 08:37:24 -0400 |
---|---|---|
committer | Martin Kosek <mkosek@redhat.com> | 2013-02-20 17:35:16 +0100 |
commit | a694e61f42092cc75585c42238e158bc85edc31f (patch) | |
tree | cd5fd822e94a96df625304643a09de251897c522 /ipalib | |
parent | d66898405b2a38244723555c5d9e1b8510919baa (diff) | |
download | freeipa-a694e61f42092cc75585c42238e158bc85edc31f.tar.gz freeipa-a694e61f42092cc75585c42238e158bc85edc31f.tar.xz freeipa-a694e61f42092cc75585c42238e158bc85edc31f.zip |
Prevent a sudo command from being deleted if it is a member of a sudo rule
Tests included.
Diffstat (limited to 'ipalib')
-rw-r--r-- | ipalib/plugins/sudocmd.py | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/ipalib/plugins/sudocmd.py b/ipalib/plugins/sudocmd.py index f27a58cad..f6ea88a25 100644 --- a/ipalib/plugins/sudocmd.py +++ b/ipalib/plugins/sudocmd.py @@ -109,6 +109,32 @@ class sudocmd_del(LDAPDelete): msg_summary = _('Deleted Sudo Command "%(value)s"') + def pre_callback(self, ldap, dn, *keys, **options): + filters = [ + ldap.make_filter_from_attr(attr, dn) + for attr in ('memberallowcmd', 'memberdenycmd')] + filter = ldap.combine_filters(filters, ldap.MATCH_ANY) + filter = ldap.combine_filters( + (filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')), + ldap.MATCH_ALL) + dependent_sudorules = [] + try: + entries, truncated = ldap.find_entries( + filter, ['cn'], + base_dn=DN(api.env.container_sudorule, api.env.basedn)) + except errors.NotFound: + pass + else: + for entry_dn, entry_attrs in entries: + [cn] = entry_attrs['cn'] + dependent_sudorules.append(cn) + + if dependent_sudorules: + raise errors.DependentEntry( + key=keys[0], label='sudorule', + dependent=', '.join(dependent_sudorules)) + return dn + api.register(sudocmd_del) class sudocmd_mod(LDAPUpdate): |