diff options
| -rw-r--r-- | ipalib/plugins/sudocmd.py | 26 | ||||
| -rw-r--r-- | tests/test_xmlrpc/test_sudocmd_plugin.py | 70 | ||||
| -rw-r--r-- | tests/test_xmlrpc/test_sudorule_plugin.py | 2 |
3 files changed, 98 insertions, 0 deletions
diff --git a/ipalib/plugins/sudocmd.py b/ipalib/plugins/sudocmd.py index f27a58cad..f6ea88a25 100644 --- a/ipalib/plugins/sudocmd.py +++ b/ipalib/plugins/sudocmd.py @@ -109,6 +109,32 @@ class sudocmd_del(LDAPDelete): msg_summary = _('Deleted Sudo Command "%(value)s"') + def pre_callback(self, ldap, dn, *keys, **options): + filters = [ + ldap.make_filter_from_attr(attr, dn) + for attr in ('memberallowcmd', 'memberdenycmd')] + filter = ldap.combine_filters(filters, ldap.MATCH_ANY) + filter = ldap.combine_filters( + (filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')), + ldap.MATCH_ALL) + dependent_sudorules = [] + try: + entries, truncated = ldap.find_entries( + filter, ['cn'], + base_dn=DN(api.env.container_sudorule, api.env.basedn)) + except errors.NotFound: + pass + else: + for entry_dn, entry_attrs in entries: + [cn] = entry_attrs['cn'] + dependent_sudorules.append(cn) + + if dependent_sudorules: + raise errors.DependentEntry( + key=keys[0], label='sudorule', + dependent=', '.join(dependent_sudorules)) + return dn + api.register(sudocmd_del) class sudocmd_mod(LDAPUpdate): diff --git a/tests/test_xmlrpc/test_sudocmd_plugin.py b/tests/test_xmlrpc/test_sudocmd_plugin.py index 0ea8e10b8..7b355072b 100644 --- a/tests/test_xmlrpc/test_sudocmd_plugin.py +++ b/tests/test_xmlrpc/test_sudocmd_plugin.py @@ -29,12 +29,15 @@ from tests.test_xmlrpc import objectclasses sudocmd1 = u'/usr/bin/sudotestcmd1' sudocmd1_camelcase = u'/usr/bin/sudoTestCmd1' +sudorule1 = u'test_sudorule1' + class test_sudocmd(Declarative): cleanup_commands = [ ('sudocmd_del', [sudocmd1], {}), ('sudocmd_del', [sudocmd1_camelcase], {}), + ('sudorule_del', [sudorule1], {}), ] tests = [ @@ -206,6 +209,73 @@ class test_sudocmd(Declarative): ), ), + dict( + desc='Create %r' % sudorule1, + command=('sudorule_add', [sudorule1], {}), + expected=lambda e, result: True, + ), + + dict( + desc='Add %r to %r allow list' % (sudocmd1, sudorule1), + command=('sudorule_add_allow_command', [sudorule1], + dict(sudocmd=sudocmd1)), + expected=dict( + completed=1, + failed=dict( + memberallowcmd=dict(sudocmdgroup=(), sudocmd=())), + result=lambda result: True, + ), + ), + + dict( + desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1), + command=('sudocmd_del', [sudocmd1], {}), + expected=errors.DependentEntry(key=sudocmd1, label='sudorule', + dependent=sudorule1), + ), + + dict( + desc='Remove %r from %r' % (sudocmd1, sudorule1), + command=('sudorule_remove_allow_command', [sudorule1], + dict(sudocmd=sudocmd1)), + expected=dict( + completed=1, + failed=dict( + memberallowcmd=dict(sudocmdgroup=(), sudocmd=())), + result=lambda result: True, + ), + ), + + dict( + desc='Add %r to %r deny list' % (sudocmd1, sudorule1), + command=('sudorule_add_deny_command', [sudorule1], + dict(sudocmd=sudocmd1)), + expected=dict( + completed=1, + failed=dict( + memberdenycmd=dict(sudocmdgroup=(), sudocmd=())), + result=lambda result: True, + ), + ), + + dict( + desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1), + command=('sudocmd_del', [sudocmd1], {}), + expected=errors.DependentEntry(key=sudocmd1, label='sudorule', + dependent=sudorule1), + ), + + dict( + desc='Remove %r from %r' % (sudocmd1, sudorule1), + command=('sudorule_remove_deny_command', [sudorule1], + dict(sudocmd=sudocmd1)), + expected=dict( + completed=1, + failed=dict( + memberdenycmd=dict(sudocmdgroup=(), sudocmd=())), + result=lambda result: True, + ), + ), dict( desc='Delete %r' % sudocmd1, diff --git a/tests/test_xmlrpc/test_sudorule_plugin.py b/tests/test_xmlrpc/test_sudorule_plugin.py index 9b44065af..ec5d16d62 100644 --- a/tests/test_xmlrpc/test_sudorule_plugin.py +++ b/tests/test_xmlrpc/test_sudorule_plugin.py @@ -718,6 +718,8 @@ class test_sudorule(XMLRPC_test): api.Command['group_del'](self.test_group) api.Command['host_del'](self.test_host) api.Command['hostgroup_del'](self.test_hostgroup) + api.Command['sudorule_remove_allow_command'](self.rule_name, + sudocmd=self.test_command) api.Command['sudocmd_del'](self.test_command) api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup) api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup) |