summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ACI.txt12
-rw-r--r--ipalib/plugins/automount.py9
-rw-r--r--ipalib/plugins/privilege.py16
-rw-r--r--ipalib/plugins/sudocmdgroup.py5
4 files changed, 42 insertions, 0 deletions
diff --git a/ACI.txt b/ACI.txt
index 063386c56..dd9e7c5ae 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -10,8 +10,12 @@ dn: cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "automountinformation || automountkey || description")(targetfilter = "(objectclass=automount)")(version 3.0;acl "permission:System: Modify Automount Keys";allow (write) groupdn = "ldap:///cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=automount)")(version 3.0;acl "permission:System: Remove Automount Keys";allow (delete) groupdn = "ldap:///cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Add Automount Locations";allow (add) groupdn = "ldap:///cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Read Automount Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "automountinformation || automountkey || automountmapname || cn || description || objectclass")(version 3.0;acl "permission:System: Read Automount Configuration";allow (compare,read,search) userdn = "ldap:///anyone";)
+dn: cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Remove Automount Locations";allow (delete) groupdn = "ldap:///cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=automountmap)")(version 3.0;acl "permission:System: Add Automount Maps";allow (add) groupdn = "ldap:///cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
@@ -134,8 +138,14 @@ dn: cn=System: Read ACIs,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Read Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "businesscategory || cn || description || ipapermbindruletype || ipapermdefaultattr || ipapermexcludedattr || ipapermincludedattr || ipapermissiontype || ipapermlocation || ipapermright || ipapermtarget || ipapermtargetfilter || member || memberhost || memberof || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipapermission)")(version 3.0;acl "permission:System: Read Permissions";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Add Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Add Privileges";allow (add) groupdn = "ldap:///cn=System: Add Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "businesscategory || cn || description || o || ou || owner || seealso")(targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Modify Privileges";allow (write) groupdn = "ldap:///cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Read Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "businesscategory || cn || description || member || memberhost || memberof || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Read Privileges";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Remove Privileges";allow (delete) groupdn = "ldap:///cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example
@@ -188,6 +198,8 @@ dn: cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=exampl
aci: (targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Delete Sudo Command Group";allow (delete) groupdn = "ldap:///cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "member")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Manage Sudo Command Group Membership";allow (write) groupdn = "ldap:///cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "description")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Modify Sudo Command Group";allow (write) groupdn = "ldap:///cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=System: Read Sudo Command Groups,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "businesscategory || cn || description || ipauniqueid || member || memberhost || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Read Sudo Command Groups";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/ipalib/plugins/automount.py b/ipalib/plugins/automount.py
index 02f0a3f60..0a5c121ca 100644
--- a/ipalib/plugins/automount.py
+++ b/ipalib/plugins/automount.py
@@ -212,6 +212,7 @@ class automountlocation(LDAPObject):
default_attributes = ['cn']
label = _('Automount Locations')
label_singular = _('Automount Location')
+ permission_filter_objectclasses = ['nscontainer']
managed_permissions = {
'System: Read Automount Configuration': {
# Single permission for all automount-related entries
@@ -226,6 +227,14 @@ class automountlocation(LDAPObject):
'automountmapname', 'description',
},
},
+ 'System: Add Automount Locations': {
+ 'ipapermright': {'add'},
+ 'default_privileges': {'Automount Administrators'},
+ },
+ 'System: Remove Automount Locations': {
+ 'ipapermright': {'delete'},
+ 'default_privileges': {'Automount Administrators'},
+ },
}
takes_params = (
diff --git a/ipalib/plugins/privilege.py b/ipalib/plugins/privilege.py
index cff6fe197..6a503709e 100644
--- a/ipalib/plugins/privilege.py
+++ b/ipalib/plugins/privilege.py
@@ -75,6 +75,22 @@ class privilege(LDAPObject):
},
'default_privileges': {'RBAC Readers'},
},
+ 'System: Add Privileges': {
+ 'ipapermright': {'add'},
+ 'default_privileges': {'Delegation Administrator'},
+ },
+ 'System: Modify Privileges': {
+ 'ipapermright': {'write'},
+ 'ipapermdefaultattr': {
+ 'businesscategory', 'cn', 'description', 'o', 'ou', 'owner',
+ 'seealso',
+ },
+ 'default_privileges': {'Delegation Administrator'},
+ },
+ 'System: Remove Privileges': {
+ 'ipapermright': {'delete'},
+ 'default_privileges': {'Delegation Administrator'},
+ },
}
label = _('Privileges')
diff --git a/ipalib/plugins/sudocmdgroup.py b/ipalib/plugins/sudocmdgroup.py
index b443dd41b..40ff294bb 100644
--- a/ipalib/plugins/sudocmdgroup.py
+++ b/ipalib/plugins/sudocmdgroup.py
@@ -92,6 +92,11 @@ class sudocmdgroup(LDAPObject):
],
'default_privileges': {'Sudo Administrator'},
},
+ 'System: Modify Sudo Command Group': {
+ 'ipapermright': {'write'},
+ 'ipapermdefaultattr': {'description'},
+ 'default_privileges': {'Sudo Administrator'},
+ },
'System: Manage Sudo Command Group Membership': {
'ipapermright': {'write'},
'ipapermdefaultattr': {'member'},
generated by cgit (git 2.34.1) at 2024-05-18 16:50:08 +0000