diff options
Diffstat (limited to 'ipatests/test_xmlrpc/test_sudorule_plugin.py')
| -rw-r--r-- | ipatests/test_xmlrpc/test_sudorule_plugin.py | 781 |
1 files changed, 781 insertions, 0 deletions
diff --git a/ipatests/test_xmlrpc/test_sudorule_plugin.py b/ipatests/test_xmlrpc/test_sudorule_plugin.py new file mode 100644 index 000000000..ec5d16d62 --- /dev/null +++ b/ipatests/test_xmlrpc/test_sudorule_plugin.py @@ -0,0 +1,781 @@ +# Authors: +# Jr Aquino <jr.aquino@citrixonline.com> +# Pavel Zuna <pzuna@redhat.com> +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +""" +Test the `ipalib/plugins/sudorule.py` module. +""" + +from nose.tools import raises, assert_raises # pylint: disable=E0611 + +from xmlrpc_test import XMLRPC_test, assert_attr_equal +from ipalib import api +from ipalib import errors + +class test_sudorule(XMLRPC_test): + """ + Test the `sudorule` plugin. + """ + rule_name = u'testing_sudorule1' + rule_name2 = u'testing_sudorule2' + rule_command = u'/usr/bin/testsudocmd1' + rule_desc = u'description' + rule_desc_mod = u'description modified' + + test_user = u'sudorule_test_user' + test_external_user = u'external_test_user' + test_group = u'sudorule_test_group' + test_external_group = u'external_test_group' + test_host = u'sudorule.testhost' + test_external_host = u'external.testhost' + test_hostgroup = u'sudorule_test_hostgroup' + test_sudoallowcmdgroup = u'sudorule_test_allowcmdgroup' + test_sudodenycmdgroup = u'sudorule_test_denycmdgroup' + test_command = u'/usr/bin/testsudocmd1' + test_denycommand = u'/usr/bin/testdenysudocmd1' + test_runasuser = u'manager' + test_runasgroup = u'manager' + test_category = u'all' + test_option = u'authenticate' + + test_invalid_user = u'+invalid#user' + test_invalid_host = u'+invalid&host.nonexist.com' + test_invalid_group = u'+invalid#group' + + def test_0_sudorule_add(self): + """ + Test adding a new Sudo rule using `xmlrpc.sudorule_add`. + """ + ret = self.failsafe_add(api.Object.sudorule, + self.rule_name, + description=self.rule_desc, + ) + entry = ret['result'] + assert_attr_equal(entry, 'cn', self.rule_name) + assert_attr_equal(entry, 'description', self.rule_desc) + + @raises(errors.DuplicateEntry) + def test_1_sudorule_add(self): + """ + Test adding an duplicate Sudo rule using `xmlrpc.sudorule_add'. + """ + api.Command['sudorule_add']( + self.rule_name + ) + + def test_2_sudorule_show(self): + """ + Test displaying a Sudo rule using `xmlrpc.sudorule_show`. + """ + entry = api.Command['sudorule_show'](self.rule_name)['result'] + assert_attr_equal(entry, 'cn', self.rule_name) + assert_attr_equal(entry, 'description', self.rule_desc) + + def test_3_sudorule_mod(self): + """ + Test modifying a Sudo rule using `xmlrpc.sudorule_mod`. + """ + ret = api.Command['sudorule_mod']( + self.rule_name, description=self.rule_desc_mod + ) + entry = ret['result'] + assert_attr_equal(entry, 'description', self.rule_desc_mod) + + def test_6_sudorule_find(self): + """ + Test searching for Sudo rules using `xmlrpc.sudorule_find`. + """ + ret = api.Command['sudorule_find']( + cn=self.rule_name, + description=self.rule_desc_mod + ) + assert ret['truncated'] is False + entries = ret['result'] + assert_attr_equal(entries[0], 'cn', self.rule_name) + assert_attr_equal(entries[0], 'description', self.rule_desc_mod) + + def test_7_sudorule_init_testing_data(self): + """ + Initialize data for more Sudo rule plugin testing. + """ + self.failsafe_add(api.Object.user, + self.test_user, givenname=u'first', sn=u'last' + ) + self.failsafe_add(api.Object.user, + self.test_runasuser, givenname=u'first', sn=u'last' + ) + self.failsafe_add(api.Object.group, + self.test_group, description=u'description' + ) + self.failsafe_add(api.Object.host, + self.test_host, force=True + ) + self.failsafe_add(api.Object.hostgroup, + self.test_hostgroup, description=u'description' + ) + self.failsafe_add(api.Object.sudocmdgroup, + self.test_sudoallowcmdgroup, description=u'desc' + ) + self.failsafe_add(api.Object.sudocmdgroup, + self.test_sudodenycmdgroup, description=u'desc' + ) + self.failsafe_add(api.Object.sudocmd, + self.test_command, description=u'desc' + ) + + def test_8_sudorule_add_user(self): + """ + Test adding user and group to Sudo rule using + `xmlrpc.sudorule_add_user`. + """ + ret = api.Command['sudorule_add_user']( + self.rule_name, user=self.test_user, group=self.test_group + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberuser' in failed + assert 'user' in failed['memberuser'] + assert not failed['memberuser']['user'] + assert 'group' in failed['memberuser'] + assert not failed['memberuser']['group'] + entry = ret['result'] + assert_attr_equal(entry, 'memberuser_user', self.test_user) + assert_attr_equal(entry, 'memberuser_group', self.test_group) + + def test_9_a_show_user(self): + """ + Test showing a user to verify Sudo rule membership + `xmlrpc.user_show`. + """ + ret = api.Command['user_show'](self.test_user, all=True) + entry = ret['result'] + assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) + + def test_9_b_show_group(self): + """ + Test showing a group to verify Sudo rule membership + `xmlrpc.group_show`. + """ + ret = api.Command['group_show'](self.test_group, all=True) + entry = ret['result'] + assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) + + def test_9_sudorule_remove_user(self): + """ + Test removing user and group from Sudo rule using + `xmlrpc.sudorule_remove_user'. + """ + ret = api.Command['sudorule_remove_user']( + self.rule_name, user=self.test_user, group=self.test_group + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberuser' in failed + assert 'user' in failed['memberuser'] + assert not failed['memberuser']['user'] + assert 'group' in failed['memberuser'] + assert not failed['memberuser']['group'] + entry = ret['result'] + assert 'memberuser_user' not in entry + assert 'memberuser_group' not in entry + + def test_a_sudorule_add_runasuser(self): + """ + Test adding run as user to Sudo rule using + `xmlrpc.sudorule_add_runasuser`. + """ + ret = api.Command['sudorule_add_runasuser']( + self.rule_name, user=self.test_runasuser + ) + assert ret['completed'] == 1 + failed = ret['failed'] + assert 'ipasudorunas' in failed + assert 'user' in failed['ipasudorunas'] + assert not failed['ipasudorunas']['user'] + entry = ret['result'] + assert_attr_equal(entry, 'ipasudorunas_user', self.test_runasuser) + + def test_a_sudorule_add_runasuser_invalid(self): + """ + Test adding run as invalid user to Sudo rule using + `xmlrpc.sudorule_add_runasuser`. + """ + try: + api.Command['sudorule_add_runasuser']( + self.rule_name, user=self.test_invalid_user + ) + except errors.ValidationError: + pass + else: + assert False + + def test_b_sudorule_remove_runasuser(self): + """ + Test removing run as user to Sudo rule using + `xmlrpc.sudorule_remove_runasuser'. + """ + ret = api.Command['sudorule_remove_runasuser']( + self.rule_name, user=self.test_runasuser + ) + assert ret['completed'] == 1 + failed = ret['failed'] + assert 'ipasudorunas' in failed + assert 'user' in failed['ipasudorunas'] + assert not failed['ipasudorunas']['user'] + entry = ret['result'] + assert 'ipasudorunas_user' not in entry + + def test_a_sudorule_add_runasgroup(self): + """ + Test adding run as group to Sudo rule using + `xmlrpc.sudorule_add_runasgroup`. + """ + ret = api.Command['sudorule_add_runasgroup']( + self.rule_name, group=self.test_runasgroup + ) + assert ret['completed'] == 1 + failed = ret['failed'] + assert 'ipasudorunasgroup' in failed + assert 'group' in failed['ipasudorunasgroup'] + assert not failed['ipasudorunasgroup']['group'] + entry = ret['result'] + assert_attr_equal(entry, 'ipasudorunasgroup_group', + self.test_runasgroup) + + def test_a_sudorule_add_runasgroup_invalid(self): + """ + Test adding run as invalid user to Sudo rule using + `xmlrpc.sudorule_add_runasuser`. + """ + try: + api.Command['sudorule_add_runasgroup']( + self.rule_name, group=self.test_invalid_group + ) + except errors.ValidationError: + pass + else: + assert False + + def test_b_sudorule_remove_runasgroup(self): + """ + Test removing run as group to Sudo rule using + `xmlrpc.sudorule_remove_runasgroup'. + """ + ret = api.Command['sudorule_remove_runasgroup']( + self.rule_name, group=self.test_runasgroup + ) + assert ret['completed'] == 1 + failed = ret['failed'] + assert 'ipasudorunasgroup' in failed + assert 'group' in failed['ipasudorunasgroup'] + assert not failed['ipasudorunasgroup']['group'] + entry = ret['result'] + assert 'ipasudorunasgroup_group' not in entry + + def test_a_sudorule_add_externaluser(self): + """ + Test adding an external user to Sudo rule using + `xmlrpc.sudorule_add_user`. + """ + ret = api.Command['sudorule_add_user']( + self.rule_name, user=self.test_external_user + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert_attr_equal(entry, 'externaluser', self.test_external_user) + + def test_a_sudorule_add_externaluser_invalid(self): + """ + Test adding an invalid external user to Sudo rule using + `xmlrpc.sudorule_add_user`. + """ + try: + api.Command['sudorule_add_user']( + self.rule_name, user=self.test_invalid_user + ) + except errors.ValidationError: + pass + else: + assert False + + def test_b_sudorule_remove_externaluser(self): + """ + Test removing an external user from Sudo rule using + `xmlrpc.sudorule_remove_user'. + """ + ret = api.Command['sudorule_remove_user']( + self.rule_name, user=self.test_external_user + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert entry['externaluser'] == () + + def test_a_sudorule_add_runasexternaluser(self): + """ + Test adding an external runasuser to Sudo rule using + `xmlrpc.sudorule_add_runasuser`. + """ + ret = api.Command['sudorule_add_runasuser']( + self.rule_name, user=self.test_external_user + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert_attr_equal(entry, 'ipasudorunasextuser', self.test_external_user) + + def test_b_sudorule_remove_runasexternaluser(self): + """ + Test removing an external runasuser from Sudo rule using + `xmlrpc.sudorule_remove_runasuser'. + """ + ret = api.Command['sudorule_remove_runasuser']( + self.rule_name, user=self.test_external_user + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert entry['ipasudorunasextuser'] == () + + def test_a_sudorule_add_runasexternalgroup(self): + """ + Test adding an external runasgroup to Sudo rule using + `xmlrpc.sudorule_add_runasgroup`. + """ + ret = api.Command['sudorule_add_runasgroup']( + self.rule_name, group=self.test_external_group + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert_attr_equal(entry, 'ipasudorunasextgroup', self.test_external_group) + + def test_b_sudorule_remove_runasexternalgroup(self): + """ + Test removing an external runasgroup from Sudo rule using + `xmlrpc.sudorule_remove_runasgroup'. + """ + ret = api.Command['sudorule_remove_runasgroup']( + self.rule_name, group=self.test_external_group + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert entry['ipasudorunasextgroup'] == () + + def test_a_sudorule_add_option(self): + """ + Test adding an option to Sudo rule using + `xmlrpc.sudorule_add_option`. + """ + ret = api.Command['sudorule_add_option']( + self.rule_name, ipasudoopt=self.test_option + ) + entry = ret['result'] + assert_attr_equal(entry, 'ipasudoopt', self.test_option) + + def test_b_sudorule_remove_option(self): + """ + Test removing an option from Sudo rule using + `xmlrpc.sudorule_remove_option'. + """ + ret = api.Command['sudorule_remove_option']( + self.rule_name, ipasudoopt=self.test_option + ) + entry = ret['result'] + assert 'ipasudoopt' not in entry + + def test_a_sudorule_add_host(self): + """ + Test adding host and hostgroup to Sudo rule using + `xmlrpc.sudorule_add_host`. + """ + ret = api.Command['sudorule_add_host']( + self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberhost' in failed + assert 'host' in failed['memberhost'] + assert not failed['memberhost']['host'] + assert 'hostgroup' in failed['memberhost'] + assert not failed['memberhost']['hostgroup'] + entry = ret['result'] + assert_attr_equal(entry, 'memberhost_host', self.test_host) + assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup) + + def test_a_sudorule_show_host(self): + """ + Test showing host to verify Sudo rule membership + `xmlrpc.host_show`. + """ + ret = api.Command['host_show'](self.test_host, all=True) + entry = ret['result'] + assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) + + def test_a_sudorule_show_hostgroup(self): + """ + Test showing hostgroup to verify Sudo rule membership + `xmlrpc.hostgroup_show`. + """ + ret = api.Command['hostgroup_show'](self.test_hostgroup, all=True) + entry = ret['result'] + assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) + + def test_b_sudorule_remove_host(self): + """ + Test removing host and hostgroup from Sudo rule using + `xmlrpc.sudorule_remove_host`. + """ + ret = api.Command['sudorule_remove_host']( + self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberhost' in failed + assert 'host' in failed['memberhost'] + assert not failed['memberhost']['host'] + assert 'hostgroup' in failed['memberhost'] + assert not failed['memberhost']['hostgroup'] + entry = ret['result'] + assert 'memberhost_host' not in entry + assert 'memberhost_hostgroup' not in entry + + def test_a_sudorule_add_externalhost(self): + """ + Test adding an external host to Sudo rule using + `xmlrpc.sudorule_add_host`. + """ + ret = api.Command['sudorule_add_host']( + self.rule_name, host=self.test_external_host + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert_attr_equal(entry, 'externalhost', self.test_external_host) + + def test_a_sudorule_add_externalhost_invalid(self): + """ + Test adding an invalid external host to Sudo rule using + `xmlrpc.sudorule_add_host`. + """ + try: + api.Command['sudorule_add_host']( + self.rule_name, host=self.test_invalid_host + ) + except errors.ValidationError: + pass + else: + assert False + + def test_a_sudorule_mod_externalhost_invalid_addattr(self): + """ + Test adding an invalid external host to Sudo rule using + `xmlrpc.sudorule_mod --addattr`. + """ + try: + api.Command['sudorule_mod']( + self.rule_name, + addattr='externalhost=%s' % self.test_invalid_host + ) + except errors.ValidationError, e: + assert unicode(e) == ("invalid 'externalhost': only letters, " + + "numbers, _, and - are allowed. " + + "DNS label may not start or end with -") + else: + assert False + + def test_b_sudorule_remove_externalhost(self): + """ + Test removing an external host from Sudo rule using + `xmlrpc.sudorule_remove_host`. + """ + ret = api.Command['sudorule_remove_host']( + self.rule_name, host=self.test_external_host + ) + assert ret['completed'] == 1 + failed = ret['failed'] + entry = ret['result'] + assert len(entry['externalhost']) == 0 + + def test_a_sudorule_add_allow_command(self): + """ + Test adding allow command and cmdgroup to Sudo rule using + `xmlrpc.sudorule_add_allow_command`. + """ + ret = api.Command['sudorule_add_allow_command']( + self.rule_name, sudocmd=self.test_command, + sudocmdgroup=self.test_sudoallowcmdgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberallowcmd' in failed + assert 'sudocmd' in failed['memberallowcmd'] + assert not failed['memberallowcmd']['sudocmd'] + assert 'sudocmdgroup' in failed['memberallowcmd'] + assert not failed['memberallowcmd']['sudocmdgroup'] + entry = ret['result'] + assert_attr_equal(entry, 'memberallowcmd_sudocmd', self.test_command) + assert_attr_equal(entry, 'memberallowcmd_sudocmdgroup', + self.test_sudoallowcmdgroup) + + def test_a_sudorule_remove_allow_command(self): + """ + Test removing allow command and sudocmdgroup from Sudo rule using + `xmlrpc.sudorule_remove_command`. + """ + ret = api.Command['sudorule_remove_allow_command']( + self.rule_name, sudocmd=self.test_command, + sudocmdgroup=self.test_sudoallowcmdgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberallowcmd' in failed + assert 'sudocmd' in failed['memberallowcmd'] + assert not failed['memberallowcmd']['sudocmd'] + assert 'sudocmdgroup' in failed['memberallowcmd'] + assert not failed['memberallowcmd']['sudocmdgroup'] + entry = ret['result'] + assert 'memberallowcmd_sudocmd' not in entry + assert 'memberallowcmd_sudocmdgroup' not in entry + + def test_b_sudorule_add_deny_command(self): + """ + Test adding deny command and cmdgroup to Sudo rule using + `xmlrpc.sudorule_add_deny_command`. + """ + ret = api.Command['sudorule_add_deny_command']( + self.rule_name, sudocmd=self.test_command, + sudocmdgroup=self.test_sudodenycmdgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberdenycmd' in failed + assert 'sudocmd' in failed['memberdenycmd'] + assert not failed['memberdenycmd']['sudocmd'] + assert 'sudocmdgroup' in failed['memberdenycmd'] + assert not failed['memberdenycmd']['sudocmdgroup'] + entry = ret['result'] + assert_attr_equal(entry, 'memberdenycmd_sudocmd', self.test_command) + assert_attr_equal(entry, 'memberdenycmd_sudocmdgroup', + self.test_sudodenycmdgroup) + + def test_b_sudorule_remove_deny_command(self): + """ + Test removing deny command and sudocmdgroup from Sudo rule using + `xmlrpc.sudorule_remove_deny_command`. + """ + ret = api.Command['sudorule_remove_deny_command']( + self.rule_name, sudocmd=self.test_command, + sudocmdgroup=self.test_sudodenycmdgroup + ) + assert ret['completed'] == 2 + failed = ret['failed'] + assert 'memberdenycmd' in failed + assert 'sudocmd' in failed['memberdenycmd'] + assert not failed['memberdenycmd']['sudocmd'] + assert 'sudocmdgroup' in failed['memberdenycmd'] + assert not failed['memberdenycmd']['sudocmdgroup'] + entry = ret['result'] + assert 'memberdenycmd_sudocmd' not in entry + assert 'memberdenycmd_sudocmdgroup' not in entry + + @raises(errors.MutuallyExclusiveError) + def test_c_sudorule_exclusiveuser(self): + """ + Test adding a user to an Sudo rule when usercat='all' + """ + api.Command['sudorule_mod'](self.rule_name, usercategory=u'all') + try: + api.Command['sudorule_add_user'](self.rule_name, user=u'admin') + finally: + api.Command['sudorule_mod'](self.rule_name, usercategory=u'') + + @raises(errors.MutuallyExclusiveError) + def test_d_sudorule_exclusiveuser(self): + """ + Test setting usercat='all' in an Sudo rule when there are users + """ + api.Command['sudorule_add_user'](self.rule_name, user=u'admin') + try: + api.Command['sudorule_mod'](self.rule_name, usercategory=u'all') + finally: + api.Command['sudorule_remove_user'](self.rule_name, user=u'admin') + + @raises(errors.MutuallyExclusiveError) + def test_e_sudorule_exclusivehost(self): + """ + Test adding a host to an Sudo rule when hostcat='all' + """ + api.Command['sudorule_mod'](self.rule_name, hostcategory=u'all') + try: + api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) + finally: + api.Command['sudorule_mod'](self.rule_name, hostcategory=u'') + + @raises(errors.MutuallyExclusiveError) + def test_f_sudorule_exclusivehost(self): + """ + Test setting hostcat='all' in an Sudo rule when there are hosts + """ + api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) + try: + api.Command['sudorule_mod'](self.rule_name, hostcategory=u'all') + finally: + api.Command['sudorule_remove_host'](self.rule_name, host=self.test_host) + + @raises(errors.MutuallyExclusiveError) + def test_g_sudorule_exclusivecommand(self): + """ + Test adding a command to an Sudo rule when cmdcategory='all' + """ + api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'all') + try: + api.Command['sudorule_add_allow_command'](self.rule_name, sudocmd=self.test_command) + finally: + api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'') + + @raises(errors.MutuallyExclusiveError) + def test_h_sudorule_exclusivecommand(self): + """ + Test setting cmdcategory='all' in an Sudo rule when there are commands + """ + api.Command['sudorule_add_allow_command'](self.rule_name, sudocmd=self.test_command) + try: + api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'all') + finally: + api.Command['sudorule_remove_allow_command'](self.rule_name, sudocmd=self.test_command) + + @raises(errors.MutuallyExclusiveError) + def test_i_sudorule_exclusiverunas(self): + """ + Test adding a runasuser to an Sudo rule when ipasudorunasusercategory='all' + """ + api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'all') + try: + api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_user) + finally: + api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'') + + @raises(errors.MutuallyExclusiveError) + def test_j_1_sudorule_exclusiverunas(self): + """ + Test setting ipasudorunasusercategory='all' in an Sudo rule when there are runas users + """ + api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_user) + try: + api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'all') + finally: + api.Command['sudorule_remove_runasuser'](self.rule_name, user=self.test_command) + + def test_j_2_sudorule_referential_integrity(self): + """ + Test adding various links to Sudo rule + """ + api.Command['sudorule_add_user'](self.rule_name, user=self.test_user) + api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_runasuser, + group=self.test_group) + api.Command['sudorule_add_runasgroup'](self.rule_name, group=self.test_group) + api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) + api.Command['sudorule_add_allow_command'](self.rule_name, + sudocmd=self.test_command) + api.Command['sudorule_add_deny_command'](self.rule_name, + sudocmdgroup=self.test_sudodenycmdgroup) + entry = api.Command['sudorule_show'](self.rule_name)['result'] + assert_attr_equal(entry, 'cn', self.rule_name) + assert_attr_equal(entry, 'memberuser_user', self.test_user) + assert_attr_equal(entry, 'memberallowcmd_sudocmd', self.test_command) + assert_attr_equal(entry, 'memberdenycmd_sudocmdgroup', + self.test_sudodenycmdgroup) + assert_attr_equal(entry, 'memberhost_host', self.test_host) + assert_attr_equal(entry, 'ipasudorunas_user', self.test_runasuser) + assert_attr_equal(entry, 'ipasudorunas_group', self.test_group) + assert_attr_equal(entry, 'ipasudorunasgroup_group', self.test_group) + + + def test_k_1_sudorule_clear_testing_data(self): + """ + Clear data for Sudo rule plugin testing. + """ + api.Command['user_del'](self.test_user) + api.Command['user_del'](self.test_runasuser) + api.Command['group_del'](self.test_group) + api.Command['host_del'](self.test_host) + api.Command['hostgroup_del'](self.test_hostgroup) + api.Command['sudorule_remove_allow_command'](self.rule_name, + sudocmd=self.test_command) + api.Command['sudocmd_del'](self.test_command) + api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup) + api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup) + + def test_k_2_sudorule_referential_integrity(self): + """ + Test that links in Sudo rule were removed by referential integrity plugin + """ + entry = api.Command['sudorule_show'](self.rule_name)['result'] + assert_attr_equal(entry, 'cn', self.rule_name) + assert 'memberuser_user' not in entry + assert 'memberallowcmd_sudocmd' not in entry + assert 'memberdenycmd_sudocmdgroup' not in entry + assert 'memberhost_host' not in entry + assert 'ipasudorunas_user' not in entry + assert 'ipasudorunas_group' not in entry + assert 'ipasudorunasgroup_group' not in entry + + def test_l_sudorule_order(self): + """ + Test that order uniqueness is maintained + """ + api.Command['sudorule_mod'](self.rule_name, sudoorder=1) + + api.Command['sudorule_add'](self.rule_name2) + + # mod of rule that has no order and set a duplicate + try: + api.Command['sudorule_mod'](self.rule_name2, sudoorder=1) + except errors.ValidationError: + pass + + # Remove the rule so we can re-add it + api.Command['sudorule_del'](self.rule_name2) + + # add a new rule with a duplicate order + with assert_raises(errors.ValidationError): + api.Command['sudorule_add'](self.rule_name2, sudoorder=1) + + # add a new rule with a unique order + api.Command['sudorule_add'](self.rule_name2, sudoorder=2) + with assert_raises(errors.ValidationError): + api.Command['sudorule_mod'](self.rule_name2, sudoorder=1) + + # Try setting both to 0 + api.Command['sudorule_mod'](self.rule_name2, sudoorder=0) + with assert_raises(errors.ValidationError): + api.Command['sudorule_mod'](self.rule_name, sudoorder=0) + + + def test_m_sudorule_del(self): + """ + Test deleting a Sudo rule using `xmlrpc.sudorule_del`. + """ + api.Command['sudorule_del'](self.rule_name) + # verify that it's gone + with assert_raises(errors.NotFound): + api.Command['sudorule_show'](self.rule_name) + api.Command['sudorule_del'](self.rule_name2) |