diff options
Diffstat (limited to 'tests/test_xmlrpc/test_sudorule_plugin.py')
| -rw-r--r-- | tests/test_xmlrpc/test_sudorule_plugin.py | 781 |
1 files changed, 0 insertions, 781 deletions
diff --git a/tests/test_xmlrpc/test_sudorule_plugin.py b/tests/test_xmlrpc/test_sudorule_plugin.py deleted file mode 100644 index ec5d16d62..000000000 --- a/tests/test_xmlrpc/test_sudorule_plugin.py +++ /dev/null @@ -1,781 +0,0 @@ -# Authors: -# Jr Aquino <jr.aquino@citrixonline.com> -# Pavel Zuna <pzuna@redhat.com> -# -# Copyright (C) 2010 Red Hat -# see file 'COPYING' for use and warranty information -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. -""" -Test the `ipalib/plugins/sudorule.py` module. -""" - -from nose.tools import raises, assert_raises # pylint: disable=E0611 - -from xmlrpc_test import XMLRPC_test, assert_attr_equal -from ipalib import api -from ipalib import errors - -class test_sudorule(XMLRPC_test): - """ - Test the `sudorule` plugin. - """ - rule_name = u'testing_sudorule1' - rule_name2 = u'testing_sudorule2' - rule_command = u'/usr/bin/testsudocmd1' - rule_desc = u'description' - rule_desc_mod = u'description modified' - - test_user = u'sudorule_test_user' - test_external_user = u'external_test_user' - test_group = u'sudorule_test_group' - test_external_group = u'external_test_group' - test_host = u'sudorule.testhost' - test_external_host = u'external.testhost' - test_hostgroup = u'sudorule_test_hostgroup' - test_sudoallowcmdgroup = u'sudorule_test_allowcmdgroup' - test_sudodenycmdgroup = u'sudorule_test_denycmdgroup' - test_command = u'/usr/bin/testsudocmd1' - test_denycommand = u'/usr/bin/testdenysudocmd1' - test_runasuser = u'manager' - test_runasgroup = u'manager' - test_category = u'all' - test_option = u'authenticate' - - test_invalid_user = u'+invalid#user' - test_invalid_host = u'+invalid&host.nonexist.com' - test_invalid_group = u'+invalid#group' - - def test_0_sudorule_add(self): - """ - Test adding a new Sudo rule using `xmlrpc.sudorule_add`. - """ - ret = self.failsafe_add(api.Object.sudorule, - self.rule_name, - description=self.rule_desc, - ) - entry = ret['result'] - assert_attr_equal(entry, 'cn', self.rule_name) - assert_attr_equal(entry, 'description', self.rule_desc) - - @raises(errors.DuplicateEntry) - def test_1_sudorule_add(self): - """ - Test adding an duplicate Sudo rule using `xmlrpc.sudorule_add'. - """ - api.Command['sudorule_add']( - self.rule_name - ) - - def test_2_sudorule_show(self): - """ - Test displaying a Sudo rule using `xmlrpc.sudorule_show`. - """ - entry = api.Command['sudorule_show'](self.rule_name)['result'] - assert_attr_equal(entry, 'cn', self.rule_name) - assert_attr_equal(entry, 'description', self.rule_desc) - - def test_3_sudorule_mod(self): - """ - Test modifying a Sudo rule using `xmlrpc.sudorule_mod`. - """ - ret = api.Command['sudorule_mod']( - self.rule_name, description=self.rule_desc_mod - ) - entry = ret['result'] - assert_attr_equal(entry, 'description', self.rule_desc_mod) - - def test_6_sudorule_find(self): - """ - Test searching for Sudo rules using `xmlrpc.sudorule_find`. - """ - ret = api.Command['sudorule_find']( - cn=self.rule_name, - description=self.rule_desc_mod - ) - assert ret['truncated'] is False - entries = ret['result'] - assert_attr_equal(entries[0], 'cn', self.rule_name) - assert_attr_equal(entries[0], 'description', self.rule_desc_mod) - - def test_7_sudorule_init_testing_data(self): - """ - Initialize data for more Sudo rule plugin testing. - """ - self.failsafe_add(api.Object.user, - self.test_user, givenname=u'first', sn=u'last' - ) - self.failsafe_add(api.Object.user, - self.test_runasuser, givenname=u'first', sn=u'last' - ) - self.failsafe_add(api.Object.group, - self.test_group, description=u'description' - ) - self.failsafe_add(api.Object.host, - self.test_host, force=True - ) - self.failsafe_add(api.Object.hostgroup, - self.test_hostgroup, description=u'description' - ) - self.failsafe_add(api.Object.sudocmdgroup, - self.test_sudoallowcmdgroup, description=u'desc' - ) - self.failsafe_add(api.Object.sudocmdgroup, - self.test_sudodenycmdgroup, description=u'desc' - ) - self.failsafe_add(api.Object.sudocmd, - self.test_command, description=u'desc' - ) - - def test_8_sudorule_add_user(self): - """ - Test adding user and group to Sudo rule using - `xmlrpc.sudorule_add_user`. - """ - ret = api.Command['sudorule_add_user']( - self.rule_name, user=self.test_user, group=self.test_group - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberuser' in failed - assert 'user' in failed['memberuser'] - assert not failed['memberuser']['user'] - assert 'group' in failed['memberuser'] - assert not failed['memberuser']['group'] - entry = ret['result'] - assert_attr_equal(entry, 'memberuser_user', self.test_user) - assert_attr_equal(entry, 'memberuser_group', self.test_group) - - def test_9_a_show_user(self): - """ - Test showing a user to verify Sudo rule membership - `xmlrpc.user_show`. - """ - ret = api.Command['user_show'](self.test_user, all=True) - entry = ret['result'] - assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) - - def test_9_b_show_group(self): - """ - Test showing a group to verify Sudo rule membership - `xmlrpc.group_show`. - """ - ret = api.Command['group_show'](self.test_group, all=True) - entry = ret['result'] - assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) - - def test_9_sudorule_remove_user(self): - """ - Test removing user and group from Sudo rule using - `xmlrpc.sudorule_remove_user'. - """ - ret = api.Command['sudorule_remove_user']( - self.rule_name, user=self.test_user, group=self.test_group - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberuser' in failed - assert 'user' in failed['memberuser'] - assert not failed['memberuser']['user'] - assert 'group' in failed['memberuser'] - assert not failed['memberuser']['group'] - entry = ret['result'] - assert 'memberuser_user' not in entry - assert 'memberuser_group' not in entry - - def test_a_sudorule_add_runasuser(self): - """ - Test adding run as user to Sudo rule using - `xmlrpc.sudorule_add_runasuser`. - """ - ret = api.Command['sudorule_add_runasuser']( - self.rule_name, user=self.test_runasuser - ) - assert ret['completed'] == 1 - failed = ret['failed'] - assert 'ipasudorunas' in failed - assert 'user' in failed['ipasudorunas'] - assert not failed['ipasudorunas']['user'] - entry = ret['result'] - assert_attr_equal(entry, 'ipasudorunas_user', self.test_runasuser) - - def test_a_sudorule_add_runasuser_invalid(self): - """ - Test adding run as invalid user to Sudo rule using - `xmlrpc.sudorule_add_runasuser`. - """ - try: - api.Command['sudorule_add_runasuser']( - self.rule_name, user=self.test_invalid_user - ) - except errors.ValidationError: - pass - else: - assert False - - def test_b_sudorule_remove_runasuser(self): - """ - Test removing run as user to Sudo rule using - `xmlrpc.sudorule_remove_runasuser'. - """ - ret = api.Command['sudorule_remove_runasuser']( - self.rule_name, user=self.test_runasuser - ) - assert ret['completed'] == 1 - failed = ret['failed'] - assert 'ipasudorunas' in failed - assert 'user' in failed['ipasudorunas'] - assert not failed['ipasudorunas']['user'] - entry = ret['result'] - assert 'ipasudorunas_user' not in entry - - def test_a_sudorule_add_runasgroup(self): - """ - Test adding run as group to Sudo rule using - `xmlrpc.sudorule_add_runasgroup`. - """ - ret = api.Command['sudorule_add_runasgroup']( - self.rule_name, group=self.test_runasgroup - ) - assert ret['completed'] == 1 - failed = ret['failed'] - assert 'ipasudorunasgroup' in failed - assert 'group' in failed['ipasudorunasgroup'] - assert not failed['ipasudorunasgroup']['group'] - entry = ret['result'] - assert_attr_equal(entry, 'ipasudorunasgroup_group', - self.test_runasgroup) - - def test_a_sudorule_add_runasgroup_invalid(self): - """ - Test adding run as invalid user to Sudo rule using - `xmlrpc.sudorule_add_runasuser`. - """ - try: - api.Command['sudorule_add_runasgroup']( - self.rule_name, group=self.test_invalid_group - ) - except errors.ValidationError: - pass - else: - assert False - - def test_b_sudorule_remove_runasgroup(self): - """ - Test removing run as group to Sudo rule using - `xmlrpc.sudorule_remove_runasgroup'. - """ - ret = api.Command['sudorule_remove_runasgroup']( - self.rule_name, group=self.test_runasgroup - ) - assert ret['completed'] == 1 - failed = ret['failed'] - assert 'ipasudorunasgroup' in failed - assert 'group' in failed['ipasudorunasgroup'] - assert not failed['ipasudorunasgroup']['group'] - entry = ret['result'] - assert 'ipasudorunasgroup_group' not in entry - - def test_a_sudorule_add_externaluser(self): - """ - Test adding an external user to Sudo rule using - `xmlrpc.sudorule_add_user`. - """ - ret = api.Command['sudorule_add_user']( - self.rule_name, user=self.test_external_user - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert_attr_equal(entry, 'externaluser', self.test_external_user) - - def test_a_sudorule_add_externaluser_invalid(self): - """ - Test adding an invalid external user to Sudo rule using - `xmlrpc.sudorule_add_user`. - """ - try: - api.Command['sudorule_add_user']( - self.rule_name, user=self.test_invalid_user - ) - except errors.ValidationError: - pass - else: - assert False - - def test_b_sudorule_remove_externaluser(self): - """ - Test removing an external user from Sudo rule using - `xmlrpc.sudorule_remove_user'. - """ - ret = api.Command['sudorule_remove_user']( - self.rule_name, user=self.test_external_user - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert entry['externaluser'] == () - - def test_a_sudorule_add_runasexternaluser(self): - """ - Test adding an external runasuser to Sudo rule using - `xmlrpc.sudorule_add_runasuser`. - """ - ret = api.Command['sudorule_add_runasuser']( - self.rule_name, user=self.test_external_user - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert_attr_equal(entry, 'ipasudorunasextuser', self.test_external_user) - - def test_b_sudorule_remove_runasexternaluser(self): - """ - Test removing an external runasuser from Sudo rule using - `xmlrpc.sudorule_remove_runasuser'. - """ - ret = api.Command['sudorule_remove_runasuser']( - self.rule_name, user=self.test_external_user - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert entry['ipasudorunasextuser'] == () - - def test_a_sudorule_add_runasexternalgroup(self): - """ - Test adding an external runasgroup to Sudo rule using - `xmlrpc.sudorule_add_runasgroup`. - """ - ret = api.Command['sudorule_add_runasgroup']( - self.rule_name, group=self.test_external_group - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert_attr_equal(entry, 'ipasudorunasextgroup', self.test_external_group) - - def test_b_sudorule_remove_runasexternalgroup(self): - """ - Test removing an external runasgroup from Sudo rule using - `xmlrpc.sudorule_remove_runasgroup'. - """ - ret = api.Command['sudorule_remove_runasgroup']( - self.rule_name, group=self.test_external_group - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert entry['ipasudorunasextgroup'] == () - - def test_a_sudorule_add_option(self): - """ - Test adding an option to Sudo rule using - `xmlrpc.sudorule_add_option`. - """ - ret = api.Command['sudorule_add_option']( - self.rule_name, ipasudoopt=self.test_option - ) - entry = ret['result'] - assert_attr_equal(entry, 'ipasudoopt', self.test_option) - - def test_b_sudorule_remove_option(self): - """ - Test removing an option from Sudo rule using - `xmlrpc.sudorule_remove_option'. - """ - ret = api.Command['sudorule_remove_option']( - self.rule_name, ipasudoopt=self.test_option - ) - entry = ret['result'] - assert 'ipasudoopt' not in entry - - def test_a_sudorule_add_host(self): - """ - Test adding host and hostgroup to Sudo rule using - `xmlrpc.sudorule_add_host`. - """ - ret = api.Command['sudorule_add_host']( - self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberhost' in failed - assert 'host' in failed['memberhost'] - assert not failed['memberhost']['host'] - assert 'hostgroup' in failed['memberhost'] - assert not failed['memberhost']['hostgroup'] - entry = ret['result'] - assert_attr_equal(entry, 'memberhost_host', self.test_host) - assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup) - - def test_a_sudorule_show_host(self): - """ - Test showing host to verify Sudo rule membership - `xmlrpc.host_show`. - """ - ret = api.Command['host_show'](self.test_host, all=True) - entry = ret['result'] - assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) - - def test_a_sudorule_show_hostgroup(self): - """ - Test showing hostgroup to verify Sudo rule membership - `xmlrpc.hostgroup_show`. - """ - ret = api.Command['hostgroup_show'](self.test_hostgroup, all=True) - entry = ret['result'] - assert_attr_equal(entry, 'memberof_sudorule', self.rule_name) - - def test_b_sudorule_remove_host(self): - """ - Test removing host and hostgroup from Sudo rule using - `xmlrpc.sudorule_remove_host`. - """ - ret = api.Command['sudorule_remove_host']( - self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberhost' in failed - assert 'host' in failed['memberhost'] - assert not failed['memberhost']['host'] - assert 'hostgroup' in failed['memberhost'] - assert not failed['memberhost']['hostgroup'] - entry = ret['result'] - assert 'memberhost_host' not in entry - assert 'memberhost_hostgroup' not in entry - - def test_a_sudorule_add_externalhost(self): - """ - Test adding an external host to Sudo rule using - `xmlrpc.sudorule_add_host`. - """ - ret = api.Command['sudorule_add_host']( - self.rule_name, host=self.test_external_host - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert_attr_equal(entry, 'externalhost', self.test_external_host) - - def test_a_sudorule_add_externalhost_invalid(self): - """ - Test adding an invalid external host to Sudo rule using - `xmlrpc.sudorule_add_host`. - """ - try: - api.Command['sudorule_add_host']( - self.rule_name, host=self.test_invalid_host - ) - except errors.ValidationError: - pass - else: - assert False - - def test_a_sudorule_mod_externalhost_invalid_addattr(self): - """ - Test adding an invalid external host to Sudo rule using - `xmlrpc.sudorule_mod --addattr`. - """ - try: - api.Command['sudorule_mod']( - self.rule_name, - addattr='externalhost=%s' % self.test_invalid_host - ) - except errors.ValidationError, e: - assert unicode(e) == ("invalid 'externalhost': only letters, " + - "numbers, _, and - are allowed. " + - "DNS label may not start or end with -") - else: - assert False - - def test_b_sudorule_remove_externalhost(self): - """ - Test removing an external host from Sudo rule using - `xmlrpc.sudorule_remove_host`. - """ - ret = api.Command['sudorule_remove_host']( - self.rule_name, host=self.test_external_host - ) - assert ret['completed'] == 1 - failed = ret['failed'] - entry = ret['result'] - assert len(entry['externalhost']) == 0 - - def test_a_sudorule_add_allow_command(self): - """ - Test adding allow command and cmdgroup to Sudo rule using - `xmlrpc.sudorule_add_allow_command`. - """ - ret = api.Command['sudorule_add_allow_command']( - self.rule_name, sudocmd=self.test_command, - sudocmdgroup=self.test_sudoallowcmdgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberallowcmd' in failed - assert 'sudocmd' in failed['memberallowcmd'] - assert not failed['memberallowcmd']['sudocmd'] - assert 'sudocmdgroup' in failed['memberallowcmd'] - assert not failed['memberallowcmd']['sudocmdgroup'] - entry = ret['result'] - assert_attr_equal(entry, 'memberallowcmd_sudocmd', self.test_command) - assert_attr_equal(entry, 'memberallowcmd_sudocmdgroup', - self.test_sudoallowcmdgroup) - - def test_a_sudorule_remove_allow_command(self): - """ - Test removing allow command and sudocmdgroup from Sudo rule using - `xmlrpc.sudorule_remove_command`. - """ - ret = api.Command['sudorule_remove_allow_command']( - self.rule_name, sudocmd=self.test_command, - sudocmdgroup=self.test_sudoallowcmdgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberallowcmd' in failed - assert 'sudocmd' in failed['memberallowcmd'] - assert not failed['memberallowcmd']['sudocmd'] - assert 'sudocmdgroup' in failed['memberallowcmd'] - assert not failed['memberallowcmd']['sudocmdgroup'] - entry = ret['result'] - assert 'memberallowcmd_sudocmd' not in entry - assert 'memberallowcmd_sudocmdgroup' not in entry - - def test_b_sudorule_add_deny_command(self): - """ - Test adding deny command and cmdgroup to Sudo rule using - `xmlrpc.sudorule_add_deny_command`. - """ - ret = api.Command['sudorule_add_deny_command']( - self.rule_name, sudocmd=self.test_command, - sudocmdgroup=self.test_sudodenycmdgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberdenycmd' in failed - assert 'sudocmd' in failed['memberdenycmd'] - assert not failed['memberdenycmd']['sudocmd'] - assert 'sudocmdgroup' in failed['memberdenycmd'] - assert not failed['memberdenycmd']['sudocmdgroup'] - entry = ret['result'] - assert_attr_equal(entry, 'memberdenycmd_sudocmd', self.test_command) - assert_attr_equal(entry, 'memberdenycmd_sudocmdgroup', - self.test_sudodenycmdgroup) - - def test_b_sudorule_remove_deny_command(self): - """ - Test removing deny command and sudocmdgroup from Sudo rule using - `xmlrpc.sudorule_remove_deny_command`. - """ - ret = api.Command['sudorule_remove_deny_command']( - self.rule_name, sudocmd=self.test_command, - sudocmdgroup=self.test_sudodenycmdgroup - ) - assert ret['completed'] == 2 - failed = ret['failed'] - assert 'memberdenycmd' in failed - assert 'sudocmd' in failed['memberdenycmd'] - assert not failed['memberdenycmd']['sudocmd'] - assert 'sudocmdgroup' in failed['memberdenycmd'] - assert not failed['memberdenycmd']['sudocmdgroup'] - entry = ret['result'] - assert 'memberdenycmd_sudocmd' not in entry - assert 'memberdenycmd_sudocmdgroup' not in entry - - @raises(errors.MutuallyExclusiveError) - def test_c_sudorule_exclusiveuser(self): - """ - Test adding a user to an Sudo rule when usercat='all' - """ - api.Command['sudorule_mod'](self.rule_name, usercategory=u'all') - try: - api.Command['sudorule_add_user'](self.rule_name, user=u'admin') - finally: - api.Command['sudorule_mod'](self.rule_name, usercategory=u'') - - @raises(errors.MutuallyExclusiveError) - def test_d_sudorule_exclusiveuser(self): - """ - Test setting usercat='all' in an Sudo rule when there are users - """ - api.Command['sudorule_add_user'](self.rule_name, user=u'admin') - try: - api.Command['sudorule_mod'](self.rule_name, usercategory=u'all') - finally: - api.Command['sudorule_remove_user'](self.rule_name, user=u'admin') - - @raises(errors.MutuallyExclusiveError) - def test_e_sudorule_exclusivehost(self): - """ - Test adding a host to an Sudo rule when hostcat='all' - """ - api.Command['sudorule_mod'](self.rule_name, hostcategory=u'all') - try: - api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) - finally: - api.Command['sudorule_mod'](self.rule_name, hostcategory=u'') - - @raises(errors.MutuallyExclusiveError) - def test_f_sudorule_exclusivehost(self): - """ - Test setting hostcat='all' in an Sudo rule when there are hosts - """ - api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) - try: - api.Command['sudorule_mod'](self.rule_name, hostcategory=u'all') - finally: - api.Command['sudorule_remove_host'](self.rule_name, host=self.test_host) - - @raises(errors.MutuallyExclusiveError) - def test_g_sudorule_exclusivecommand(self): - """ - Test adding a command to an Sudo rule when cmdcategory='all' - """ - api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'all') - try: - api.Command['sudorule_add_allow_command'](self.rule_name, sudocmd=self.test_command) - finally: - api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'') - - @raises(errors.MutuallyExclusiveError) - def test_h_sudorule_exclusivecommand(self): - """ - Test setting cmdcategory='all' in an Sudo rule when there are commands - """ - api.Command['sudorule_add_allow_command'](self.rule_name, sudocmd=self.test_command) - try: - api.Command['sudorule_mod'](self.rule_name, cmdcategory=u'all') - finally: - api.Command['sudorule_remove_allow_command'](self.rule_name, sudocmd=self.test_command) - - @raises(errors.MutuallyExclusiveError) - def test_i_sudorule_exclusiverunas(self): - """ - Test adding a runasuser to an Sudo rule when ipasudorunasusercategory='all' - """ - api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'all') - try: - api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_user) - finally: - api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'') - - @raises(errors.MutuallyExclusiveError) - def test_j_1_sudorule_exclusiverunas(self): - """ - Test setting ipasudorunasusercategory='all' in an Sudo rule when there are runas users - """ - api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_user) - try: - api.Command['sudorule_mod'](self.rule_name, ipasudorunasusercategory=u'all') - finally: - api.Command['sudorule_remove_runasuser'](self.rule_name, user=self.test_command) - - def test_j_2_sudorule_referential_integrity(self): - """ - Test adding various links to Sudo rule - """ - api.Command['sudorule_add_user'](self.rule_name, user=self.test_user) - api.Command['sudorule_add_runasuser'](self.rule_name, user=self.test_runasuser, - group=self.test_group) - api.Command['sudorule_add_runasgroup'](self.rule_name, group=self.test_group) - api.Command['sudorule_add_host'](self.rule_name, host=self.test_host) - api.Command['sudorule_add_allow_command'](self.rule_name, - sudocmd=self.test_command) - api.Command['sudorule_add_deny_command'](self.rule_name, - sudocmdgroup=self.test_sudodenycmdgroup) - entry = api.Command['sudorule_show'](self.rule_name)['result'] - assert_attr_equal(entry, 'cn', self.rule_name) - assert_attr_equal(entry, 'memberuser_user', self.test_user) - assert_attr_equal(entry, 'memberallowcmd_sudocmd', self.test_command) - assert_attr_equal(entry, 'memberdenycmd_sudocmdgroup', - self.test_sudodenycmdgroup) - assert_attr_equal(entry, 'memberhost_host', self.test_host) - assert_attr_equal(entry, 'ipasudorunas_user', self.test_runasuser) - assert_attr_equal(entry, 'ipasudorunas_group', self.test_group) - assert_attr_equal(entry, 'ipasudorunasgroup_group', self.test_group) - - - def test_k_1_sudorule_clear_testing_data(self): - """ - Clear data for Sudo rule plugin testing. - """ - api.Command['user_del'](self.test_user) - api.Command['user_del'](self.test_runasuser) - api.Command['group_del'](self.test_group) - api.Command['host_del'](self.test_host) - api.Command['hostgroup_del'](self.test_hostgroup) - api.Command['sudorule_remove_allow_command'](self.rule_name, - sudocmd=self.test_command) - api.Command['sudocmd_del'](self.test_command) - api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup) - api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup) - - def test_k_2_sudorule_referential_integrity(self): - """ - Test that links in Sudo rule were removed by referential integrity plugin - """ - entry = api.Command['sudorule_show'](self.rule_name)['result'] - assert_attr_equal(entry, 'cn', self.rule_name) - assert 'memberuser_user' not in entry - assert 'memberallowcmd_sudocmd' not in entry - assert 'memberdenycmd_sudocmdgroup' not in entry - assert 'memberhost_host' not in entry - assert 'ipasudorunas_user' not in entry - assert 'ipasudorunas_group' not in entry - assert 'ipasudorunasgroup_group' not in entry - - def test_l_sudorule_order(self): - """ - Test that order uniqueness is maintained - """ - api.Command['sudorule_mod'](self.rule_name, sudoorder=1) - - api.Command['sudorule_add'](self.rule_name2) - - # mod of rule that has no order and set a duplicate - try: - api.Command['sudorule_mod'](self.rule_name2, sudoorder=1) - except errors.ValidationError: - pass - - # Remove the rule so we can re-add it - api.Command['sudorule_del'](self.rule_name2) - - # add a new rule with a duplicate order - with assert_raises(errors.ValidationError): - api.Command['sudorule_add'](self.rule_name2, sudoorder=1) - - # add a new rule with a unique order - api.Command['sudorule_add'](self.rule_name2, sudoorder=2) - with assert_raises(errors.ValidationError): - api.Command['sudorule_mod'](self.rule_name2, sudoorder=1) - - # Try setting both to 0 - api.Command['sudorule_mod'](self.rule_name2, sudoorder=0) - with assert_raises(errors.ValidationError): - api.Command['sudorule_mod'](self.rule_name, sudoorder=0) - - - def test_m_sudorule_del(self): - """ - Test deleting a Sudo rule using `xmlrpc.sudorule_del`. - """ - api.Command['sudorule_del'](self.rule_name) - # verify that it's gone - with assert_raises(errors.NotFound): - api.Command['sudorule_show'](self.rule_name) - api.Command['sudorule_del'](self.rule_name2) |