From 7786ff694b098f44574f92b3bbf89db48438a20f Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 26 Mar 2014 14:19:44 +0100 Subject: Add managed read permissions to Sudo objects Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek --- ipalib/plugins/sudocmdgroup.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'ipalib/plugins/sudocmdgroup.py') diff --git a/ipalib/plugins/sudocmdgroup.py b/ipalib/plugins/sudocmdgroup.py index 0afa45819..471c8b858 100644 --- a/ipalib/plugins/sudocmdgroup.py +++ b/ipalib/plugins/sudocmdgroup.py @@ -55,6 +55,7 @@ class sudocmdgroup(LDAPObject): object_name = _('sudo command group') object_name_plural = _('sudo command groups') object_class = ['ipaobject', 'ipasudocmdgrp'] + permission_filter_objectclasses = ['ipasudocmdgrp'] default_attributes = [ 'cn', 'description', 'member', ] @@ -62,6 +63,17 @@ class sudocmdgroup(LDAPObject): attribute_members = { 'member': ['sudocmd'], } + managed_permissions = { + 'System: Read Sudo Command Groups': { + 'replaces_global_anonymous_aci': True, + 'ipapermbindruletype': 'all', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'businesscategory', 'cn', 'description', 'ipauniqueid', + 'member', 'o', 'objectclass', 'ou', 'owner', 'seealso', + }, + }, + } label = _('Sudo Command Groups') label_singular = _('Sudo Command Group') -- cgit