diff options
author | Petr Viktorin <pviktori@redhat.com> | 2014-05-14 14:57:35 +0200 |
---|---|---|
committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 17:34:18 +0200 |
commit | 91a5aecd4892700cf1468a9ac5608227d06d21db (patch) | |
tree | 6109a4db118f81a3d346a7d21797178716cfc7ed /ipalib | |
parent | acb2ca47d68becca8c7385899c9107d5b6a13a1a (diff) | |
download | freeipa-91a5aecd4892700cf1468a9ac5608227d06d21db.tar.gz freeipa-91a5aecd4892700cf1468a9ac5608227d06d21db.tar.xz freeipa-91a5aecd4892700cf1468a9ac5608227d06d21db.zip |
Convert Sudo rule default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'ipalib')
-rw-r--r-- | ipalib/plugins/sudorule.py | 33 |
1 files changed, 32 insertions, 1 deletions
diff --git a/ipalib/plugins/sudorule.py b/ipalib/plugins/sudorule.py index 627b4b975..658cc06ba 100644 --- a/ipalib/plugins/sudorule.py +++ b/ipalib/plugins/sudorule.py @@ -144,7 +144,38 @@ class sudorule(LDAPObject): 'sudorunasuser', 'sudorunasgroup', 'sudooption', 'sudonotbefore', 'sudonotafter', 'sudoorder', 'description', }, - } + }, + 'System: Add Sudo rule': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'add'}, + 'replaces': [ + '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo rule";allow (add) groupdn = "ldap:///cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Sudo Administrator'}, + }, + 'System: Delete Sudo rule': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'delete'}, + 'replaces': [ + '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo rule";allow (delete) groupdn = "ldap:///cn=Delete Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Sudo Administrator'}, + }, + 'System: Modify Sudo rule': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'description', 'ipaenabledflag', 'usercategory', + 'hostcategory', 'cmdcategory', 'ipasudorunasusercategory', + 'ipasudorunasgroupcategory', 'externaluser', + 'ipasudorunasextuser', 'ipasudorunasextgroup', 'memberdenycmd', + 'memberallowcmd', 'memberuser', + }, + 'replaces': [ + '(targetattr = "description || ipaenabledflag || usercategory || hostcategory || cmdcategory || ipasudorunasusercategory || ipasudorunasgroupcategory || externaluser || ipasudorunasextuser || ipasudorunasextgroup || memberdenycmd || memberallowcmd || memberuser")(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify Sudo rule";allow (write) groupdn = "ldap:///cn=Modify Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Sudo Administrator'}, + }, } label = _('Sudo Rules') |