diff options
Diffstat (limited to 'ipalib')
| -rw-r--r-- | ipalib/plugins/hbacrule.py | 2 | ||||
| -rw-r--r-- | ipalib/plugins/selinuxusermap.py | 23 |
2 files changed, 17 insertions, 8 deletions
diff --git a/ipalib/plugins/hbacrule.py b/ipalib/plugins/hbacrule.py index 0fa44a59..53d25aac 100644 --- a/ipalib/plugins/hbacrule.py +++ b/ipalib/plugins/hbacrule.py @@ -243,7 +243,7 @@ class hbacrule_del(LDAPDelete): msg_summary = _('Deleted HBAC rule "%(value)s"') def pre_callback(self, ldap, dn, *keys, **options): - kw = dict(seealso=dn) + kw = dict(seealso=keys[0]) _entries = api.Command.selinuxusermap_find(None, **kw) if _entries['count']: raise errors.DependentEntry(key=keys[0], label=self.api.Object['selinuxusermap'].label_singular, dependent=_entries['result'][0]['cn'][0]) diff --git a/ipalib/plugins/selinuxusermap.py b/ipalib/plugins/selinuxusermap.py index 475376f6..ee9a8133 100644 --- a/ipalib/plugins/selinuxusermap.py +++ b/ipalib/plugins/selinuxusermap.py @@ -29,7 +29,9 @@ SELinux User Mapping Map IPA users to SELinux users by host. Hosts, hostgroups, users and groups can be either defined within -the rule or it may point to an existing HBAC rule. +the rule or it may point to an existing HBAC rule. When using +--hbacrule option to selinuxusermap-find an exact match is made on the +HBAC rule name, so only one or zero entries will be returned. EXAMPLES: @@ -54,6 +56,9 @@ EXAMPLES: Enable a named rule: ipa selinuxusermap-enable test1 + Find a rule referencing a specific HBAC rule: + ipa selinuxusermap-find --hbacrule=allow_some + Remove a named rule: ipa selinuxusermap-del john_unconfined @@ -298,12 +303,16 @@ class selinuxusermap_find(LDAPSearch): def execute(self, *args, **options): # If searching on hbacrule we need to find the uuid to search on - if 'seealso' in options: - kw = dict(cn=options['seealso'], all=True) - _entries = api.Command.hbacrule_find(None, **kw)['result'] - del options['seealso'] - if _entries: - options['seealso'] = _entries[0]['dn'] + if options.get('seealso'): + hbacrule = options['seealso'] + + try: + hbac = api.Command['hbacrule_show'](hbacrule, +all=True)['result'] + dn = hbac['dn'] + except errors.NotFound: + return dict(count=0, result=[], truncated=False) + options['seealso'] = dn return super(selinuxusermap_find, self).execute(*args, **options) |