From dbd87af80b55af0454866260d24d7b3b1f5d9666 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 17 Jan 2012 17:54:00 -0500 Subject: Fix deletion of HBAC Rules when there are SELinux user maps defined When deleting an HBAC rule we need to ensure that an SELinux user map isn't pointing at it. We need to take what is the cn of the HBAC rule and see if that rule exists, then return the dn to that rule. The search was not being done properly and wasn't enforcing uniqueness. It could have returned partial matches as well (so tests for the search test). https://fedorahosted.org/freeipa/ticket/2269 --- ipalib/plugins/selinuxusermap.py | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) (limited to 'ipalib/plugins/selinuxusermap.py') diff --git a/ipalib/plugins/selinuxusermap.py b/ipalib/plugins/selinuxusermap.py index 475376f6..ee9a8133 100644 --- a/ipalib/plugins/selinuxusermap.py +++ b/ipalib/plugins/selinuxusermap.py @@ -29,7 +29,9 @@ SELinux User Mapping Map IPA users to SELinux users by host. Hosts, hostgroups, users and groups can be either defined within -the rule or it may point to an existing HBAC rule. +the rule or it may point to an existing HBAC rule. When using +--hbacrule option to selinuxusermap-find an exact match is made on the +HBAC rule name, so only one or zero entries will be returned. EXAMPLES: @@ -54,6 +56,9 @@ EXAMPLES: Enable a named rule: ipa selinuxusermap-enable test1 + Find a rule referencing a specific HBAC rule: + ipa selinuxusermap-find --hbacrule=allow_some + Remove a named rule: ipa selinuxusermap-del john_unconfined @@ -298,12 +303,16 @@ class selinuxusermap_find(LDAPSearch): def execute(self, *args, **options): # If searching on hbacrule we need to find the uuid to search on - if 'seealso' in options: - kw = dict(cn=options['seealso'], all=True) - _entries = api.Command.hbacrule_find(None, **kw)['result'] - del options['seealso'] - if _entries: - options['seealso'] = _entries[0]['dn'] + if options.get('seealso'): + hbacrule = options['seealso'] + + try: + hbac = api.Command['hbacrule_show'](hbacrule, +all=True)['result'] + dn = hbac['dn'] + except errors.NotFound: + return dict(count=0, result=[], truncated=False) + options['seealso'] = dn return super(selinuxusermap_find, self).execute(*args, **options) -- cgit