Make sure member* attrs are always granted together in read permissions

Memberofindirect processing of an entry doesn't work if the user doesn't
have rights to any one of these attributes:
- member
- memberuser
- memberhost

Add all of these to any read permission that specifies any of them.

Add a check to makeaci that will enforce this for any future permissions.

Reviewed-By: Martin Kosek <mkosek@redhat.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/makeaci b/makeaci
index ab823558d..6c1a4603c 100755
--- a/makeaci
+++ b/makeaci
@@ -72,6 +72,24 @@ def generate_aci_lines(api):
         yield 'dn: %s\n' % dn
         yield 'aci: %s\n' % aci
 
+        check_member_attrs(name, template)
+
+
+def check_member_attrs(name, template):
+    """Check that member* attrs are always present together for read
+
+    ldap2._process_memberofindirect reads all these attributes together;
+    if the user doesn't have rights to one of them, the entire entry is
+    left out and memberofindirect processing returns wrong a result.
+    So we need all of them be readable.
+    """
+    checked_attrs = ['member', 'memberuser', 'memberhost']
+    perm_attrs = template.get('ipapermdefaultattr', ())
+    flags = [(a in perm_attrs) for a in checked_attrs]
+    if 'read' in template['ipapermright'] and any(flags) and not all(flags):
+        raise AssertionError("'%s' includes some  but not all of %s" %
+                             (name, checked_attrs))
+
 
 def main(options):
     api.bootstrap(