Prevent a sudo command from being deleted if it is a member of a sudo rule

Tests included.

3 files changed, 98 insertions, 0 deletions

diff --git a/ipalib/plugins/sudocmd.py b/ipalib/plugins/sudocmd.py
index f27a58cad..f6ea88a25 100644
--- a/ipalib/plugins/sudocmd.py
+++ b/ipalib/plugins/sudocmd.py
@@ -109,6 +109,32 @@ class sudocmd_del(LDAPDelete):
 
     msg_summary = _('Deleted Sudo Command "%(value)s"')
 
+    def pre_callback(self, ldap, dn, *keys, **options):
+        filters = [
+            ldap.make_filter_from_attr(attr, dn)
+            for attr in ('memberallowcmd', 'memberdenycmd')]
+        filter = ldap.combine_filters(filters, ldap.MATCH_ANY)
+        filter = ldap.combine_filters(
+            (filter, ldap.make_filter_from_attr('objectClass', 'ipasudorule')),
+            ldap.MATCH_ALL)
+        dependent_sudorules = []
+        try:
+            entries, truncated = ldap.find_entries(
+                filter, ['cn'],
+                base_dn=DN(api.env.container_sudorule, api.env.basedn))
+        except errors.NotFound:
+            pass
+        else:
+            for entry_dn, entry_attrs in entries:
+                [cn] = entry_attrs['cn']
+                dependent_sudorules.append(cn)
+
+        if dependent_sudorules:
+            raise errors.DependentEntry(
+                key=keys[0], label='sudorule',
+                dependent=', '.join(dependent_sudorules))
+        return dn
+
 api.register(sudocmd_del)
 
 class sudocmd_mod(LDAPUpdate):
diff --git a/tests/test_xmlrpc/test_sudocmd_plugin.py b/tests/test_xmlrpc/test_sudocmd_plugin.py
index 0ea8e10b8..7b355072b 100644
--- a/tests/test_xmlrpc/test_sudocmd_plugin.py
+++ b/tests/test_xmlrpc/test_sudocmd_plugin.py
@@ -29,12 +29,15 @@ from tests.test_xmlrpc import objectclasses
 sudocmd1 = u'/usr/bin/sudotestcmd1'
 sudocmd1_camelcase = u'/usr/bin/sudoTestCmd1'
 
+sudorule1 = u'test_sudorule1'
+
 
 class test_sudocmd(Declarative):
 
     cleanup_commands = [
         ('sudocmd_del', [sudocmd1], {}),
         ('sudocmd_del', [sudocmd1_camelcase], {}),
+        ('sudorule_del', [sudorule1], {}),
     ]
 
     tests = [
@@ -206,6 +209,73 @@ class test_sudocmd(Declarative):
             ),
         ),
 
+        dict(
+            desc='Create %r' % sudorule1,
+            command=('sudorule_add', [sudorule1], {}),
+            expected=lambda e, result: True,
+        ),
+
+        dict(
+            desc='Add %r to %r allow list' % (sudocmd1, sudorule1),
+            command=('sudorule_add_allow_command', [sudorule1],
+                dict(sudocmd=sudocmd1)),
+            expected=dict(
+                    completed=1,
+                    failed=dict(
+                        memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
+                    result=lambda result: True,
+                ),
+        ),
+
+        dict(
+            desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
+            command=('sudocmd_del', [sudocmd1], {}),
+            expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
+                dependent=sudorule1),
+        ),
+
+        dict(
+            desc='Remove %r from %r' % (sudocmd1, sudorule1),
+            command=('sudorule_remove_allow_command', [sudorule1],
+                dict(sudocmd=sudocmd1)),
+            expected=dict(
+                    completed=1,
+                    failed=dict(
+                        memberallowcmd=dict(sudocmdgroup=(), sudocmd=())),
+                    result=lambda result: True,
+                ),
+        ),
+
+        dict(
+            desc='Add %r to %r deny list' % (sudocmd1, sudorule1),
+            command=('sudorule_add_deny_command', [sudorule1],
+                dict(sudocmd=sudocmd1)),
+            expected=dict(
+                    completed=1,
+                    failed=dict(
+                        memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
+                    result=lambda result: True,
+                ),
+        ),
+
+        dict(
+            desc="Test %r can't be deleted when in %r" % (sudocmd1, sudorule1),
+            command=('sudocmd_del', [sudocmd1], {}),
+            expected=errors.DependentEntry(key=sudocmd1, label='sudorule',
+                dependent=sudorule1),
+        ),
+
+        dict(
+            desc='Remove %r from %r' % (sudocmd1, sudorule1),
+            command=('sudorule_remove_deny_command', [sudorule1],
+                dict(sudocmd=sudocmd1)),
+            expected=dict(
+                    completed=1,
+                    failed=dict(
+                        memberdenycmd=dict(sudocmdgroup=(), sudocmd=())),
+                    result=lambda result: True,
+                ),
+        ),
 
         dict(
             desc='Delete %r' % sudocmd1,
diff --git a/tests/test_xmlrpc/test_sudorule_plugin.py b/tests/test_xmlrpc/test_sudorule_plugin.py
index 9b44065af..ec5d16d62 100644
--- a/tests/test_xmlrpc/test_sudorule_plugin.py
+++ b/tests/test_xmlrpc/test_sudorule_plugin.py
@@ -718,6 +718,8 @@ class test_sudorule(XMLRPC_test):
         api.Command['group_del'](self.test_group)
         api.Command['host_del'](self.test_host)
         api.Command['hostgroup_del'](self.test_hostgroup)
+        api.Command['sudorule_remove_allow_command'](self.rule_name,
+                                                     sudocmd=self.test_command)
         api.Command['sudocmd_del'](self.test_command)
         api.Command['sudocmdgroup_del'](self.test_sudoallowcmdgroup)
         api.Command['sudocmdgroup_del'](self.test_sudodenycmdgroup)