Add several CRUD default permissions

Add missing Add, Modify, Removedefault permissions to:
- automountlocation (Add/Remove only; locations have
   no data to modify)
- privilege
- sudocmdgroup (Modify only; the others were present)

Related to: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>

4 files changed, 42 insertions, 0 deletions

diff --git a/ACI.txt b/ACI.txt
index 063386c56..dd9e7c5ae 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -10,8 +10,12 @@ dn: cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "automountinformation || automountkey || description")(targetfilter = "(objectclass=automount)")(version 3.0;acl "permission:System: Modify Automount Keys";allow (write) groupdn = "ldap:///cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=automount)")(version 3.0;acl "permission:System: Remove Automount Keys";allow (delete) groupdn = "ldap:///cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Add Automount Locations";allow (add) groupdn = "ldap:///cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Automount Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "automountinformation || automountkey || automountmapname || cn || description || objectclass")(version 3.0;acl "permission:System: Read Automount Configuration";allow (compare,read,search) userdn = "ldap:///anyone";)
+dn: cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Remove Automount Locations";allow (delete) groupdn = "ldap:///cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=automountmap)")(version 3.0;acl "permission:System: Add Automount Maps";allow (add) groupdn = "ldap:///cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
@@ -134,8 +138,14 @@ dn: cn=System: Read ACIs,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "aci")(version 3.0;acl "permission:System: Read ACIs";allow (compare,read,search) groupdn = "ldap:///cn=System: Read ACIs,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "businesscategory || cn || description || ipapermbindruletype || ipapermdefaultattr || ipapermexcludedattr || ipapermincludedattr || ipapermissiontype || ipapermlocation || ipapermright || ipapermtarget || ipapermtargetfilter || member || memberhost || memberof || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipapermission)")(version 3.0;acl "permission:System: Read Permissions";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Add Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Add Privileges";allow (add) groupdn = "ldap:///cn=System: Add Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "businesscategory || cn || description || o || ou || owner || seealso")(targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Modify Privileges";allow (write) groupdn = "ldap:///cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "businesscategory || cn || description || member || memberhost || memberof || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Read Privileges";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Remove Privileges";allow (delete) groupdn = "ldap:///cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example
@@ -188,6 +198,8 @@ dn: cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=exampl
 aci: (targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Delete Sudo Command Group";allow (delete) groupdn = "ldap:///cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "member")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Manage Sudo Command Group Membership";allow (write) groupdn = "ldap:///cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "description")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Modify Sudo Command Group";allow (write) groupdn = "ldap:///cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Sudo Command Groups,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "businesscategory || cn || description || ipauniqueid || member || memberhost || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipasudocmdgrp)")(version 3.0;acl "permission:System: Read Sudo Command Groups";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/ipalib/plugins/automount.py b/ipalib/plugins/automount.py
index 02f0a3f60..0a5c121ca 100644
--- a/ipalib/plugins/automount.py
+++ b/ipalib/plugins/automount.py
@@ -212,6 +212,7 @@ class automountlocation(LDAPObject):
     default_attributes = ['cn']
     label = _('Automount Locations')
     label_singular = _('Automount Location')
+    permission_filter_objectclasses = ['nscontainer']
     managed_permissions = {
         'System: Read Automount Configuration': {
             # Single permission for all automount-related entries
@@ -226,6 +227,14 @@ class automountlocation(LDAPObject):
                 'automountmapname', 'description',
             },
         },
+        'System: Add Automount Locations': {
+            'ipapermright': {'add'},
+            'default_privileges': {'Automount Administrators'},
+        },
+        'System: Remove Automount Locations': {
+            'ipapermright': {'delete'},
+            'default_privileges': {'Automount Administrators'},
+        },
     }
 
     takes_params = (
diff --git a/ipalib/plugins/privilege.py b/ipalib/plugins/privilege.py
index cff6fe197..6a503709e 100644
--- a/ipalib/plugins/privilege.py
+++ b/ipalib/plugins/privilege.py
@@ -75,6 +75,22 @@ class privilege(LDAPObject):
             },
             'default_privileges': {'RBAC Readers'},
         },
+        'System: Add Privileges': {
+            'ipapermright': {'add'},
+            'default_privileges': {'Delegation Administrator'},
+        },
+        'System: Modify Privileges': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {
+                'businesscategory',  'cn', 'description', 'o', 'ou', 'owner',
+                'seealso',
+            },
+            'default_privileges': {'Delegation Administrator'},
+        },
+        'System: Remove Privileges': {
+            'ipapermright': {'delete'},
+            'default_privileges': {'Delegation Administrator'},
+        },
     }
 
     label = _('Privileges')
diff --git a/ipalib/plugins/sudocmdgroup.py b/ipalib/plugins/sudocmdgroup.py
index b443dd41b..40ff294bb 100644
--- a/ipalib/plugins/sudocmdgroup.py
+++ b/ipalib/plugins/sudocmdgroup.py
@@ -92,6 +92,11 @@ class sudocmdgroup(LDAPObject):
             ],
             'default_privileges': {'Sudo Administrator'},
         },
+        'System: Modify Sudo Command Group': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {'description'},
+            'default_privileges': {'Sudo Administrator'},
+        },
         'System: Manage Sudo Command Group Membership': {
             'ipapermright': {'write'},
             'ipapermdefaultattr': {'member'},