diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2017-01-13 20:33:45 +1000 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2017-02-28 14:30:23 +0000 |
| commit | b81ac59640f0b76fa9f53cf8be441f085a7089c4 (patch) | |
| tree | 7d8033eeb839ae00bbcab315733ab19141b20f08 /ipapython | |
| parent | ada91c20588046bb147fc701718d3da4d2c080ca (diff) | |
| download | freeipa-b81ac59640f0b76fa9f53cf8be441f085a7089c4.tar.gz freeipa-b81ac59640f0b76fa9f53cf8be441f085a7089c4.tar.xz freeipa-b81ac59640f0b76fa9f53cf8be441f085a7089c4.zip | |
ca: correctly authorise ca-del, ca-enable and ca-disable
CAs consist of a FreeIPA and a corresponding Dogtag object. When
executing ca-del, ca-enable and ca-disable, changes are made to the
Dogtag object. In the case of ca-del, the corresponding FreeIPA
object is deleted after the Dogtag CA is deleted.
These operations were not correctly authorised; the FreeIPA
permissions are not checked before the Dogtag operations are
executed. This allows any user to delete, enable or disable a
lightweight CA (except the main IPA CA, for which there are
additional check to prevent deletion or disablement).
Add the proper authorisation checks to the ca-del, ca-enable and
ca-disable commands.
https://pagure.io/freeipa/issue/6713
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Diffstat (limited to 'ipapython')
0 files changed, 0 insertions, 0 deletions