From 394b094fc22ef67742824ec03d4e851a2876fd81 Mon Sep 17 00:00:00 2001 From: Martin Basti Date: Sat, 11 Jun 2016 17:49:00 +0200 Subject: DNS Locations: permission: allow to read status of services New permission was added: "System: Read Status of Services on IPA Servers" This permission is needed for detection which records should be created on which servers. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek Reviewed-By: Jan Cholasta --- ACI.txt | 4 +++- ipaserver/plugins/server.py | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ACI.txt b/ACI.txt index a26e2dd4b..3947b3f0a 100644 --- a/ACI.txt +++ b/ACI.txt @@ -235,7 +235,9 @@ aci: (targetattr = "accesstime || cn || createtimestamp || description || entryu dn: cn=usermap,cn=selinux,dc=ipa,dc=example aci: (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Remove SELinux User Maps";allow (delete) groupdn = "ldap:///cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example -aci: (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipalocationweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaLocationMember)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";) +aci: (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipalocationweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example +aci: (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=services,cn=accounts,dc=ipa,dc=example aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=services,cn=accounts,dc=ipa,dc=example diff --git a/ipaserver/plugins/server.py b/ipaserver/plugins/server.py index a2c2752d9..edbd3bb78 100644 --- a/ipaserver/plugins/server.py +++ b/ipaserver/plugins/server.py @@ -66,7 +66,7 @@ class server(LDAPObject): 'ipalocation': ('IPA', 'in_', 'not_in_'), 'role': ('Enabled', '', 'no_'), } - permission_filter_objectclasses = ['ipaLocationMember'] + permission_filter_objectclasses = ['ipaConfigObject'] managed_permissions = { 'System: Read Locations of IPA Servers': { 'ipapermright': {'read', 'search', 'compare'}, @@ -75,6 +75,11 @@ class server(LDAPObject): }, 'default_privileges': {'DNS Administrators'}, }, + 'System: Read Status of Services on IPA Servers': { + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': {'objectclass', 'cn', 'ipaconfigstring'}, + 'default_privileges': {'DNS Administrators'}, + } } takes_params = ( -- cgit