From 6d984172afd16492ec220c3f36b51a6314808fd1 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 8 Dec 2011 10:04:09 +0100 Subject: Reorder privileges so that memberof for permissions are generated properly. The privilege was added after the permission causing the memberof to not be generated. Add a new task to regenerate memberof for existing PBAC to fix upgrades. https://fedorahosted.org/freeipa/ticket/2058 https://fedorahosted.org/freeipa/ticket/2059 https://fedorahosted.org/freeipa/ticket/2060 https://fedorahosted.org/freeipa/ticket/2061 --- install/updates/40-delegation.update | 41 +++++++++++++++++----------------- install/updates/45-roles.update | 3 +++ install/updates/55-pbacmemberof.update | 10 +++++++++ install/updates/Makefile.am | 1 + 4 files changed, 34 insertions(+), 21 deletions(-) create mode 100644 install/updates/55-pbacmemberof.update diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index a23521166..3502ce89a 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -18,6 +18,12 @@ dn: $SUFFIX add:aci: '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,$SUFFIX";)' # Host-Based Access Control +dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: HBAC Administrator +default:description: HBAC Administrator dn: cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX default:objectClass: groupofnames @@ -82,13 +88,6 @@ default:objectClass: top default:cn: Manage HBAC service group membership default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX -dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX -default:objectClass: nestedgroup -default:objectClass: groupofnames -default:objectClass: top -default:cn: HBAC Administrator -default:description: HBAC Administrator - dn: $SUFFIX add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC rule";allow (add) groupdn = "ldap:///cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC rule";allow (delete) groupdn = "ldap:///cn=Delete HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' @@ -102,6 +101,13 @@ add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=hbacservicegroups,cn # SUDO +dn: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: Sudo Administrator +default:description: Sudo Administrator + dn: cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX default:objectClass: groupofnames default:objectClass: ipapermission @@ -165,13 +171,6 @@ default:objectClass: top default:cn: Manage Sudo command group membership default:member: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX -dn: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX -default:objectClass: nestedgroup -default:objectClass: groupofnames -default:objectClass: top -default:cn: Sudo Administrator -default:description: Sudo Administrator - dn: $SUFFIX add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo rule";allow (add) groupdn = "ldap:///cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo rule";allow (delete) groupdn = "ldap:///cn=Delete Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)' @@ -184,6 +183,13 @@ add:aci: '(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0 add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Manage Sudo command group membership";allow (write) groupdn = "ldap:///cn=Manage Sudo command group membership,cn=permissions,cn=pbac,$SUFFIX";)' # Password Policy +dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: Password Policy Administrator +default:description: Password Policy Administrator + dn: cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX default:objectClass: groupofnames default:objectClass: ipapermission @@ -226,13 +232,6 @@ default:objectClass: top default:cn: Modify Group Password Policy default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX -dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX -default:objectClass: nestedgroup -default:objectClass: groupofnames -default:objectClass: top -default:cn: Password Policy Administrator -default:description: Password Policy Administrator - dn: $SUFFIX add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy costemplate";allow (add) groupdn = "ldap:///cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy costemplate";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' diff --git a/install/updates/45-roles.update b/install/updates/45-roles.update index 04f4be8fd..3803cee3b 100644 --- a/install/updates/45-roles.update +++ b/install/updates/45-roles.update @@ -21,6 +21,9 @@ default:cn: Modify Group membership default:description: Modify Group membership default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX +dn: cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX +add:member: 'cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX' + dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX default:objectClass: groupofnames default:objectClass: nestedgroup diff --git a/install/updates/55-pbacmemberof.update b/install/updates/55-pbacmemberof.update new file mode 100644 index 000000000..bc17f5664 --- /dev/null +++ b/install/updates/55-pbacmemberof.update @@ -0,0 +1,10 @@ +# +# This needs to come later in the cycle otherwise the DN sorting is going +# to cause it to execute before the member attributes are added +dn: cn=Update PBAC memberOf $TIME, cn=memberof task, cn=tasks, cn=config +add: objectClass: top +add: objectClass: extensibleObject +add: cn: IPA PBAC memberOf $TIME +add: basedn: 'cn=privileges,cn=pbac,$SUFFIX' +add: filter: (objectclass=*) +add: ttl: 10 diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am index 71d699fd5..40e8e26d0 100644 --- a/install/updates/Makefile.am +++ b/install/updates/Makefile.am @@ -26,6 +26,7 @@ app_DATA = \ 50-groupuuid.update \ 50-hbacservice.update \ 50-nis.update \ + 55-pbacmemberof.update \ $(NULL) EXTRA_DIST = \ -- cgit