From 49abbb1ead9807e67bf8e9f8eae29162549eafe7 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 4 Jun 2014 17:39:10 +0200 Subject: Convert HBAC Service default permissions to managed Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek --- ACI.txt | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'ACI.txt') diff --git a/ACI.txt b/ACI.txt index 5069d996d..33c431bd6 100644 --- a/ACI.txt +++ b/ACI.txt @@ -62,6 +62,10 @@ dn: cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "accessruletype || accesstime || cn || description || hostcategory || ipaenabledflag || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Modify HBAC Rule";allow (write) groupdn = "ldap:///cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Read HBAC Rules,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "accessruletype || accesstime || cn || description || externalhost || hostcategory || ipaenabledflag || ipauniqueid || member || memberhost || memberservice || memberuser || objectclass || servicecategory || sourcehost || sourcehostcategory || usercategory")(targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Read HBAC Rules";allow (compare,read,search) userdn = "ldap:///all";) +dn: cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example +aci: (targetfilter = "(objectclass=ipahbacservice)")(version 3.0;acl "permission:System: Add HBAC Services";allow (add) groupdn = "ldap:///cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example +aci: (targetfilter = "(objectclass=ipahbacservice)")(version 3.0;acl "permission:System: Delete HBAC Services";allow (delete) groupdn = "ldap:///cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Read HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "cn || description || ipauniqueid || memberof || objectclass")(targetfilter = "(objectclass=ipahbacservice)")(version 3.0;acl "permission:System: Read HBAC Services";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=System: Read HBAC Service Groups,cn=permissions,cn=pbac,dc=ipa,dc=example -- cgit