The change_password permission was too broad, limit it to users.

The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin.

ticket 628

rob
>From bff0d00e44465d70f6a954cf88329404dbca16fd Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Fri, 17 Dec 2010 15:04:47 -0500
Subject: [PATCH] Fix the change_password permissions and the DNS access controls.

The change_password permission was too broad, limit it to users.

The DNS access controls rolled everything into a single ACI. I broke
it out into separate ACIs for add, delete and add. I also added a new
dns type for the permission plugin.

ticket 628
---
 install/share/delegation.ldif |    2 +-
 install/share/dns.ldif        |   32 ++++++++++++++++++++++++++++----
 ipalib/plugins/aci.py         |    3 ++-
 ipalib/plugins/permission.py  |    2 +-
 4 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif
index 7881a02..d87b6c2 100644
--- a/install/share/delegation.ldif
+++ b/install/share/delegation.ldif
@@ -493,7 +493,7 @@ dn: $SUFFIX
 changetype: modify
 add: aci
 aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX";)(version 3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=permissions,cn=accounts,$SUFFIX";;)
-aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";;)
+aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX";)(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";;)
 aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX";)(version 3.0;acl "Add user to default group";allow (write) groupdn = "ldap:///cn=add_user_to_default_group,cn=permissions,cn=accounts,$SUFFIX";;)
 aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX";)(version 3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=permissions,cn=accounts,$SUFFIX";;)
 aci: (targetattr = "givenName || sn || cn || displayName || title || initials || loginShell || gecos || homePhone || mobile || pager || facsimileTelephoneNumber || telephoneNumber || street || roomNumber || l || st || postalCode || manager || secretary || description || carLicense || labeledURI || inetUserHTTPURL || seeAlso || employeeType || businessCategory || ou || mepManagedEntry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX";)(version 3.0;acl "Modify Users";allow (write) groupdn = "ldap:///cn=modifyusers,cn=permissions,cn=accounts,$SUFFIX";;)
diff --git a/install/share/dns.ldif b/install/share/dns.ldif
index da58955..f9ea495 100644
--- a/install/share/dns.ldif
+++ b/install/share/dns.ldif
@@ -3,17 +3,41 @@ changetype: add
 objectClass: nsContainer
 objectClass: top
 cn: dns
-aci: (targetfilter = "(objectClass=idnsRecord)")(targetattr != "aci")(version 3.0; acl "DNS Servers Updates"; allow (add,write,delete) groupdn = "ldap:///cn=update_dns,cn=permissions,cn=accounts,$SUFFIX";;)
 
-dn: cn=update_dns,cn=permissions,cn=accounts,$SUFFIX
+dn: cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX
 changetype: add
+objectClass: groupofnames
 objectClass: top
+cn: add dns entries
+description: Add DNS entries
+member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
+member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
+
+dn: cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX
+changetype: add
 objectClass: groupofnames
-cn: update_dns
-description: DNS Servers Updates
+objectClass: top
+cn: remove dns entries
+description: Remove DNS entries
 member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
 member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
 
+dn: cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX
+changetype: add
+objectClass: groupofnames
+objectClass: top
+cn: update dns entries
+description: Update DNS entries
+member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
+member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
+
+dn: $SUFFIX
+changetype: modify
+add: aci
+aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX";)(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX";)
+aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX";)(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX";)
+aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX";)(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX";)
+
 dn: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
 changetype: add
 objectClass: top
diff --git a/ipalib/plugins/aci.py b/ipalib/plugins/aci.py
index 5a57a30..1dcba92 100644
--- a/ipalib/plugins/aci.py
+++ b/ipalib/plugins/aci.py
@@ -135,6 +135,7 @@ _type_map = {
     'hostgroup': 'ldap:///cn=*,%s,%s' % (api.env.container_hostgroup, api.env.basedn),
     'service': 'ldap:///krbprincipalname=*,%s,%s' % (api.env.container_service, api.env.basedn),
     'netgroup': 'ldap:///ipauniqueid=*,%s,%s' % (api.env.container_netgroup, api.env.basedn),
+    'dns': 'ldap:///idnsname=*,%s,%s' % (api.env.container_dns, api.env.basedn),
 }
 
 _valid_permissions_values = [
@@ -378,7 +379,7 @@ class aci(Object):
             cli_name='type',
             label=_('Type'),
             doc=_('type of IPA object (user, group, host, hostgroup, service, netgroup)'),
-            values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup'),
+            values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup', u'dns',),
         ),
         Str('memberof?',
             cli_name='memberof',
diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py
index 18dd577..0587564 100644
--- a/ipalib/plugins/permission.py
+++ b/ipalib/plugins/permission.py
@@ -120,7 +120,7 @@ class permission(LDAPObject):
             cli_name='type',
             label=_('Type'),
             doc=_('Type of IPA object (user, group, host, hostgroup, service, netgroup)'),
-            values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup'),
+            values=(u'user', u'group', u'host', u'service', u'hostgroup', u'netgroup', u'dns',),
         ),
         Str('memberof?',
             cli_name='memberof',
-- 
1.7.2.1

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to