On Thu, 15 Dec 2011, Rob Crittenden wrote: > >If this is acceptable, I can do refactoring in a different ticket. > > NACK. > > We still have the value passed in by the user, right (in > options['user'] and options['group'])? We basically take that, > create a DN out of it, then pull the same value out. Why not skip > all that and just look at the raw values instead? > > Or there is already a helper to get the key out of a dn, see > self.Object.user.get_primary_key_from_dn(str(group)) > > Also, I found this doesn't handle a list of users or groups. If you > pass in --users=joe,all then both get added as external users > (assuming joe doesn't already exist, of course). Refactored the patch using original values from options[]:
$ ipa sudorule-add-runasuser testr --group=all ipa: ERROR: invalid 'runas-user': RunAsUser does not accept 'all' as a group name $ ipa sudorule-add-runasuser testr --group=admins,all ipa: ERROR: invalid 'runas-user': RunAsUser does not accept 'all' as a group name $ ipa sudorule-add-runasuser testr --user=admin,all ipa: ERROR: invalid 'runas-user': RunAsUser does not accept 'all' as a user name $ ipa sudorule-add-runasgroup testr --group=admin,all ipa: ERROR: invalid 'runas-group': RunAsGroup does not accept 'all' as a group name Accepts a single value or a list. This is a patch against master (should apply to ipa-2-2 w/o issues). -- / Alexander Bokovoy
>From 9b11875d84b341220e299560671551d3c538f20a Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy <[email protected]> Date: Mon, 14 Nov 2011 11:23:19 +0200 Subject: [PATCH] Validate sudo RunAsUser/RunAsGroup arguments FreeIPA SUDO rules use --usercat/--groupcat to specify that rule applies to all users or groups. Thus, sudorule-add-runasuser and sudorule-add-runasgroup accept specific groups and users and do not accept ALL reserved word. The patch validates user and group passed to these commands and reports appropriate errors when these are ALL. Ticket #1496 https://fedorahosted.org/freeipa/ticket/1496 --- ipalib/plugins/sudorule.py | 39 ++++++++++++++++++++++++++++++++++++++- 1 files changed, 38 insertions(+), 1 deletions(-) diff --git a/ipalib/plugins/sudorule.py b/ipalib/plugins/sudorule.py index 93ca03f0170d922b91eff45ec2f42871336973f1..65a1d8541cd52c89e7fcb7b70adccf73490bdcbc 100644 --- a/ipalib/plugins/sudorule.py +++ b/ipalib/plugins/sudorule.py @@ -472,13 +472,34 @@ class sudorule_remove_host(LDAPRemoveMember): api.register(sudorule_remove_host) - class sudorule_add_runasuser(LDAPAddMember): __doc__ = _('Add users and groups for Sudo to execute as.') member_attributes = ['ipasudorunas'] member_count_out = ('%i object added.', '%i objects added.') + def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): + def check_validity(runas): + v = unicode(runas) + if v.upper() == u'ALL': + return False + return True + + if 'user' in options: + for name in options['user']: + if not check_validity(name): + raise errors.ValidationError(name='runas-user', + error=unicode(_("RunAsUser does not accept '%(name)s' as a user name")) % + dict(name=name)) + if 'group' in options: + for name in options['group']: + if not check_validity(name): + raise errors.ValidationError(name='runas-user', + error=unicode(_("RunAsUser does not accept '%(name)s' as a group name")) % + dict(name=name)) + + return dn + def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): completed_external = 0 # Sift through the user failures. We assume that these are all @@ -547,6 +568,22 @@ class sudorule_add_runasgroup(LDAPAddMember): member_attributes = ['ipasudorunasgroup'] member_count_out = ('%i object added.', '%i objects added.') + def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): + def check_validity(runas): + v = unicode(runas) + if v.upper() == u'ALL': + return False + return True + + if 'group' in options: + for name in options['group']: + if not check_validity(name): + raise errors.ValidationError(name='runas-group', + error=unicode(_("RunAsGroup does not accept '%(name)s' as a group name")) % + dict(name=name)) + + return dn + def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): completed_external = 0 # Sift through the group failures. We assume that these are all -- 1.7.8.2
_______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
