Skip to content
Snippets Groups Projects
Commit 22f31d02 authored by Rafael Guterres Jeffman's avatar Rafael Guterres Jeffman
Browse files

sudorule: Fix runas with external users and groups. 

When setting 'runasuser' or 'runasgroup' for a sudorule, either IPA or
external users and groups can be used, but only IPA users and groups
were being searched for when modifying the attributes, making this task
not idempotent if an external group or user was used..

This patch fixes this issue by comparing users and groups to the IPA
and external setting.

The IPA CLI commands are slightly confusing, as the sudorule-add and
sudorule-mod display separate options for internal and external users
and groups, but these options are deprecated and do not work anymore,
in favor of sudorule-add-runasuser and sudorule-add-runasgroup, which
don't diferentiate between internal and external users, from the CLI
user perspective.
parent 17dd8e4e
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
plugins/modules/ipasudorule.py
+ 83
− 13
View file @ 22f31d02
...@@ -456,11 +456,31 @@ def main(): ...@@ -456,11 +456,31 @@ def main():
sudooption_add, sudooption_del = gen_add_del_lists( sudooption_add, sudooption_del = gen_add_del_lists(
sudooption, res_find.get('ipasudoopt', [])) sudooption, res_find.get('ipasudoopt', []))
# runasuser attribute can be used with both IPA and
# non-IPA (external) users. IPA will handle the correct
# attribute to properly store data, so we need to compare
# the provided list against both users and external
# users list.
runasuser_add, runasuser_del = gen_add_del_lists( runasuser_add, runasuser_del = gen_add_del_lists(
runasuser, res_find.get('ipasudorunas_user', [])) runasuser,
(
res_find.get('ipasudorunas_user', [])
+ res_find.get('ipasudorunasextuser', [])
)
)
# runasgroup attribute can be used with both IPA and
# non-IPA (external) groups. IPA will handle the correct
# attribute to properly store data, so we need to compare
# the provided list against both groups and external
# groups list.
runasgroup_add, runasgroup_del = gen_add_del_lists( runasgroup_add, runasgroup_del = gen_add_del_lists(
runasgroup, res_find.get('ipasudorunas_group', [])) runasgroup,
(
res_find.get('ipasudorunas_group', [])
+ res_find.get('ipasudorunasextgroup', [])
)
)
# Add hosts and hostgroups # Add hosts and hostgroups
if len(host_add) > 0 or len(hostgroup_add) > 0: if len(host_add) > 0 or len(hostgroup_add) > 0:
...@@ -593,14 +613,38 @@ def main(): ...@@ -593,14 +613,38 @@ def main():
"ipasudoopt" in res_find: "ipasudoopt" in res_find:
sudooption = gen_add_list( sudooption = gen_add_list(
sudooption, res_find["ipasudoopt"]) sudooption, res_find["ipasudoopt"])
if runasuser is not None and \ # runasuser attribute can be used with both IPA and
"ipasudorunas_user" in res_find: # non-IPA (external) users, so we need to compare
# the provided list against both users and external
# users list.
if (
runasuser is not None
and (
"ipasudorunas_user" in res_find
or "ipasudorunasextuser" in res_find
)
):
runasuser = gen_add_list( runasuser = gen_add_list(
runasuser, res_find["ipasudorunas_user"]) runasuser,
if runasgroup is not None and \ (list(res_find.get('ipasudorunas_user', []))
"ipasudorunasgroup_group" in res_find: + list(res_find.get('ipasudorunasextuser', [])))
)
# runasgroup attribute can be used with both IPA and
# non-IPA (external) groups, so we need to compare
# the provided list against both users and external
# groups list.
if (
runasgroup is not None
and (
"ipasudorunasgroup_group" in res_find
or "ipasudorunasextgroup" in res_find
)
):
runasgroup = gen_add_list( runasgroup = gen_add_list(
runasgroup, res_find["ipasudorunasgroup_group"]) runasgroup,
(list(res_find.get("ipasudorunasgroup_group", []))
+ list(res_find.get("ipasudorunasextgroup", [])))
)
# Add hosts and hostgroups # Add hosts and hostgroups
if host is not None or hostgroup is not None: if host is not None or hostgroup is not None:
...@@ -724,17 +768,43 @@ def main(): ...@@ -724,17 +768,43 @@ def main():
sudooption, res_find["ipasudoopt"]) sudooption, res_find["ipasudoopt"])
else: else:
sudooption = None sudooption = None
# runasuser attribute can be used with both IPA and
# non-IPA (external) users, so we need to compare
# the provided list against both users and external
# users list.
if runasuser is not None: if runasuser is not None:
if "ipasudorunas_user" in res_find: if (
"ipasudorunas_user" in res_find
or "ipasudorunasextuser" in res_find
):
runasuser = gen_intersection_list( runasuser = gen_intersection_list(
runasuser, res_find["ipasudorunas_user"]) runasuser,
(
list(res_find.get('ipasudorunas_user', []))
+ list(res_find.get(
'ipasudorunasextuser', []))
)
)
else: else:
runasuser = None runasuser = None
# runasgroup attribute can be used with both IPA and
# non-IPA (external) groups, so we need to compare
# the provided list against both groups and external
# groups list.
if runasgroup is not None: if runasgroup is not None:
if "ipasudorunasgroup_group" in res_find: if (
"ipasudorunasgroup_group" in res_find
or "ipasudorunasextgroup" in res_find
):
runasgroup = gen_intersection_list( runasgroup = gen_intersection_list(
runasgroup, runasgroup,
res_find["ipasudorunasgroup_group"]) (
list(res_find.get(
"ipasudorunasgroup_group", []))
+ list(res_find.get(
"ipasudorunasextgroup", []))
)
)
else: else:
runasgroup = None runasgroup = None
......
tests/sudorule/test_sudorule.yml
+ 130
− 0
View file @ 22f31d02
...@@ -73,6 +73,7 @@ ...@@ -73,6 +73,7 @@
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}" ipaapi_context: "{{ ipa_context | default(omit) }}"
name: name:
- test_upstream_issue_664
- testrule1 - testrule1
- allusers - allusers
- allhosts - allhosts
...@@ -755,6 +756,134 @@ ...@@ -755,6 +756,134 @@
register: result register: result
failed_when: result.changed or result.failed failed_when: result.changed or result.failed
- name: Ensure sudorule with external user in 'runasuser' is present
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule with external user in 'runasuser' is present, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule member external user in 'runasuser' is absent
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
action: member
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule member external user in 'runasuser' is absent, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
action: member
state: absent
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule member external user in 'runasuser' is present
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
action: member
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule member external user in 'runasuser' is present, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasuser:
- apache
action: member
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule with external group in 'runasgroup' is present
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule with external group in 'runasgroup' user is present, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule member external group in 'runasgroup' is absent
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
action: member
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule member external group in 'runasgroup' is absent, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
action: member
state: absent
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule member external group in 'runasgroup' is present
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
action: member
register: result
failed_when: not result.changed or result.failed
- name: Ensure sudorule member external group in 'runasgroup' is present, again
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
runasgroup:
- wheel
action: member
register: result
failed_when: result.changed or result.failed
- name: Ensure sudorule 'test_upstream_issue_664' is absent
ipasudorule:
ipaadmin_password: SomeADMINpassword
name: test_upstream_issue_664
state: absent
register: result
failed_when: not result.changed or result.failed
# cleanup # cleanup
- name: Ensure sudocmdgroup is absent - name: Ensure sudocmdgroup is absent
ipasudocmdgroup: ipasudocmdgroup:
...@@ -777,6 +906,7 @@ ...@@ -777,6 +906,7 @@
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}" ipaapi_context: "{{ ipa_context | default(omit) }}"
name: name:
- test_upstream_issue_664
- testrule1 - testrule1
- allusers - allusers
- allhosts - allhosts
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment