freeipa

#4340 Let deny commands be added to sudo rule with cmdcatetory=ALL
Closed: Fixed Opened by rcritten.

Closed: Fixed
Reopen Issue

One may want to allow all commands except a certain subset, like su and a set of shells.

This is currently not allowed.

Starting review

Patch is already on review - Tomas forgot to switch the flag.

pushed to master as part of sudorule enhancements:

  • 5a1207cb6ee6dd4314ae95e6637ee6859d5fda1a sudorule: PEP8 fixes in sudorule.py
  • a228d7a3cb32b14ff24b47adb14d896d317f6312 sudorule: Allow using hostmasks for setting allowed hosts
  • 9304b649a32c57e80f53913d7fbdee92fd76a251 sudorule: Allow using external groups as groups of runAsUsers
  • 3a56b155e80a744c7a924915aae954e0a3d81e9e sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute
  • c7da22c1e69cb4d6cc8c6f368aad5ffddbd3762c sudorule: Include externalhost and ipasudorunasextgroup in the list of default attributes
  • fix: af2eb4d69506b641504d076e79b80c7ee54eeda9 sudorule: Allow adding deny commands when command category set to ALL
  • 9bb88a15e0297e3a3e8e713267bc399164e0cdd6 sudorule: Make sure all the relevant attributes are checked when setting category to ALL
  • a1d6c9ab6b710076902c1dd8ffcdec96b2538c21 sudorule: Fix the order of the parameters to have less chaotic output
  • b1275c5b1c2038c9769377e9cf0afe04139d1d8d sudorule: Enforce category ALL checks on dirsrv level
  • d537da8b8a52dde18f4d07455fef8a4ef1c4ef04 ipatests: test_sudo: Add tests for allowing hosts via hostmasks
  • c50d190549ff56c35d2dac270f319d764c972113 ipatests: test_sudo: Add coverage for external entries
  • ec2050b7dfa94ef5ce41172a98c9153c14d4c972 ipatests: test_sudo: Add coverage for category ALL validation
  • e0fd2695ca3c1c2df8bbecadd4597ccf0aeca004 ipatests: test_sudo: Fix assertions not assuming runasgroupcat set to ALL
  • 701f1fc8ba8fa2cbde6c16b031793d0069fddd33 ipatests: test_sudo: Do not expect enumeration of runasuser groups
  • e7969f5af56be1b9163a8f9ee4686becb3fdcb59 ipatests: test_sudo: Expect root listed out if no RunAsUser available
  • af4518b72882f88a01de0e5c23d423898ba894b4 sudorule: Refactor add and remove external_post_callback

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1113919

Metadata Update from @rcritten:
- Issue assigned to tbabej
- Issue set to the milestone: FreeIPA 4.0 - 2014/06
Metadata
None
None
None
Normal
defect
IPA
1
pviktori
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.