Issue #7649: error shown when options are added to an existing sudo rule - freeipa

freeipa

#7649 error shown when options are added to an existing sudo rule

Closed: fixed 5 years ago Opened 5 years ago by tscherf.

Issue

When I add a SELinux type and/or role options to an existing sudo rule, an error is shown. Here is how to reproduce the issue:

Create a hostgroup called 'webservers' and a user group called 'sysadmin' with at least a single host and user as a member.
Create the hbac rule:

$ ipa hbacrule-add sysadmin_webservers                                             
$ ipa hbacrule-add-host sysadmin_webservers --hostgroup webservers                 
$ ipa hbacrule-add-user sysadmin_webservers --group sysadmin                       
$ ipa hbacrule-mod sysadmin_webservers --servicecat=all

Create a sudo rule:

$ ipa sudorule-add sysadmin_sudo --hostcat=all --runasusercat=all --runasgroupcat=all --cmdcat=all
$ ipa sudorule-add-user sysadmin_sudo --group sysadmin

Create a SELinux map rule:

$ ipa selinuxusermap-add sysadmin_staff_t --hbacrule sysadmin_webservers --selinuxuser staff_u:s0-s0:c0.c1023

Modify the sudo rule to add SELinux related options:

$ ipa sudorule-add-option sysadmin_sudo --sudooption type=unconfined_t             
-------------------------------------------------------------                      
Added option "type=unconfined_t" to Sudo Rule "sysadmin_sudo"                      
-------------------------------------------------------------                      
  Rule name: sysadmin_sudo                                                         
  Enabled: TRUE                                                                    
  Host category: all                                                               
  Command category: all                                                            
  RunAs User category: all                                                         
  RunAs Group category: all                                                        
  Sudo Option: type=unconfined_t                                                   
  Failed users/groups: cn=sysadmin,cn=groups,cn=accounts,dc=ipademo,dc=local

It's not expected to see the last 'Failed users/groups` error message.

No error is shown when the sudo rule is listed:

$ ipa sudorule-show sysadmin_sudo                                                  
  Rule name: sysadmin_sudo                                                         
  Enabled: TRUE                                                                    
  Host category: all                                                               
  Command category: all                                                            
  RunAs User category: all                                                         
  RunAs Group category: all                                                        
  User Groups: sysadmin                                                            
  Sudo Option: type=unconfined_t

$ rpm -q freeipa-server
freeipa-server-4.6.90.pre2-3.fc28.x86_64