Re: [389-devel] Design review: Access control on entries specified in MODDN operation (ticket 47553)
by Noriko Hosoi
Rich Megginson wrote:
> On 02/24/2014 09:00 AM, thierry bordaz wrote:
>> Hello,
>>
>> IPA team filled this ticket
>> https://fedorahosted.org/389/ticket/47553.
>>
>> It requires an ACI improvement so that during a MODDN a given
>> user is only allowed to move an entry from one specified part of
>> the DIT to an other specified part of the DIT. This without the
>> need to grant the ADD permission.
>>
>> Here is the design of what could be implemented to support this
>> need
>> http://port389.org/wiki/Access_control_on_trees_specified_in_MODDN_operation
>>
>> regards
>> thierry
>>
>
> Since this not related to any Red Hat internal or customer
> information, we should move this discussion to the 389-devel list.
>
Hi Thierry,
Your design looks good. A minor question. The doc does not mention
about "deny". For instance, in your example DIT, can I allow "moddn_to"
and "moddn_from" on the top "dc=example,dc=com" and deny them on
"cn=tests". Then, I can move an entry between cn=accounts and staging,
but not to/from cn=tests? Or "deny" is not supposed to use there?
Thanks,
--noriko
9 years
portability issue: scripts expecting /bin/sh to be bash
by Timo Aaltonen
Hi
I noticed that some shell scripts have bashisms in them, on Debian and
it's derivatives /bin/sh is dash. A quick list of scripts shipped by
389-ds-base having this issue:
monitor
ldif2db
ldif2ldap
db2bak
vlvindex
dn2rdn
restoreconfig
saveconfig
upgradedb
suffix2instance
dbverify
but since I just ran all the scripts without any options, there might be
others too that fail with "unexpected operator" errors etc when ran in a
real environment. So maybe change all of them to use /bin/bash or
migrate them to be posix compatible (and somehow test new ones for
compliance)?
--
t
9 years
Please review lib389: various fixes
by thierry bordaz
fixes are:
* support of setProperties for plugins
* add a wait timeout to task completion
commit c01618821f25e6caf3b28e3e08b5a1e097954581
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Tue Feb 25 19:01:40 2014 +0100
Support of setProperties for plugins
diff --git a/lib389/plugins.py b/lib389/plugins.py
index 5e847c7..e591398 100644
--- a/lib389/plugins.py
+++ b/lib389/plugins.py
@@ -50,6 +50,41 @@ class Plugins(object):
ents = self.conn.search_s(base, scope, filt)
return ents
+ def setProperties(self, plugin_dn=None, properties=None):
+ # No properties provided
+ if len(properties) == 0:
+ return
+
+ # check that the given properties are valid
+ for prop in properties:
+ # skip the prefix to add/del value
+ if not inProperties(prop, PLUGIN_PROPNAME_TO_ATTRNAME):
+ raise ValueError("unknown property: %s" % prop)
+ else:
+ self.log.debug("setProperties: %s:%s" % (prop,
properties[prop]))
+
+ # At least we need to have plugin_dn
+ if not plugin_dn:
+ raise InvalidArgumentError("plugin_dn are missing")
+
+
+ # build the MODS
+ mods = []
+ for prop in properties:
+ # take the operation type from the property name
+ val = rawProperty(prop)
+ if str(prop).startswith('+'):
+ op = ldap.MOD_ADD
+ elif str(prop).startswith('-'):
+ op = ldap.MOD_DELETE
+ else:
+ op = ldap.MOD_REPLACE
+
+ mods.append((op, PLUGIN_PROPNAME_TO_ATTRNAME[val],
properties[prop]))
+
+ # that is fine now to apply the MOD
+ self.conn.modify_s(plugin_dn, mods)
+
def enable(self, name=None, plugin_dn=None):
'''
Enable a plugin
diff --git a/lib389/properties.py b/lib389/properties.py
index 2cf2dec..13ea1ec 100644
--- a/lib389/properties.py
+++ b/lib389/properties.py
@@ -226,6 +226,7 @@ RA_PROPNAME_TO_ATTRNAME = {RA_NAME:
'cn',
PLUGIN_NAME = "name"
PLUGIN_PATH = "path"
PLUGIN_ENABLE = 'enable'
+PLUGIN_PRECEDENCE = 'precedence'
PLUGINS_OBJECTCLASS_VALUE = "nsSlapdPlugin"
PLUGINS_ENABLE_ON_VALUE = "on"
@@ -233,7 +234,8 @@ PLUGINS_ENABLE_OFF_VALUE = "off"
PLUGIN_PROPNAME_TO_ATTRNAME = {PLUGIN_NAME: 'cn',
PLUGIN_PATH: 'nsslapd-pluginPath',
- PLUGIN_ENABLE: 'nsslapd-pluginEnabled'}
+ PLUGIN_ENABLE: 'nsslapd-pluginEnabled',
+ PLUGIN_PRECEDENCE:
'nsslapd-pluginprecedence'}
####################################
#
commit 60ef8a844ae24a1d996612c1b544e9414c527bea
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Tue Feb 18 11:27:01 2014 +0100
Add timeout to CheckTask
diff --git a/lib389/properties.py b/lib389/properties.py
index 73bfd29..2cf2dec 100644
--- a/lib389/properties.py
+++ b/lib389/properties.py
@@ -254,7 +254,8 @@ INDEX_PROPNAME_TO_ATTRNAME = {INDEX_TYPE: 'nsIndexType',
#
####################################
-TASK_WAIT = "wait"
+TASK_WAIT = "task-wait"
+TASK_TIMEOUT = "task-timeout"
EXPORT_REPL_INFO = "repl-info"
diff --git a/lib389/tasks.py b/lib389/tasks.py
index f61f935..6edf9ce 100644
--- a/lib389/tasks.py
+++ b/lib389/tasks.py
@@ -21,7 +21,7 @@ class Tasks(object):
if name in Tasks.proxied_methods:
return DirSrv.__getattr__(self.conn, name)
- def checkTask(self, entry, dowait=False):
+ def checkTask(self, entry, dowait=False, timeout=0):
'''check task status - task is complete when the
nsTaskExitCode attr is set
return a 2 tuple (true/false,code) first is false if task is
running, true if
done - if true, second is the exit code - if dowait is True,
this function
@@ -31,6 +31,7 @@ class Tasks(object):
done = False
exitCode = 0
dn = entry.dn
+ count_down = timeout
while not done:
entry = self.conn.getEntry(dn, attrlist=attrlist)
self.log.debug("task entry %r" % entry)
@@ -40,6 +41,14 @@ class Tasks(object):
done = True
if dowait:
time.sleep(1)
+ count_down -= 1
+ if timeout > 0:
+ if count_down == 0:
+ self.log.error("Task did no complete in %d sec.
Break" % timeout)
+ exitCode = -1
+ break
+ else:
+ self.log.info("Task has not completed yet.
Still %d sec to wait" % count_down)
else:
break
return (done, exitCode)
@@ -221,7 +230,8 @@ class Tasks(object):
exitCode = 0
if args and args.get(TASK_WAIT, False):
- (done, exitCode) = self.conn.tasks.checkTask(entry, True)
+ timeout = args.get(TASK_TIMEOUT, 0)
+ (done, exitCode) = self.conn.tasks.checkTask(entry,
dowait=True, timeout=timeout)
if exitCode:
self.log.error("Error: index task %s exited with %d" % (
9 years