Ñò
Ã#xPc @ sª d d k l Z l Z d d k l Z l Z l Z d d k Td d k l Z d d k l Z l
Z
e d ƒ Z d e d ƒ f Z d „ Z
d
„ Z d „ Z d „ Z d
e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e! f d „ ƒ YZ" e i e" ƒ d e# f d „ ƒ YZ$ e i e$ ƒ d! e! f d" „ ƒ YZ% e i e% ƒ d# e# f d$ „ ƒ YZ& e i e& ƒ d% e! f d& „ ƒ YZ' e i e' ƒ d' e# f d( „ ƒ YZ( e i e( ƒ d) e! f d* „ ƒ YZ) e i e) ƒ d+ e# f d, „ ƒ YZ* e i e* ƒ d- e! f d. „ ƒ YZ+ e i e+ ƒ d/ e# f d0 „ ƒ YZ, e i e, ƒ d1 e! f d2 „ ƒ YZ- e i e- ƒ d3 e# f d4 „ ƒ YZ. e i e. ƒ d5 e f d6 „ ƒ YZ/ e i e/ ƒ d7 e f d8 „ ƒ YZ0 e i e0 ƒ d9 S(: iÿÿÿÿ( t apit errors( t Strt StrEnumt Bool( t *( t is_all( t _t ngettextsv
Sudo Rules
Sudo (su "do") allows a system administrator to delegate authority to
give certain users (or groups of users) the ability to run some (or all)
commands as root or another user while providing an audit trail of the
commands and their arguments.
FreeIPA provides a means to configure the various aspects of Sudo:
Users: The user(s)/group(s) allowed to invoke Sudo.
Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
Allow Command: The specific command(s) permitted to be run via Sudo.
Deny Command: The specific command(s) prohibited to be run via Sudo.
RunAsUser: The user(s) or group(s) of users whose rights Sudo will be invoked with.
RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.
Options: The various Sudoers Options that can modify Sudo's behavior.
An order can be added to a sudorule to control the order in which they
are evaluated (if the client supports it). This order is an integer and
must be unique.
FreeIPA provides a designated binddn to use with Sudo located at:
uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
To enable the binddn run the following command to set the password:
LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
For more information, see the FreeIPA Documentation to Sudo.
t sudos+ Commands for controlling sudo configurationc C s" t i d | d t d ƒ ƒ ‚ d S( Nt namet errors this option has been deprecated.( R t ValidationErrorR ( t attribute( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt
deprecated< s c C s t d ƒ d S( Nt externaluser( R ( t ugettextt value( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt validate_externaluser? s c C s t d ƒ d S( Nt runasexternaluser( R ( R R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt validate_runasextuserB s c C s t d ƒ d S( Nt runasexternalgroup( R ( R R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt validate_runasextgroupE s t sudorulec ! B sÊ e Z d Z e i i Z e d ƒ Z e d ƒ Z d d g Z
d d d d d d
d d d
d d d d d d d d g Z d Z d Z
h d d g d 6d d g d
6d d g d 6d d g d 6d d g d 6d g d 6Z e d ƒ Z e d ƒ Z e d d d d! e d" ƒ d# e ƒe d$ d d% d! e d& ƒ ƒe d' d! e d( ƒ d) d* g ƒe d+ d d, d! e d- ƒ d. e d/ ƒ d0 dt ƒe d2 d d3 d! e d4 ƒ d. e d5 ƒ d0 du ƒe d6 d d7 d! e d8 ƒ d. e d9 ƒ d0 dv ƒe d: d d; d! e d< ƒ d. e d= ƒ d0 dw ƒe d> d d? d! e d@ ƒ d. e dA ƒ d0 dx ƒe dB d dC d! e dD ƒ d. e dE ƒ dF dG dH dG ƒe dI d! e dJ ƒ d) dK dL dM g ƒe dN d! e dO ƒ d) dK dL dM g ƒe dP d! e dQ ƒ d) dK dL dM g ƒe dR d! e dS ƒ d) dK dL dM g ƒe dT d! e dU ƒ d) dK dL dM g ƒe dV d! e dW ƒ d) dK dL dM g ƒe dX d! e dY ƒ d) dK dL dM g ƒe dZ d! e d[ ƒ d) dK dL dM g ƒe d\ d! e d] ƒ d. e d^ ƒ d) dK dL dM g ƒe d_ d! e d` ƒ d. e da ƒ d) dK dL dM g ƒe db e d d d! e dc ƒ d. e dd ƒ ƒe de e d df d! e dg ƒ d. e dh ƒ ƒe di e d dj d! e dk ƒ d. e dl ƒ ƒe dm d! e dn ƒ d) dK dL dM g ƒe do d! e dp ƒ d. e dq ƒ d) dK dL dM g ƒe f Z e dr ƒ Z ds „ Z RS(y s
Sudo Rule object.
s sudo rules
sudo rulest ipaassociationt ipasudorulet cnt ipaenabledflagR t descriptiont usercategoryt hostcategoryt cmdcategoryt
memberusert
memberhostt memberallowcmdt
memberdenycmdt
ipasudooptt ipasudorunast ipasudorunasgroupt ipasudorunasusercategoryt ipasudorunasgroupcategoryt sudoordert ipauniqueidt usert groupt hostt hostgroupt sudocmdt sudocmdgroups
Sudo Ruless Sudo Rulet cli_namet
sudorule_namet labels Rule namet primary_keys description?t desct Descriptions ipaenabledflag?t Enabledt flagst no_options
usercategory?t usercats
User categoryt docs! User category the rule applies tot valuesu alls
hostcategory?t hostcats
Host categorys! Host category the rule applies tos cmdcategory?t cmdcats Command categorys$ Command category the rule applies tos ipasudorunasusercategory?t runasusercats RunAs User categorys' RunAs User category the rule applies tos ipasudorunasgroupcategory?t
runasgroupcats RunAs Group categorys( RunAs Group category the rule applies tos
sudoorder?t orders
Sudo orders integer to order the Sudo rulest defaulti t minvalues memberuser_user?t Userst no_createt no_updatet no_searchs memberuser_group?s User Groupss memberhost_host?t Hostss memberhost_hostgroup?s Host Groupss memberallowcmd_sudocmd?s Sudo Allow Commandss memberdenycmd_sudocmd?s Sudo Deny Commandss memberallowcmd_sudocmdgroup?s Sudo Allow Command Groupss memberdenycmd_sudocmdgroup?s Sudo Deny Command Groupss ipasudorunas_user?s RunAs Userss
Run as a users ipasudorunas_group?s Groups of RunAs Userss( Run as any user within a specified groups
externaluser?s
External Users6 External User the rule applies to (sudorule-find only)s ipasudorunasextuser?R s RunAs External Users: External User the commands can run as (sudorule-find only)s ipasudorunasextgroup?R s RunAs External Groups; External Group the commands can run as (sudorule-find only)s ipasudoopt?s Sudo Options ipasudorunasgroup_group?s RunAs Groupss+ Run with the gid of a specified POSIX groupsA order must be a unique value (%(order)d already used by %(rule)s)c O sŒ d | j o{ | i i d | d ƒ d } t | ƒ d j oG | d d d } t i d d d | i h | d d 6| d 6ƒ ‚ qˆ n d S( NR) t resulti R R
RA R t rule( t methodst findt lenR R t order_not_unique_msg( t selft keyst optionst entriest rule_name( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt check_order_uniquenessã s
( u all( u all( u all( u all( u all( t __name__t
__module__t __doc__R t envt container_sudorulet container_dnR t object_namet object_name_pluralt object_classt default_attributest uuid_attributet
rdn_attributet attribute_membersR3 t label_singularR t TrueR R t IntR R R t external_host_paramt takes_paramsRN RT ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR H sî
t sudorule_addc B s) e Z e d ƒ Z d „ Z e d ƒ Z RS( s Create new Sudo Rule.c O s! | i i | | Ž d | d <| S( Nt TRUER ( t objRT ( RO t ldapt dnt entry_attrst
attrs_listRP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt pre_callbackø s
s Added Sudo Rule "%(value)s"( RU RV R RW Rn t msg_summary( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRg õ s t sudorule_delc B s e Z e d ƒ Z e d ƒ Z RS( s Delete Sudo Rule.s Deleted Sudo Rule "%(value)s"( RU RV R RW Ro ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRp s t sudorule_modc B s) e Z e d ƒ Z e d ƒ Z d „ Z RS( s Modify Sudo Rule.s Modified Sudo Rule "%(value)s"c O s d | j oŒ | i d ƒ } | i i i | d ƒ d } d | j o< t | d d ƒ } | | j o | i i | | Ž q• q™ | i i | | Ž n y" | i | | i i ƒ \ }
} Wn& t i
j
o | i i | Œ n Xt | d ƒ o) d | j o t i
d t d ƒ ƒ ‚ n t | d ƒ o) d
| j o t i
d t d ƒ ƒ ‚ n t | d ƒ o0 d
p d | j o t i
d t d ƒ ƒ ‚ n t | d ƒ o) d | j o t i
d t d ƒ ƒ ‚ n t | d ƒ o) d | j o t i
d t d ƒ ƒ ‚ n | S( NR) iÿÿÿÿRI i R R t reasonsB user category cannot be set to 'all' while there are allowed usersR R! sB host category cannot be set to 'all' while there are allowed hostsR R" t memberdenywcmdsN command category cannot be set to 'all' while there are allow or deny commandsR' R% s@ user runAs category cannot be set to 'all' while there are usersR( R& sB group runAs category cannot be set to 'all' while there are groups( t getR t Commandt
sudorule_showt intRi RT t get_entryR^ R t NotFoundt handle_not_foundR t MutuallyExclusiveErrorR ( RO Rj Rk Rl Rm RP RQ t new_ordert old_entryt old_ordert _dnt _entry_attrs( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn s0
"
( RU RV R RW Ro Rn ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRq s t
sudorule_findc B s& e Z e d ƒ Z e d d d ƒ Z RS( s Search for Sudo Rule.s %(count)d Sudo Rule matcheds %(count)d Sudo Rules matchedi ( RU RV R RW R Ro ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR 1 s Rv c B s e Z e d ƒ Z RS( s Display Sudo Rule.( RU RV R RW ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRv ; s t sudorule_enablec B s& e Z e d ƒ Z d „ Z d „ Z RS( s Enable a Sudo Rule.c C sŠ | i i } | i i | ƒ } h d d 6} y | i | | ƒ Wn; t i j
o n' t i j
o | i i | ƒ n Xt d t ƒ S( NRh R RI (
Ri t backendt get_dnt update_entryR t EmptyModlistRy Rz t dictRc ( RO R Rj Rk Rl ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt executeD s
c C s | i t d ƒ | ƒ d S( Ns Enabled Sudo Rule "%s"( t print_dashedR ( RO t textuiRI R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt output_for_cliS s ( RU RV R RW Rˆ R‹ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR‚ A s t sudorule_disablec B s& e Z e d ƒ Z d „ Z d „ Z RS( s Disable a Sudo Rule.c C sŠ | i i } | i i | ƒ } h d d 6} y | i | | ƒ Wn; t i j
o n' t i j
o | i i | ƒ n Xt d t ƒ S( Nt FALSER RI (
Ri Rƒ R„ R… R R† Ry Rz R‡ Rc ( RO R Rj Rk Rl ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRˆ \ s
c C s | i t d ƒ | ƒ d S( Ns Disabled Sudo Rule "%s"( R‰ R ( RO RŠ RI R ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR‹ k s ( RU RV R RW Rˆ R‹ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRŒ Y s t sudorule_add_allow_commandc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s; Add commands and sudo command groups affected by Sudo Rule.R" s %i object added.s %i objects added.c O s{ y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ o t i d t d ƒ ƒ ‚ n | S( NR Rr s4 commands cannot be added when command category='all'( Rx Ri R^ R Ry Rz R R{ R ( RO Rj Rk t foundt not_foundRP RQ R R€ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn w s " ( s %i object added.s %i objects added.( RU RV R RW t member_attributest member_count_outRn ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRŽ q s t sudorule_remove_allow_commandc B s# e Z e d ƒ Z d g Z d Z RS( s> Remove commands and sudo command groups affected by Sudo Rule.R" s %i object removed.s %i objects removed.( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR“ … s t sudorule_add_deny_commandc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s; Add commands and sudo command groups affected by Sudo Rule.R# s %i object added.s %i objects added.c O s{ y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ o t i d t d ƒ ƒ ‚ n | S( NR Rr s4 commands cannot be added when command category='all'( Rx Ri R^ R Ry Rz R R{ R ( RO Rj Rk R R RP RQ R R€ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn ” s " ( s %i object added.s %i objects added.( RU RV R RW R‘ R’ Rn ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR” Ž s t sudorule_remove_deny_commandc B s# e Z e d ƒ Z d g Z d Z RS( s> Remove commands and sudo command groups affected by Sudo Rule.R# s %i object removed.s %i objects removed.( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR• ¡ s t sudorule_add_userc B s5 e Z e d ƒ Z d g Z d Z d „ Z d „ Z RS( s+ Add users and groups affected by Sudo Rule.R s %i object added.s %i objects added.c O s y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ o t i d t d ƒ ƒ ‚ n t d | | | | ƒ S( NR Rr s. users cannot be added when user category='all'R+ (
Rx Ri R^ R Ry Rz R R{ R t add_external_pre_callback( RO Rj Rk R R RP RQ R R€ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn ° s " c O s% t d d d | | | | | | | ƒ
S( NR R+ R ( t add_external_post_callback( RO Rj t completedt failedRk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt
post_callbackº s ( s %i object added.s %i objects added.( RU RV R RW R‘ R’ Rn R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR– ª s
t sudorule_remove_userc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s. Remove users and groups affected by Sudo Rule.R s %i object removed.s %i objects removed.c O s% t d d d | | | | | | | ƒ
S( NR R+ R ( t remove_external_post_callback( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› Ç s ( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRœ Á s t sudorule_add_hostc B s5 e Z e d ƒ Z d g Z d Z d „ Z d „ Z RS( s/ Add hosts and hostgroups affected by Sudo Rule.R! s %i object added.s %i objects added.c O s y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ o t i d t d ƒ ƒ ‚ n t d | | | | ƒ S( NR Rr s. hosts cannot be added when host category='all'R- (
Rx Ri R^ R Ry Rz R R{ R R— ( RO Rj Rk R R RP RQ R R€ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn Ô s " c O s% t d d d | | | | | | | ƒ
S( NR! R- t externalhost( R˜ ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› Þ s ( s %i object added.s %i objects added.( RU RV R RW R‘ R’ Rn R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRž Î s
t sudorule_remove_hostc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s2 Remove hosts and hostgroups affected by Sudo Rule.R! s %i object removed.s %i objects removed.c O s% t d d d | | | | | | | ƒ
S( NR! R- RŸ ( R ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› ë s ( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR å s t sudorule_add_runasuserc B s5 e Z e d ƒ Z d g Z d Z d „ Z d „ Z RS( s, Add users and groups for Sudo to execute as.R% s %i object added.s %i objects added.c O sv d „ } y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ p t | d ƒ o t i d t d ƒ ƒ ‚ n d | j o[ xX | d D]H }
| |
ƒ p5 t i d d d t
t d
ƒ ƒ t d |
ƒ ƒ ‚ q¨ q¨ Wn d | j o[ xX | d D]H }
| |
ƒ p5 t i d d d t
t d ƒ ƒ t d |
ƒ ƒ ‚ qqWn t d | | | | ƒ S(
Nc S s( t | ƒ } | i ƒ d j o t St S( Nu ALL( t unicodet uppert FalseRc ( t runast v( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt check_validityù s R' R( Rr sC users cannot be added when runAs user or runAs group category='all'R+ R
s
runas-userR s3 RunAsUser does not accept '%(name)s' as a user nameR, s4 RunAsUser does not accept '%(name)s' as a group name(
Rx Ri R^ R Ry Rz R R{ R R R¢ R‡ R— ( RO Rj Rk Rl Rm RP RQ R§ R R€ R
( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn ÷ s. "
c O s% t d d d | | | | | | | ƒ
S( NR% R+ t ipasudorunasextuser( R˜ ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› s ( s %i object added.s %i objects added.( RU RV R RW R‘ R’ Rn R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR¡ ñ s
t sudorule_remove_runasuserc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s/ Remove users and groups for Sudo to execute as.R% s %i object removed.s %i objects removed.c O s% t d d d | | | | | | | ƒ
S( NR% R+ R¨ ( R ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› # s ( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR© s t sudorule_add_runasgroupc B s5 e Z e d ƒ Z d g Z d Z d „ Z d „ Z RS( s! Add group for Sudo to execute as.R& s %i object added.s %i objects added.c O s d „ } y" | i | | i i ƒ \ } } Wn& t i j
o | i i | Œ n Xt | d ƒ p t | d ƒ o t i d t d ƒ ƒ ‚ n d | j o[ xX | d D]H }
| |
ƒ p5 t i d d d t
t d
ƒ ƒ t d |
ƒ ƒ ‚ q¨ q¨ Wn t d | | | | ƒ S( Nc S s( t | ƒ } | i ƒ d j o t St S( Nu ALL( R¢ R£ R¤ Rc ( R¥ R¦ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR§ 2 s R' R( Rr sC users cannot be added when runAs user or runAs group category='all'R, R
s runas-groupR s5 RunAsGroup does not accept '%(name)s' as a group name(
Rx Ri R^ R Ry Rz R R{ R R R¢ R‡ R— ( RO Rj Rk Rl Rm RP RQ R§ R R€ R
( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRn 0 s "
c O s% t d d d | | | | | | | ƒ
S( NR& R, t ipasudorunasextgroup( R˜ ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› I s ( s %i object added.s %i objects added.( RU RV R RW R‘ R’ Rn R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRª * s
t sudorule_remove_runasgroupc B s, e Z e d ƒ Z d g Z d Z d „ Z RS( s$ Remove group for Sudo to execute as.R& s %i object removed.s %i objects removed.c O s% t d d d | | | | | | | ƒ
S( NR& R, R« ( R ( RO Rj R™ Rš Rk Rl RP RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR› V s ( s %i object removed.s %i objects removed.( RU RV R RW R‘ R’ R› ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR¬ P s t sudorule_add_optionc B sG e Z e d ƒ Z e d d d d e d ƒ ƒf Z d „ Z d „ Z RS( s Add an option to the Sudo Rule.R$ R1 t
sudooptionR3 s Sudo Optionc K s_ | i i } | i i | ƒ } | d i ƒ p t i ƒ ‚ n | i | d g ƒ \ } } yC | d | d j o! | i d g ƒ i | d ƒ n
t i ‚ Wn0 t
j
o$ | i d g ƒ i | d ƒ n Xy | i | | ƒ Wn; t i j
o n' t i j
o | i i
| ƒ n X| i i } | i | | d | i i ƒ\ } } t d | ƒ S( NR$ t normalizeRI ( Ri Rƒ R„ t stripR R† Rx t
setdefaultt appendt DuplicateEntryt KeyErrorR… Ry Rz R^ t normalize_dnR‡ ( RO R RQ Rj Rk Rl Rm ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRˆ g s.
c K sM | i t d ƒ t d | d d | ƒ ƒ t t | ƒ i | | | | ƒ d S( Ns1 Added option "%(option)s" to Sudo Rule "%(rule)s"t optionR$ RJ ( R‰ R R‡ t superR R‹ ( RO RŠ RI R RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR‹ ‡ s ( RU RV R RW R t
takes_optionsRˆ R‹ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR ] s t sudorule_remove_optionc B sG e Z e d ƒ Z e d d d d e d ƒ ƒf Z d „ Z d „ Z RS( s Remove an option from Sudo Rule.R$ R1 R® R3 s Sudo Optionc K sh | i i } | i i | ƒ } | d i ƒ p t i ƒ ‚ n | i | d g ƒ \ } } yf | d | d j o1 | i d g ƒ i | d ƒ | i | | ƒ n t i
d d d | d ƒ ‚ Wnh t j
o } nU t j
o# t i
d d d | d ƒ ‚ n' t i
j
o | i i | ƒ n X| i i } | i | | d | i i ƒ\ } } t d | ƒ S( NR$ t attrR R¯ RI ( Ri Rƒ R„ R° R R† Rx R± t removeR… t AttrValueNotFoundt
ValueErrorR´ Ry Rz R^ Rµ R‡ ( RO R RQ Rj Rk Rl t eRm ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyRˆ › s2 c K sM | i t d ƒ t d | d d | ƒ ƒ t t | ƒ i | | | | ƒ d S( Ns5 Removed option "%(option)s" from Sudo Rule "%(rule)s"R¶ R$ RJ ( R‰ R R‡ R· R¹ R‹ ( RO RŠ RI R RQ ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR‹ ¾ s ( RU RV R RW R R¸ Rˆ R‹ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyR¹ ‘ s #N(1 t ipalibR R R R R t ipalib.plugins.baseldapt ipalib.plugins.hbacruleR R R RW t topicR R R R t
LDAPObjectR t registert
LDAPCreateRg t
LDAPDeleteRp t
LDAPUpdateRq t
LDAPSearchR t LDAPRetrieveRv t LDAPQueryR‚ RŒ t
LDAPAddMemberRŽ t LDAPRemoveMemberR“ R” R• R– Rœ Rž R R¡ R© Rª R¬ R R¹ ( ( ( s; /usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.pyt sn
ª
"
)
#
1
2