Attachment 656940 Details for Bug 883106 – sudo_host_refresh_test

sudo_host_refresh_test

sudo_host_refresh_test (text/plain), 2.78 KB, created by Nikolai Kondrashov on 2012-12-03 19:32:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nikolai Kondrashov

Created: 2012-12-03 19:32:37 UTC

Size: 2.78 KB

patch

obsolete

>#!/bin/bash
>
>set -o errexit -o nounset -o pipefail
>
>declare -r SMART_INTERVAL=1
>declare -r FULL_INTERVAL=$((SMART_INTERVAL * 10))
>declare -r BASE_DN="ou=Sudoers,dc=example,dc=com"
>declare -r -a LDAP_OPTS=(-x -h server -D 'cn=Directory Manager' -w Secret123)
>
>declare REFRESH_WAIT=0
>
>function sudo_check_user()
>{
>    declare -r name="$1"
>    declare status=0
>    su user1 -c 'sudo -u user2 true' || status=$?
>    echo "$name: $status"
>}
>
>function rule_add()
>{
>    declare -r name="$1"
>    {
>        cat <<EOF
>dn: cn=$name,$BASE_DN
>cn: $name
>objectClass: top
>objectClass: sudoRole
>EOF
>        cat
>    } | ldapmodify "${LDAP_OPTS[@]}" -a >/dev/null
>}
>
>function rule_mod()
>{
>    declare -r name="$1"
>    {
>        cat <<EOF
>dn: cn=$name,$BASE_DN
>changetype: modify
>EOF
>        cat
>    } | ldapmodify "${LDAP_OPTS[@]}" >/dev/null
>}
>
>function rule_dump()
>{
>    declare -r name="$1"
>    ldapsearch "${LDAP_OPTS[@]}" -LLL -b "cn=$name,$BASE_DN"
>}
>
>function rule_del()
>{
>    declare -r name="$1"
>    ldapdelete "${LDAP_OPTS[@]}" "cn=$name,$BASE_DN"
>}
>
>function ldap_setup()
>{
>    rule_add test <<EOF
>sudoUser: ALL
>sudoHost: ALL
>sudoCommand: ALL
>EOF
>}
>
>function ldap_teardown()
>{
>    rule_del test
>}
>
>function sssd_setup()
>{
>    ldap_setup
>    REFRESH_WAIT=$((SMART_INTERVAL + 2))
>    service sssd stop >/dev/null
>    cat >>/etc/sssd/sssd.conf <<EOF
>entry_cache_nowait_percentage       = 0
>entry_cache_timeout                 = 0
>ldap_sudo_smart_refresh_interval    = $SMART_INTERVAL
>ldap_sudo_full_refresh_interval     = $FULL_INTERVAL
>EOF
>    rm -f /var/lib/sss/db/*.ldb
>    service sssd start >/dev/null
>}
>
>function sssd_teardown()
>{
>    service sssd stop >/dev/null
>    cat /etc/sssd/sssd.conf |
>        grep -v 'ldap_sudo_$smart\|full$_refresh_interval' |
>        grep -v 'entry_cache_$nowait_percentage\|timeout$' \
>            > /etc/sssd/sssd.conf.new
>    mv /etc/sssd/sssd.conf{.new,}
>    chmod 0600 /etc/sssd/sssd.conf
>    rm -f /var/lib/sss/db/*.ldb
>    ldap_teardown
>    REFRESH_WAIT=0
>    service sssd start >/dev/null
>}
>
>function test_sudo_runas()
>{
>    declare i
>    declare j
>    declare -r ADDR=`getent hosts "$HOSTNAME" | cut -d' ' -f1`
>    declare NOT_ADDR=""
>    declare o=
>    for o in ${ADDR//./ }; do
>        NOT_ADDR="${NOT_ADDR:+$NOT_ADDR.}$((o ^ 255))"
>    done
>
>    for ((i=1; i<=5; i++)); do
>            rule_mod test <<EOF
>replace:    sudoHost
>sudoHost:   $ADDR
>EOF
>            sleep $REFRESH_WAIT
>            rule_mod test <<EOF
>replace:    sudoHost
>sudoHost:   $NOT_ADDR
>EOF
>            sleep $REFRESH_WAIT
>        for ((j=1; j<=5; j++)); do
>            sudo_check_user "`date +%s` $i/$j"
>        done
>    done
>}
>
>if [ $# != 1 ]; then
>    echo "Invalid number of arguments" >&2
>    echo "Usage: `basename $0` sssd|ldap" >&2
>    exit 1
>fi
>declare -r backend="$1"
>trap ${backend}_teardown EXIT
>${backend}_setup
>test_sudo_runas

Actions: View

Attachments on bug 883106: 656918 | 656928 | 656940 | 656941 | 656942 | 656943 | 660711 | 660719 | 660722 | 660745 | 660746