Attachment 671580 Details for Bug 891356 – sudo_defaults_openldap_test

sudo_defaults_openldap_test

sudo_defaults_openldap_test (text/plain), 2.71 KB, created by Nikolai Kondrashov on 2013-01-02 17:19:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nikolai Kondrashov

Created: 2013-01-02 17:19:03 UTC

Size: 2.71 KB

patch

obsolete

>#!/bin/bash
>
>set -o errexit -o nounset -o pipefail
>
>declare -r SMART_INTERVAL=1
>declare -r FULL_INTERVAL=30
>declare -r OVERLAP_INTERVAL=2
>declare -r BASE_DN="ou=Sudoers,dc=example,dc=com"
>declare -r -a LDAP_OPTS=(-x -h server
>                         -D cn=Manager,dc=example,dc=com -w Secret123)
>
>declare SMART_WAIT=0
>declare FULL_WAIT=0
>
>function sudo_check_user()
>{
>    declare -r name="$1"
>    declare status=0
>    su user1 -c 'sudo -u user2 true' || status=$?
>    echo "$name: $status"
>}
>
>function rule_add()
>{
>    declare -r name="$1"
>    {
>        cat <<EOF
>dn: cn=$name,$BASE_DN
>cn: $name
>objectClass: top
>objectClass: sudoRole
>EOF
>        cat
>    } | ldapmodify "${LDAP_OPTS[@]}" -a >/dev/null
>}
>
>function rule_mod()
>{
>    declare -r name="$1"
>    {
>        cat <<EOF
>dn: cn=$name,$BASE_DN
>changetype: modify
>EOF
>        cat
>    } | ldapmodify "${LDAP_OPTS[@]}" >/dev/null
>}
>
>function rule_dump()
>{
>    declare -r name="$1"
>    ldapsearch "${LDAP_OPTS[@]}" -LLL -b "cn=$name,$BASE_DN"
>}
>
>function rule_del()
>{
>    declare -r name="$1"
>    ldapdelete "${LDAP_OPTS[@]}" "cn=$name,$BASE_DN"
>}
>
>function ldap_setup()
>{
>    :
>}
>
>function ldap_teardown()
>{
>    :
>}
>
>function sssd_setup()
>{
>    ldap_setup
>    SMART_WAIT=$((SMART_INTERVAL + OVERLAP_INTERVAL))
>    FULL_WAIT=$((FULL_INTERVAL + OVERLAP_INTERVAL))
>    service sssd stop >/dev/null
>    cat >>/etc/sssd/sssd.conf <<EOF
>entry_cache_nowait_percentage       = 0
>entry_cache_timeout                 = 0
>ldap_sudo_smart_refresh_interval    = $SMART_INTERVAL
>ldap_sudo_full_refresh_interval     = $FULL_INTERVAL
>EOF
>    rm -f /var/lib/sss/db/*.ldb
>    service sssd start >/dev/null
>}
>
>function sssd_teardown()
>{
>    service sssd stop >/dev/null
>    cat /etc/sssd/sssd.conf |
>        grep -v 'ldap_sudo_$smart\|full$_refresh_interval' |
>        grep -v 'entry_cache_$nowait_percentage\|timeout$' \
>            > /etc/sssd/sssd.conf.new
>    mv /etc/sssd/sssd.conf{.new,}
>    chmod 0600 /etc/sssd/sssd.conf
>    rm -f /var/lib/sss/db/*.ldb
>    ldap_teardown
>    SMART_WAIT=0
>    FULL_WAIT=0
>    service sssd start >/dev/null
>}
>
>function test_run()
>{
>    sudo_check_user initially
>    rule_add test <<EOF
>sudoUser: ALL
>sudoHost: ALL
>sudoCommand: ALL
>sudoRunAsUser: ALL
>EOF
>    sleep $SMART_WAIT
>    sudo_check_user smart_refresh_with_rule_added
>
>    rule_add defaults <<<"sudoOption: !authenticate"
>    sleep $SMART_WAIT
>    sudo_check_user smart_refresh_with_defaults_added
>
>    sleep $((FULL_WAIT - SMART_WAIT * 2))
>    sudo_check_user full_refresh_with_defaults_added
>
>    rule_del defaults
>    rule_del test
>}
>
>if [ $# != 1 ]; then
>    echo "Invalid number of arguments" >&2
>    echo "Usage: `basename $0` sssd|ldap" >&2
>    exit 1
>fi
>declare -r backend="$1"
>trap ${backend}_teardown EXIT
>${backend}_setup
>test_run

Actions: View

Attachments on bug 891356: 671567 | 671568 | 671580 | 672016 | 672017