Bug 751020

Summary:	Default Sudo Administration Role - Permissions missing
Product:	Red Hat Enterprise Linux 6	Reporter:	Gowrishankar Rajaiyan <grajaiya>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.2	CC:	dpal, jgalipea, mkosek, nsoman
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-2.2.0-1.el6	Doc Type:	Bug Fix
Doc Text:	No documentation needed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 13:16:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	756082

Description Gowrishankar Rajaiyan 2011-11-03 09:21:56 UTC

Description of problem:


Version-Release number of selected component (if applicable):
ipa-server-2.1.3-8.el6.x86_64

How reproducible:


Steps to Reproduce:
1. [root@decepticons ~]# ipa privilege-find "User Administrators"
-------------------
1 privilege matched
-------------------
  Privilege name: User Administrators
  Description: User Administrators
  Permissions: add users, change a user password, add user to default group,
unlock user accounts, remove users, modify users
  Granting privilege to roles: User Administrator
----------------------------
Number of entries returned 1
----------------------------
[root@decepticons ~]# 

2. [root@decepticons ~]# ipa privilege-find "Sudo Administrator"
-------------------
1 privilege matched
-------------------
  Privilege name: Sudo Administrator
  Description: Sudo Administrator
  Granting privilege to roles: IT Security Specialist
----------------------------
Number of entries returned 1
----------------------------
[root@decepticons ~]# 

3.
  
Actual results:
Sudo Administrator Role exists with no permissions assigned
No Sudo permissions

Expected results:
Default Sudo permissions exist
Sudo Administrator Role has the expected permissions assigned


Additional info:

Comment 2 Martin Kosek 2011-11-03 11:59:20 UTC

This is the same root cause as in Bug 751029. I will target this for 6.3.0.


# ipa permission-find sudo --all
---------------------
9 permissions matched
---------------------
  dn: cn=add sudo command,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  Permission name: Add Sudo command
  Permissions: add
  Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  Granted to Privilege: Sudo Administrator   <<<<<<<
  objectclass: groupofnames, ipapermission, top

  dn: cn=add sudo command group,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  Permission name: Add Sudo command group
  Permissions: add
  Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  Granted to Privilege: Sudo Administrator   <<<<<<<
  objectclass: groupofnames, ipapermission, top
...

Comment 3 Martin Kosek 2011-11-03 12:22:17 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2060

Comment 4 Martin Kosek 2011-12-08 09:10:34 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/373e9d1cf8b6539149e50b02655bdc7e931d7bf6
ipa-2-1: https://fedorahosted.org/freeipa/changeset/6d984172afd16492ec220c3f36b51a6314808fd1

Comment 6 Jenny Severance 2012-04-18 17:04:43 UTC

verified:

# ipa permission-find sudo --all
---------------------
9 permissions matched
---------------------
  dn: cn=add sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Add Sudo command
  Permissions: add
  Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=add sudo command group,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Add Sudo command group
  Permissions: add
  Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=add sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Add Sudo rule
  Permissions: add
  Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=delete sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Delete Sudo command
  Permissions: delete
  Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=delete sudo command group,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Delete Sudo command group
  Permissions: delete
  Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=delete sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Delete Sudo rule
  Permissions: delete
  Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=manage sudo command group membership,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Manage Sudo command group membership
  Permissions: write
  Attributes: member
  Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=modify sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Modify Sudo command
  Permissions: write
  Attributes: description
  Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top

  dn: cn=modify sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com
  Permission name: Modify Sudo rule
  Permissions: write
  Attributes: description, ipaenabledflag, usercategory, hostcategory, cmdcategory, ipasudorunasusercategory, ipasudorunasgroupcategory, externaluser,
              ipasudorunasextuser, ipasudorunasextgroup, memberdenycmd, memberallowcmd, memberuser
  Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com
  Granted to Privilege: Sudo Administrator
  memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com
  objectclass: groupofnames, ipapermission, top
----------------------------
Number of entries returned 9
----------------------------

version:
ipa-server-2.2.0-9.el6.x86_64

Comment 8 Martin Kosek 2012-04-19 11:37:46 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation needed.

Comment 10 errata-xmlrpc 2012-06-20 13:16:14 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html