Bug 800545 - [RFE] Support SUDO command rename
Summary: [RFE] Support SUDO command rename
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Pavel Picka
Depends On: 837356
Blocks: 1298243
TreeView+ depends on / blocked
Reported: 2012-03-06 17:21 UTC by Dmitri Pal
Modified: 2017-10-30 06:55 UTC (History)
14 users (show)

Fixed In Version: ipa-4.5.0-3.el7
Doc Type: Enhancement
Doc Text:
Clone Of:
Last Closed: 2017-08-01 09:37:23 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Dmitri Pal 2012-03-06 17:21:39 UTC
This bug is created as a clone of upstream ticket:

Currently it is possible to change the primary key of an object using the --rename option only on objects whose primary key attribute and RDN attribute are the same. Allow renaming any object by providing the --rename option for all objects.

Comment 1 Jiri Vitek 2012-09-04 15:50:23 UTC
imagine these steps:
1.) create sudo rule like: /usr/bin/setfacl -m g:apache:rwx /home/www/* after some time you will need to enhance that with -R param to work recursive
2.) you have to delete this record
3.) create new record
4.) update command assignement in sudo command group, but only if you are lucky and you are using command groups(45 in my scenario). If not, you have to update all sudo rules manualy(hundred in my scenario).

Please consider if you can include it with rhel6.x (6.4) It makes my work on sudo and others entries incredible long. And yes i know that i can make update from cli. But cli is not everytime accesible. And also sorry for my english.


Comment 2 Martin Kosek 2012-09-11 08:04:22 UTC
Thanks Jiri for this note, we will reconsider including this ticket to RHEL 6.4.

Please keep in mind that this change depends on Bug 837356. We need to ensure referential integrity for objects like sudo otherwise sudo rule rename operation would cause more harm than good by leaving dangling references for example sudo command groups.

Comment 3 Dmitri Pal 2012-09-11 18:03:42 UTC
Unfortunately we do not have capacity to include it into the 6.4 release at this stage. But it will be in our next major release.

Comment 4 Jiri Vitek 2012-09-12 13:59:21 UTC
Major release, so you mean that is still planed up to 7.0 release?

Comment 5 Dmitri Pal 2012-09-12 16:55:08 UTC
It will be in 7.x but I can't say whether it will make 7.0 or will be deferred to 7.1 or even later. Please keep an eye on the upstream ticket.

Comment 7 Martin Kosek 2016-02-24 11:18:40 UTC
This request is not too general. I do not think we would invest the resources to support rename with *all* FreeIPA objects, it is too costly without being bound to real world request (like this one).

I talked to Petr Vobornik, we will rather narrow down the request to the reported problem around SUDO commands - this will increase a chance it would be really done.

Comment 13 Kaleem 2017-05-18 08:43:16 UTC
changing needinfo

Comment 14 Standa Laznicka 2017-05-18 08:51:57 UTC
Run "ipatests/test_xmlrpc/test_sudorule_plugin.py" suite which contains the reproducer in the "test_l_1_sudorule_rename()" test.

Comment 15 Xiyang Dong 2017-05-19 14:05:39 UTC
Thanks Stanislav.
Verified on ipa-server-4.5.0-9.el7:
# ipa sudorule-add test
Added Sudo Rule "test"
  Rule name: test
  Enabled: TRUE
# ipa sudorule-mod --help|grep rename
  --rename=STR          Rename the sudo rule object
# ipa sudorule-mod test --rename=test_renamed
Modified Sudo Rule "test"
# ipa sudorule-show test 
ipa: ERROR: test: sudo rule not found
# ipa sudorule-show test_renamed
  Rule name: test_renamed
  Enabled: TRUE
# ipa sudorule-mod test_renamed --rename=test
Modified Sudo Rule "test_renamed"
  Rule name: test
  Enabled: TRUE
# ipa sudorule-show test 
  Rule name: test
  Enabled: TRUE
# ipa sudorule-show test_renamed
ipa: ERROR: test_renamed: sudo rule not found

Comment 16 Martin Kosek 2017-05-26 09:39:58 UTC
Please note that Red Hat officially released public RHEL-7.4 Beta this week, as announced here:

The new RHEL-7.4 release includes a lot of new IdM functionality, including this RFE. Highlights can be found in RHEL-7.4 Release Notes, especially in the Authentication & Interoperability chapter:

IdM Engineering team would like to encourage everyone interested in this new functionality (and especially customers or community members requesting it) to try Beta and provide us with your feedback!

Comment 17 errata-xmlrpc 2017-08-01 09:37:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.