Bug 800545 - [RFE] Support SUDO command rename
[RFE] Support SUDO command rename
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.0
All Linux
high Severity high
: rc
: ---
Assigned To: IPA Maintainers
Pavel Picka
: FutureFeature
Depends On: 837356
Blocks: 1298243
  Show dependency treegraph
 
Reported: 2012-03-06 12:21 EST by Dmitri Pal
Modified: 2017-08-01 05:37 EDT (History)
14 users (show)

See Also:
Fixed In Version: ipa-4.5.0-3.el7
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 05:37:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dmitri Pal 2012-03-06 12:21:39 EST
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2466

Currently it is possible to change the primary key of an object using the --rename option only on objects whose primary key attribute and RDN attribute are the same. Allow renaming any object by providing the --rename option for all objects.
Comment 1 Jiri Vitek 2012-09-04 11:50:23 EDT
imagine these steps:
1.) create sudo rule like: /usr/bin/setfacl -m g:apache:rwx /home/www/* after some time you will need to enhance that with -R param to work recursive
2.) you have to delete this record
3.) create new record
4.) update command assignement in sudo command group, but only if you are lucky and you are using command groups(45 in my scenario). If not, you have to update all sudo rules manualy(hundred in my scenario).

Please consider if you can include it with rhel6.x (6.4) It makes my work on sudo and others entries incredible long. And yes i know that i can make update from cli. But cli is not everytime accesible. And also sorry for my english.

Thanks
Comment 2 Martin Kosek 2012-09-11 04:04:22 EDT
Thanks Jiri for this note, we will reconsider including this ticket to RHEL 6.4.

Please keep in mind that this change depends on Bug 837356. We need to ensure referential integrity for objects like sudo otherwise sudo rule rename operation would cause more harm than good by leaving dangling references for example sudo command groups.
Comment 3 Dmitri Pal 2012-09-11 14:03:42 EDT
Unfortunately we do not have capacity to include it into the 6.4 release at this stage. But it will be in our next major release.
Comment 4 Jiri Vitek 2012-09-12 09:59:21 EDT
Major release, so you mean that is still planed up to 7.0 release?
Comment 5 Dmitri Pal 2012-09-12 12:55:08 EDT
It will be in 7.x but I can't say whether it will make 7.0 or will be deferred to 7.1 or even later. Please keep an eye on the upstream ticket.
Comment 7 Martin Kosek 2016-02-24 06:18:40 EST
This request is not too general. I do not think we would invest the resources to support rename with *all* FreeIPA objects, it is too costly without being bound to real world request (like this one).

I talked to Petr Vobornik, we will rather narrow down the request to the reported problem around SUDO commands - this will increase a chance it would be really done.
Comment 13 Kaleem 2017-05-18 04:43:16 EDT
changing needinfo
Comment 14 Stanislav Laznicka 2017-05-18 04:51:57 EDT
Run "ipatests/test_xmlrpc/test_sudorule_plugin.py" suite which contains the reproducer in the "test_l_1_sudorule_rename()" test.
Comment 15 Xiyang Dong 2017-05-19 10:05:39 EDT
Thanks Stanislav.
Verified on ipa-server-4.5.0-9.el7:
# ipa sudorule-add test
----------------------
Added Sudo Rule "test"
----------------------
  Rule name: test
  Enabled: TRUE
# ipa sudorule-mod --help|grep rename
  --rename=STR          Rename the sudo rule object
# ipa sudorule-mod test --rename=test_renamed
-------------------------
Modified Sudo Rule "test"
------------------------
# ipa sudorule-show test 
ipa: ERROR: test: sudo rule not found
# ipa sudorule-show test_renamed
  Rule name: test_renamed
  Enabled: TRUE
# ipa sudorule-mod test_renamed --rename=test
---------------------------------
Modified Sudo Rule "test_renamed"
---------------------------------
  Rule name: test
  Enabled: TRUE
# ipa sudorule-show test 
  Rule name: test
  Enabled: TRUE
# ipa sudorule-show test_renamed
ipa: ERROR: test_renamed: sudo rule not found
Comment 16 Martin Kosek 2017-05-26 05:39:58 EDT
Please note that Red Hat officially released public RHEL-7.4 Beta this week, as announced here:
https://www.redhat.com/en/about/blog/red-hat-enterprise-linux-74-beta-now-available

The new RHEL-7.4 release includes a lot of new IdM functionality, including this RFE. Highlights can be found in RHEL-7.4 Release Notes, especially in the Authentication & Interoperability chapter:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7-Beta/html/7.4_Release_Notes/new_features_authentication_and_interoperability.html

IdM Engineering team would like to encourage everyone interested in this new functionality (and especially customers or community members requesting it) to try Beta and provide us with your feedback!
Comment 17 errata-xmlrpc 2017-08-01 05:37:23 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304

Note You need to log in before you can comment on or make changes to this bug.