|
 |
53a374 |
From 8de62d5187f54b0e994c160a1d39dbece4615aa5 Mon Sep 17 00:00:00 2001
|
|
|
53a374 |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
53a374 |
Date: Tue, 15 Nov 2016 14:02:54 +1000
|
|
|
53a374 |
Subject: [PATCH] certprofile-mod: correctly authorise config update
|
|
|
53a374 |
|
|
|
53a374 |
Certificate profiles consist of an FreeIPA object, and a
|
|
|
53a374 |
corresponding Dogtag configuration object. When updating profile
|
|
|
53a374 |
configuration, changes to the Dogtag configuration are not properly
|
|
|
53a374 |
authorised, allowing unprivileged operators to modify (but not
|
|
|
53a374 |
create or delete) profiles. This could result in issuance of
|
|
|
53a374 |
certificates with fraudulent subject naming information, improper
|
|
|
53a374 |
key usage, or other badness.
|
|
|
53a374 |
|
|
|
53a374 |
Update certprofile-mod to ensure that the operator has permission to
|
|
|
53a374 |
modify FreeIPA certprofile objects before modifying the Dogtag
|
|
|
53a374 |
configuration.
|
|
|
53a374 |
|
|
|
53a374 |
https://fedorahosted.org/freeipa/ticket/6560
|
|
|
53a374 |
|
|
|
53a374 |
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
|
|
|
53a374 |
---
|
|
|
53a374 |
ipaserver/plugins/certprofile.py | 5 +++++
|
|
|
53a374 |
1 file changed, 5 insertions(+)
|
|
|
53a374 |
|
|
|
53a374 |
diff --git a/ipaserver/plugins/certprofile.py b/ipaserver/plugins/certprofile.py
|
|
|
53a374 |
index f4466077484591c8e941027fa8e4897602384f7c..2bd3311e3b729b768188d537bf7f675a0f9346c2 100644
|
|
|
53a374 |
--- a/ipaserver/plugins/certprofile.py
|
|
|
53a374 |
+++ b/ipaserver/plugins/certprofile.py
|
|
|
53a374 |
@@ -310,6 +310,11 @@ class certprofile_mod(LDAPUpdate):
|
|
|
53a374 |
raise errors.ProtectedEntryError(label='certprofile', key=keys[0],
|
|
|
53a374 |
reason=_('Certificate profiles cannot be renamed'))
|
|
|
53a374 |
if 'file' in options:
|
|
|
53a374 |
+ # ensure operator has permission to update a certprofile
|
|
|
53a374 |
+ if not ldap.can_write(dn, 'ipacertprofilestoreissued'):
|
|
|
53a374 |
+ raise errors.ACIError(info=_(
|
|
|
53a374 |
+ "Insufficient privilege to modify a certificate profile."))
|
|
|
53a374 |
+
|
|
|
53a374 |
with self.api.Backend.ra_certprofile as profile_api:
|
|
|
53a374 |
profile_api.disable_profile(keys[0])
|
|
|
53a374 |
try:
|
|
|
53a374 |
--
|
|
|
53a374 |
2.10.2
|
|
|
53a374 |
|