|
 |
76b7d5 |
From 61156c5157ec3f8982f4f6efdbf8dfa281cb5a11 Mon Sep 17 00:00:00 2001
|
|
|
ff14fa |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
ff14fa |
Date: Fri, 13 Jan 2017 20:33:45 +1000
|
|
|
ff14fa |
Subject: [PATCH] ca: correctly authorise ca-del, ca-enable and ca-disable
|
|
|
ff14fa |
|
|
|
ff14fa |
CAs consist of a FreeIPA and a corresponding Dogtag object. When
|
|
|
ff14fa |
executing ca-del, ca-enable and ca-disable, changes are made to the
|
|
|
ff14fa |
Dogtag object. In the case of ca-del, the corresponding FreeIPA
|
|
|
ff14fa |
object is deleted after the Dogtag CA is deleted.
|
|
|
ff14fa |
|
|
|
ff14fa |
These operations were not correctly authorised; the FreeIPA
|
|
|
ff14fa |
permissions are not checked before the Dogtag operations are
|
|
|
ff14fa |
executed. This allows any user to delete, enable or disable a
|
|
|
ff14fa |
lightweight CA (except the main IPA CA, for which there are
|
|
|
ff14fa |
additional check to prevent deletion or disablement).
|
|
|
ff14fa |
|
|
|
ff14fa |
Add the proper authorisation checks to the ca-del, ca-enable and
|
|
|
ff14fa |
ca-disable commands.
|
|
|
76b7d5 |
|
|
|
76b7d5 |
https://pagure.io/freeipa/issue/6713
|
|
|
76b7d5 |
|
|
|
76b7d5 |
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
|
|
|
ff14fa |
---
|
|
|
ff14fa |
ipaserver/plugins/ca.py | 6 ++++++
|
|
|
ff14fa |
1 file changed, 6 insertions(+)
|
|
|
ff14fa |
|
|
|
ff14fa |
diff --git a/ipaserver/plugins/ca.py b/ipaserver/plugins/ca.py
|
|
|
ff14fa |
index 966ae2b1bdb4bb0207dfa58f0e9c951bc930f766..b642a5d1d6e03b415ba562491e8a38569b116563 100644
|
|
|
ff14fa |
--- a/ipaserver/plugins/ca.py
|
|
|
ff14fa |
+++ b/ipaserver/plugins/ca.py
|
|
|
ff14fa |
@@ -192,6 +192,12 @@ class ca_del(LDAPDelete):
|
|
|
ff14fa |
def pre_callback(self, ldap, dn, *keys, **options):
|
|
|
ff14fa |
ca_enabled_check()
|
|
|
ff14fa |
|
|
|
ff14fa |
+ # ensure operator has permission to delete CA
|
|
|
ff14fa |
+ # before contacting Dogtag
|
|
|
ff14fa |
+ if not ldap.can_delete(dn):
|
|
|
ff14fa |
+ raise errors.ACIError(info=_(
|
|
|
ff14fa |
+ "Insufficient privilege to delete a CA."))
|
|
|
ff14fa |
+
|
|
|
ff14fa |
if keys[0] == IPA_CA_CN:
|
|
|
ff14fa |
raise errors.ProtectedEntryError(
|
|
|
ff14fa |
label=_("CA"),
|
|
|
ff14fa |
--
|
|
|
ff14fa |
2.9.3
|
|
|
ff14fa |
|