From b3f06994b7b44a0f9cd0c6bd0302c9db87dc2502 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 15 Jan 2019 17:33:56 +0100 Subject: [PATCH] Fix systemd-user HBAC rule 2ef6e14c5a87724a3b37dd5f0817af48c4411e03 added an invalid HBAC rule that encoded the service wrongly. See: https://bugzilla.redhat.com/show_bug.cgi?id=1643928 Fixes: https://pagure.io/freeipa/issue/7831 Signed-off-by: Christian Heimes --- install/share/default-hbac.ldif | 2 +- ipatests/test_integration/test_commands.py | 12 +++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/install/share/default-hbac.ldif b/install/share/default-hbac.ldif index 8dd90685c..c89bd3eef 100644 --- a/install/share/default-hbac.ldif +++ b/install/share/default-hbac.ldif @@ -21,7 +21,7 @@ cn: allow_systemd-user accessruletype: allow usercategory: all hostcategory: all -servicecategory: systemd-user +memberService: cn=systemd-user,cn=hbacservices,cn=hbac,$SUFFIX ipaenabledflag: TRUE description: Allow pam_systemd to run user@.service to create a system user session ipauniqueid: autogenerate diff --git a/ipatests/test_integration/test_commands.py b/ipatests/test_integration/test_commands.py index 1fb6450a2..8b2c84fc6 100644 --- a/ipatests/test_integration/test_commands.py +++ b/ipatests/test_integration/test_commands.py @@ -500,12 +500,18 @@ class TestIPACommand(IntegrationTest): # https://pagure.io/freeipa/issue/7831 tasks.kinit_admin(self.master) # check for presence - self.master.run_command( - ['ipa', 'hbacrule-show', 'allow_systemd-user'] - ) self.master.run_command( ['ipa', 'hbacsvc-show', 'systemd-user'] ) + result = self.master.run_command( + ['ipa', 'hbacrule-show', 'allow_systemd-user', '--all'] + ) + lines = set(l.strip() for l in result.stdout_text.split('\n')) + assert 'User category: all' in lines + assert 'Host category: all' in lines + assert 'Enabled: TRUE' in lines + assert 'Services: systemd-user' in lines + assert 'accessruletype: allow' in lines # delete both self.master.run_command( -- 2.20.1