From 8b1341528e8028d5569240f60e7a0521388b22a3 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 28 Jan 2013 02:30:30 +0100 Subject: List commands are now created by the user him/herself. --- ldap/acl.ldif | 50 +++++---- ldap/populate.ldif | 20 ++++ ldap/test-user-acl.sh | 281 ++++++++++++++++++++++++++++++++++++++++++++++---- 3 files changed, 312 insertions(+), 39 deletions(-) diff --git a/ldap/acl.ldif b/ldap/acl.ldif index 7b19d5f..5cc0ef0 100644 --- a/ldap/acl.ldif +++ b/ldap/acl.ldif @@ -84,9 +84,9 @@ olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" by dnattr=fripostOwner =z break by * =0 break # -# The list creation service can delete the 'pending' status on lists. +# The list creation service can delete the 'pending' status on lists and list commands. olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" - filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) + filter=(&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(objectClass=FripostPendingEntry)) attrs=objectClass val=FripostPendingEntry by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" =z break by * +0 break @@ -97,7 +97,7 @@ olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=dev" by * +rscd # # The pending token is not public, but domain owner and postmasters can check their and -# delete it (upon success, but it's done on the library side). +# delete it (if the token matches, but the check is done on the library side). olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" filter=(&(objectClass=FripostVirtualDomain)(objectClass=FripostPendingEntry)) attrs=fripostPendingToken @@ -105,9 +105,9 @@ olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" by dnattr=fripostOwner =zcd break by * +0 break # -# The list creation service can delete the 'pending' status on lists. +# The list creation service can delete the 'pending' status on lists and list commands. olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" - filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) + filter=(&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(objectClass=FripostPendingEntry)) attrs=fripostPendingToken by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" +z by * +0 @@ -119,14 +119,6 @@ olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" by dn.exact="cn=DeletePendingEntries,ou=services,o=mailHosting,dc=fripost,dc=dev" =zrd break by * =0 break # -# Only the list creation service may add list commands. (It seems unsafe since it can create -# arbitrary commands, but as other services it run in safe environments only.) -# (Listcommands are not concerned by the cleaning service.) -olcAccess: to dn.regex="^fvl=[^,]+-[^,-]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev$" - filter=(objectClass=FripostVirtualListCommand) - attrs=entry - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" =a -# # One can search search everywhere in the virtual tree. olcAccess: to dn.subtree="ou=virtual,o=mailHosting,dc=fripost,dc=dev" attrs=entry @@ -149,7 +141,6 @@ olcAccess: to dn.one="ou=virtual,o=mailHosting,dc=fripost,dc=dev" filter=(&(objectClass=FripostVirtualDomain)(!(objectClass=FripostPendingEntry))) attrs=children by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" =w - by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" =a # # The cleaning service needs to know when entries have been created. olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" @@ -159,6 +150,7 @@ olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" # # Users can use these in filters (e.g., to list the entries they have created). olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" + filter=(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)) attrs=fripostOwner,fripostPostmaster,fripostCanAddAlias,fripostCanAddList by dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=dev" =s break # @@ -352,18 +344,38 @@ olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripos by group/FripostVirtualDomain/fripostOwner.expand="$1" =wrscd by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =wrscd # -# 1-3. People with "canAddList" access can create lists, but only with a -# 'pending' status. -# 4. The list creation service can search and browse the entry. +# 1. The domain owner can create and delete lists, but only those with a 'pending' status +# 2. So can the domain postmaster. +# 3. The list owner can delete pending lists. +# 4. The entry creator can delete pending lists (needed to be able to rollback). +# 5. People with "canAddList" access can create lists, but only with a 'pending' status. +# 6. The list creation service can search and browse the entry. olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" filter=(&(objectClass=FripostVirtualList)(objectClass=FripostPendingEntry)) attrs=entry - by group/FripostVirtualDomain/fripostOwner.expand="$1" +a break - by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +a break + by group/FripostVirtualDomain/fripostOwner.expand="$1" +w break + by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +w break + by dnattr=fripostOwner +z continue + by dnattr=creatorsName +z continue by set.exact="this/-1/fripostCanAddList & (user | user/-1)" +a break by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" +rd by * +0 break # +# 1. The domain owner can create and delete list commands, but only those with a 'pending' status +# 2. So can the domain postmaster. +# 3. The entry creator can delete pending list commands (needed to be able to rollback). +# 4. People with "canAddList" access can create list commands, but only with a 'pending' status. +# 5. The list creation service can search and browse the entry. +olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=dev)$" + filter=(&(objectClass=FripostVirtualListCommand)(objectClass=FripostPendingEntry)) + attrs=entry + by group/FripostVirtualDomain/fripostOwner.expand="$1" +w + by group/FripostVirtualDomain/fripostPostmaster.expand="$1" +w + by dnattr=creatorsName +z continue + by set.exact="this/-1/fripostCanAddList & (user | user/-1)" +a + by dn.exact="cn=CreateList,ou=services,o=mailHosting,dc=fripost,dc=dev" +rd + by * +0 +# # 1. The list owners can read the entry. # 2. So can the domain's Owner. # 3. So can the domain's Postmaster. diff --git a/ldap/populate.ldif b/ldap/populate.ldif index edd5d73..73d11fa 100644 --- a/ldap/populate.ldif +++ b/ldap/populate.ldif @@ -220,6 +220,26 @@ FripostLocalAlias: list-request#postmastered.org objectClass: SimpleSecurityObject userPassword: bogus +dn: fvl=list-request,fvd=example2.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualListCommand +objectClass: FripostPendingEntry +FripostLocalAlias: list-request#example2.org + +dn: fvl=list-request,fvd=example3.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualListCommand +objectClass: FripostPendingEntry +FripostLocalAlias: list-request#example3.org + +dn: fvl=list2-request,fvd=postmastered.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualListCommand +objectClass: FripostPendingEntry +FripostLocalAlias: list2-request#postmastered.org + +dn: fvl=list3-request,fvd=owned.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualListCommand +objectClass: FripostPendingEntry +FripostLocalAlias: list2-request#postmastered.org + dn: fvl=user,fvd=postmastered.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev objectClass: FripostVirtualUser userPassword: user diff --git a/ldap/test-user-acl.sh b/ldap/test-user-acl.sh index cfa577d..5e92a3c 100755 --- a/ldap/test-user-acl.sh +++ b/ldap/test-user-acl.sh @@ -421,6 +421,16 @@ usersD ${OPERATTRS} | isOK '=0$' entryUUID [ $? -eq 0 ] || exit $? +msg "Cannot create non-pending entries" +for U in ${USERS}; do + for D in ${DOMAINS}; do + search -s base -b "${D},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' || \ + checkACL "${U}" "${D}" entry/add + done +done | isOK 'DENIED$' entry add +[ $? -eq 0 ] || exit $? + + # We check the following permissions: # 0. Simple user # 1. canAddAlias (exact,wildcard) @@ -894,7 +904,8 @@ echo "Authenticated users, access to list entries" # * entry: # =s for all # +a if canAddList, domain owner or domain postmaster -# +rd if list owner, domain owner or domain postmaster +# +z if creator +# +zrd if list owner, domain owner or domain postmaster # * children: # =0 for all # * objectClass @@ -942,12 +953,22 @@ done | isOK 'DENIED$' fripostListManager [ $? -eq 0 ] || exit $? -msg "Cannot delete entry or the pending status" +msg "Cannot remove the pending status" for U in ${USERS}; do for L in ${LISTS}; do - checkACL "${U}" "${L}" objectClass/delete:FripostPendingEntry entry/delete + checkACL "${U}" "${L}" objectClass/delete:FripostPendingEntry done -done | isOK 'DENIED$' entry +done | isOK 'DENIED$' 'objectClass=FripostPendingEntry' delete +[ $? -eq 0 ] || exit $? + + +msg "Cannot create or delete non-pending entries" +for U in ${USERS}; do + for L in ${LISTS}; do + search -s base -b "${L},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' || \ + checkACL "${U}" "${L}" entry/delete entry/add + done +done | isOK 'DENIED$' entry delete [ $? -eq 0 ] || exit $? @@ -1000,7 +1021,7 @@ for U in ${USERS}; do DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" search -s base -b "${DL},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \ search -s base -b "${L},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ - checkACL "${U}" "${L}" entry/add + checkACL "${U}" "${L}" entry/add entry/delete done done | isOK 'ALLOWED$' entry add [ $? -eq 0 ] || exit $? @@ -1015,7 +1036,7 @@ for U in ${USERS}; do search -s base -b "${L},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ checkACL "${U}" "${L}" entry/add done -done | isOK 'ALLOWED$' entry add +done | isOK 'ALLOWED$' entry [ $? -eq 0 ] || exit $? @@ -1046,22 +1067,68 @@ done | isOK 'ALLOWED$' entry [ $? -eq 0 ] || exit $? -msg "Do not have >=a access to \"entry\" (unless canAddList)" +msg "Have >=z access to \"entry\" (if pending list owner)" +for U in ${USERS}; do + for L in ${LISTS}; do + search -s base -b "${L},${SUFFIX}" "(&(objectClass=FripostPendingEntry)(fripostOwner=${U},${SUFFIX}))" | grep -q '^dn: ' && \ + checkACL "${U}" "${L}" entry/delete + done +done | isOK 'ALLOWED$' entry +[ $? -eq 0 ] || exit $? + + +msg "Have >=z access to \"entry\" (if pending list creator)" +ldapadd -w user2 -xD 'fvl=user2,fvd=fripost.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev' > /dev/null << EOF +dn: fvl=testlist,fvd=example3.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualList +objectClass: FripostPendingEntry +FripostLocalAlias: testlist#example3.org +fripostListManager: mailman +fripostIsStatusActive: TRUE +EOF +for U in ${USERS}; do + for L in ${LISTS} 'fvl=testlist,fvd=example3.org'; do + search -s base -b "${L},${SUFFIX}" "(&(objectClass=FripostPendingEntry)(creatorsName=${U},${SUFFIX}))" | grep -q '^dn: ' && \ + checkACL "${U}" "${L}" entry/delete + done +done | isOK 'ALLOWED$' entry +[ $? -eq 0 ] || exit $? +ldapdelete -w user2 -xD 'fvl=user2,fvd=fripost.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev' \ + "fvl=testlist,fvd=example3.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev" > /dev/null + + +msg "Do not have +a access to \"entry\" (unless canAddList on pending lists)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for L in ${LISTS}; do DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DL},${SUFFIX}" "(!(|(fripostCanAddList=${U},${SUFFIX}) - (fripostCanAddList=${DU},${SUFFIX}) - (fripostOwner=${U},${SUFFIX}) - (fripostPostmaster=${U},${SUFFIX})))" | grep -q '^dn: ' || \ - search -s base -b "${L},${SUFFIX}" "(!(objectClass=FripostPendingEntry))" | grep -q '^dn: ' && \ + search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) + (fripostOwner=${U},${SUFFIX}) + (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ + search -s base -b "${L},${SUFFIX}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ checkACL "${U}" "${L}" entry/add done done | isOK 'DENIED$' entry [ $? -eq 0 ] || exit $? +msg "Do not have +z access to \"entry\" (unless canAddList on pending lists)" +for U in ${USERS}; do + DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + for L in ${LISTS}; do + DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX}) + (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ + search -s base -b "${L},${SUFFIX}" "(fripostOwner=${U},${SUFFIX})" | grep -q '^dn: ' || \ + search -s base -b "${L},${SUFFIX}" "(creatorsName=${U},${SUFFIX})" | grep -q '^dn: ' || \ + search -s base -b "${L},${SUFFIX}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ + checkACL "${U}" "${L}" entry/delete + done +done | isOK 'DENIED$' entry +[ $? -eq 0 ] || exit $? + + msg "Cannot manage ownership (unless domain owner/domain postmaster)" for U in ${USERS}; do for L in ${LISTS}; do @@ -1086,15 +1153,174 @@ for U in ${USERS}; do done | isOK 'DENIED$' entry delete [ $? -eq 0 ] || exit $? -msg "Have =0 access to the list command entries" + +########################################################################### + + +echo +echo "Authenticated users, access to list command entries" + +# * entry: +# =s for all +# +a if canAddList, domain owner or domain postmaster +# +zrd if creator, domain owner or domain postmaster +# * children: +# =0 for all +# * objectClass +# =rscd for all +# * fvl: +# =0 forall +# * localAlias: +# =0 for all + + +usersLC () { + for U in ${USERS}; do + for LC in ${LISTSC}; do + checkACL "${U}" "${LC}" "$@" + done + done +} + +msg "Have >=s access on \"entry\"" +usersLC entry/search | isOK 'ALLOWED$' entry +[ $? -eq 0 ] || exit $? + +msg "Cannot read entries" +usersLC entry/read entry/disclose | isOK 'DENIED$' entry read +[ $? -eq 0 ] || exit $? + + +msg "Have =0 access the \"children\", \"localAlias\" and operational attributes" +usersLC children fripostLocalAlias ${OPERATTRS} | isOK '=0$' children +[ $? -eq 0 ] || exit $? + + +msg "Cannot remove the pending status" +for U in ${USERS}; do + for LC in ${LISTSC}; do + checkACL "${U}" "${LC}" objectClass/delete:FripostPendingEntry + done +done | isOK 'DENIED$' 'objectClass=FripostPendingEntry' delete +[ $? -eq 0 ] || exit $? + + +msg "Cannot create or delete non-pending entries" +for U in ${USERS}; do + for LC in ${LISTSC}; do + search -s base -b "${LC},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' || \ + checkACL "${U}" "${LC}" entry/add entry/delete + done +done | isOK 'DENIED$' entry add +[ $? -eq 0 ] || exit $? + + +msg "Can create list command (if domain Owner)" +[ $? -eq 0 ] || exit $? +for U in ${USERS}; do + for LC in ${LISTSC}; do + DL="$(echo "${LC}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${LC},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ + checkACL "${U}" "${LC}" entry/add entry/delete + done +done | isOK 'ALLOWED$' entry add +[ $? -eq 0 ] || exit $? + + +msg "Can create list command (if domain Postmaster)" +[ $? -eq 0 ] || exit $? +for U in ${USERS}; do + for LC in ${LISTSC}; do + DL="$(echo "${LC}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${LC},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ + checkACL "${U}" "${LC}" entry/add entry/delete + done +done | isOK 'ALLOWED$' entry add +[ $? -eq 0 ] || exit $? + + +# Needed to create new entries. ("+z" is required to delete, btw.) +msg "Have >=a access to \"entry\" (if CanAddList, exact)" for U in ${USERS}; do for LC in ${LISTSC}; do - checkACL "${U}" "${LC}" + DL="$(echo "${LC}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${LC},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ + checkACL "${U}" "${LC}" entry/add done -done | grep -Ev '^objectClass=' | isOK '=0$' entry +done | isOK 'ALLOWED$' entry [ $? -eq 0 ] || exit $? +# Needed to create new entries. ("+z" is required to delete, btw.) +msg "Have >=a access to \"entry\" (if CanAddList, wildcard)" +for U in ${USERS}; do + DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + for LC in ${LISTSC}; do + DL="$(echo "${LC}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${LC},${SUFFIX}" "objectClass=FripostPendingEntry" | grep -q '^dn: ' && \ + checkACL "${U}" "${LC}" entry/add + done +done | isOK 'ALLOWED$' entry +[ $? -eq 0 ] || exit $? + + +msg "Have >=z access to \"entry\" (if pending list command creator)" +ldapadd -w user2 -xD 'fvl=user2,fvd=fripost.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev' > /dev/null << EOF +dn: fvl=test-request,fvd=example3.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev +objectClass: FripostVirtualListCommand +objectClass: FripostPendingEntry +FripostLocalAlias: test-request#example3.org +EOF +for U in ${USERS}; do + for LC in ${LISTSC} 'fvl=test-request,fvd=example3.org'; do + search -s base -b "${LC},${SUFFIX}" "(&(objectClass=FripostPendingEntry)(creatorsName=${U},${SUFFIX}))" | grep -q '^dn: ' && \ + checkACL "${U}" "${LC}" entry/delete + done +done | isOK 'ALLOWED$' entry +[ $? -eq 0 ] || exit $? +ldapdelete -w user2 -xD 'fvl=user2,fvd=fripost.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev' \ + "fvl=test-request,fvd=example3.org,ou=virtual,o=mailHosting,dc=fripost,dc=dev" > /dev/null + + +msg "Do not have >=a access to \"entry\" (unless canAddList)" +for U in ${USERS}; do + DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + for L in ${LISTS}; do + DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) + (fripostOwner=${U},${SUFFIX}) + (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ + search -s base -b "${L},${SUFFIX}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ + checkACL "${U}" "${L}" entry/add + done +done | isOK 'DENIED$' entry +[ $? -eq 0 ] || exit $? + + +msg "Do not have +a or +z access to \"entry\" (unless canAddList on pending lists)" +for U in ${USERS}; do + DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + for LC in ${LISTSC}; do + DL="$(echo "${LC}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" + search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) + (fripostOwner=${U},${SUFFIX}) + (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ + search -s base -b "${LC},${SUFFIX}" "(creatorsName=${U},${SUFFIX})" | grep -q '^dn: ' || \ + search -s base -b "${LC},${SUFFIX}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ + checkACL "${U}" "${LC}" entry/add entry/delete + done +done | isOK 'DENIED$' entry add +[ $? -eq 0 ] || exit $? + + + + ########################################################################### @@ -1206,8 +1432,15 @@ for L in ${LISTS}; do done | isOK 'ALLOWED$' [ $? -eq 0 ] || exit $? +msg "Can remove the 'pending' status on list commands" +for LC in ${LISTSC}; do + search -s base -b "${LC},${SUFFIXV}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' && \ + checkACL "cn=CreateList" "${LC}" objectClass/delete:FripostPendingEntry fripostPendingToken/delete +done | isOK 'ALLOWED$' +[ $? -eq 0 ] || exit $? + msg "Cannot create a 'pending' satus" -for L in ${LISTS}; do +for L in ${LISTS} ${LISTSC}; do search -s base -b "${L},${SUFFIXV}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ checkACL "cn=CreateList" "${L}" objectClass/delete:FripostPendingEntry fripostPendingToken/delete done | isOK 'DENIED$' @@ -1226,11 +1459,11 @@ for L in ${LISTS}; do done | isOK '=rsd$' [ $? -eq 0 ] || exit $? -msg "Have =a access on domains' children attribute" +msg "Have =0 access on domains' children attribute" for D in ${DOMAINS}; do search -s base -b "${D},${SUFFIXV}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ checkACL "cn=CreateList" "${D}" children -done | isOK '=a$' +done | isOK '=0$' [ $? -eq 0 ] || exit $? msg "Have =0 access on other list attributes" @@ -1239,10 +1472,11 @@ for L in ${LISTS}; do done | isOK '=0$' fvl [ $? -eq 0 ] || exit $? -msg "Have =a access on list commands' entry attribute" +msg "Have =rsd access on pending list commands' \"entry\" attribute" for LC in ${LISTSC}; do + search -s base -b "${LC},${SUFFIXV}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' && \ checkACL "cn=CreateList" "${LC}" entry -done | isOK '=a$' +done | isOK '=rsd$' entry [ $? -eq 0 ] || exit $? msg "Have =0 access on other list command attributes" @@ -1251,6 +1485,13 @@ for LC in ${LISTSC}; do done | isOK '=0$' children [ $? -eq 0 ] || exit $? +msg "Cannot read non pending list commands" +for LC in ${LISTSC}; do + search -s base -b "${LC},${SUFFIXV}" "(objectClass=FripostPendingEntry)" | grep -q '^dn: ' || \ + checkACL "cn=CreateList" "${LC}" entry/read entry/write +done | isOK 'DENIED$' entry read +[ $? -eq 0 ] || exit $? + ########################################################################### -- cgit v1.2.3