From 03415210a74739563a54c1b3a9ae786027a0d8be Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sat, 19 Jan 2013 02:21:23 +0100 Subject: =?UTF-8?q?CanCreate=20=E2=86=92=20CanAdd?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ldap/test-user-acl.sh | 134 +++++++++++++++++++++++++------------------------- 1 file changed, 67 insertions(+), 67 deletions(-) (limited to 'ldap/test-user-acl.sh') diff --git a/ldap/test-user-acl.sh b/ldap/test-user-acl.sh index c55916e..9b954c7 100755 --- a/ldap/test-user-acl.sh +++ b/ldap/test-user-acl.sh @@ -168,36 +168,36 @@ echo "Authenticated users, access to domain entries" # * entry: # =s-a for all -# +rd if children, canCreate{Alias,List}, owner or postmaster +# +rd if children, canAdd{Alias,List}, owner or postmaster # +z if owner or postmaster # * children: # =w for all # * objectClass: # =s for all # * fvd: -# =rscd if children, canCreate{Alias,List}, owner or postmaster +# =rscd if children, canAdd{Alias,List}, owner or postmaster # +w if owner or postmaster # * fripostIsStatusActive -# =rscd if children, canCreate{Alias,List}, owner or postmaster +# =rscd if children, canAdd{Alias,List}, owner or postmaster # +w if owner or postmaster -# * fripostCanCreateAlias -# =rscd if canCreateAlias, owner or postmaster +# * fripostCanAddAlias +# =rscd if canAddAlias, owner or postmaster # +w if postmaster -# * fripostCanCreateList -# =rscd if canCreateList, owner or postmaster +# * fripostCanAddList +# =rscd if canAddList, owner or postmaster # +w if postmaster # * fripostOwner # =s for all # +d if children -# +rc if canCreate{Alias,List}, owner or postmaster +# +rc if canAdd{Alias,List}, owner or postmaster # * fripostPostmaster # =s for all # +d if children -# +rc if canCreate{Alias,List}, owner or postmaster +# +rc if canAdd{Alias,List}, owner or postmaster # * fripostOptionalMaildrop # =wrscd if owner or postmaster # * description -# =rscd if children, canCreate{Alias,List}, owner or postmaster +# =rscd if children, canAdd{Alias,List}, owner or postmaster # +w if owner or postmaster usersD () { @@ -236,8 +236,8 @@ usersD ${OPERATTRS} | isOK '=0$' entryUUID # We check the following permissions: # 0. Simple user -# 1. canCreateAlias (exact,wildcard) -# 2. canCreateList (exact,wildcard) +# 1. canAddAlias (exact,wildcard) +# 2. canAddList (exact,wildcard) # 3. Owner # 4. Postmaster @@ -259,11 +259,11 @@ done | isOK 'ALLOWED$' entry read # 1 ATTRSA="fripostOwner/read fripostOwner/compare fripostPostmaster/read fripostPostmaster/compare - fripostCanCreateAlias/read fripostCanCreateAlias/search fripostCanCreateAlias/compare fripostCanCreateAlias/disclose" -msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateAlias, exact)" + fripostCanAddAlias/read fripostCanAddAlias/search fripostCanAddAlias/compare fripostCanAddAlias/disclose" +msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddAlias, exact)" for U in ${USERS}; do for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "fripostCanCreateAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${D},${SUFFIX}" "fripostCanAddAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA} done done | isOK 'ALLOWED$' children @@ -271,11 +271,11 @@ done | isOK 'ALLOWED$' children # 1 -msg "Have >=rscd to the public attributes and >=a to \"children\" (if CanCreateAlias, wildcard)" +msg "Have >=rscd to the public attributes and >=a to \"children\" (if CanAddAlias, wildcard)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "fripostCanCreateAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${D},${SUFFIX}" "fripostCanAddAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA} done done | isOK 'ALLOWED$' children @@ -285,11 +285,11 @@ done | isOK 'ALLOWED$' children # 2 ATTRSL="fripostOwner/read fripostOwner/compare fripostPostmaster/read fripostPostmaster/compare - fripostCanCreateList/read fripostCanCreateList/search fripostCanCreateList/compare fripostCanCreateList/disclose" -msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateList, exact)" + fripostCanAddList/read fripostCanAddList/search fripostCanAddList/compare fripostCanAddList/disclose" +msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, exact)" for U in ${USERS}; do for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "fripostCanCreateList=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${D},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL} done done | isOK 'ALLOWED$' children @@ -297,11 +297,11 @@ done | isOK 'ALLOWED$' children # 2 -msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateList, wildcard)" +msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, wildcard)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "fripostCanCreateList=${DU},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${D},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL} done done | isOK 'ALLOWED$' children @@ -309,10 +309,10 @@ done | isOK 'ALLOWED$' children # 3 -# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanCreateAlias" and -# "fripostCanCreateList", and =wrscd to the rest (other than "Owner" and +# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and +# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and # Postmaster") -msg "Have =wrscd to the domain attributes (other than \"canCreate\"), and >=w to \"children\" (if Owner)" +msg "Have =wrscd to the domain attributes (other than \"canAdd\"), and >=w to \"children\" (if Owner)" ATTRSO="entry/delete fvd/write fripostIsStatusActive/write @@ -328,12 +328,12 @@ done | isOK 'ALLOWED$' children # 4 -# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanCreateAlias" and -# "fripostCanCreateList", and =wrscd to the rest (other than "Owner" and +# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and +# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and # Postmaster") msg "Have =wrscd to the domain attributes, and >=w to \"children\" (if Postmaster)" -ATTRSP="fripostCanCreateAlias/add fripostCanCreateAlias/delete - fripostCanCreateList/add fripostCanCreateList/delete" +ATTRSP="fripostCanAddAlias/add fripostCanAddAlias/delete + fripostCanAddList/add fripostCanAddList/delete" for U in ${USERS}; do for D in ${DOMAINS}; do search -s base -b "${D},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' && \ @@ -349,10 +349,10 @@ for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do [ "x${DU}" = "x${D}" ] || \ - search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX}) - (fripostCanCreateAlias=${DU},${SUFFIX}) - (fripostCanCreateList=${U},${SUFFIX}) - (fripostCanCreateList=${DU},${SUFFIX}) + search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX}) + (fripostCanAddAlias=${DU},${SUFFIX}) + (fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ checkACL "${U}" "${D}" ${ATTRS0} @@ -362,14 +362,14 @@ done | isOK 'DENIED$' entry read # not (1 or 2 or 3 or 4) -msg "Do not have >=rc access to \"canCreate{Alias,List}\", \"Owner\", \"Postmaster\" (unless member)" +msg "Do not have >=rc access to \"canAdd{Alias,List}\", \"Owner\", \"Postmaster\" (unless member)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX}) - (fripostCanCreateAlias=${DU},${SUFFIX}) - (fripostCanCreateList=${U},${SUFFIX}) - (fripostCanCreateList=${DU},${SUFFIX}) + search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX}) + (fripostCanAddAlias=${DU},${SUFFIX}) + (fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ checkACL "${U}" "${D}" ${ATTRSA} ${ATTRSL} entry/add @@ -379,30 +379,30 @@ done | isOK 'DENIED$' entry # "entry" here is useless, but it's just to get the # not (1 or 3 or 4) -msg "Have =0 access to \"canCreateAlias\" (unless member, Owner, or Postmaster)" +msg "Have =0 access to \"canAddAlias\" (unless member, Owner, or Postmaster)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX}) - (fripostCanCreateAlias=${DU},${SUFFIX}) + search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX}) + (fripostCanAddAlias=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ - checkACL "${U}" "${D}" fripostCanCreateAlias entry/add + checkACL "${U}" "${D}" fripostCanAddAlias entry/add done done | isOK '\(=0\|DENIED\)$' entry # "entry" here is useless, but it's just to get the count [ $? -eq 0 ] || exit $? # not (2 or 3 or 4) -msg "Have =0 access to \"canCreateList\" (unless member, Owner, or Postmaster)" +msg "Have =0 access to \"canAddList\" (unless member, Owner, or Postmaster)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for D in ${DOMAINS}; do - search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateList=${U},${SUFFIX}) - (fripostCanCreateList=${DU},${SUFFIX}) + search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ - checkACL "${U}" "${D}" fripostCanCreateList entry/add + checkACL "${U}" "${D}" fripostCanAddList entry/add done done | isOK '\(=0\|DENIED\)$' entry # "entry" here is useless, but it's just to get the count [ $? -eq 0 ] || exit $? @@ -421,7 +421,7 @@ done | isOK 'DENIED$' entry # not 4 -msg "Do not have >=w access to \"canCreate{Alias,List}\" (unless Postmaster)" +msg "Do not have >=w access to \"canAdd{Alias,List}\" (unless Postmaster)" for U in ${USERS}; do for D in ${DOMAINS}; do search -s base -b "${D},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' || \ @@ -550,7 +550,7 @@ echo "Authenticated users, access to alias entries" # * entry: # =s for all -# +a if canCreateAlias +# +a if canAddAlias # +zrd if alias owner, domain owner or domain postmaster # * children: # =0 for all @@ -633,11 +633,11 @@ done | isOK 'ALLOWED$' entry add # Needed to create new entries. ("+z" is required to delete, btw.) -msg "Have >=a access to \"entry\" (if CanCreateAlias, exact)" +msg "Have >=a access to \"entry\" (if CanAddAlias, exact)" for U in ${USERS}; do for A in ${ALIASES}; do DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DA},${SUFFIX}" "fripostCanCreateAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${A}" entry/add done done | isOK 'ALLOWED$' entry add @@ -645,25 +645,25 @@ done | isOK 'ALLOWED$' entry add # Needed to create new entries. ("+z" is required to delete, btw.) -msg "Have >=a access to \"entry\" (if CanCreateAlias, wildcard)" +msg "Have >=a access to \"entry\" (if CanAddAlias, wildcard)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for A in ${ALIASES}; do DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DA},${SUFFIX}" "fripostCanCreateAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${A}" entry/add done done | isOK 'ALLOWED$' entry add [ $? -eq 0 ] || exit $? -msg "Do not have >=a access to \"entry\" (unless canCreateAlias)" +msg "Do not have >=a access to \"entry\" (unless canAddAlias)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for A in ${ALIASES}; do DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DA},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX}) - (fripostCanCreateAlias=${DU},${SUFFIX}) + search -s base -b "${DA},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX}) + (fripostCanAddAlias=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ checkACL "${U}" "${A}" entry/add @@ -706,7 +706,7 @@ echo "Authenticated users, access to list entries" # * entry: # =s for all -# +a if canCreateList, domain owner or domain postmaster +# +a if canAddList, domain owner or domain postmaster # +rd if list owner, domain owner or domain postmaster # * children: # =0 for all @@ -806,11 +806,11 @@ done | isOK 'ALLOWED$' entry add # Needed to create new entries. ("+z" is required to delete, btw.) -msg "Have >=a access to \"entry\" (if CanCreateList, exact)" +msg "Have >=a access to \"entry\" (if CanAddList, exact)" for U in ${USERS}; do for L in ${LISTS}; do DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DL},${SUFFIX}" "fripostCanCreateList=${U},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${L}" entry/add done done | isOK 'ALLOWED$' entry @@ -818,25 +818,25 @@ done | isOK 'ALLOWED$' entry # Needed to create new entries. ("+z" is required to delete, btw.) -msg "Have >=a access to \"entry\" (if CanCreateList, wildcard)" +msg "Have >=a access to \"entry\" (if CanAddList, wildcard)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for L in ${LISTS}; do DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DL},${SUFFIX}" "fripostCanCreateList=${DU},${SUFFIX}" | grep -q '^dn: ' && \ + search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \ checkACL "${U}" "${L}" entry/add done done | isOK 'ALLOWED$' entry [ $? -eq 0 ] || exit $? -msg "Do not have >=a access to \"entry\" (unless canCreateList)" +msg "Do not have >=a access to \"entry\" (unless canAddList)" for U in ${USERS}; do DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" for L in ${LISTS}; do DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')" - search -s base -b "${DL},${SUFFIX}" "(|(fripostCanCreateList=${U},${SUFFIX}) - (fripostCanCreateList=${DU},${SUFFIX}) + search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX}) + (fripostCanAddList=${DU},${SUFFIX}) (fripostOwner=${U},${SUFFIX}) (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \ checkACL "${U}" "${L}" entry/add @@ -893,7 +893,7 @@ done | isOK '=rsd$' entry msg "Have =0 access on other domain attributes" for D in ${DOMAINS}; do - checkACL "cn=SMTP" "${D}" children ${OPERATTRS} fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description + checkACL "cn=SMTP" "${D}" children ${OPERATTRS} fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description done | isOK 'none(=0)$' children msg "Can read and search the user attributes it needs" @@ -944,7 +944,7 @@ echo "Service ListCreator" msg "Have =0 access on domain attributes" for D in ${DOMAINS}; do - checkACL "cn=ListCreator" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description + checkACL "cn=ListCreator" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description done | isOK '=0$' entry msg "Have =0 access on user attributes" @@ -995,7 +995,7 @@ echo "Service AdminWebPanel" msg "Have =0 access on domain attributes" for D in ${DOMAINS}; do - checkACL "cn=AdminWebPanel" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description + checkACL "cn=AdminWebPanel" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description done | isOK 'none(=0)$' entry msg "Have =0 access on user attributes" @@ -1018,7 +1018,7 @@ for LC in ${LISTSC}; do checkACL "cn=AdminWebPanel" "${LC}" entry children ${OPERATTRS} fvlc fripostLocalAlias done | isOK 'none(=0)$' entry -if sudo -u fpanel klist >/dev/null; then +if test -x /usr/bin/sudo && sudo -u fpanel klist >/dev/null; then msg "Can SASL authenticate (GSSAPI)" DN=$(echo "dn:cn=AdminWebPanel,${SUFFIXS}" | tr [A-Z] [a-z]) DN2=$(sudo -u fpanel ldapwhoami -Q | tr [A-Z] [a-z]) -- cgit v1.2.3