[Freeipa-devel] [PATCHES] 0540-0542 Add managed read permissions to user

[Martin Kosek]

On 05/22/2014 04:20 PM, Petr Viktorin wrote:
> On 05/21/2014 12:14 PM, Simo Sorce wrote:
>> On Wed, 2014-05-21 at 08:03 +0200, Martin Kosek wrote:
>>> On 05/16/2014 04:33 PM, Petr Viktorin wrote:
>>>> On 05/16/2014 01:54 PM, Martin Kosek wrote:
>>>>> On 04/29/2014 11:00 PM, Petr Viktorin wrote:
>>>>>> Patch 0540 adds a bunch of managed read ACIs for user, as discussed
>>>>>> previously
>>>>>> [0].
>>>>>>
>>>>>> Patch 0541 is some minor refactoring for the next part.
>>>>>>
>>>>>> Patch 0542 sets the read acces to addressbook attributes to anonymous when
>>>>>> upgrading from pre-4.0.
>>>>>> I first this by checking if the update is run from ipa-server-install or
>>>>>> not,
>>>>>> but then I realized the logic I want is simple: if the global anon read ACI
>>>>>> exists, we want to preserve its spirit by setting addressbook attribute
>>>>>> ACI to
>>>>>> anonymous.
>>>>>>
>>>>>>
>>>>>> [0] http://www.redhat.com/archives/freeipa-devel/2014-April/msg00363.html et
>>>>>> al.
>>>>>>
>>>>>
>>>>> 540:
>>>>>
>>>>> Looks good! The only attributes I am concerned about are special IPA
>>>>> attributes:
>>>>>
>>>>> - ipauniqueid
>>>>> - ipasshpubkey
>>>>> - ipauserauthtype
>>>>> - userclass
>>>>>
>>>>> I personally do not think they should be included in POSIX attributes
>>>>> permissions, they are far from POSIX definition...
>>>>>
>>>>> What about creating one more permission "System: Read User IPA Attributes" as
>>>>> these are specific to FreeIPA use and allowing that permission for all
>>>>> authenticated users?
>>>>
>>>> Sounds reasonable. I assume we want this one to be also set to anonymous when
>>>> upgrading from old versions.
>>>> Attaching updated patches.
>>>
>>> Ok, looks good.
>>>
>>> I am now just pondering whether "System: Read User POSIX Attributes" is the
>>> right name for the permission as there are not just POSIX attributes, but also
>>> attributes from organizationalPerson or inetOrgPerson objectclasses.
>>>
>>> Maybe we should name it "System: Read User Core Attributes" or "System: Read
>>> User Basic Attributes"? Simo, any preference?
>>
>> We could use: "System: Read User Standard Attributes"
> 
> I've used this one, then.
> 
>>
>> but the 'posix' version is also ok to me.
> 
> On Wed, 2014-05-21 at 08:03 +0200, Martin Kosek wrote:
>> Also, I just realized we forgot memberOf attribute - it needs to be available
>> to authenticated users otherwise group membership will fall apart.
> 
> Good catch. Added.
> 

We are very close to push this one - I have just one last concern about
userpkcs12 attribute. On upgrade, we previously hidden userpkcs12 from user,
now we added it to be read by default. This results in this warning during upgrade:

Excluded attributes for System: Read User Addressbook Attributes: userpkcs12

Simo (or others), is this OK or do we want to keep hiding userpkcs12 by default?

Martin