freeipa

#8382 ipa sudorule allows deny commands with usercat=all
Closed: fixed by antorres. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla: Bug 1848229

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Description of problem:
After adding deny commands into sudo rule, 'Command category' still shows all.
Version-Release number of selected component (if applicable):
  ipa-server-4.6.4-10.el7.x86_64
How reproducible:
  100% percent.
Steps to Reproduce:
# kinit admin
# ipa sudocmd-add '/bin/sh'
# ipa sudorule-add --hostcat='all' --usercat='all' --cmdcat='all' --order='7'
deny_sudo_-s
# ipa sudorule-add-deny-command --sudocmds='/bin/sh' deny_sudo_-s
# ipa sudorule-show deny_sudo_-s --all
Actual results:
  The mutex parameters 'Command category' and 'Sudo Deny Commands' are shown
simultaneously in 'ipa sudorule-show' result.
Expected results:
  Only 'Sudo Deny Commands' can be seen.
Additional info:

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1848229

BZ got closed so closing this too.

Metadata Update from @antorres:
- Custom field affects_doc adjusted to on
- Custom field knownissue adjusted to on
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
on
on
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.