POSIXUsers: allow better <MemberOf group="foo"/> syntax

6 files changed, 35 insertions, 22 deletions

diff --git a/doc/server/plugins/generators/rules.txt b/doc/server/plugins/generators/rules.txt
index 845006115..2493be53f 100644
--- a/doc/server/plugins/generators/rules.txt
+++ b/doc/server/plugins/generators/rules.txt
@@ -395,9 +395,9 @@ For example:
 
     <POSIXUser name="daemon" home="/sbin" shell="/sbin/nologin"
                gecos="daemon" uid="2" group="daemon">
-      <MemberOf>lp</MemberOf>
-      <MemberOf>adm</MemberOf>
-      <MemberOf>bin</MemberOf>
+      <MemberOf group="lp"/>
+      <MemberOf group="adm"/>
+      <MemberOf group="bin/>
     </POSIXUser>
 
 The group specified will automatically be created if it does not
diff --git a/schemas/types.xsd b/schemas/types.xsd
index 31fea26a2..05bf674ad 100644
--- a/schemas/types.xsd
+++ b/schemas/types.xsd
@@ -381,6 +381,27 @@
     </xsd:restriction>
   </xsd:simpleType>
 
+  <xsd:complexType name="MemberOfType">
+    <xsd:annotation>
+      <xsd:documentation>
+        Specify additional supplementary groups for the POSIXUser
+      </xsd:documentation>
+    </xsd:annotation>
+    <xsd:simpleContent>
+      <xsd:extension base="xsd:token">
+        <xsd:attribute name="group" type="xsd:token">
+          <xsd:annotation>
+            <xsd:documentation>
+              The name of the supplementary group.  This can also be
+              specified as content of the tag, although that is
+              deprecated.
+            </xsd:documentation>
+          </xsd:annotation>
+        </xsd:attribute>
+      </xsd:extension>
+    </xsd:simpleContent>
+  </xsd:complexType>
+
   <xsd:complexType name="POSIXUserType">
     <xsd:annotation>
       <xsd:documentation>
@@ -388,13 +409,7 @@
       </xsd:documentation>
     </xsd:annotation>
     <xsd:choice minOccurs='0' maxOccurs='unbounded'>
-      <xsd:element name='MemberOf' type='xsd:token'>
-        <xsd:annotation>
-          <xsd:documentation>
-            Specify additional supplementary groups for the POSIXUser
-          </xsd:documentation>
-        </xsd:annotation>
-      </xsd:element>
+      <xsd:element name='MemberOf' type='MemberOfType'/>
     </xsd:choice>
     <xsd:attribute type="xsd:token" name="name" use="required">
       <xsd:annotation>
diff --git a/src/lib/Bcfg2/Client/Tools/POSIXUsers.py b/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
index 0250a1a42..8226392f9 100644
--- a/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
+++ b/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
@@ -154,7 +154,8 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
         if entry.get("current_exists", "true") == "true":
             # verify supplemental groups
             actual = [g[0] for g in self.user_supplementary_groups(entry)]
-            expected = [e.text.strip() for e in entry.findall("MemberOf")]
+            expected = [e.get("group", e.text).strip()
+                        for e in entry.findall("MemberOf")]
             if set(expected) != set(actual):
                 entry.set('qtext',
                           "\n".join([entry.get('qtext', '')] +
@@ -252,7 +253,8 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
                 if entry.get('uid'):
                     cmd.extend(['-u', entry.get('uid')])
                 cmd.extend(['-g', entry.get('group')])
-                extras = [e.text.strip() for e in entry.findall("MemberOf")]
+                extras = [e.get("group", e.text).strip()
+                          for e in entry.findall("MemberOf")]
                 if extras:
                     cmd.extend(['-G', ",".join(extras)])
                 cmd.extend(['-d', entry.get('home')])
diff --git a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
index 40ff71dbd..6e47acfc0 100644
--- a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
+++ b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
@@ -115,8 +115,7 @@ class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
             SEInterface={None: dict(name=None, selinuxtype=is_selinux_type)},
             SEPermissive={None: dict(name=is_selinux_type)},
             POSIXGroup={None: dict(name=is_username)},
-            POSIXUser={None: dict(name=is_username)},
-            MemberOf={None: dict(__text__=is_username)})
+            POSIXUser={None: dict(name=is_username)})
 
     def Run(self):
         self.check_packages()
diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
index 4fcd63a60..9478f7071 100644
--- a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
+++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
@@ -227,8 +227,7 @@ class TestPOSIXUsers(TestTool):
         users.user_supplementary_groups.assert_called_with(entry)
 
         reset()
-        m1 = lxml.etree.SubElement(entry, "MemberOf")
-        m1.text = "wheel"
+        m1 = lxml.etree.SubElement(entry, "MemberOf", group="wheel")
         m2 = lxml.etree.SubElement(entry, "MemberOf")
         m2.text = "users"
         self.assertTrue(users.VerifyPOSIXUser(entry, []))
@@ -237,8 +236,7 @@ class TestPOSIXUsers(TestTool):
         users.user_supplementary_groups.assert_called_with(entry)
 
         reset()
-        m3 = lxml.etree.SubElement(entry, "MemberOf")
-        m3.text = "extra"
+        m3 = lxml.etree.SubElement(entry, "MemberOf", group="extra")
         self.assertFalse(users.VerifyPOSIXUser(entry, []))
         users.populate_user_entry.assert_called_with(entry)
         users._verify.assert_called_with(users.populate_user_entry.return_value)
@@ -373,8 +371,7 @@ class TestPOSIXUsers(TestTool):
         entry = lxml.etree.Element("POSIXUser", name="test", group="test",
                                    home="/home/test", shell="/bin/zsh",
                                    gecos="Test McTest")
-        m1 = lxml.etree.SubElement(entry, "MemberOf")
-        m1.text = "wheel"
+        m1 = lxml.etree.SubElement(entry, "MemberOf", group="wheel")
         m2 = lxml.etree.SubElement(entry, "MemberOf")
         m2.text = "users"
 
diff --git a/tools/posixusers_baseline.py b/tools/posixusers_baseline.py
index a4abca42d..c45e54f1a 100755
--- a/tools/posixusers_baseline.py
+++ b/tools/posixusers_baseline.py
@@ -61,8 +61,8 @@ def main():
         if entry.tag == 'POSIXUser':
             entry.set("group", grp.getgrgid(data[3])[0])
             for group in users.user_supplementary_groups(entry):
-                memberof = lxml.etree.SubElement(entry, "MemberOf")
-                memberof.text = group[0]
+                memberof = lxml.etree.SubElement(entry, "MemberOf",
+                                                 group=group[0])
 
         entry.tag = "Bound" + entry.tag
         baseline.append(entry)