Make the kadm5.acl example sane

It is an eggregious security violation to give all admin principals
admin rights and then give all null instances permission to change
the password of the associated admin instance.

While here, don't assume that admin and root are the only non-null
instances, and correct the formatting of an entry with restrictions.

diff --git a/doc/rst_source/krb_admins/conf_files/kadm5_acl.rst b/doc/rst_source/krb_admins/conf_files/kadm5_acl.rst
index 5f28b7acd5e745f95adb4eec44c37d614df50e4a..a02472e2111f3701bf7f55573b854cc385c6fcc0 100644 (file)
--- a/doc/rst_source/krb_admins/conf_files/kadm5_acl.rst
+++ b/doc/rst_source/krb_admins/conf_files/kadm5_acl.rst
@@ -101,9 +101,9 @@ Here is an example of a kadm5.acl file.
     */admin@ATHENA.MIT.EDU        *                           # line 1
     joeadmin@ATHENA.MIT.EDU   ADMCIL                          # line 2
     joeadmin/*@ATHENA.MIT.EDU il  */root@ATHENA.MIT.EDU       # line 3
-    *@ATHENA.MIT.EDU          cil *1/admin@ATHENA.MIT.EDU     # line 4
+    */root@ATHENA.MIT.EDU     cil *1@ATHENA.MIT.EDU           # line 4
     */*@ATHENA.MIT.EDU        i                               # line 5
-    */admin@EXAMPLE.COM       * -maxlife 9h -postdateable     # line 6
+    */admin@EXAMPLE.COM       x   * -maxlife 9h -postdateable # line 6
 
 (line 1) Any principal in the ``ATHENA.MIT.EDU`` realm with
 an ``admin`` instance has all administrative privileges.
@@ -111,13 +111,14 @@ an ``admin`` instance has all administrative privileges.
 (lines 1-3) The user ``joeadmin`` has all permissions with his
 ``admin`` instance, ``joeadmin/admin@ATHENA.MIT.EDU`` (matches line
 1).  He has no permissions at all with his null instance,
-``joeadmin@ATHENA.MIT.EDU`` (matches line 2).  His root instance has
-inquire and list permissions with any other principal that has the
-instance root (matches line 3).
-
-(line 4) Any principal in ``ATHENA.MIT.EDU`` can inquire, list,
-or change the password of their ``admin`` instance, but not any other
-admin instance.  (Here, "\*1" denotes a back-reference to the first
+``joeadmin@ATHENA.MIT.EDU`` (matches line 2).  His ``root`` and other
+non-``admin``, non-null instances (e.g., ``extra`` or ``dbadmin``) have
+inquire and list permissions with any principal that has the
+instance ``root`` (matches line 3).
+
+(line 4) Any ``root`` principal in ``ATHENA.MIT.EDU`` can inquire, list,
+or change the password of their null instance, but not any other
+null instance.  (Here, "\*1" denotes a back-reference to the first
 component of the actor principal.)
 
 (line 5) Any principal in the realm ``ATHENA.MIT.EDU`` (except for