修正：普通用户无法访问admin权限的资源

pkg/cloudcommon/db/rbac.go

@@ -54,14 +54,14 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
 	} else {
 		requireAdmin = true
 	}
-	if !requireAdmin {
-		result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
-			manager.KeywordPlural(), action, extra...)
-		if result == rbacutils.Allow || result == rbacutils.OwnerAllow {
-			return true
-		}
+	// if !requireAdmin {
+	result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
+		manager.KeywordPlural(), action, extra...)
+	if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow) {
+		return true
 	}
-	result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
+	// }
+	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 		manager.KeywordPlural(), action, extra...)
 	return result == rbacutils.Allow
 }
@@ -85,14 +85,14 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 		requireAdmin = true
 	}
 
-	if !requireAdmin {
-		result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
-			manager.KeywordPlural(), action, extra...)
-		if result == rbacutils.Allow || (result == rbacutils.OwnerAllow && isOwner) {
-			return true
-		}
+	//if !requireAdmin {
+	result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
+		manager.KeywordPlural(), action, extra...)
+	if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow && isOwner) {
+		return true
 	}
-	result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
+	//}
+	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 		manager.KeywordPlural(), action, extra...)
 	return result == rbacutils.Allow
 }

pkg/cloudcommon/policy/policy.go

@@ -52,12 +52,12 @@ func parseJsonPolicy(obj jsonutils.JSONObject) (string, rbacutils.SRbacPolicy, e
 		return "", policy, err
 	}
 
-	blobStr, err := obj.GetString("blob")
+	blobStr, err := obj.GetString("policy")
 	if err != nil {
 		log.Errorf("get blob error %s", err)
 		return "", policy, err
 	}
-	blob, err := jsonutils.ParseString(blobStr)
+	blob, err := jsonutils.ParseYAML(blobStr)
 	if err != nil {
 		log.Errorf("parse blob json error %s", err)
 		return "", policy, err
@@ -77,14 +77,12 @@ func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRb
 	policies := make(map[string]rbacutils.SRbacPolicy)
 	adminPolicies := make(map[string]rbacutils.SRbacPolicy)
 
-	modules.Policies.SetEnableFilter(false)
-
 	offset := 0
 	for {
 		params := jsonutils.NewDict()
 		params.Add(jsonutils.NewInt(2048), "limit")
 		params.Add(jsonutils.NewInt(int64(offset)), "offset")
-		result, err := modules.Policies.ResourceManager.List(s, params)
+		result, err := modules.Policies.List(s, params)
 
 		if err != nil {
 			log.Errorf("fetch policy failed")

pkg/compute/usages/handler.go

@@ -286,19 +286,27 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo
 		}
 	}
 
+	includeCommon := false
 	if consts.IsRbacEnabled() {
 		if policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
 			"usages", policy.PolicyActionGet) == rbacutils.Deny {
-			err = httperrors.NewForbiddenError("not allow to get usages")
-			return
+			if !isAdmin {
+				err = httperrors.NewForbiddenError("not allow to get usages")
+				return
+			}
+		} else {
+			includeCommon = true
 		}
 	}
 
-	commonUsage, err := getCommonGeneralUsage(userCred, rangeObj, hostTypes)
-	if err != nil {
-		return
+	if includeCommon {
+		var commonUsage map[string]interface{}
+		commonUsage, err = getCommonGeneralUsage(userCred, rangeObj, hostTypes)
+		if err != nil {
+			return
+		}
+		count.Include(commonUsage)
 	}
-	count.Include(commonUsage)
 	return
 }