fix: check assign-host previliges

pkg/compute/guestdrivers/kvm.go

@@ -553,6 +553,20 @@ func (self *SKVMGuestDriver) IsSupportLiveMigrate() bool {
 	return true
 }
 
+func checkAssignHost(userCred mcclient.TokenCredential, preferHost string) error {
+	iHost, _ := models.HostManager.FetchByIdOrName(userCred, preferHost)
+	if iHost == nil {
+		return httperrors.NewBadRequestError("Host %s not found", preferHost)
+	}
+	host := iHost.(*models.SHost)
+	if db.IsAdminAllowPerform(userCred, host, "assign-host") {
+	} else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId {
+	} else {
+		return httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host")
+	}
+	return nil
+}
+
 func (self *SKVMGuestDriver) CheckMigrate(guest *models.SGuest, userCred mcclient.TokenCredential, input api.GuestMigrateInput) error {
 	if len(guest.BackupHostId) > 0 {
 		return httperrors.NewBadRequestError("Guest have backup, can't migrate")
@@ -574,8 +588,9 @@ func (self *SKVMGuestDriver) CheckMigrate(guest *models.SGuest, userCred mcclien
 		return httperrors.NewBadRequestError("Cannot migrate with isolated devices")
 	}
 	if len(input.PreferHost) > 0 {
-		if !db.IsAdminAllowPerform(userCred, guest, "assign-host") {
-			return httperrors.NewBadRequestError("Only system admin can assign host")
+		err := checkAssignHost(userCred, input.PreferHost)
+		if err != nil {
+			return errors.Wrap(err, "checkAssignHost")
 		}
 	}
 	return nil
@@ -598,8 +613,9 @@ func (self *SKVMGuestDriver) CheckLiveMigrate(guest *models.SGuest, userCred mcc
 			return httperrors.NewBadRequestError("Cannot do live migrate, too low qemu version")
 		}
 		if len(input.PreferHost) > 0 {
-			if !db.IsAdminAllowPerform(userCred, guest, "assign-host") {
-				return httperrors.NewBadRequestError("Only system admin can assign host")
+			err := checkAssignHost(userCred, input.PreferHost)
+			if err != nil {
+				return errors.Wrap(err, "checkAssignHost")
 			}
 		}
 	}

pkg/compute/models/guest_actions.go

@@ -4410,15 +4410,18 @@ func (manager *SGuestManager) PerformBatchMigrate(ctx context.Context, userCred
 
 	var preferHostId string
 	if len(params.PreferHostId) > 0 {
-		if !db.IsAdminAllowPerform(userCred, manager, "assign-host") {
-			return nil, httperrors.NewBadRequestError("Only system admin can assign host")
-		}
 		iHost, _ := HostManager.FetchByIdOrName(userCred, params.PreferHostId)
 		if iHost == nil {
 			return nil, httperrors.NewBadRequestError("Host %s not found", params.PreferHostId)
 		}
 		host := iHost.(*SHost)
 		preferHostId = host.Id
+
+		if db.IsAdminAllowPerform(userCred, host, "assign-host") {
+		} else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId {
+		} else {
+			return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host")
+		}
 	}
 
 	guests := make([]SGuest, 0)

pkg/compute/models/helper.go

@@ -23,13 +23,10 @@ import (
 	"yunion.io/x/pkg/utils"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
-	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
-	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
-	"yunion.io/x/onecloud/pkg/util/rbacutils"
 )
 
 func RunBatchCreateTask(
@@ -55,18 +52,6 @@ func RunBatchCreateTask(
 	}
 }
 
-func allowAssignHost(userCred mcclient.TokenCredential) bool {
-	for _, scope := range []rbacutils.TRbacScope{
-		rbacutils.ScopeSystem,
-		rbacutils.ScopeDomain,
-	} {
-		if userCred.IsAllow(scope, consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") {
-			return true
-		}
-	}
-	return false
-}
-
 func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCredential, input *api.ServerCreateInput, hypervisor string) (*api.ServerCreateInput, error) {
 	var err error
 
@@ -77,9 +62,6 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred
 	// base validate_create_data
 	if (input.PreferHost != "") && hypervisor != api.HYPERVISOR_CONTAINER {
 
-		if !allowAssignHost(userCred) {
-			return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host")
-		}
 		bmName := input.PreferHost
 		bmObj, err := HostManager.FetchByIdOrName(nil, bmName)
 		if err != nil {
@@ -90,6 +72,13 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred
 			}
 		}
 		baremetal := bmObj.(*SHost)
+
+		if db.IsAdminAllowPerform(userCred, baremetal, "assign-host") {
+		} else if db.IsDomainAllowPerform(userCred, baremetal, "assign-host") && userCred.GetProjectDomainId() == baremetal.DomainId {
+		} else {
+			return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host")
+		}
+
 		if !baremetal.GetEnabled() {
 			return nil, httperrors.NewInvalidStatusError("Baremetal %s not enabled", bmName)
 		}

pkg/compute/models/hosts.go

@@ -4922,15 +4922,17 @@ func (host *SHost) PerformHostMaintenance(ctx context.Context, userCred mcclient
 	var preferHostId string
 	preferHost, _ := data.GetString("prefer_host")
 	if len(preferHost) > 0 {
-		if !db.IsAdminAllowPerform(userCred, host, "assign-host") {
-			return nil, httperrors.NewBadRequestError("Only system admin can assign host")
-		}
 		iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost)
 		if iHost == nil {
 			return nil, httperrors.NewBadRequestError("Host %s not found", preferHost)
 		}
 		host := iHost.(*SHost)
 		preferHostId = host.Id
+		if db.IsAdminAllowPerform(userCred, host, "assign-host") {
+		} else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId {
+		} else {
+			return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host")
+		}
 	}
 
 	guests := host.GetKvmGuests()