From 4d5aadb64bf7291c08989d04da6cf0eb454c8a22 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Mon, 7 Sep 2020 18:12:24 +0800 Subject: [PATCH] fix: check assign-host previliges --- pkg/compute/guestdrivers/kvm.go | 24 ++++++++++++++++++++---- pkg/compute/models/guest_actions.go | 9 ++++++--- pkg/compute/models/helper.go | 25 +++++++------------------ pkg/compute/models/hosts.go | 8 +++++--- 4 files changed, 38 insertions(+), 28 deletions(-) diff --git a/pkg/compute/guestdrivers/kvm.go b/pkg/compute/guestdrivers/kvm.go index 414a309757..63f794dc8e 100644 --- a/pkg/compute/guestdrivers/kvm.go +++ b/pkg/compute/guestdrivers/kvm.go @@ -553,6 +553,20 @@ func (self *SKVMGuestDriver) IsSupportLiveMigrate() bool { return true } +func checkAssignHost(userCred mcclient.TokenCredential, preferHost string) error { + iHost, _ := models.HostManager.FetchByIdOrName(userCred, preferHost) + if iHost == nil { + return httperrors.NewBadRequestError("Host %s not found", preferHost) + } + host := iHost.(*models.SHost) + if db.IsAdminAllowPerform(userCred, host, "assign-host") { + } else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId { + } else { + return httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host") + } + return nil +} + func (self *SKVMGuestDriver) CheckMigrate(guest *models.SGuest, userCred mcclient.TokenCredential, input api.GuestMigrateInput) error { if len(guest.BackupHostId) > 0 { return httperrors.NewBadRequestError("Guest have backup, can't migrate") @@ -574,8 +588,9 @@ func (self *SKVMGuestDriver) CheckMigrate(guest *models.SGuest, userCred mcclien return httperrors.NewBadRequestError("Cannot migrate with isolated devices") } if len(input.PreferHost) > 0 { - if !db.IsAdminAllowPerform(userCred, guest, "assign-host") { - return httperrors.NewBadRequestError("Only system admin can assign host") + err := checkAssignHost(userCred, input.PreferHost) + if err != nil { + return errors.Wrap(err, "checkAssignHost") } } return nil @@ -598,8 +613,9 @@ func (self *SKVMGuestDriver) CheckLiveMigrate(guest *models.SGuest, userCred mcc return httperrors.NewBadRequestError("Cannot do live migrate, too low qemu version") } if len(input.PreferHost) > 0 { - if !db.IsAdminAllowPerform(userCred, guest, "assign-host") { - return httperrors.NewBadRequestError("Only system admin can assign host") + err := checkAssignHost(userCred, input.PreferHost) + if err != nil { + return errors.Wrap(err, "checkAssignHost") } } } diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 2d3f25485e..596c4b79ca 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -4410,15 +4410,18 @@ func (manager *SGuestManager) PerformBatchMigrate(ctx context.Context, userCred var preferHostId string if len(params.PreferHostId) > 0 { - if !db.IsAdminAllowPerform(userCred, manager, "assign-host") { - return nil, httperrors.NewBadRequestError("Only system admin can assign host") - } iHost, _ := HostManager.FetchByIdOrName(userCred, params.PreferHostId) if iHost == nil { return nil, httperrors.NewBadRequestError("Host %s not found", params.PreferHostId) } host := iHost.(*SHost) preferHostId = host.Id + + if db.IsAdminAllowPerform(userCred, host, "assign-host") { + } else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId { + } else { + return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host") + } } guests := make([]SGuest, 0) diff --git a/pkg/compute/models/helper.go b/pkg/compute/models/helper.go index 08f568b111..f165f44285 100644 --- a/pkg/compute/models/helper.go +++ b/pkg/compute/models/helper.go @@ -23,13 +23,10 @@ import ( "yunion.io/x/pkg/utils" api "yunion.io/x/onecloud/pkg/apis/compute" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" - "yunion.io/x/onecloud/pkg/util/rbacutils" ) func RunBatchCreateTask( @@ -55,18 +52,6 @@ func RunBatchCreateTask( } } -func allowAssignHost(userCred mcclient.TokenCredential) bool { - for _, scope := range []rbacutils.TRbacScope{ - rbacutils.ScopeSystem, - rbacutils.ScopeDomain, - } { - if userCred.IsAllow(scope, consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { - return true - } - } - return false -} - func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCredential, input *api.ServerCreateInput, hypervisor string) (*api.ServerCreateInput, error) { var err error @@ -77,9 +62,6 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred // base validate_create_data if (input.PreferHost != "") && hypervisor != api.HYPERVISOR_CONTAINER { - if !allowAssignHost(userCred) { - return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host") - } bmName := input.PreferHost bmObj, err := HostManager.FetchByIdOrName(nil, bmName) if err != nil { @@ -90,6 +72,13 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred } } baremetal := bmObj.(*SHost) + + if db.IsAdminAllowPerform(userCred, baremetal, "assign-host") { + } else if db.IsDomainAllowPerform(userCred, baremetal, "assign-host") && userCred.GetProjectDomainId() == baremetal.DomainId { + } else { + return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host") + } + if !baremetal.GetEnabled() { return nil, httperrors.NewInvalidStatusError("Baremetal %s not enabled", bmName) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 0a8bb57291..4250ade053 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -4922,15 +4922,17 @@ func (host *SHost) PerformHostMaintenance(ctx context.Context, userCred mcclient var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !db.IsAdminAllowPerform(userCred, host, "assign-host") { - return nil, httperrors.NewBadRequestError("Only system admin can assign host") - } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) if iHost == nil { return nil, httperrors.NewBadRequestError("Host %s not found", preferHost) } host := iHost.(*SHost) preferHostId = host.Id + if db.IsAdminAllowPerform(userCred, host, "assign-host") { + } else if db.IsDomainAllowPerform(userCred, host, "assign-host") && userCred.GetProjectDomainId() == host.DomainId { + } else { + return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can assign host") + } } guests := host.GetKvmGuests()