opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Automatic merge from release/2.3.0 -> release/2.4.0

Browse Source 
* commit 'b4150df337286fbfa40597d7247a8e9b594f152c':
  修正rbac，非管理模式下权限有deny, owner, user, guest四个级别，管理模式下，有deny, allow两个级别。只有非管理模式下，才会应用缺省的权限设置。
This commit is contained in:
邱剑
2018-11-30 13:56:01 +08:00
parent 6e9f010fa9 b4150df337
commit 5d3006c971
2 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/rbac.go
+13 -12
View File
@@ -1,8 +1,6 @@
package db
import (
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -14,9 +12,11 @@ func isListRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential,
}
func isListRbacAllowedInternal(manager IModelManager, resource string, userCred mcclient.TokenCredential, isAdminMode bool) bool {
log.Debugf("%s %s", manager.KeywordPlural(), resource)
var requireAdmin bool
ownerId := manager.GetOwnerId(userCred)
var ownerId string
if userCred != nil {
ownerId = manager.GetOwnerId(userCred)
}
if len(ownerId) > 0 {
if isAdminMode {
requireAdmin = true
@@ -36,8 +36,6 @@ func isListRbacAllowedInternal(manager IModelManager, resource string, userCred
return true
case result == rbacutils.OwnerAllow && !requireAdmin:
return true
case result == rbacutils.AdminAllow && requireAdmin:
return true
}
result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -52,7 +50,10 @@ func isJointListRbacAllowed(manager IJointModelManager, userCred mcclient.TokenC
func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential, ownerProjId string, action string, extra ...string) bool {
var requireAdmin bool
ownerId := manager.GetOwnerId(userCred)
var ownerId string
if userCred != nil {
ownerId = manager.GetOwnerId(userCred)
}
if len(ownerId) > 0 {
if ownerProjId == ownerId {
requireAdmin = false
@@ -72,8 +73,6 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
return true
case result == rbacutils.OwnerAllow && !requireAdmin:
return true
case result == rbacutils.AdminAllow && requireAdmin:
return true
}
result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -85,7 +84,11 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
var requireAdmin bool
var isOwner bool
ownerId := model.GetModelManager().GetOwnerId(userCred)
var ownerId string
if userCred != nil {
ownerId = model.GetModelManager().GetOwnerId(userCred)
}
if len(ownerId) > 0 {
objOwnerId := model.GetOwnerProjectId()
@@ -109,8 +112,6 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
return true
case result == rbacutils.OwnerAllow && isOwner && !requireAdmin:
return true
case result == rbacutils.AdminAllow && (requireAdmin || isOwner):
return true
}
result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
pkg/cloudcommon/policy/policy.go
+12 -1
View File
@@ -221,7 +221,7 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
currentPriv = result
}
}
if manager.defaultPolicy != nil {
if !isAdmin && manager.defaultPolicy != nil {
result := manager.defaultPolicy.Allow(userCredJson, service, resource, action, extra...)
if currentPriv.StricterThan(result) {
currentPriv = result
@@ -230,6 +230,17 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
if consts.IsRbacDebug() {
log.Debugf("[RBAC: %v] %s %s %s %#v permission %s", isAdmin, service, resource, action, extra, currentPriv)
}
if isAdmin {
switch currentPriv {
case rbacutils.OwnerAllow, rbacutils.UserAllow, rbacutils.GuestAllow:
currentPriv = rbacutils.AdminAllow
}
} else {
switch currentPriv {
case rbacutils.AdminAllow:
currentPriv = rbacutils.UserAllow
}
}
return currentPriv
}