From 2f22ebe0a889ac7ce78e0dd980e59227a954c3eb Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Thu, 29 Nov 2018 23:13:53 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3rbac=EF=BC=8C=E9=9D=9E?=
 =?UTF-8?q?=E7=AE=A1=E7=90=86=E6=A8=A1=E5=BC=8F=E4=B8=8B=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E6=9C=89deny,=20owner,=20user,=20guest=E5=9B=9B=E4=B8=AA?=
 =?UTF-8?q?=E7=BA=A7=E5=88=AB=EF=BC=8C=E7=AE=A1=E7=90=86=E6=A8=A1=E5=BC=8F?=
 =?UTF-8?q?=E4=B8=8B=EF=BC=8C=E6=9C=89deny,=20allow=E4=B8=A4=E4=B8=AA?=
 =?UTF-8?q?=E7=BA=A7=E5=88=AB=E3=80=82=E5=8F=AA=E6=9C=89=E9=9D=9E=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E6=A8=A1=E5=BC=8F=E4=B8=8B=EF=BC=8C=E6=89=8D=E4=BC=9A?=
 =?UTF-8?q?=E5=BA=94=E7=94=A8=E7=BC=BA=E7=9C=81=E7=9A=84=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E8=AE=BE=E7=BD=AE=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkg/cloudcommon/db/rbac.go       | 25 +++++++++++++------------
 pkg/cloudcommon/policy/policy.go | 13 ++++++++++++-
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index d2565e2bd2..76c2fd2152 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -1,8 +1,6 @@
 package db
 
 import (
-	"yunion.io/x/log"
-
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -14,9 +12,11 @@ func isListRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential,
 }
 
 func isListRbacAllowedInternal(manager IModelManager, resource string, userCred mcclient.TokenCredential, isAdminMode bool) bool {
-	log.Debugf("%s %s", manager.KeywordPlural(), resource)
 	var requireAdmin bool
-	ownerId := manager.GetOwnerId(userCred)
+	var ownerId string
+	if userCred != nil {
+		ownerId = manager.GetOwnerId(userCred)
+	}
 	if len(ownerId) > 0 {
 		if isAdminMode {
 			requireAdmin = true
@@ -36,8 +36,6 @@ func isListRbacAllowedInternal(manager IModelManager, resource string, userCred
 		return true
 	case result == rbacutils.OwnerAllow && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && requireAdmin:
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -52,7 +50,10 @@ func isJointListRbacAllowed(manager IJointModelManager, userCred mcclient.TokenC
 
 func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential, ownerProjId string, action string, extra ...string) bool {
 	var requireAdmin bool
-	ownerId := manager.GetOwnerId(userCred)
+	var ownerId string
+	if userCred != nil {
+		ownerId = manager.GetOwnerId(userCred)
+	}
 	if len(ownerId) > 0 {
 		if ownerProjId == ownerId {
 			requireAdmin = false
@@ -72,8 +73,6 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
 		return true
 	case result == rbacutils.OwnerAllow && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && requireAdmin:
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -85,7 +84,11 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 	var requireAdmin bool
 	var isOwner bool
 
-	ownerId := model.GetModelManager().GetOwnerId(userCred)
+	var ownerId string
+
+	if userCred != nil {
+		ownerId = model.GetModelManager().GetOwnerId(userCred)
+	}
 
 	if len(ownerId) > 0 {
 		objOwnerId := model.GetOwnerProjectId()
@@ -109,8 +112,6 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 		return true
 	case result == rbacutils.OwnerAllow && isOwner && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && (requireAdmin || isOwner):
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index ebbda04d79..d4ab475993 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -221,7 +221,7 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
 			currentPriv = result
 		}
 	}
-	if manager.defaultPolicy != nil {
+	if !isAdmin && manager.defaultPolicy != nil {
 		result := manager.defaultPolicy.Allow(userCredJson, service, resource, action, extra...)
 		if currentPriv.StricterThan(result) {
 			currentPriv = result
@@ -230,6 +230,17 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
 	if consts.IsRbacDebug() {
 		log.Debugf("[RBAC: %v] %s %s %s %#v permission %s", isAdmin, service, resource, action, extra, currentPriv)
 	}
+	if isAdmin {
+		switch currentPriv {
+		case rbacutils.OwnerAllow, rbacutils.UserAllow, rbacutils.GuestAllow:
+			currentPriv = rbacutils.AdminAllow
+		}
+	} else {
+		switch currentPriv {
+		case rbacutils.AdminAllow:
+			currentPriv = rbacutils.UserAllow
+		}
+	}
 	return currentPriv
 }