From 6d1067a0de73dc4ed5ad2ebb0ff97a932694da26 Mon Sep 17 00:00:00 2001
From: Jian Qiu <swordqiu@gmail.com>
Date: Sun, 8 May 2022 23:42:05 +0800
Subject: [PATCH] fix: adjust secadmin and opsadmin policies (#14218)

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
---
 pkg/keystone/locale/predefined_yaml.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkg/keystone/locale/predefined_yaml.go b/pkg/keystone/locale/predefined_yaml.go
index 013839cc82..8da07c5ff8 100644
--- a/pkg/keystone/locale/predefined_yaml.go
+++ b/pkg/keystone/locale/predefined_yaml.go
@@ -44,6 +44,7 @@ policy:
     secgroups:
       '*': deny
       list: allow
+      get: allow
     servers:
       '*': allow
       perform:
@@ -51,6 +52,12 @@ policy:
         start: deny
         stop: deny
         change-owner: deny
+        add-secgroup: deny
+        set-secgroup: deny
+        revoke-secgroup: deny
+        revoke-admin-secgroup: deny
+        assign-secgroup: deny
+        assign-admin-secgroup: deny
   image:
     '*':
       '*': allow
@@ -103,6 +110,8 @@ policy:
       '*': deny
     secgroups:
       '*': allow
+    secgrouprules:
+      '*': allow
     servers:
       '*': deny
       delete: allow
@@ -111,6 +120,12 @@ policy:
       perform:
         '*': deny
         change-owner: allow
+        add-secgroup: allow
+        set-secgroup: allow
+        revoke-secgroup: allow
+        revoke-admin-secgroup: allow
+        assign-secgroup: allow
+        assign-admin-secgroup: allow
         purge: allow
   monitor:
     events: