From 6ff9e75fb1d5f15697c7b8fba28b3dfa2241f051 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 13 Oct 2023 14:00:39 +0800 Subject: [PATCH] fix(common): remove service default policy (#18312) --- pkg/cloudid/policy/defaults.go | 133 +++-- pkg/compute/policy/defaults.go | 729 ++++++++++++++-------------- pkg/image/policy/defaults.go | 59 +-- pkg/keystone/models/rolepolicies.go | 3 + pkg/keystone/options/options.go | 6 +- pkg/logger/policy/defaults.go | 49 +- pkg/notify/policy/defaults.go | 277 ++++++----- pkg/yunionconf/policy/defaults.go | 70 +-- 8 files changed, 655 insertions(+), 671 deletions(-) diff --git a/pkg/cloudid/policy/defaults.go b/pkg/cloudid/policy/defaults.go index a0ca1a7633..f3d30db081 100644 --- a/pkg/cloudid/policy/defaults.go +++ b/pkg/cloudid/policy/defaults.go @@ -15,9 +15,6 @@ package policy import ( - "yunion.io/x/pkg/util/rbacscope" - - api "yunion.io/x/onecloud/pkg/apis/cloudid" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -33,78 +30,80 @@ const ( var ( predefinedDefaultPolicies = []rbacutils.SRbacPolicy{ - { - Auth: true, - Scope: rbacscope.ScopeSystem, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "cloudpolicies", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudpolicies", - Action: PolicyActionGet, - Result: rbacutils.Allow, + /* + { + Auth: true, + Scope: rbacscope.ScopeSystem, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "cloudpolicies", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudpolicies", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeDomain, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "cloudgroups", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudgroups", - Action: PolicyActionGet, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeDomain, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "cloudgroups", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudgroups", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "cloudusers", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudusers", - Action: PolicyActionGet, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "cloudusers", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudusers", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "samlusers", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "samlusers", - Action: PolicyActionGet, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "samlusers", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "samlusers", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, }, }, - }, + */ } ) diff --git a/pkg/compute/policy/defaults.go b/pkg/compute/policy/defaults.go index cb2b89860a..b59f5dfb23 100644 --- a/pkg/compute/policy/defaults.go +++ b/pkg/compute/policy/defaults.go @@ -37,145 +37,147 @@ var ( Auth: true, Scope: rbacscope.ScopeSystem, Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "zones", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "zones", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudregions", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudregions", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cachedimages", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cachedimages", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dbinstance_skus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dbinstance_skus", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "serverskus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "serverskus", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "secgrouprules", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "elasticcacheskus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "elasticcacheskus", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "secgrouprules", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "loadbalancerclusters", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "schedtags", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dns_recordsets", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dns_recodsets", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dns_zonecaches", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "dns_zonecaches", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudaccounts", - Action: PolicyActionGet, - Extra: []string{"saml"}, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "waf_rules", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "waf_rules", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, + /* + { + Service: api.SERVICE_TYPE, + Resource: "zones", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "zones", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudregions", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudregions", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cachedimages", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cachedimages", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dbinstance_skus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dbinstance_skus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "serverskus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "serverskus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "secgrouprules", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "elasticcacheskus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "elasticcacheskus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "secgrouprules", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "loadbalancerclusters", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "schedtags", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dns_recordsets", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dns_recodsets", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dns_zonecaches", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "dns_zonecaches", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudaccounts", + Action: PolicyActionGet, + Extra: []string{"saml"}, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "waf_rules", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "waf_rules", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + */ { Service: api.SERVICE_TYPE, Resource: "capabilities", @@ -184,235 +186,238 @@ var ( }, }, }, - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ + /* { - Service: api.SERVICE_TYPE, - Resource: "keypairs", - Action: PolicyActionGet, - Result: rbacutils.Allow, + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "keypairs", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "keypairs", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "keypairs", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "keypairs", + Action: PolicyActionUpdate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "keypairs", + Action: PolicyActionDelete, + Result: rbacutils.Allow, + }, + }, }, - { - Service: api.SERVICE_TYPE, - Resource: "keypairs", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "keypairs", - Action: PolicyActionCreate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "keypairs", - Action: PolicyActionUpdate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "keypairs", - Action: PolicyActionDelete, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeDomain, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "cloudaccounts", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudaccounts", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudproviders", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "cloudproviders", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "domain_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "domain_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "infras_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "infras_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "vpcs", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "vpcs", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "wires", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "wires", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "proxysettings", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "proxysettings", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "nat_skus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "nat_skus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "nas_skus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "nas_skus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "modelarts_skus", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "modelarts_skus", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeDomain, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "cloudaccounts", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudaccounts", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudproviders", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "cloudproviders", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "domain_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "domain_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "infras_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "infras_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "vpcs", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "vpcs", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "wires", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "wires", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "proxysettings", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "proxysettings", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "nat_skus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "nat_skus", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "nas_skus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "nas_skus", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "modelarts_skus", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "modelarts_skus", - Action: PolicyActionGet, - Result: rbacutils.Allow, + */ + /* + { + Auth: true, + Scope: rbacscope.ScopeProject, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "region_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "region_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "zone_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "zone_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "project_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "project_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "networks", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "networks", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeProject, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "region_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "region_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "zone_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "zone_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "project_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "project_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - /*{ - Service: api.SERVICE_TYPE, - Resource: "networks", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "networks", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - */ - }, - }, + */ } ) diff --git a/pkg/image/policy/defaults.go b/pkg/image/policy/defaults.go index c6a5559b32..44beb40e42 100644 --- a/pkg/image/policy/defaults.go +++ b/pkg/image/policy/defaults.go @@ -30,49 +30,26 @@ const ( var ( predefinedDefaultPolicies = []rbacutils.SRbacPolicy{ - { - Auth: true, - Scope: rbacscope.ScopeProject, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "image_quotas", - Action: PolicyActionGet, - Result: rbacutils.Allow, + /* + { + Auth: true, + Scope: rbacscope.ScopeProject, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "image_quotas", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "image_quotas", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, }, - { - Service: api.SERVICE_TYPE, - Resource: "image_quotas", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - /*{ - Service: api.SERVICE_TYPE, - Resource: "images", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "images", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "guestimages", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "guestimages", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - */ }, - }, + */ { // for anonymous update torrent status Auth: false, diff --git a/pkg/keystone/models/rolepolicies.go b/pkg/keystone/models/rolepolicies.go index 03c2696080..a5571f1a08 100644 --- a/pkg/keystone/models/rolepolicies.go +++ b/pkg/keystone/models/rolepolicies.go @@ -494,6 +494,9 @@ func (manager *SRolePolicyManager) GetMatchPolicyGroupByCred(userCred api.IRbacI case rbacscope.ScopeProject: consolePolicyName = options.Options.ProjectDashboardPolicy } + if len(consolePolicyName) == 0 { + continue + } names, policies, err = appendPolicy(names, policies, scope, consolePolicyName, nameOnly) if err != nil { return nil, nil, errors.Wrapf(err, "appendConsolePolicy %s %s", scope, consolePolicyName) diff --git a/pkg/keystone/options/options.go b/pkg/keystone/options/options.go index 4cef17b3ea..a4adb15875 100644 --- a/pkg/keystone/options/options.go +++ b/pkg/keystone/options/options.go @@ -60,9 +60,9 @@ type SKeystoneOptions struct { DomainAdminRoleToNotify string `help:"domain admin role to notify" default:"domainadmin"` AdminRoleToNotify string `help:"admin role to notify" default:"admin"` - SystemDashboardPolicy string `help:"dashboard policy name for system view" default:"sys-dashboard"` - DomainDashboardPolicy string `help:"dashboard policy name for domain view" default:"domain-dashboard"` - ProjectDashboardPolicy string `help:"dashboard policy name for project view" default:"project-dashboard"` + SystemDashboardPolicy string `help:"dashboard policy name for system view" default:""` + DomainDashboardPolicy string `help:"dashboard policy name for domain view" default:""` + ProjectDashboardPolicy string `help:"dashboard policy name for project view" default:""` NoPolicyViolationCheck bool `help:"do not check policy violation when modify or assign policy" default:"false"` diff --git a/pkg/logger/policy/defaults.go b/pkg/logger/policy/defaults.go index 1545ca9fd6..ac85dcfebd 100644 --- a/pkg/logger/policy/defaults.go +++ b/pkg/logger/policy/defaults.go @@ -15,9 +15,6 @@ package policy import ( - "yunion.io/x/pkg/util/rbacscope" - - api "yunion.io/x/onecloud/pkg/apis/logger" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -30,30 +27,32 @@ const ( var ( predefinedDefaultPolicies = []rbacutils.SRbacPolicy{ - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "actions", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "actions", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "actions", - Action: PolicyActionCreate, - Result: rbacutils.Allow, + /* + { + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "actions", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "actions", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "actions", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, }, }, - }, + */ } ) diff --git a/pkg/notify/policy/defaults.go b/pkg/notify/policy/defaults.go index 509b2efba7..c0d70c1e0a 100644 --- a/pkg/notify/policy/defaults.go +++ b/pkg/notify/policy/defaults.go @@ -15,9 +15,6 @@ package policy import ( - "yunion.io/x/pkg/util/rbacscope" - - api "yunion.io/x/onecloud/pkg/apis/notify" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -33,150 +30,152 @@ const ( var ( predefinedDefaultPolicies = []rbacutils.SRbacPolicy{ - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionCreate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionUpdate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionDelete, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "receivers", - Action: PolicyActionPerform, - Result: rbacutils.Allow, + /* + { + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionUpdate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionDelete, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "receivers", + Action: PolicyActionPerform, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeSystem, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "topics", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "topics", - Action: PolicyActionList, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeSystem, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "topics", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "topics", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeSystem, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionCreate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionUpdate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionDelete, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionPerform, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeSystem, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionUpdate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionDelete, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionPerform, + Result: rbacutils.Allow, + }, }, }, - }, - { - Auth: true, - Scope: rbacscope.ScopeDomain, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionCreate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionUpdate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionDelete, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "subscribers", - Action: PolicyActionPerform, - Result: rbacutils.Allow, + { + Auth: true, + Scope: rbacscope.ScopeDomain, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionUpdate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionDelete, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "subscribers", + Action: PolicyActionPerform, + Result: rbacutils.Allow, + }, }, }, - }, + */ } ) diff --git a/pkg/yunionconf/policy/defaults.go b/pkg/yunionconf/policy/defaults.go index fd0d2caeb6..b43dfa3128 100644 --- a/pkg/yunionconf/policy/defaults.go +++ b/pkg/yunionconf/policy/defaults.go @@ -32,42 +32,44 @@ const ( var ( predefinedDefaultPolicies = []rbacutils.SRbacPolicy{ - { - Auth: true, - Scope: rbacscope.ScopeUser, - Rules: []rbacutils.SRbacRule{ - { - Service: api.SERVICE_TYPE, - Resource: "parameters", - Action: PolicyActionGet, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "parameters", - Action: PolicyActionList, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "parameters", - Action: PolicyActionCreate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "parameters", - Action: PolicyActionUpdate, - Result: rbacutils.Allow, - }, - { - Service: api.SERVICE_TYPE, - Resource: "parameters", - Action: PolicyActionDelete, - Result: rbacutils.Allow, + /* + { + Auth: true, + Scope: rbacscope.ScopeUser, + Rules: []rbacutils.SRbacRule{ + { + Service: api.SERVICE_TYPE, + Resource: "parameters", + Action: PolicyActionGet, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "parameters", + Action: PolicyActionList, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "parameters", + Action: PolicyActionCreate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "parameters", + Action: PolicyActionUpdate, + Result: rbacutils.Allow, + }, + { + Service: api.SERVICE_TYPE, + Resource: "parameters", + Action: PolicyActionDelete, + Result: rbacutils.Allow, + }, }, }, - }, + */ { Auth: true, Scope: rbacscope.ScopeProject,