opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-19 10:46:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: sysadmin can override policy violation check

Browse Source
This commit is contained in:
Qiu Jian
2020-04-29 17:57:36 +08:00
parent 4d1b93e29e
commit b1647e7ebf
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/keystone/models/policies.go
+3
View File
@@ -103,6 +103,9 @@ func (manager *SPolicyManager) FetchEnabledPolicies() ([]SPolicy, error) {
}
func validatePolicyVioldatePrivilege(userCred mcclient.TokenCredential, policy *rbacutils.SRbacPolicy) error {
if userCred.GetUserName() == api.SystemAdminUser && userCred.GetDomainId() == api.DEFAULT_DOMAIN_ID {
return nil
}
opsScope, opsPolicySet := policyman.PolicyManager.GetMatchedPolicySet(userCred)
if opsScope != rbacutils.ScopeSystem && policy.Scope.HigherThan(opsScope) {
return errors.Wrapf(httperrors.ErrNotSufficientPrivilege, "cannot create policy scope higher than %s", opsScope)