opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-08-31 01:35:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: the default policy for actions not matching any rule defaults to allow

Browse Source
This commit is contained in:
Qiu Jian
2019-03-29 16:35:16 +08:00
committed by Yousong Zhou
parent 43ffaa9a9e
commit fefdb706f3
2 changed files with 29 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/policy/policy.go
+27 -6
View File
@@ -245,17 +245,38 @@ func (manager *SPolicyManager) allowWithoutCache(isAdmin bool, userCred mcclient
log.Warningf("no policies fetched")
return rbacutils.Deny
}
findMatchRule := false
currentPriv := rbacutils.Deny
for _, p := range policies {
result := p.Allow(userCred, service, resource, action, extra...)
if currentPriv.StricterThan(result) {
currentPriv = result
if !p.Match(userCred) {
continue
}
rule := p.GetMatchRule(service, resource, action, extra...)
if rule != nil {
findMatchRule = true
if currentPriv.StricterThan(rule.Result) {
currentPriv = rule.Result
}
}
// result := p.Allow(userCred, service, resource, action, extra...)
// if currentPriv.StricterThan(result) {
// currentPriv = result
// }
}
if !isAdmin && manager.defaultPolicy != nil {
result := manager.defaultPolicy.Allow(userCred, service, resource, action, extra...)
if currentPriv.StricterThan(result) {
currentPriv = result
rule := manager.defaultPolicy.GetMatchRule(service, resource, action, extra...)
if rule != nil {
findMatchRule = true
if currentPriv.StricterThan(rule.Result) {
currentPriv = rule.Result
}
}
}
if !findMatchRule {
if isAdmin {
currentPriv = rbacutils.AdminAllow
} else {
currentPriv = rbacutils.OwnerAllow
}
}
if consts.IsRbacDebug() {
pkg/util/rbacutils/rabc.go
+2 -2
View File
@@ -457,7 +457,7 @@ func (policy *SRbacPolicy) Match(userCred mcclient.TokenCredential) bool {
return false
}
func (policy *SRbacPolicy) Allow(userCred mcclient.TokenCredential, service, resource, action string, extra ...string) TRbacResult {
/*func (policy *SRbacPolicy) Allow(userCred mcclient.TokenCredential, service, resource, action string, extra ...string) TRbacResult {
if !policy.Match(userCred) {
return Deny
}
@@ -466,4 +466,4 @@ func (policy *SRbacPolicy) Allow(userCred mcclient.TokenCredential, service, res
return Deny
}
return rule.Result
}
}*/