shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-03-19 06:50:07 +03:00
Code Releases Wiki Activity

Better management of new object creation requests

Browse Source 
The ACLs associated to the objects are not created if the object doesn't have a oid
This commit is contained in:
Carlos Martín 2011-12-30 21:35:51 +01:00
parent a473b28052
commit 394da7925c
2 changed files with 68 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

133
src/acl/AclManager.cc
View File

@ -188,75 +188,78 @@ const bool AclManager::authorize(
// ---------------------------------------------------
// Create temporary rules from the object permissions
// ---------------------------------------------------
multimap<long long, AclRule*> tmp_rules;
long long perm_user, perm_resource, perm_rights;
AclRule * tmp_rule;
perm_resource = obj_type | AclRule::INDIVIDUAL_ID | obj_perms.oid;
// Rule "#uid ob_type/#oid user_rights"
perm_user = AclRule::INDIVIDUAL_ID | obj_perms.uid;
perm_rights = 0;
if ( obj_perms.owner_u == 1 )
if ( obj_perms.oid >= 0 ) // If oid is -1, this is a new obj. creation
{
perm_rights = perm_rights | AuthRequest::USE;
long long perm_user, perm_resource, perm_rights;
AclRule * tmp_rule;
perm_resource = obj_type | AclRule::INDIVIDUAL_ID | obj_perms.oid;
// Rule "#uid ob_type/#oid user_rights"
perm_user = AclRule::INDIVIDUAL_ID | obj_perms.uid;
perm_rights = 0;
if ( obj_perms.owner_u == 1 )
{
perm_rights = perm_rights | AuthRequest::USE;
}
if ( obj_perms.owner_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.owner_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
// Rule "@gid ob_type/#oid group_rights"
perm_user = AclRule::GROUP_ID | obj_perms.gid;
perm_rights = 0;
if ( obj_perms.group_u == 1 )
{
perm_rights = perm_rights | AuthRequest::USE;
}
if ( obj_perms.group_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.group_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
// Rule "* ob_type/#oid others_rights"
perm_user = AclRule::ALL_ID;
perm_rights = 0;
if ( obj_perms.other_u == 1 )
{
perm_rights = perm_rights | AuthRequest::USE;
}
if ( obj_perms.other_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.other_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
}
if ( obj_perms.owner_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.owner_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
// Rule "@gid ob_type/#oid group_rights"
perm_user = AclRule::GROUP_ID | obj_perms.gid;
perm_rights = 0;
if ( obj_perms.group_u == 1 )
{
perm_rights = perm_rights | AuthRequest::USE;
}
if ( obj_perms.group_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.group_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
// Rule "* ob_type/#oid others_rights"
perm_user = AclRule::ALL_ID;
perm_rights = 0;
if ( obj_perms.other_u == 1 )
{
perm_rights = perm_rights | AuthRequest::USE;
}
if ( obj_perms.other_m == 1 )
{
perm_rights = perm_rights | AuthRequest::MANAGE;
}
if ( obj_perms.other_a == 1 )
{
perm_rights = perm_rights | AuthRequest::ADMIN;
}
tmp_rule = new AclRule(0, perm_user, perm_resource, perm_rights);
tmp_rules.insert( make_pair(tmp_rule->user, tmp_rule) );
// ---------------------------------------------------
// Look for rules that apply to everyone
// ---------------------------------------------------

2
src/authm/AuthManager.cc
View File

@ -57,8 +57,6 @@ void AuthRequest::add_auth(Object ob,
{
oss << "-:";
}
ob_perms.oid = -1;
}
else
{