← Back to branch summary

~ubuntu-branches/ubuntu/raring/nova/raring-proposed

« back to all changes in this revision

Viewing changes to nova/policy.py

  • Committer: Package Import Robot
  • Author(s): Chuck Short, Adam Gandelman, Chuck Short
  • Date: 2012-11-23 09:04:58 UTC
  • mfrom: (1.1.66)
  • Revision ID: package-import@ubuntu.com-20121123090458-91565o7aev1i1h71
Tags: 2013.1~g1-0ubuntu1
https://launchpad.net/bugs/1073289
https://launchpad.net/bugs/1076442
[ Adam Gandelman ]
* debian/control: Ensure novaclient is upgraded with nova,
  require python-keystoneclient >= 1:2.9.0. (LP: #1073289)
* debian/patches/{ubuntu/*, rbd-security.patch}: Dropped, applied
  upstream.
* debian/control: Add python-testtools to Build-Depends.

[ Chuck Short ]
* New upstream version.
* Refreshed debian/patches/avoid_setuptools_git_dependency.patch.
* debian/rules: FTBFS if missing binaries.
* debian/nova-scheudler.install: Add missing rabbit-queues and
  nova-rpc-zmq-receiver.
* Remove nova-volume since it doesnt exist anymore, transition to cinder-*.
* debian/rules: install apport hook in the right place.
* debian/patches/ubuntu-show-tests.patch: Display test failures.
* debian/control: Add depends on genisoimage
* debian/control: Suggest guestmount.
* debian/control: Suggest websockify. (LP: #1076442)
* debian/nova.conf: Disable nova-volume service.
* debian/control: Depend on xen-system-* rather than the hypervisor.
* debian/control, debian/mans/nova-conductor.8, debian/nova-conductor.init,
  debian/nova-conductor.install, debian/nova-conductor.logrotate
  debian/nova-conductor.manpages, debian/nova-conductor.postrm
  debian/nova-conductor.upstart.in: Add nova-conductor service.
* debian/control: Add python-fixtures as a build deps.

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/policy.py
20
20
import os.path
21
21
 
22
22
from nova import exception
23
 
from nova import flags
24
23
from nova.openstack.common import cfg
25
24
from nova.openstack.common import policy
26
25
from nova import utils
35
34
               help=_('Rule checked when requested rule is not found')),
36
35
    ]
37
36
 
38
 
FLAGS = flags.FLAGS
39
 
FLAGS.register_opts(policy_opts)
 
37
CONF = cfg.CONF
 
38
CONF.register_opts(policy_opts)
40
39
 
41
40
_POLICY_PATH = None
42
41
_POLICY_CACHE = {}
54
53
    global _POLICY_PATH
55
54
    global _POLICY_CACHE
56
55
    if not _POLICY_PATH:
57
 
        _POLICY_PATH = FLAGS.policy_file
 
56
        _POLICY_PATH = CONF.policy_file
58
57
        if not os.path.exists(_POLICY_PATH):
59
 
            _POLICY_PATH = FLAGS.find_file(_POLICY_PATH)
 
58
            _POLICY_PATH = CONF.find_file(_POLICY_PATH)
60
59
        if not _POLICY_PATH:
61
 
            raise exception.ConfigNotFound(path=FLAGS.policy_file)
 
60
            raise exception.ConfigNotFound(path=CONF.policy_file)
62
61
    utils.read_cached_file(_POLICY_PATH, _POLICY_CACHE,
63
 
                           reload_func=_set_brain)
64
 
 
65
 
 
66
 
def _set_brain(data):
67
 
    default_rule = FLAGS.policy_default_rule
68
 
    policy.set_brain(policy.Brain.load_json(data, default_rule))
69
 
 
70
 
 
71
 
def enforce(context, action, target):
 
62
                           reload_func=_set_rules)
 
63
 
 
64
 
 
65
def _set_rules(data):
 
66
    default_rule = CONF.policy_default_rule
 
67
    policy.set_rules(policy.Rules.load_json(data, default_rule))
 
68
 
 
69
 
 
70
def enforce(context, action, target, do_raise=True):
72
71
    """Verifies that the action is valid on the target in this context.
73
72
 
74
73
       :param context: nova context
77
76
           i.e. ``compute:create_instance``,
78
77
           ``compute:attach_volume``,
79
78
           ``volume:attach_volume``
80
 
 
81
 
       :param object: dictionary representing the object of the action
 
79
       :param target: dictionary representing the object of the action
82
80
           for object creation this should be a dictionary representing the
83
81
           location of the object e.g. ``{'project_id': context.project_id}``
84
 
 
85
 
       :raises nova.exception.PolicyNotAllowed: if verification fails.
86
 
 
 
82
       :param do_raise: if True (the default), raises PolicyNotAuthorized;
 
83
           if False, returns False
 
84
 
 
85
       :raises nova.exception.PolicyNotAuthorized: if verification fails
 
86
           and do_raise is True.
 
87
 
 
88
       :return: returns a non-False value (not necessarily "True") if
 
89
           authorized, and the exact value False if not authorized and
 
90
           do_raise is False.
87
91
    """
88
92
    init()
89
93
 
90
 
    match_list = ('rule:%s' % action,)
91
94
    credentials = context.to_dict()
92
95
 
93
 
    # NOTE(vish): This is to work around the following launchpad bug:
94
 
    #             https://bugs.launchpad.net/openstack-common/+bug/1039132
95
 
    #             It can be removed when that bug is fixed.
96
 
    credentials['is_admin'] = unicode(credentials['is_admin'])
 
96
    # Add the exception arguments if asked to do a raise
 
97
    extra = {}
 
98
    if do_raise:
 
99
        extra.update(exc=exception.PolicyNotAuthorized, action=action)
97
100
 
98
 
    policy.enforce(match_list, target, credentials,
99
 
                   exception.PolicyNotAuthorized, action=action)
 
101
    return policy.check(action, target, credentials, **extra)
100
102
 
101
103
 
102
104
def check_is_admin(roles):
105
107
    """
106
108
    init()
107
109
 
108
 
    action = 'context_is_admin'
109
 
    match_list = ('rule:%s' % action,)
110
110
    target = {}
111
111
    credentials = {'roles': roles}
112
112
 
113
 
    try:
114
 
        policy.enforce(match_list, target, credentials,
115
 
                       exception.PolicyNotAuthorized, action=action)
116
 
    except exception.PolicyNotAuthorized:
117
 
        return False
118
 
 
119
 
    return True
 
113
    return policy.check('context_is_admin', target, credentials)
 
114
 
 
115
 
 
116
@policy.register('is_admin')
 
117
class IsAdminCheck(policy.Check):
 
118
    """An explicit check for is_admin."""
 
119
 
 
120
    def __init__(self, kind, match):
 
121
        """Initialize the check."""
 
122
 
 
123
        self.expected = (match.lower() == 'true')
 
124
 
 
125
        super(IsAdminCheck, self).__init__(kind, str(self.expected))
 
126
 
 
127
    def __call__(self, target, creds):
 
128
        """Determine whether is_admin matches the requested value."""
 
129
 
 
130
        return creds['is_admin'] == self.expected