Add new policy rule SG_OWNER
During the migration to new, secure-rbac policies we already proposed rules NET_OWNER and PARENT_OWNER to extract "ADMIN" from the old, deprecated rules. We missed to do the same for SG_OWNER so this patch adds it and also switch new SG rules to use that new rule instead of old one. Change-Id: Ic3ddfbfd0df59ffd10576f02730202c8b740ed26
This commit is contained in:
parent
37f245c406
commit
90edcf6441
|
@ -81,6 +81,7 @@ SYSTEM_OR_PROJECT_READER = (
|
||||||
# Additional rules needed in Neutron
|
# Additional rules needed in Neutron
|
||||||
RULE_NET_OWNER = 'rule:network_owner'
|
RULE_NET_OWNER = 'rule:network_owner'
|
||||||
RULE_PARENT_OWNER = 'rule:ext_parent_owner'
|
RULE_PARENT_OWNER = 'rule:ext_parent_owner'
|
||||||
|
RULE_SG_OWNER = 'rule:sg_owner'
|
||||||
|
|
||||||
rules = [
|
rules = [
|
||||||
policy.RuleDefault(
|
policy.RuleDefault(
|
||||||
|
@ -141,6 +142,10 @@ rules = [
|
||||||
'ext_parent_owner',
|
'ext_parent_owner',
|
||||||
'tenant_id:%(ext_parent:tenant_id)s',
|
'tenant_id:%(ext_parent:tenant_id)s',
|
||||||
description='Rule for common parent owner check'),
|
description='Rule for common parent owner check'),
|
||||||
|
policy.RuleDefault(
|
||||||
|
name='sg_owner',
|
||||||
|
check_str='tenant_id:%(security_group:tenant_id)s',
|
||||||
|
description='Rule for security group owner access'),
|
||||||
]
|
]
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -140,7 +140,7 @@ rules = [
|
||||||
name='get_security_group_rule',
|
name='get_security_group_rule',
|
||||||
check_str=base.policy_or(
|
check_str=base.policy_or(
|
||||||
base.SYSTEM_OR_PROJECT_READER,
|
base.SYSTEM_OR_PROJECT_READER,
|
||||||
RULE_ADMIN_OWNER_OR_SG_OWNER),
|
base.RULE_SG_OWNER),
|
||||||
scope_types=['system', 'project'],
|
scope_types=['system', 'project'],
|
||||||
description='Get a security group rule',
|
description='Get a security group rule',
|
||||||
operations=[
|
operations=[
|
||||||
|
|
Loading…
Reference in New Issue