Add new policy rule SG_OWNER
During the migration to new, secure-rbac policies we already proposed rules NET_OWNER and PARENT_OWNER to extract "ADMIN" from the old, deprecated rules. We missed to do the same for SG_OWNER so this patch adds it and also switch new SG rules to use that new rule instead of old one. Change-Id: Ic3ddfbfd0df59ffd10576f02730202c8b740ed26
This commit is contained in:
parent
37f245c406
commit
90edcf6441
|
@ -81,6 +81,7 @@ SYSTEM_OR_PROJECT_READER = (
|
|||
# Additional rules needed in Neutron
|
||||
RULE_NET_OWNER = 'rule:network_owner'
|
||||
RULE_PARENT_OWNER = 'rule:ext_parent_owner'
|
||||
RULE_SG_OWNER = 'rule:sg_owner'
|
||||
|
||||
rules = [
|
||||
policy.RuleDefault(
|
||||
|
@ -141,6 +142,10 @@ rules = [
|
|||
'ext_parent_owner',
|
||||
'tenant_id:%(ext_parent:tenant_id)s',
|
||||
description='Rule for common parent owner check'),
|
||||
policy.RuleDefault(
|
||||
name='sg_owner',
|
||||
check_str='tenant_id:%(security_group:tenant_id)s',
|
||||
description='Rule for security group owner access'),
|
||||
]
|
||||
|
||||
|
||||
|
|
|
@ -140,7 +140,7 @@ rules = [
|
|||
name='get_security_group_rule',
|
||||
check_str=base.policy_or(
|
||||
base.SYSTEM_OR_PROJECT_READER,
|
||||
RULE_ADMIN_OWNER_OR_SG_OWNER),
|
||||
base.RULE_SG_OWNER),
|
||||
scope_types=['system', 'project'],
|
||||
description='Get a security group rule',
|
||||
operations=[
|
||||
|
|
Loading…
Reference in New Issue