e4532efcfe
When a policy check fails it is easy enough to recreate the target from request information that's available, but the credentials used can not easily be determined without asking the user. This logs the non sensitive credentials when a policy check fails. Things like project_id, user_id, and roles. Change-Id: I599660386286529ec0914a18c44d5e2939b18ccd
140 lines
4.6 KiB
Python
140 lines
4.6 KiB
Python
# Copyright (c) 2011 OpenStack Foundation
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
"""Policy Engine For Nova."""
|
|
|
|
import logging
|
|
|
|
from oslo_utils import excutils
|
|
|
|
from nova import exception
|
|
from nova.openstack.common import policy
|
|
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
_ENFORCER = None
|
|
|
|
|
|
def reset():
|
|
global _ENFORCER
|
|
if _ENFORCER:
|
|
_ENFORCER.clear()
|
|
_ENFORCER = None
|
|
|
|
|
|
def init(policy_file=None, rules=None, default_rule=None, use_conf=True):
|
|
"""Init an Enforcer class.
|
|
|
|
:param policy_file: Custom policy file to use, if none is specified,
|
|
`CONF.policy_file` will be used.
|
|
:param rules: Default dictionary / Rules to use. It will be
|
|
considered just in the first instantiation.
|
|
:param default_rule: Default rule to use, CONF.default_rule will
|
|
be used if none is specified.
|
|
:param use_conf: Whether to load rules from config file.
|
|
"""
|
|
|
|
global _ENFORCER
|
|
if not _ENFORCER:
|
|
_ENFORCER = policy.Enforcer(policy_file=policy_file,
|
|
rules=rules,
|
|
default_rule=default_rule,
|
|
use_conf=use_conf)
|
|
|
|
|
|
def set_rules(rules, overwrite=True, use_conf=False):
|
|
"""Set rules based on the provided dict of rules.
|
|
|
|
:param rules: New rules to use. It should be an instance of dict.
|
|
:param overwrite: Whether to overwrite current rules or update them
|
|
with the new rules.
|
|
:param use_conf: Whether to reload rules from config file.
|
|
"""
|
|
|
|
init(use_conf=False)
|
|
_ENFORCER.set_rules(rules, overwrite, use_conf)
|
|
|
|
|
|
def enforce(context, action, target, do_raise=True, exc=None):
|
|
"""Verifies that the action is valid on the target in this context.
|
|
|
|
:param context: nova context
|
|
:param action: string representing the action to be checked
|
|
this should be colon separated for clarity.
|
|
i.e. ``compute:create_instance``,
|
|
``compute:attach_volume``,
|
|
``volume:attach_volume``
|
|
:param target: dictionary representing the object of the action
|
|
for object creation this should be a dictionary representing the
|
|
location of the object e.g. ``{'project_id': context.project_id}``
|
|
:param do_raise: if True (the default), raises PolicyNotAuthorized;
|
|
if False, returns False
|
|
|
|
:raises nova.exception.PolicyNotAuthorized: if verification fails
|
|
and do_raise is True.
|
|
|
|
:return: returns a non-False value (not necessarily "True") if
|
|
authorized, and the exact value False if not authorized and
|
|
do_raise is False.
|
|
"""
|
|
init()
|
|
credentials = context.to_dict()
|
|
if not exc:
|
|
exc = exception.PolicyNotAuthorized
|
|
try:
|
|
result = _ENFORCER.enforce(action, target, credentials,
|
|
do_raise=do_raise, exc=exc, action=action)
|
|
except Exception:
|
|
credentials.pop('auth_token', None)
|
|
with excutils.save_and_reraise_exception():
|
|
LOG.debug('Policy check for %(action)s failed with credentials '
|
|
'%(credentials)s',
|
|
{'action': action, 'credentials': credentials})
|
|
return result
|
|
|
|
|
|
def check_is_admin(context):
|
|
"""Whether or not roles contains 'admin' role according to policy setting.
|
|
|
|
"""
|
|
|
|
init()
|
|
# the target is user-self
|
|
credentials = context.to_dict()
|
|
target = credentials
|
|
return _ENFORCER.enforce('context_is_admin', target, credentials)
|
|
|
|
|
|
@policy.register('is_admin')
|
|
class IsAdminCheck(policy.Check):
|
|
"""An explicit check for is_admin."""
|
|
|
|
def __init__(self, kind, match):
|
|
"""Initialize the check."""
|
|
|
|
self.expected = (match.lower() == 'true')
|
|
|
|
super(IsAdminCheck, self).__init__(kind, str(self.expected))
|
|
|
|
def __call__(self, target, creds, enforcer):
|
|
"""Determine whether is_admin matches the requested value."""
|
|
|
|
return creds['is_admin'] == self.expected
|
|
|
|
|
|
def get_rules():
|
|
if _ENFORCER:
|
|
return _ENFORCER.rules
|