openstack/openstack-ansible-os_designate
Code Issues Proposed changes

Update paste, policy and rootwrap configurations 2016-11-18

Browse Source 
Change-Id: I4ea2471488ea795512c82108987a090cf40c99d8
This commit is contained in:
Andy McCrae 2016-11-18 09:15:34 +00:00
parent 55e1d28182
commit 35dc65f711
4 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
files/rootwrap.d/bind9.filters
View File

@ -1,7 +1,7 @@
# designate-rootwrap command filters for nodes on which designate is
# expected to control network
#
# This file should be owned by (and only-writeable by) the root user
# This file should be owned by (and only-writable by) the root user
# format seems to be
# cmd-name: filter-name, raw-command, user, args

4
files/rootwrap.d/djbdns.filters Normal file
View File

@ -0,0 +1,4 @@
[Filters]
tcpclient: CommandFilter, /usr/bin/tcpclient, root
axfr-get: CommandFilter, /usr/bin/axfr-get, root
tinydns-data: CommandFilter, /usr/bin/tinydns-data, root

3
files/rootwrap.d/knot2.filters Normal file
View File

@ -0,0 +1,3 @@
# cmd-name: filter-name, raw-command, user, args
[Filters]
knotc: CommandFilter, /usr/sbin/knotc, root

5
templates/policy.json.j2
View File

@ -122,5 +122,8 @@
"find_zone_exports": "rule:admin_or_owner",
"get_zone_export": "rule:admin_or_owner",
"update_zone_export": "rule:admin_or_owner",
"delete_zone_export": "rule:admin_or_owner"
"find_service_status": "rule:admin",
"find_service_statuses": "rule:admin",
"update_service_service_status": "rule:admin"
}