From 6184063a4ca2f908a9186f292b3f2c59e9e59e0d Mon Sep 17 00:00:00 2001 From: zhongjun Date: Fri, 24 Nov 2017 16:29:00 +0800 Subject: [PATCH] [policy in code] Add support for share resource [3/10] This patch adds policy in code support for share resources. Change-Id: I9a79b5ececc583e80129cc980930e162e805b246 Partial-Implements: blueprint policy-in-code --- etc/manila/policy.json | 29 ---- manila/policies/__init__.py | 2 + manila/policies/shares.py | 329 ++++++++++++++++++++++++++++++++++++ manila/policy.py | 3 +- 4 files changed, 333 insertions(+), 30 deletions(-) create mode 100644 manila/policies/shares.py diff --git a/etc/manila/policy.json b/etc/manila/policy.json index 7bfdc1dc47..234b8efa86 100644 --- a/etc/manila/policy.json +++ b/etc/manila/policy.json @@ -11,32 +11,6 @@ "service:index": "rule:admin_api", "service:update": "rule:admin_api", - "share:create": "", - "share:delete": "rule:default", - "share:get": "rule:default", - "share:get_all": "rule:default", - "share:list_by_share_server_id": "rule:admin_api", - "share:list_by_host": "rule:admin_api", - "share:update": "rule:default", - "share:access_get": "rule:default", - "share:access_get_all": "rule:default", - "share:allow_access": "rule:default", - "share:deny_access": "rule:default", - "share:extend": "rule:default", - "share:shrink": "rule:default", - "share:get_share_metadata": "rule:default", - "share:delete_share_metadata": "rule:default", - "share:update_share_metadata": "rule:default", - "share:migration_start": "rule:admin_api", - "share:migration_complete": "rule:admin_api", - "share:migration_cancel": "rule:admin_api", - "share:migration_get_progress": "rule:admin_api", - "share:reset_task_state": "rule:admin_api", - "share:manage": "rule:admin_api", - "share:unmanage": "rule:admin_api", - "share:force_delete": "rule:admin_api", - "share:reset_status": "rule:admin_api", - "share:revert_to_snapshot": "rule:default", "share_export_location:index": "rule:default", "share_export_location:show": "rule:default", @@ -45,9 +19,6 @@ "share_instance:force_delete": "rule:admin_api", "share_instance:reset_status": "rule:admin_api", - "share:create_snapshot": "rule:default", - "share:delete_snapshot": "rule:default", - "share:snapshot_update": "rule:default", "share_snapshot:get_snapshot": "rule:default", "share_snapshot:get_all_snapshots": "rule:default", "share_snapshot:manage_snapshot": "rule:admin_api", diff --git a/manila/policies/__init__.py b/manila/policies/__init__.py index bbe723d7dc..4e02676a5d 100644 --- a/manila/policies/__init__.py +++ b/manila/policies/__init__.py @@ -19,11 +19,13 @@ import itertools from manila.policies import base from manila.policies import share_instance_export_location from manila.policies import share_type +from manila.policies import shares def list_rules(): return itertools.chain( base.list_rules(), + shares.list_rules(), share_instance_export_location.list_rules(), share_type.list_rules(), ) diff --git a/manila/policies/shares.py b/manila/policies/shares.py new file mode 100644 index 0000000000..18822215db --- /dev/null +++ b/manila/policies/shares.py @@ -0,0 +1,329 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share:%s' + + +shares_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'create', + check_str="", + description="Create share.", + operations=[ + { + 'method': 'POST', + 'path': '/shares', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'get', + check_str=base.RULE_DEFAULT, + description="Get share.", + operations=[ + { + 'method': 'GET', + 'path': '/shares/{share_id}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'get_all', + check_str=base.RULE_DEFAULT, + description="List shares.", + operations=[ + { + 'method': 'GET', + 'path': '/shares', + }, + { + 'method': 'GET', + 'path': '/shares/detail', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'update', + check_str=base.RULE_DEFAULT, + description="Update share.", + operations=[ + { + 'method': 'PUT', + 'path': '/shares', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'delete', + check_str=base.RULE_DEFAULT, + description="Delete share.", + operations=[ + { + 'method': 'DELETE', + 'path': '/shares/{share_id}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'force_delete', + check_str=base.RULE_ADMIN_API, + description="Force Delete a share.", + operations=[ + { + 'method': 'DELETE', + 'path': '/shares/{share_id}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'manage', + check_str=base.RULE_ADMIN_API, + description="Manage share.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/manage', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'unmanage', + check_str=base.RULE_ADMIN_API, + description="Unmanage share.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/unmanage', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'create_snapshot', + check_str=base.RULE_DEFAULT, + description="Create share snapshot.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'list_by_host', + check_str=base.RULE_ADMIN_API, + description="List share by host.", + operations=[ + { + 'method': 'GET', + 'path': '/shares', + }, + { + 'method': 'GET', + 'path': '/shares/detail', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'list_by_share_server_id', + check_str=base.RULE_ADMIN_API, + description="List share by server id.", + operations=[ + { + 'method': 'GET', + 'path': '/shares' + }, + { + 'method': 'GET', + 'path': '/shares/detail', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'access_get', + check_str=base.RULE_DEFAULT, + description="Get share access rule, it under deny access operation.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'access_get_all', + check_str=base.RULE_DEFAULT, + description="List share access rules.", + operations=[ + { + 'method': 'GET', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'extend', + check_str=base.RULE_DEFAULT, + description="Extend share.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'shrink', + check_str=base.RULE_DEFAULT, + description="Shrink share.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'migration_start', + check_str=base.RULE_ADMIN_API, + description="Migrate a share to the specified host.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'migration_complete', + check_str=base.RULE_ADMIN_API, + description="Invokes 2nd phase of share migration.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'migration_cancel', + check_str=base.RULE_ADMIN_API, + description="Attempts to cancel share migration.", + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'migration_get_progress', + check_str=base.RULE_ADMIN_API, + description=("Retrieve share migration progress for a given " + "share."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'reset_task_state', + check_str=base.RULE_ADMIN_API, + description=("Reset task state."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'reset_status', + check_str=base.RULE_ADMIN_API, + description=("Reset status."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'revert_to_snapshot', + check_str=base.RULE_DEFAULT, + description=("Revert a share to a snapshot."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'allow_access', + check_str=base.RULE_DEFAULT, + description=("Add share access rule."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'deny_access', + check_str=base.RULE_DEFAULT, + description=("Remove share access rule."), + operations=[ + { + 'method': 'POST', + 'path': '/shares/{share_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'delete_snapshot', + check_str=base.RULE_DEFAULT, + description=("Delete share snapshot."), + operations=[ + { + 'method': 'DELETE', + 'path': '/snapshots/{snapshot_id}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'snapshot_update', + check_str=base.RULE_DEFAULT, + description=("Update share snapshot."), + operations=[ + { + 'method': 'PUT', + 'path': '/snapshots/{snapshot_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'update_share_metadata', + check_str=base.RULE_DEFAULT, + description=("Update share metadata."), + operations=[ + { + 'method': 'PUT', + 'path': '/shares/{share_id}/metadata', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'delete_share_metadata', + check_str=base.RULE_DEFAULT, + description=("Delete share metadata."), + operations=[ + { + 'method': 'DELETE', + 'path': '/shares/{share_id}/metadata/{key}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'get_share_metadata', + check_str=base.RULE_DEFAULT, + description=("Get share metadata."), + operations=[ + { + 'method': 'GET', + 'path': '/shares/{share_id}/metadata', + } + ]), +] + + +def list_rules(): + return shares_policies diff --git a/manila/policy.py b/manila/policy.py index a91a1af311..39e53bcd85 100644 --- a/manila/policy.py +++ b/manila/policy.py @@ -208,7 +208,8 @@ def check_policy(context, resource, action, target_obj=None): _action = '%s:%s' % (resource, action) # The else branch will be deleted after all policy in code patches # be merged. - if resource in ('share_instance_export_location', 'share_type', ): + if resource in ('share_instance_export_location', 'share_type', + 'share', ): authorize(context, _action, target) else: enforce(context, _action, target)