openstack/neutron
Code Issues Proposed changes

Merge "Add new policy rules NET_OWNER and PARENT_OWNER"

Browse Source
This commit is contained in:
Zuul 2021-03-04 22:50:36 +00:00 committed by Gerrit Code Review
commit cb64e3a19f
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
neutron/conf/policies/base.py
View File

@ -78,6 +78,9 @@ SYSTEM_ADMIN_OR_PROJECT_MEMBER = (
SYSTEM_OR_PROJECT_READER = (
'(' + SYSTEM_READER + ') or (' + PROJECT_READER + ')')
# Additional rules needed in Neutron
RULE_NET_OWNER = 'rule:network_owner'
RULE_PARENT_OWNER = 'rule:ext_parent_owner'
rules = [
policy.RuleDefault(

6
neutron/conf/policies/subnet.py
View File

@ -41,7 +41,7 @@ rules = [
name='create_subnet',
check_str=base.policy_or(
base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
base.RULE_ADMIN_OR_NET_OWNER),
base.RULE_NET_OWNER),
scope_types=['system', 'project'],
description='Create a subnet',
operations=ACTION_POST,
@ -111,7 +111,7 @@ rules = [
name='update_subnet',
check_str=base.policy_or(
base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
base.RULE_ADMIN_OR_NET_OWNER),
base.RULE_NET_OWNER),
scope_types=['system', 'project'],
description='Update a subnet',
operations=ACTION_PUT,
@ -149,7 +149,7 @@ rules = [
name='delete_subnet',
check_str=base.policy_or(
base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
base.RULE_ADMIN_OR_NET_OWNER),
base.RULE_NET_OWNER),
scope_types=['system', 'project'],
description='Delete a subnet',
operations=ACTION_DELETE,