mon: add check_privileges function to MonCaps

diff --git a/src/mon/MonCaps.cc b/src/mon/MonCaps.cc
index 47d69ee5df362f710275de60b795884f23d03fb1..bd8b523ee837760e184ad3c17223f9d92d6c836e 100644 (file)
--- a/src/mon/MonCaps.cc
+++ b/src/mon/MonCaps.cc
@@ -233,3 +233,26 @@ rwx_t MonCaps::get_caps(int service)
   return caps;
 }
 
+/* general strategy:
+ * if they specify an auid, make sure they are allowed to behave
+ * as that user (for r/w/x as needed by req_perms).
+ * Then, make sure they have the correct cap on the requested service.
+ * If any test fails, return false. If they all pass, success!
+ *
+ * Note that this means auid permissions are NOT very su-like. It gives
+ * you access to their data with the rwx that they specify, but you
+ * only get as much access as they allow you AND you have on your own data.
+ *
+ */
+bool MonCaps::check_privileges(int service, int req_perms, __u64 req_auid)
+{
+  if (allow_all) return true; //you're an admin, do anything!
+  if (req_auid != CEPH_AUTH_UID_DEFAULT && req_auid != auid) {
+    if (!pool_auid_map.count(req_auid)) return false;
+    MonCap& auid_cap = pool_auid_map[req_auid];
+    if ((auid_cap.allow & req_perms) != req_perms) return false;
+  }
+  int service_caps = get_caps(service);
+  if ((service_caps & req_perms) != req_perms) return false;
+  return true;
+}

diff --git a/src/mon/MonCaps.h b/src/mon/MonCaps.h
index d2efdd1bf1264c8dfe8222b0269263698c66e9cb..ddd83b45f1fdd2ad414089182170f666a103244d 100644 (file)
--- a/src/mon/MonCaps.h
+++ b/src/mon/MonCaps.h
@@ -48,6 +48,8 @@ public:
   const string& get_str() const { return text; }
   bool parse(bufferlist::iterator& iter);
   rwx_t get_caps(int service);
+  bool check_privileges(int service, int req_perm,
+                       __u64 auid=CEPH_AUTH_UID_DEFAULT);
   void set_allow_all(bool allow) { allow_all = allow; }
   void set_auid(__u64 uid) { auid = uid; }
 };