From: Greg Farnum <gregf@hq.newdream.net>
Date: Wed, 10 Mar 2010 00:38:33 +0000 (-0800)
Subject: mon: add check_privileges function to MonCaps
X-Git-Tag: v0.20~295
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=e59f544afdb36d0029a17aa25afd2585f6ced92a;p=ceph.git

mon: add check_privileges function to MonCaps
---

diff --git a/src/mon/MonCaps.cc b/src/mon/MonCaps.cc
index 47d69ee5df36..bd8b523ee837 100644
--- a/src/mon/MonCaps.cc
+++ b/src/mon/MonCaps.cc
@@ -233,3 +233,26 @@ rwx_t MonCaps::get_caps(int service)
   return caps;
 }
 
+/* general strategy:
+ * if they specify an auid, make sure they are allowed to behave
+ * as that user (for r/w/x as needed by req_perms).
+ * Then, make sure they have the correct cap on the requested service.
+ * If any test fails, return false. If they all pass, success!
+ *
+ * Note that this means auid permissions are NOT very su-like. It gives
+ * you access to their data with the rwx that they specify, but you
+ * only get as much access as they allow you AND you have on your own data.
+ *
+ */
+bool MonCaps::check_privileges(int service, int req_perms, __u64 req_auid)
+{
+  if (allow_all) return true; //you're an admin, do anything!
+  if (req_auid != CEPH_AUTH_UID_DEFAULT && req_auid != auid) {
+    if (!pool_auid_map.count(req_auid)) return false;
+    MonCap& auid_cap = pool_auid_map[req_auid];
+    if ((auid_cap.allow & req_perms) != req_perms) return false;
+  }
+  int service_caps = get_caps(service);
+  if ((service_caps & req_perms) != req_perms) return false;
+  return true;
+}
diff --git a/src/mon/MonCaps.h b/src/mon/MonCaps.h
index d2efdd1bf126..ddd83b45f1fd 100644
--- a/src/mon/MonCaps.h
+++ b/src/mon/MonCaps.h
@@ -48,6 +48,8 @@ public:
   const string& get_str() const { return text; }
   bool parse(bufferlist::iterator& iter);
   rwx_t get_caps(int service);
+  bool check_privileges(int service, int req_perm,
+			__u64 auid=CEPH_AUTH_UID_DEFAULT);
   void set_allow_all(bool allow) { allow_all = allow; }
   void set_auid(__u64 uid) { auid = uid; }
 };