|
| 1 | +# Copyright (c) 2015 OpenStack Foundation |
| 2 | +# All Rights Reserved. |
| 3 | +# |
| 4 | +# Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 5 | +# not use this file except in compliance with the License. You may obtain |
| 6 | +# a copy of the License at |
| 7 | +# |
| 8 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +# |
| 10 | +# Unless required by applicable law or agreed to in writing, software |
| 11 | +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 12 | +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the |
| 13 | +# License for the specific language governing permissions and limitations |
| 14 | +# under the License. |
| 15 | + |
| 16 | +"""Policy Engine For zun.""" |
| 17 | + |
| 18 | +from oslo_log import log as logging |
| 19 | +from oslo_policy import policy |
| 20 | + |
| 21 | +from bigbang.common import exception |
| 22 | +import cfg |
| 23 | + |
| 24 | +_ENFORCER = None |
| 25 | +CONF = cfg.CONF |
| 26 | + |
| 27 | +LOG = logging.getLogger(__name__) |
| 28 | + |
| 29 | + |
| 30 | +# we can get a policy enforcer by this init. |
| 31 | +# oslo policy support change policy rule dynamically. |
| 32 | +# at present, policy.enforce will reload the policy rules when it checks |
| 33 | +# the policy files have been touched. |
| 34 | +def init(policy_file=None, rules=None, |
| 35 | + default_rule=None, use_conf=True, overwrite=True): |
| 36 | + """Init an Enforcer class. |
| 37 | +
|
| 38 | + :param policy_file: Custom policy file to use, if none is |
| 39 | + specified, ``conf.policy_file`` will be |
| 40 | + used. |
| 41 | + :param rules: Default dictionary / Rules to use. It will be |
| 42 | + considered just in the first instantiation. If |
| 43 | + :meth:`load_rules` with ``force_reload=True``, |
| 44 | + :meth:`clear` or :meth:`set_rules` with |
| 45 | + ``overwrite=True`` is called this will be overwritten. |
| 46 | + :param default_rule: Default rule to use, conf.default_rule will |
| 47 | + be used if none is specified. |
| 48 | + :param use_conf: Whether to load rules from cache or config file. |
| 49 | + :param overwrite: Whether to overwrite existing rules when reload rules |
| 50 | + from config file. |
| 51 | + """ |
| 52 | + global _ENFORCER |
| 53 | + if not _ENFORCER: |
| 54 | + # http://docs.openstack.org/developer/oslo.policy/usage.html |
| 55 | + _ENFORCER = policy.Enforcer(CONF, |
| 56 | + policy_file=policy_file, |
| 57 | + rules=rules, |
| 58 | + default_rule=default_rule, |
| 59 | + use_conf=use_conf, |
| 60 | + overwrite=overwrite) |
| 61 | + return _ENFORCER |
| 62 | + |
| 63 | + |
| 64 | +def enforce(context, rule=None, target=None, |
| 65 | + do_raise=True, exc=None, *args, **kwargs): |
| 66 | + |
| 67 | + """Checks authorization of a rule against the target and credentials. |
| 68 | +
|
| 69 | + :param dict context: As much information about the user performing the |
| 70 | + action as possible. |
| 71 | + :param rule: The rule to evaluate. |
| 72 | + :param dict target: As much information about the object being operated |
| 73 | + on as possible. |
| 74 | + :param do_raise: Whether to raise an exception or not if check |
| 75 | + fails. |
| 76 | + :param exc: Class of the exception to raise if the check fails. |
| 77 | + Any remaining arguments passed to :meth:`enforce` (both |
| 78 | + positional and keyword arguments) will be passed to |
| 79 | + the exception class. If not specified, |
| 80 | + :class:`PolicyNotAuthorized` will be used. |
| 81 | +
|
| 82 | + :return: ``False`` if the policy does not allow the action and `exc` is |
| 83 | + not provided; otherwise, returns a value that evaluates to |
| 84 | + ``True``. Note: for rules using the "case" expression, this |
| 85 | + ``True`` value will be the specified string from the |
| 86 | + expression. |
| 87 | + """ |
| 88 | + enforcer = init() |
| 89 | + credentials = context.to_dict() |
| 90 | + if not exc: |
| 91 | + exc = exception.PolicyNotAuthorized |
| 92 | + if target is None: |
| 93 | + target = {'project_id': context.project_id, |
| 94 | + 'user_id': context.user_id} |
| 95 | + return enforcer.enforce(rule, target, credentials, |
| 96 | + do_raise=do_raise, exc=exc, *args, **kwargs) |
0 commit comments