ceph/src/mon/MonCap.h

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4 #ifndef CEPH_MONCAP_H
   5 #define CEPH_MONCAP_H
   6
   7 #include <ostream>
   8 using std::ostream;
   9
  10 #include "include/types.h"
  11 #include "common/entity_name.h"
  12
  13 class CephContext;
  14
  15 static const __u8 MON_CAP_R     = (1 << 1);      // read
  16 static const __u8 MON_CAP_W     = (1 << 2);      // write
  17 static const __u8 MON_CAP_X     = (1 << 3);      // execute
  18 static const __u8 MON_CAP_ALL   = MON_CAP_R | MON_CAP_W | MON_CAP_X;
  19 static const __u8 MON_CAP_ANY   = 0xff;          // *
  20
  21 struct mon_rwxa_t {
  22   __u8 val;
  23
  24   // cppcheck-suppress noExplicitConstructor
  25   mon_rwxa_t(__u8 v = 0) : val(v) {}
  26   mon_rwxa_t& operator=(__u8 v) {
  27     val = v;
  28     return *this;
  29   }
  30   operator __u8() const {
  31     return val;
  32   }
  33 };
  34
  35 ostream& operator<<(ostream& out, const mon_rwxa_t& p);
  36
  37 struct StringConstraint {
  38   enum MatchType {
  39     MATCH_TYPE_NONE,
  40     MATCH_TYPE_EQUAL,
  41     MATCH_TYPE_PREFIX,
  42     MATCH_TYPE_REGEX
  43   };
  44
  45   MatchType match_type = MATCH_TYPE_NONE;
  46   string value;
  47
  48   StringConstraint() {}
  49   StringConstraint(MatchType match_type, string value)
  50     : match_type(match_type), value(value) {
  51   }
  52 };
  53
  54 ostream& operator<<(ostream& out, const StringConstraint& c);
  55
  56 struct MonCapGrant {
  57   /*
  58    * A grant can come in one of four forms:
  59    *
  60    *  - a blanket allow ('allow rw', 'allow *')
  61    *    - this will match against any service and the read/write/exec flags
  62    *      in the mon code.  semantics of what X means are somewhat ad hoc.
  63    *
  64    *  - a service allow ('allow service mds rw')
  65    *    - this will match against a specific service and the r/w/x flags.
  66    *
  67    *  - a profile ('allow profile osd')
  68    *    - this will match against specific monitor-enforced semantics of what
  69    *      this type of user should need to do.  examples include 'osd', 'mds',
  70    *      'bootstrap-osd'.
  71    *
  72    *  - a command ('allow command foo', 'allow command bar with arg1=val1 arg2 prefix val2')
  73    *      this includes the command name (the prefix string), and a set
  74    *      of key/value pairs that constrain use of that command.  if no pairs
  75    *      are specified, any arguments are allowed; if a pair is specified, that
  76    *      argument must be present and equal or match a prefix.
  77    */
  78   std::string service;
  79   std::string profile;
  80   std::string command;
  81   map<std::string,StringConstraint> command_args;
  82
  83   mon_rwxa_t allow;
  84
  85   // explicit grants that a profile grant expands to; populated as
  86   // needed by expand_profile() (via is_match()) and cached here.
  87   mutable list<MonCapGrant> profile_grants;
  88
  89   void expand_profile(int daemon_type, const EntityName& name) const;
  90   void expand_profile_mon(const EntityName& name) const;
  91   void expand_profile_mgr(const EntityName& name) const;
  92
  93   MonCapGrant() : allow(0) {}
  94   // cppcheck-suppress noExplicitConstructor
  95   MonCapGrant(mon_rwxa_t a) : allow(a) {}
  96   MonCapGrant(string s, mon_rwxa_t a) : service(std::move(s)), allow(a) {}
  97   // cppcheck-suppress noExplicitConstructor
  98   MonCapGrant(string c) : command(std::move(c)) {}
  99   MonCapGrant(string c, string a, StringConstraint co) : command(std::move(c)) {
 100     command_args[a] = co;
 101   }
 102
 103   /**
 104    * check if given request parameters match our constraints
 105    *
 106    * @param cct context
 107    * @param name entity name
 108    * @param service service (if any)
 109    * @param command command (if any)
 110    * @param command_args command args (if any)
 111    * @return bits we allow
 112    */
 113   mon_rwxa_t get_allowed(CephContext *cct,
 114                          int daemon_type, ///< CEPH_ENTITY_TYPE_*
 115                          EntityName name,
 116                          const std::string& service,
 117                          const std::string& command,
 118                          const map<string,string>& command_args) const;
 119
 120   bool is_allow_all() const {
 121     return
 122       allow == MON_CAP_ANY &&
 123       service.length() == 0 &&
 124       profile.length() == 0 &&
 125       command.length() == 0;
 126   }
 127 };
 128
 129 ostream& operator<<(ostream& out, const MonCapGrant& g);
 130
 131 struct MonCap {
 132   string text;
 133   std::vector<MonCapGrant> grants;
 134
 135   MonCap() {}
 136   explicit MonCap(std::vector<MonCapGrant> g) : grants(g) {}
 137
 138   string get_str() const {
 139     return text;
 140   }
 141
 142   bool is_allow_all() const;
 143   void set_allow_all();
 144   bool parse(const std::string& str, ostream *err=NULL);
 145
 146   /**
 147    * check if we are capable of something
 148    *
 149    * This method actually checks a description of a particular operation against
 150    * what the capability has specified.
 151    *
 152    * @param daemon_type CEPH_ENTITY_TYPE_* for the service (MON or MGR)
 153    * @param service service name
 154    * @param command command id
 155    * @param command_args
 156    * @param op_may_read whether the operation may need to read
 157    * @param op_may_write whether the operation may need to write
 158    * @param op_may_exec whether the operation may exec
 159    * @return true if the operation is allowed, false otherwise
 160    */
 161   bool is_capable(CephContext *cct,
 162                   int daemon_type,
 163                   EntityName name,
 164                   const string& service,
 165                   const string& command, const map<string,string>& command_args,
 166                   bool op_may_read, bool op_may_write, bool op_may_exec) const;
 167
 168   void encode(bufferlist& bl) const;
 169   void decode(bufferlist::iterator& bl);
 170   void dump(Formatter *f) const;
 171   static void generate_test_instances(list<MonCap*>& ls);
 172 };
 173 WRITE_CLASS_ENCODER(MonCap)
 174
 175 ostream& operator<<(ostream& out, const MonCap& cap);
 176
 177 #endif