use std::io::Write;
use std::collections::{HashMap, HashSet, BTreeMap, BTreeSet};
use std::path::{PathBuf, Path};
+use std::sync::{Arc, RwLock};
-use failure::*;
+use anyhow::{bail, Error};
use lazy_static::lazy_static;
pub const PRIV_SYS_POWER_MANAGEMENT: u64 = 1 << 2;
pub const PRIV_DATASTORE_AUDIT: u64 = 1 << 3;
-pub const PRIV_DATASTORE_ALLOCATE: u64 = 1 << 4;
-pub const PRIV_DATASTORE_ALLOCATE_SPACE: u64 = 1 << 5;
+pub const PRIV_DATASTORE_MODIFY: u64 = 1 << 4;
+pub const PRIV_DATASTORE_CREATE_BACKUP: u64 = 1 << 5;
+pub const PRIV_DATASTORE_READ: u64 = 1 << 6;
+pub const PRIV_DATASTORE_PRUNE: u64 = 1 << 7;
+
+pub const PRIV_PERMISSIONS_MODIFY: u64 = 1 << 8;
pub const ROLE_ADMIN: u64 = std::u64::MAX;
pub const ROLE_NO_ACCESS: u64 = 0;
pub const ROLE_DATASTORE_ADMIN: u64 =
PRIV_DATASTORE_AUDIT |
-PRIV_DATASTORE_ALLOCATE |
-PRIV_DATASTORE_ALLOCATE_SPACE;
+PRIV_DATASTORE_MODIFY |
+PRIV_DATASTORE_CREATE_BACKUP |
+PRIV_DATASTORE_READ |
+PRIV_DATASTORE_PRUNE;
pub const ROLE_DATASTORE_USER: u64 =
-PRIV_DATASTORE_AUDIT |
-PRIV_DATASTORE_ALLOCATE_SPACE;
+PRIV_DATASTORE_CREATE_BACKUP;
+
+pub const ROLE_DATASTORE_AUDIT: u64 =
+PRIV_DATASTORE_AUDIT;
-pub const ROLE_DATASTORE_AUDIT: u64 = PRIV_DATASTORE_AUDIT;
+pub const ROLE_NAME_NO_ACCESS: &str ="NoAccess";
lazy_static! {
- static ref ROLE_NAMES: HashMap<&'static str, u64> = {
+ pub static ref ROLE_NAMES: HashMap<&'static str, (u64, &'static str)> = {
let mut map = HashMap::new();
- map.insert("Admin", ROLE_ADMIN);
- map.insert("Audit", ROLE_AUDIT);
- map.insert("NoAccess", ROLE_NO_ACCESS);
-
- map.insert("Datastore.Admin", ROLE_DATASTORE_ADMIN);
- map.insert("Datastore.User", ROLE_DATASTORE_USER);
- map.insert("Datastore.Audit", ROLE_DATASTORE_AUDIT);
+ map.insert("Admin", (
+ ROLE_ADMIN,
+ "Administrator",
+ ));
+ map.insert("Audit", (
+ ROLE_AUDIT,
+ "Auditor",
+ ));
+ map.insert(ROLE_NAME_NO_ACCESS, (
+ ROLE_NO_ACCESS,
+ "Disable access",
+ ));
+
+ map.insert("Datastore.Admin", (
+ ROLE_DATASTORE_ADMIN,
+ "Datastore Administrator",
+ ));
+ map.insert("Datastore.User", (
+ ROLE_DATASTORE_USER,
+ "Datastore User",
+ ));
+ map.insert("Datastore.Audit", (
+ ROLE_DATASTORE_AUDIT,
+ "Datastore Auditor",
+ ));
map
};
for (role, propagate) in roles {
if *propagate || all {
- if role == "NoAccess" {
+ if role == ROLE_NAME_NO_ACCESS {
// return a set with a single role 'NoAccess'
let mut set = HashSet::new();
set.insert(role.to_string());
for (role, propagate) in roles {
if *propagate || all {
- if role == "NoAccess" {
+ if role == ROLE_NAME_NO_ACCESS {
// return a set with a single role 'NoAccess'
let mut set = HashSet::new();
set.insert(role.to_string());
}
pub fn insert_group_role(&mut self, group: String, role: String, propagate: bool) {
- self.groups
- .entry(group).or_insert_with(|| HashMap::new())
- .insert(role, propagate);
+ let map = self.groups.entry(group).or_insert_with(|| HashMap::new());
+ if role == ROLE_NAME_NO_ACCESS {
+ map.clear();
+ map.insert(role, propagate);
+ } else {
+ map.remove(ROLE_NAME_NO_ACCESS);
+ map.insert(role, propagate);
+ }
}
pub fn insert_user_role(&mut self, user: String, role: String, propagate: bool) {
- self.users
- .entry(user).or_insert_with(|| HashMap::new())
- .insert(role, propagate);
+ let map = self.users.entry(user).or_insert_with(|| HashMap::new());
+ if role == ROLE_NAME_NO_ACCESS {
+ map.clear();
+ map.insert(role, propagate);
+ } else {
+ map.remove(ROLE_NAME_NO_ACCESS);
+ map.insert(role, propagate);
+ }
}
}
let uglist_role_map0 = group_by_property_list(&role_ug_map0);
let uglist_role_map1 = group_by_property_list(&role_ug_map1);
- for (uglist, roles) in uglist_role_map0 {
- let role_list = roles.iter().fold(String::new(), |mut acc, v| {
+ fn role_list(roles: &BTreeSet<String>) -> String {
+ if roles.contains(ROLE_NAME_NO_ACCESS) { return String::from(ROLE_NAME_NO_ACCESS); }
+ roles.iter().fold(String::new(), |mut acc, v| {
if !acc.is_empty() { acc.push(','); }
acc.push_str(v);
acc
- });
- writeln!(w, "acl:0:{}:{}:{}", path, uglist, role_list)?;
+ })
}
- for (uglist, roles) in uglist_role_map1 {
- let role_list = roles.iter().fold(String::new(), |mut acc, v| {
- if !acc.is_empty() { acc.push(','); }
- acc.push_str(v);
- acc
- });
- writeln!(w, "acl:1:{}:{}:{}", path, uglist, role_list)?;
+ for (uglist, roles) in &uglist_role_map0 {
+ let role_list = role_list(roles);
+ writeln!(w, "acl:0:{}:{}:{}", if path.is_empty() { "/" } else { path }, uglist, role_list)?;
+ }
+
+ for (uglist, roles) in &uglist_role_map1 {
+ let role_list = role_list(roles);
+ writeln!(w, "acl:1:{}:{}:{}", if path.is_empty() { "/" } else { path }, uglist, role_list)?;
}
for (name, child) in node.children.iter() {
AclTree::load(&path)
}
+pub fn cached_config() -> Result<Arc<AclTree>, Error> {
+
+ struct ConfigCache {
+ data: Option<Arc<AclTree>>,
+ last_mtime: i64,
+ last_mtime_nsec: i64,
+ }
+
+ lazy_static! {
+ static ref CACHED_CONFIG: RwLock<ConfigCache> = RwLock::new(
+ ConfigCache { data: None, last_mtime: 0, last_mtime_nsec: 0 });
+ }
+
+ let stat = nix::sys::stat::stat(ACL_CFG_FILENAME)?;
+
+ { // limit scope
+ let cache = CACHED_CONFIG.read().unwrap();
+ if stat.st_mtime == cache.last_mtime && stat.st_mtime_nsec == cache.last_mtime_nsec {
+ if let Some(ref config) = cache.data {
+ return Ok(config.clone());
+ }
+ }
+ }
+
+ let (config, _digest) = config()?;
+ let config = Arc::new(config);
+
+ let mut cache = CACHED_CONFIG.write().unwrap();
+ cache.last_mtime = stat.st_mtime;
+ cache.last_mtime_nsec = stat.st_mtime_nsec;
+ cache.data = Some(config.clone());
+
+ Ok(config)
+}
+
pub fn save_config(acl: &AclTree) -> Result<(), Error> {
let mut raw: Vec<u8> = Vec::new();
#[cfg(test)]
mod test {
- use failure::*;
+ use anyhow::{Error};
use super::AclTree;
fn check_roles(
Ok(())
}
+
+ #[test]
+ fn test_role_add_delete() -> Result<(), Error> {
+
+ let mut tree = AclTree::new();
+
+ tree.insert_user_role("/", "user1@pbs", "Admin", true);
+ tree.insert_user_role("/", "user1@pbs", "Audit", true);
+
+ check_roles(&tree, "user1@pbs", "/", "Admin,Audit");
+
+ tree.insert_user_role("/", "user1@pbs", "NoAccess", true);
+ check_roles(&tree, "user1@pbs", "/", "NoAccess");
+
+ let mut raw: Vec<u8> = Vec::new();
+ tree.write_config(&mut raw)?;
+ let raw = std::str::from_utf8(&raw)?;
+
+ assert_eq!(raw, "acl:1:/:user1@pbs:NoAccess\n");
+
+ Ok(())
+ }
+
+ #[test]
+ fn test_no_access_overwrite() -> Result<(), Error> {
+
+ let mut tree = AclTree::new();
+
+ tree.insert_user_role("/storage", "user1@pbs", "NoAccess", true);
+
+ check_roles(&tree, "user1@pbs", "/storage", "NoAccess");
+
+ tree.insert_user_role("/storage", "user1@pbs", "Admin", true);
+ tree.insert_user_role("/storage", "user1@pbs", "Audit", true);
+
+ check_roles(&tree, "user1@pbs", "/storage", "Admin,Audit");
+
+ tree.insert_user_role("/storage", "user1@pbs", "NoAccess", true);
+
+ check_roles(&tree, "user1@pbs", "/storage", "NoAccess");
+
+ Ok(())
+ }
+
}
projects / proxmox-backup.git / blobdiff