A couple of bug reports against 0.15 highlighted some issues with the
way loan management was mapped to the new ACL model. The one we kept
open as the tracking BZ was
https://bugzilla.redhat.com/show_bug.cgi?id=1011858
While it results in a slight misnomer, my proposal is to update the
permissions as follows to ensure we're providing feature parity with 0.14:
1. "loan-any" will grant the same power over loans and reservations as
that enjoyed by the system owner. Both the system owners and users and
groups with the loan-any permission will be able to:
- grant a loan to any user
- return a loan for any user
- transfer a loan directly between users
- return a manual reservation for any user
Neither the system owner *nor* those with loan-any permissions can
return automated reservations (the job needs to be cancelled instead).
2. "loan-self" will grant the ability to loan a system that is not
currently loaned to anyone to yourself. It does *not* grant the ability
to return someone else's loan or transfer their loan to you.
3. Anyone with the system loaned to them will always have the necessary
permissions to return the loan, as well as to manually reserve and
return the system.
Linking the ability to return arbitrary manual reservations to
"loan-any" is the part that's a slight misnomer, but it's necessary to
preserve the old behaviour in 0.14 where members of system admin groups
could return each other's reservations.
For 0.16 we could split out a separate "cancel-reservation" permission
for that, but I'm not sure it makes sense to do so - being able to
cancel a manual reservation is a necessary part of being able to
reliably cancel a loan. I think it makes more sense to postpone doing
anything about that until we grant system owners the ability to cancel
arbitrary jobs running on their systems.
Thoughts?
Cheers,
Nick.
--
Nick Coghlan
Red Hat Infrastructure Engineering & Development, Brisbane
Testing Solutions Team Lead
Beaker Development Lead (
http://beaker-project.org/)