On 12.08.2015 [16:55:31 +0000], Kyle Flavin wrote:
I've been experimenting with the ownership features in Cobbler,
using the authz_ownership module.
My users.conf looks like this:
[admins]
admin = ""
cobbler = ""
[mygroup]
myuser = ""
I'm seeing a problem where "myuser" can edit systems in the WebUI,
owned by "mygroup" that already exist, but "myuser" can't create
new
systems. I get an authorization error, that seems to be tied back to
item_system.py, which loads the obj.owners as the string
"<<inherit>>"
for a new system object (even if I try to create the object with group
"mygroup"). The function __is_user_allowed() seems to expect a list
here, and ends up iterating over this string, and incorrectly checks
for user/group matches against each character in the string - ie: "<".
Not sure if this is a known issue? I'm running 2.6.9 on my server
(latest from the EPEL repos), but it looks like it's unchanged in the
latest version up on github as well. Is this a bug?
I think so. I've noticed that several times in the code,
"<<inherit>>"
needs to be special-cased or violates assumptions (like obj.owners is a
list not a string). The change below might fix it. Care to open an issue
on github? And I can send a fix via github (nacc is my user on there, if
you can subscribe when you file it).
The code snippet is here. When creating a system, obj.owners is a
string containing "<<inherit>>":
def __is_user_allowed(obj, groups, user, resource, arg1, arg2):
if user == "<DIRECT>":
# system user, logged in via web.ss
return True
for group in groups:
if group in [ "admins", "admin" ]:
return True
if obj.owners == []:
return True
if obj.owners == "<<inherit>>":
return __is_user_allowed(obj.get_conceptual_parent(), groups,
user, resource, arg1, arg2)
for allowed in obj.owners:
if user == allowed:
# user match
return True
# else look for a group match
for group in groups:
if group == allowed:
return True
return 0
Should this ^^ be False?
Thanks,
Kyle
_______________________________________________
cobbler-devel mailing list
cobbler-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/cobbler-devel