diff --git a/etc/manila/policy.json b/etc/manila/policy.json index 234b8efa86..ba43c008f3 100644 --- a/etc/manila/policy.json +++ b/etc/manila/policy.json @@ -19,25 +19,6 @@ "share_instance:force_delete": "rule:admin_api", "share_instance:reset_status": "rule:admin_api", - "share_snapshot:get_snapshot": "rule:default", - "share_snapshot:get_all_snapshots": "rule:default", - "share_snapshot:manage_snapshot": "rule:admin_api", - "share_snapshot:unmanage_snapshot": "rule:admin_api", - "share_snapshot:force_delete": "rule:admin_api", - "share_snapshot:reset_status": "rule:admin_api", - "share_snapshot:access_list": "rule:default", - "share_snapshot:allow_access": "rule:default", - "share_snapshot:deny_access": "rule:default", - "share_snapshot_export_location:index": "rule:default", - "share_snapshot_export_location:show": "rule:default", - - "share_snapshot_instance:detail": "rule:admin_api", - "share_snapshot_instance:index": "rule:admin_api", - "share_snapshot_instance:show": "rule:admin_api", - "share_snapshot_instance:reset_status": "rule:admin_api", - "share_snapshot_instance_export_location:index": "rule:admin_api", - "share_snapshot_instance_export_location:show": "rule:admin_api", - "share_types_extra_spec:create": "rule:admin_api", "share_types_extra_spec:update": "rule:admin_api", "share_types_extra_spec:show": "rule:admin_api", diff --git a/manila/policies/__init__.py b/manila/policies/__init__.py index 4e02676a5d..937b343480 100644 --- a/manila/policies/__init__.py +++ b/manila/policies/__init__.py @@ -18,6 +18,10 @@ import itertools from manila.policies import base from manila.policies import share_instance_export_location +from manila.policies import share_snapshot +from manila.policies import share_snapshot_export_location +from manila.policies import share_snapshot_instance +from manila.policies import share_snapshot_instance_export_location from manila.policies import share_type from manila.policies import shares @@ -28,4 +32,8 @@ def list_rules(): shares.list_rules(), share_instance_export_location.list_rules(), share_type.list_rules(), + share_snapshot.list_rules(), + share_snapshot_export_location.list_rules(), + share_snapshot_instance.list_rules(), + share_snapshot_instance_export_location.list_rules(), ) diff --git a/manila/policies/share_snapshot.py b/manila/policies/share_snapshot.py new file mode 100644 index 0000000000..6c6e43d961 --- /dev/null +++ b/manila/policies/share_snapshot.py @@ -0,0 +1,128 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_snapshot:%s' + + +share_snapshot_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'get_snapshot', + check_str=base.RULE_DEFAULT, + description="Get share snapshot.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshots/{snapshot_id}' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'get_all_snapshots', + check_str=base.RULE_DEFAULT, + description="Get all share snapshots.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshots' + }, + { + 'method': 'GET', + 'path': '/snapshots/detail' + }, + { + 'method': 'GET', + 'path': '/snapshots?{query}' + }, + { + 'method': 'GET', + 'path': '/snapshots/detail?{query}' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'force_delete', + check_str=base.RULE_ADMIN_API, + description="Force Delete a share snapshot.", + operations=[ + { + 'method': 'DELETE', + 'path': '/snapshots/{snapshot_id}' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'manage_snapshot', + check_str=base.RULE_ADMIN_API, + description="Manage share snapshot.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots/manage' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'unmanage_snapshot', + check_str=base.RULE_ADMIN_API, + description="Unmanage share snapshot.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots/{snapshot_id}/action' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'reset_status', + check_str=base.RULE_ADMIN_API, + description="Reset status.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots/{snapshot_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'access_list', + check_str=base.RULE_DEFAULT, + description="List access rules of a share snapshot.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshots/{snapshot_id}/access-list' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'allow_access', + check_str=base.RULE_DEFAULT, + description="Allow access to a share snapshot.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots/{snapshot_id}/action' + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'deny_access', + check_str=base.RULE_DEFAULT, + description="Deny access to a share snapshot.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshots/{snapshot_id}/action' + } + ]), +] + + +def list_rules(): + return share_snapshot_policies diff --git a/manila/policies/share_snapshot_export_location.py b/manila/policies/share_snapshot_export_location.py new file mode 100644 index 0000000000..dea0610e9d --- /dev/null +++ b/manila/policies/share_snapshot_export_location.py @@ -0,0 +1,48 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_snapshot_export_location:%s' + + +share_snapshot_export_location_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_DEFAULT, + description="List export locations of a share snapshot.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshots/{snapshot_id}/export-locations/', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_DEFAULT, + description="Get details of a specified export location of a " + "share snapshot.", + operations=[ + { + 'method': 'GET', + 'path': ('/snapshots/{snapshot_id}/' + 'export-locations/{export_location_id}'), + } + ]), +] + + +def list_rules(): + return share_snapshot_export_location_policies diff --git a/manila/policies/share_snapshot_instance.py b/manila/policies/share_snapshot_instance.py new file mode 100644 index 0000000000..f3c529da88 --- /dev/null +++ b/manila/policies/share_snapshot_instance.py @@ -0,0 +1,74 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_snapshot_instance:%s' + + +share_snapshot_instance_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_ADMIN_API, + description="Get share snapshot instance.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshot-instances/{snapshot_instance_id}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_ADMIN_API, + description="Get all share snapshot instances.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshot-instances', + }, + { + 'method': 'GET', + 'path': '/snapshot-instances?{query}', + }, + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'detail', + check_str=base.RULE_ADMIN_API, + description="Get details of share snapshot instances.", + operations=[ + { + 'method': 'GET', + 'path': '/snapshot-instances/detail', + }, + { + 'method': 'GET', + 'path': '/snapshot-instances/detail?{query}', + }, + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'reset_status', + check_str=base.RULE_ADMIN_API, + description="Reset share snapshot instance's status.", + operations=[ + { + 'method': 'POST', + 'path': '/snapshot-instances/{snapshot_instance_id}/action', + } + ]), +] + + +def list_rules(): + return share_snapshot_instance_policies diff --git a/manila/policies/share_snapshot_instance_export_location.py b/manila/policies/share_snapshot_instance_export_location.py new file mode 100644 index 0000000000..e759576b21 --- /dev/null +++ b/manila/policies/share_snapshot_instance_export_location.py @@ -0,0 +1,49 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_snapshot_instance_export_location:%s' + + +share_snapshot_instance_export_location_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_ADMIN_API, + description="List export locations of a share snapshot instance.", + operations=[ + { + 'method': 'GET', + 'path': ('/snapshot-instances/{snapshot_instance_id}/' + 'export-locations'), + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_ADMIN_API, + description="Show details of a specified export location of a share " + "snapshot instance.", + operations=[ + { + 'method': 'GET', + 'path': ('/snapshot-instances/{snapshot_instance_id}/' + 'export-locations/{export_location_id}'), + } + ]), +] + + +def list_rules(): + return share_snapshot_instance_export_location_policies diff --git a/manila/policy.py b/manila/policy.py index 39e53bcd85..458d8805c2 100644 --- a/manila/policy.py +++ b/manila/policy.py @@ -209,7 +209,10 @@ def check_policy(context, resource, action, target_obj=None): # The else branch will be deleted after all policy in code patches # be merged. if resource in ('share_instance_export_location', 'share_type', - 'share', ): + 'share', 'share_snapshot', + 'share_snapshot_export_location', + 'share_snapshot_instance', + 'share_snapshot_instance_export_location'): authorize(context, _action, target) else: enforce(context, _action, target)