Skip to content
Snippets Groups Projects
Commit d31f733a authored by Florent Gluck's avatar Florent Gluck
Browse files

Added support for new user capability VM_SET_ACCESS_ANY, which allows such a... 

Added support for new user capability VM_SET_ACCESS_ANY, which allows such a user to modify any VM's VM access.
Minor fix to clients' Makefile
Bumped server version to 1.8.3
parent 8759388f
No related branches found
No related tags found
No related merge requests found
Expand all Show whitespace changes
Inline Side-by-side
src/client/common.mk
+ 2
− 2
View file @ d31f733a
......@@ -56,7 +56,7 @@ build:
@echo "[Building for $(OS) $(ARCH)]" ;\
if [ $(OS) = "linux" ]; then \
GOARCH=$(ARCH) GOOS=$(OS) CGO_ENABLED=0 go $(build_flags) -o build/$(ARCH)/$(OS)/ ;\
strip -s build/$(ARCH)/$(OS)/$(bin) ;\
#strip -s build/$(ARCH)/$(OS)/$(bin) ;\
#upx build/$(ARCH)/$(OS)/$(bin) ;\
else \
echo "GOARCH=$(ARCH) GOOS=$(OS) go $(build_flags) -o build/$(ARCH)/$(OS)/" ;\
......@@ -76,7 +76,7 @@ build_all:
echo "[Building for $$os $$arch]" ;\
if [ $$os = "linux" ]; then \
GOARCH=$$arch GOOS=$$os CGO_ENABLED=0 go $(build_flags) -o build/$$arch/$$os/ ;\
strip -s build/$$arch/$$os/$(bin) ;\
#strip -s build/$$arch/$$os/$(bin) ;\
#upx build/$$arch/$$os/$(bin) ;\
else \
echo "GOARCH=$$arch GOOS=$$os go $(build_flags) -o build/$$arch/$$os/" ;\
......
src/common/caps/caps.go
+ 2
− 0
View file @ d31f733a
......@@ -27,6 +27,7 @@ const (
CAP_VM_EDIT = "VM_EDIT"
CAP_VM_EDIT_ANY = "VM_EDIT_ANY"
CAP_VM_SET_ACCESS = "VM_SET_ACCESS"
CAP_VM_SET_ACCESS_ANY = "VM_SET_ACCESS_ANY"
CAP_VM_READFS = "VM_READFS"
CAP_VM_READFS_ANY = "VM_READFS_ANY"
CAP_VM_WRITEFS = "VM_WRITEFS"
......@@ -58,6 +59,7 @@ var userCaps = Capabilities {
CAP_VM_REBOOT_ANY: 1,
CAP_VM_LIST_ANY: 1,
CAP_VM_SET_ACCESS: 1,
CAP_VM_SET_ACCESS_ANY: 1,
CAP_VM_READFS_ANY: 1,
CAP_VM_WRITEFS_ANY: 1,
......
src/server/router/router.go
+ 5
− 5
View file @ d31f733a
......@@ -78,13 +78,13 @@ func (router *Router)Start(port int) {
vmsGroup.GET("/stop", router.vms.GetStoppableVMs)
vmsGroup.GET("/reboot", router.vms.GetRebootableVMs)
vmsGroup.GET("/edit", router.vms.GetEditableVMs)
vmsGroup.GET("/editaccess", router.vms.GetEditableVMAccessVMs)
vmsGroup.GET("/editaccess", router.vms.GetModifiableVMAccessVMs)
vmsGroup.GET("/exportdir", router.vms.GetDirExportableVMs)
vmsGroup.GET("/importfiles", router.vms.GetFilesImportableVMs)
vmsGroup.POST("", router.vms.CreateVM)
vmsGroup.DELETE("/:id", router.vms.DeleteVMByID)
vmsGroup.PUT("/:id", router.vms.EditVMByID)
vmsGroup.DELETE("/:id", router.vms.DeleteVM)
vmsGroup.PUT("/:id", router.vms.EditVM)
vmsGroup.PUT("/:id/start", router.vms.StartVM)
vmsGroup.PUT("/:id/startwithcreds", router.vms.StartVMWithCreds)
vmsGroup.PUT("/:id/stop", router.vms.KillVM)
......@@ -102,8 +102,8 @@ func (router *Router)Start(port int) {
templatesGroup.POST("/vm", router.tpl.CreateTemplateFromVM)
templatesGroup.POST("/qcow", router.tpl.CreateTemplateFromQCOW)
templatesGroup.GET("/:id/disk", router.tpl.ExportDisk)
templatesGroup.DELETE("/:id", router.tpl.DeleteTemplateByID)
templatesGroup.PUT("/:id", router.tpl.EditTemplateByID)
templatesGroup.DELETE("/:id", router.tpl.DeleteTemplate)
templatesGroup.PUT("/:id", router.tpl.EditTemplate)
// Starts server in a dedicated goroutine.
go func() {
......
src/server/router/routerTemplates.go
+ 2
− 2
View file @ d31f733a
......@@ -186,7 +186,7 @@ func (r *RouterTemplates)CreateTemplateFromQCOW(c echo.Context) error {
// CAP_TPL_DESTROY: only a template owned by the user can be deleted.
// Remark: a template can only be deleted if no VM references it!
// curl --cacert ca.pem -X DELETE https://localhost:1077/templates/4913a2bb-edfe-4dfe-af53-38197a44523b -H "Authorization: Bearer <AccessToken>"
func (r *RouterTemplates)DeleteTemplateByID(c echo.Context) error {
func (r *RouterTemplates)DeleteTemplate(c echo.Context) error {
// Retrieves logged user from context.
user, err := getLoggedUser(r.users, c)
if err != nil {
......@@ -226,7 +226,7 @@ func (r *RouterTemplates)DeleteTemplateByID(c echo.Context) error {
// CAP_TPL_EDIT_ANY: any template can be edited.
// CAP_TPL_EDIT: only a template owned by the user can be edited.
// curl --cacert ca.pem -X PUT https://localhost:1077/templates/4913a2bb-edfe-4dfe-af53-38197a44523b -H "Authorization: Bearer <AccessToken>"
func (r *RouterTemplates)EditTemplateByID(c echo.Context) error {
func (r *RouterTemplates)EditTemplate(c echo.Context) error {
// Retrieves logged user from context.
user, err := getLoggedUser(r.users, c)
if err != nil {
......
src/server/router/routerVMs.go
+ 73
− 90
View file @ d31f733a
This diff is collapsed.
src/server/version/version.go
+ 1
− 1
View file @ d31f733a
......@@ -7,7 +7,7 @@ import (
const (
major = 1
minor = 8
bugfix = 2
bugfix = 3
)
type Version struct {
......
src/server/vms/vms.go
+ 31
− 24
View file @ d31f733a
......@@ -12,6 +12,7 @@ import (
"nexus-server/exec"
"nexus-server/paths"
"nexus-server/utils"
"nexus-server/users"
"nexus-server/logger"
c "nexus-server/consts"
"github.com/google/uuid"
......@@ -404,9 +405,9 @@ func (vms *VMs)EditVM(vmID uuid.UUID, name string, cpus, ram int, nic vm.NicType
}
// Set a VM's Access for a given user (email).
// loggedUserEmail is the email of the currently logged user
// userMail is the email of the user for which to modify the access
func (vms *VMs)SetVMAccess(vmID uuid.UUID, loggedUserEmail, userEmail string, newAccess caps.Capabilities) error {
// user is the currently logged user
// destUserEmail is the email of the user for which to modify the access
func (vms *VMs)SetVMAccess(vmID uuid.UUID, user *users.User, destUserEmail string, newAccess caps.Capabilities) error {
if err := caps.ValidateVMAccessCaps(newAccess); err != nil {
return err
}
......@@ -427,17 +428,20 @@ func (vms *VMs)SetVMAccess(vmID uuid.UUID, loggedUserEmail, userEmail string, ne
return errors.New("VM must be stopped")
}
// First, check that the logged user is the VM's owner.
if !vm.IsOwner(loggedUserEmail) {
// Next, checks the logged user has VM_SET_ACCESS set in her/his VM access.
userCaps := vm.v.Access[loggedUserEmail]
// If user has VM_SET_ACCESS_ANY, modify is allowed.
if !user.HasCapability(caps.CAP_VM_SET_ACCESS_ANY) {
// If user is the VM's owner, modify is allowed.
if !vm.IsOwner(user.Email) {
// If user has VM_SET_ACCESS and VM's VM access is present for the same user, modify is allowed.
userCaps := vm.v.Access[user.Email]
_, exists := userCaps[caps.CAP_VM_SET_ACCESS]
if !exists {
return errors.New("Insufficient capability")
}
}
}
vm.v.Access[userEmail] = newAccess
vm.v.Access[destUserEmail] = newAccess
if err = vm.writeConfig(); err != nil {
return err
......@@ -447,9 +451,9 @@ func (vms *VMs)SetVMAccess(vmID uuid.UUID, loggedUserEmail, userEmail string, ne
}
// Remove a VM's Access for a given user (email).
// loggedUserEmail is the email of the currently logged user
// userMail is the email of the user for which to remove the access
func (vms *VMs)DeleteVMAccess(vmID uuid.UUID, loggedUserEmail, userEmail string) error {
// user is the currently logged user
// destUserEmail is the email of the user for which to modify the access
func (vms *VMs)DeleteVMAccess(vmID uuid.UUID, user *users.User, destUserEmail string) error {
vms.rwlock.Lock()
defer vms.rwlock.Unlock()
......@@ -466,21 +470,24 @@ func (vms *VMs)DeleteVMAccess(vmID uuid.UUID, loggedUserEmail, userEmail string)
return errors.New("VM must be stopped")
}
// First, check that the logged user is the VM's owner.
if !vm.IsOwner(loggedUserEmail) {
// Next, checks the logged user has VM_SET_ACCESS set in her/his VM access.
userCaps := vm.v.Access[loggedUserEmail]
// If user has VM_SET_ACCESS_ANY, modify is allowed.
if !user.HasCapability(caps.CAP_VM_SET_ACCESS_ANY) {
// If user is the VM's owner, modify is allowed.
if !vm.IsOwner(user.Email) {
// If user has VM_SET_ACCESS and VM's VM access is present for the same user, modify is allowed.
userCaps := vm.v.Access[user.Email]
_, exists := userCaps[caps.CAP_VM_SET_ACCESS]
if !exists {
return errors.New("Insufficient capability")
}
}
}
// Only removes the user from the Access map if it actually had an access.
if _, exists := vm.v.Access[userEmail]; exists {
delete(vm.v.Access, userEmail)
if _, exists := vm.v.Access[destUserEmail]; exists {
delete(vm.v.Access, destUserEmail)
} else {
return errors.New("User "+userEmail+" has no VM access")
return errors.New("User "+destUserEmail+" has no VM access")
}
if err = vm.writeConfig(); err != nil {
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment