Common Policy Engine Implementation
-
class Brain(rules=None, default_rule=None)
Bases: object
Implements policy checking.
-
add_rule(key, match)
-
check(match_list, target_dict, cred_dict)
Checks authorization of some rules against credentials.
Detailed description of the check with examples in policy.enforce().
Parameters: |
- match_list – nested tuples of data to match against
- target_dict – dict of object properties
- credentials_dict – dict of actor properties
|
Returns: | True if the check passes
|
-
classmethod load_json(data, default_rule=None)
Init a brain using json instead of a rules dictionary.
-
class HttpBrain(rules=None, default_rule=None)
Bases: cinder.common.policy.Brain
A brain that can check external urls for policy.
Posts json blobs for target and credentials.
-
exception NotAuthorized
Bases: exceptions.Exception
-
enforce(match_list, target_dict, credentials_dict)
Enforces authorization of some rules against credentials.
Parameters: |
- match_list –
nested tuples of data to match against
The basic brain supports three types of match lists:
- rules
looks like: ('rule:compute:get_instance',)Retrieves the named rule from the rules dict and recursively
checks against the contents of the rule.
- roles
looks like: ('role:compute:admin',)Matches if the specified role is in credentials_dict[‘roles’].
- generic
looks like: ('tenant_id:%(tenant_id)s',)Substitutes values from the target dict into the match using
the % operator and matches them against the creds dict.
Combining rules:
The brain returns True if any of the outer tuple of rules
match and also True if all of the inner tuples match. You
can use this to perform simple boolean logic. For
example, the following rule would return True if the creds
contain the role ‘admin’ OR the if the tenant_id matches
the target dict AND the the creds contains the role
‘compute_sysadmin’: {
"rule:combined": (
'role:admin',
('tenant_id:%(tenant_id)s', 'role:compute_sysadmin')
)
}
Note that rule and role are reserved words in the credentials match, so
you can’t match against properties with those names. Custom brains may
also add new reserved words. For example, the HttpBrain adds http as a
reserved word.
- target_dict –
dict of object properties
Target dicts contain as much information as we can about the object being
operated on.
- credentials_dict –
dict of actor properties
Credentials dicts contain as much information as we can about the user
performing the action.
|
Raises NotAuthorized: |
| if the check fails
|
-
reset()
Clear the brain used by enforce().
-
set_brain(brain)
Set the brain used by enforce().
Defaults use Brain() if not set.