gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-08-29 16:44:23 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

CLOUDSTACK-6558 IAM - Admin user is able to deploy VM in a regular user's Security Group.

Browse Source 
Changes:
- Even for SecurityGroup, go through IAM to do permission checks for all type of accounts
This commit is contained in:
Prachi Damle 2014-05-01 12:18:23 -07:00
parent 430d14b676
commit e89c628843
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/src/com/cloud/network/security/SecurityGroupManagerImpl.java
View File

@ -612,7 +612,7 @@ public class SecurityGroupManagerImpl extends ManagerBase implements SecurityGro
}
// Verify permissions
_accountMgr.checkAccess(caller, null, securityGroup);
_accountMgr.checkAccess(caller, AccessType.OperateEntry, securityGroup);
Long domainId = owner.getDomainId();
if (protocol == null) {
@ -1120,7 +1120,7 @@ public class SecurityGroupManagerImpl extends ManagerBase implements SecurityGro
}
// check permissions
_accountMgr.checkAccess(caller, null, group);
_accountMgr.checkAccess(caller, AccessType.OperateEntry, group);
return Transaction.execute(new TransactionCallbackWithException<Boolean, ResourceInUseException>() {
@Override

5
server/src/com/cloud/user/AccountManagerImpl.java
View File

@ -102,6 +102,7 @@ import com.cloud.network.dao.NetworkVO;
import com.cloud.network.dao.RemoteAccessVpnDao;
import com.cloud.network.dao.RemoteAccessVpnVO;
import com.cloud.network.dao.VpnUserDao;
import com.cloud.network.security.SecurityGroup;
import com.cloud.network.security.SecurityGroupManager;
import com.cloud.network.security.dao.SecurityGroupDao;
import com.cloud.network.vpc.Vpc;
@ -497,7 +498,8 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
for (ControlledEntity entity : entities) {
if (entity instanceof VirtualMachineTemplate || entity instanceof Network
|| entity instanceof AffinityGroup) {
|| entity instanceof AffinityGroup || entity instanceof SecurityGroup) {
// Go through IAM (SecurityCheckers)
for (SecurityChecker checker : _securityCheckers) {
if (checker.checkAccess(caller, accessType, apiName, entity)) {
if (s_logger.isDebugEnabled()) {
@ -540,6 +542,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
}
} else {
// Go through IAM (SecurityCheckers)
for (SecurityChecker checker : _securityCheckers) {
if (checker.checkAccess(caller, accessType, apiName, entities)) {
if (s_logger.isDebugEnabled()) {