èáþ\4"ã@s¤
dZd
dl
Z
d
dlZd
dlZd
dlmZ
d
dlmZ
d
dl	m
Z

d
dlmZ
d
dl
mZ
d
dlmZmZ
d
d	l
mZ
ejZejeƒ
Zdad
g
Zgaejdƒ
Zdd
„Zdddddd„Zdd„Zdd„Zdddd„Z dddd„Z!dd„Z"e
j#dƒ
Gdd„de
j$ƒƒ
Z%dd „Z&d!d"„Z'd#d$„Z(d%d&„Z)dS)'zPolicy Engine For Dmapi.éN)
Úcfg)
Úlog)
Úpolicy)
Úexcutils)
Ú	exception)Ú_LEÚ_LW)
Úpolicieszos-keypairsz%\((\w+)\)sc
Cstrtj
ƒ
dadS)
N)Ú	_ENFORCERÚclear©rrú./usr/lib/python3/dist-packages/dmapi/policy.pyÚreset"s


rTc
CstsAt
jtd
|d|
d|d|ƒ
attƒ

tjƒ
tj}t|ƒ
}t|kr{t	|ƒ

t
j|ƒ
adS)aë
Init an Enforcer class.

       :param policy_file: Custom policy file to use, if none is specified,
                           `CONF.policy_file` will be used.
       :param rules: Default dictionary / Rules to use. It will be
                     considered just in the first instantiation.
       :param default_rule: Default rule to use, CONF.default_rule will
                            be used if none is specified.
       :param use_conf: Whether to load rules from config file.
    Úpolicy_fileÚrulesÚdefault_ruleÚuse_confN)r
rZEnforcerÚCONFÚregister_rulesZ
load_rulesZ
file_rulesÚ_serialize_rulesÚsaved_file_rulesÚ(_warning_for_deprecated_user_based_rulesÚcopyÚdeepcopy)rrrrZcurrent_file_rulesrrr
Úinit)s




	



	



rc
Cs5d
d„t|j
ƒƒ
Dƒ
}
t|
ddd„ƒ

S)zYSerialize all the Rule object as string which is used to compare the
    rules list.
    c
Ss(g|]\}
}|
t|ƒ
f‘qSr)
Ústr)Ú.0Z	rule_nameÚrulerrr
ú
<listcomp>Os	
z$_serialize_rules.<locals>.<listcomp>Úkeyc

Ss|d
S)Nr
r)
rrrr
Ú<lambda>Qsz"_serialize_rules.<locals>.<lambda>)ÚlistÚitemsÚsorted)rÚresultrrr
rKs	

rc

sdx]|D]U‰‡f
d
d†tDƒ
r)qdt
jˆdƒ
krtjtdƒ
ˆdƒ
qWdS)z`Warning user based policy enforcement used in the rule but the rule
    doesn't support it.
    c
s&g|]}
|
ˆdkr|
‘qS)
r
r)rÚresource)
rrr
r[s	
z<_warning_for_deprecated_user_based_rules.<locals>.<listcomp>Zuser_idé
zThe user_id attribute isn't supported in the rule '%s'. All the user_id based policy enforcement will be removed in the future.r
N)ÚUSER_BASED_RESOURCESÚKEY_EXPRÚfindallÚLOGÚwarningr)
rr)
rr
rTs


rFcCs$td
dƒ

t
j||
|ƒ
dS)a7
Set rules based on the provided dict of rules.

       :param rules: New rules to use. It should be an instance of dict.
       :param overwrite: Whether to overwrite current rules or update them
                         with the new rules.
       :param use_conf: Whether to reload rules from config file.
    rFN)rr
Ú	set_rules)rZ	overwriterrrr
r,es	

r,cCsÑtƒ
|j
ƒ}|s"tj}y+tj|
||d
|d|d|
ƒ}Wn}tjk
r‹


tj	ƒ
t
jtdƒ
ƒ

WdQRXYnBtk
rÌ


tj	ƒ!
t
j
dd|
d|iƒ
WdQRXYn
X|S)acVerifies that the action is valid on the target in this context.

       :param context: dmapi context
       :param action: string representing the action to be checked
           this should be colon separated for clarity.
           i.e. ``compute:create_instance``,
           ``compute:attach_volume``,
           ``volume:attach_volume``
       :param target: dictionary representing the object of the action
           for object creation this should be a dictionary representing the
           location of the object e.g. ``{'project_id': context.project_id}``
       :param do_raise: if True (the default), raises PolicyNotAuthorized;
           if False, returns False
       :param exc: Class of the exception to raise if the check fails.
                   Any remaining arguments passed to :meth:`authorize` (both
                   positional and keyword arguments) will be passed to
                   the exception class. If not specified,
                   :class:`PolicyNotAuthorized` will be used.

       :raises dmapi.exception.PolicyNotAuthorized: if verification fails
           and do_raise is True. Or if 'exc' is specified it will raise an
           exception of that type.

       :return: returns a non-False value (not necessarily "True") if
           authorized, and the exact value False if not authorized and
           do_raise is False.
    Údo_raiseÚexcÚactionzPolicy not registeredNzCPolicy check for %(action)s failed with credentials %(credentials)sÚcredentials)rÚto_policy_valuesrZPolicyNotAuthorizedr
Ú	authorizerZPolicyNotRegisteredrZsave_and_reraise_exceptionr*rÚ	ExceptionÚdebug)Úcontextr/Útargetr-r.r0r$rrr
r2rs


	











	
r2c
Cs,tƒ
|j
ƒ}
|
}tjd
||
ƒS)zMWhether or not roles contains 'admin' role according to policy setting.

    Zcontext_is_admin)rr1r
r2)r5r0r6rrr
Úcheck_is_admin s

r7Úis_admincs4eZ
dZd
Z‡f
dd†Zdd„Z‡S)ÚIsAdminCheckzAn explicit check for is_admin.cs;|jƒd
k|_
tt|ƒj|
t|j
ƒ
ƒ
dS)zInitialize the check.ÚtrueN)ÚlowerÚexpectedÚsuperr9Ú__init__r)ÚselfÚkindÚmatch)
Ú	__class__rr
r>°szIsAdminCheck.__init__cCs|d
|jkS)z7Determine whether is_admin matches the requested value.r8)
r<)r?r6ÚcredsÚenforcerrrr
Ú__call__·szIsAdminCheck.__call__)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r>rErr)
rBr
r9¬sr9c
Cstr
tj
SdS)
N)r
rrrrr
Ú	get_rules½s

rJc

Cs|jt
jƒƒ

dS)
N)Zregister_defaultsr	Z
list_rules)
rDrrr
rÂs
rcCsg}d
}
x`|
tt
jƒ
krnt
j|
jdƒ
dkrM|
d7}
q|jt
j|
ƒ

|
d
7}
qWtj|ddƒ


tƒ
tS)	Nr&ú
-Ú	namespaceúoutput-fileéÚprojectÚdmapi)z	namespacerM)	ÚlenÚsysÚargvÚstripÚappendrrrr
)Z	conf_argsÚ
irrr
Úget_enforcerÆs








rWcCs`trt
tj|ƒ
}nd
}||krXtjdj|
|ƒƒ

|j|ƒ

dSdSd
S)aCheck the rule of the deprecated policy action

    If the current rule of the deprecated policy action is set to a non-default
    value, then a warning message is logged stating that the new policy
    action should be used to dictate permissions as the old policy action is
    being deprecated.

    :param old_policy: policy action that is being deprecated
    :param new_policy: policy action that is replacing old_policy
    :param default_rule: the old_policy action default rule value
    :param context: the dmapi context
    NzvStart using the new action '{0}'. The existing action '{1}' is being deprecated and will be removed in future release.TF)r
rrr*r+ÚformatZcan)Z
old_policyZ
new_policyrr5Zcurrent_rulerrr
Úverify_deprecated_policyÚs






rY)*rIrÚrerRZoslo_configrZoslo_logrÚloggingZoslo_policyrZ
oslo_utilsrrPrZ
dmapi.i18nrrr	rÚ	getLoggerrFr*r
r'rÚcompiler(rrrrr,r2r7ÚregisterZCheckr9rJrrWrYrrrr
Ú<module>s:







	

	
"	
.