ó
±¤>cc@sƒ
dZd
dl
Z
d
dlZd
dlZd
dlmZ
d
dlmZ
d
dl	m
Z

d
dlmZ
d
dl
mZ
d
dlmZmZ
d
d	l
mZ
ejZejeƒ
Zdad
g
Zgaejdƒ
Zd„Zddded
„Zd„Z d„Z!ee"d„Z#edd„Z$d„Z%e
j&dƒ
de
j'f
d„ƒYƒ
Z(d„Z)d„Z*d„Z+d„Z,dS(sPolicy Engine For Dmapi.iÿÿÿÿN(
tcfg(
tlog(
tpolicy(
texcutils(
t	exception(t_LEt_LW(
tpoliciessos-keypairss%\((\w+)\)sc
Cstrtj
ƒ
dandS(
N(t	_ENFORCERtcleartNone(((s0/usr/lib/python2.7/site-packages/dmapi/policy.pytreset"s


c
Cs…tsDt
jtd
|d|
d|d|ƒ
attƒ

tjƒ
ntj}t|ƒ
}t|krt	|ƒ

t
j|ƒ
andS(së
Init an Enforcer class.

       :param policy_file: Custom policy file to use, if none is specified,
                           `CONF.policy_file` will be used.
       :param rules: Default dictionary / Rules to use. It will be
                     considered just in the first instantiation.
       :param default_rule: Default rule to use, CONF.default_rule will
                            be used if none is specified.
       :param use_conf: Whether to load rules from config file.
    tpolicy_filetrulestdefault_ruletuse_confN(RRtEnforcertCONFtregister_rulest
load_rulest
file_rulest_serialize_rulestsaved_file_rulest(_warning_for_deprecated_user_based_rulestcopytdeepcopy(RR
RRtcurrent_file_rules((s0/usr/lib/python2.7/site-packages/dmapi/policy.pytinit)s




	



	



c
CsJgt|j
ƒƒ
D]\}
}|
t|ƒ
f^q}t|d
d„ƒ

S(sYSerialize all the Rule object as string which is used to compare the
    rules list.
    tkeyc

Ss|d
S(Ni((
trule((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyt<lambda>Qs(tlisttitemststrtsorted(R
t	rule_nameRtresult((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyRKs
4
c
Cszxs|D]k}
gtD]}||
d
kr|^qr<qndt
j|
dƒ
krtjtdƒ
|
d
ƒ
qqWdS(s`Warning user based policy enforcement used in the rule but the rule
    doesn't support it.
    ituser_idi
sThe user_id attribute isn't supported in the rule '%s'. All the user_id based policy enforcement will be removed in the future.N(tUSER_BASED_RESOURCEStKEY_EXPRtfindalltLOGtwarningR(R
Rtresource((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyRTs





cCs$td
t
ƒ

tj||
|ƒ
dS(s7
Set rules based on the provided dict of rules.

       :param rules: New rules to use. It should be an instance of dict.
       :param overwrite: Whether to overwrite current rules or update them
                         with the new rules.
       :param use_conf: Whether to reload rules from config file.
    RN(RtFalseRt	set_rules(R
t	overwriteR((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyR-es	

c
CsÒtƒ
|j
ƒ}|s%tj}ny+tj|
||d
|d|d|
ƒ}Wn{tjk
rŒ


tj	ƒ
t
jtdƒ
ƒ

WdQXnBtk
rÍ


tj	ƒ#
t
j
di|
d6|d6ƒ
WdQXn
X|S(scVerifies that the action is valid on the target in this context.

       :param context: dmapi context
       :param action: string representing the action to be checked
           this should be colon separated for clarity.
           i.e. ``compute:create_instance``,
           ``compute:attach_volume``,
           ``volume:attach_volume``
       :param target: dictionary representing the object of the action
           for object creation this should be a dictionary representing the
           location of the object e.g. ``{'project_id': context.project_id}``
       :param do_raise: if True (the default), raises PolicyNotAuthorized;
           if False, returns False
       :param exc: Class of the exception to raise if the check fails.
                   Any remaining arguments passed to :meth:`authorize` (both
                   positional and keyword arguments) will be passed to
                   the exception class. If not specified,
                   :class:`PolicyNotAuthorized` will be used.

       :raises dmapi.exception.PolicyNotAuthorized: if verification fails
           and do_raise is True. Or if 'exc' is specified it will raise an
           exception of that type.

       :return: returns a non-False value (not necessarily "True") if
           authorized, and the exact value False if not authorized and
           do_raise is False.
    tdo_raisetexctactionsPolicy not registeredNsCPolicy check for %(action)s failed with credentials %(credentials)stcredentials(Rtto_policy_valuesRtPolicyNotAuthorizedRt	authorizeRtPolicyNotRegisteredRtsave_and_reraise_exceptionR)Rt	Exceptiontdebug(tcontextR1ttargetR/R0R2R$((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyR5rs














	
c
Cs,tƒ
|j
ƒ}
|
}tjd
||
ƒS(sMWhether or not roles contains 'admin' role according to policy setting.

    tcontext_is_admin(RR3RR5(R:R2R;((s0/usr/lib/python2.7/site-packages/dmapi/policy.pytcheck_is_admin s

tis_admintIsAdminCheckc
Bs eZ
dZd
„Zd„ZRS(sAn explicit check for is_admin.cCs;|jƒd
k|_
tt|ƒj|
t|j
ƒ
ƒ
dS(sInitialize the check.ttrueN(tlowertexpectedtsuperR?t__init__R!(tselftkindtmatch((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyRD°scCs|d
|jkS(s7Determine whether is_admin matches the requested value.R>(
RB(RER;tcredstenforcer((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyt__call__·s(t__name__t
__module__t__doc__RDRJ(((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyR?¬s	c
Cstr
tj
SdS(
N(RR
(((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyt	get_rules½s

c

Cs|jt
jƒƒ

dS(
N(tregister_defaultsRt
list_rules(
RI((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyRÂs
cCsg}d
}
xc|
tt
jƒ
krqt
j|
jdƒ
dkrP|
d7}
qn|jt
j|
ƒ

|
d
7}
qWtj|ddƒ


tƒ
tS(	Ni
t
-t	namespacesoutput-fileitprojecttdmapi(s	namespacesoutput-file(	tlentsystargvtstriptappendRRRR(t	conf_argst
i((s0/usr/lib/python2.7/site-packages/dmapi/policy.pytget_enforcerÆs








cCs`trt
tj|ƒ
}nd}||krXtjd
j|
|ƒƒ

|j|ƒ

tSt	SdS(sCheck the rule of the deprecated policy action

    If the current rule of the deprecated policy action is set to a non-default
    value, then a warning message is logged stating that the new policy
    action should be used to dictate permissions as the old policy action is
    being deprecated.

    :param old_policy: policy action that is being deprecated
    :param new_policy: policy action that is replacing old_policy
    :param default_rule: the old_policy action default rule value
    :param context: the dmapi context
    svStart using the new action '{0}'. The existing action '{1}' is being deprecated and will be removed in future release.N(
RR!R
R
R)R*tformattcantTrueR,(t
old_policyt
new_policyRR:tcurrent_rule((s0/usr/lib/python2.7/site-packages/dmapi/policy.pytverify_deprecated_policyÚs






(-RMRtreRVtoslo_configRtoslo_logR
tloggingtoslo_policyRt
oslo_utilsRRTRt
dmapi.i18nRRRRt	getLoggerRKR)R
RR&RtcompileR'RR_RRRR,R-R5R=tregistertCheckR?RNRR\Rc(((s0/usr/lib/python2.7/site-packages/dmapi/policy.pyt<module>s:







	

	
	"			
.