1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
10 #include "include/types.h"
11 #include "common/entity_name.h"
15 static const __u8 MON_CAP_R = (1 << 1); // read
16 static const __u8 MON_CAP_W = (1 << 2); // write
17 static const __u8 MON_CAP_X = (1 << 3); // execute
18 static const __u8 MON_CAP_ALL = MON_CAP_R | MON_CAP_W | MON_CAP_X;
19 static const __u8 MON_CAP_ANY = 0xff; // *
24 // cppcheck-suppress noExplicitConstructor
25 mon_rwxa_t(__u8 v = 0) : val(v) {}
26 mon_rwxa_t& operator=(__u8 v) {
30 operator __u8() const {
35 ostream& operator<<(ostream& out, const mon_rwxa_t& p);
37 struct StringConstraint {
45 MatchType match_type = MATCH_TYPE_NONE;
49 StringConstraint(MatchType match_type, string value)
50 : match_type(match_type), value(value) {
54 ostream& operator<<(ostream& out, const StringConstraint& c);
58 * A grant can come in one of four forms:
60 * - a blanket allow ('allow rw', 'allow *')
61 * - this will match against any service and the read/write/exec flags
62 * in the mon code. semantics of what X means are somewhat ad hoc.
64 * - a service allow ('allow service mds rw')
65 * - this will match against a specific service and the r/w/x flags.
67 * - a profile ('allow profile osd')
68 * - this will match against specific monitor-enforced semantics of what
69 * this type of user should need to do. examples include 'osd', 'mds',
72 * - a command ('allow command foo', 'allow command bar with arg1=val1 arg2 prefix val2')
73 * this includes the command name (the prefix string), and a set
74 * of key/value pairs that constrain use of that command. if no pairs
75 * are specified, any arguments are allowed; if a pair is specified, that
76 * argument must be present and equal or match a prefix.
81 map<std::string,StringConstraint> command_args;
85 // explicit grants that a profile grant expands to; populated as
86 // needed by expand_profile() (via is_match()) and cached here.
87 mutable list<MonCapGrant> profile_grants;
89 void expand_profile(int daemon_type, const EntityName& name) const;
90 void expand_profile_mon(const EntityName& name) const;
91 void expand_profile_mgr(const EntityName& name) const;
93 MonCapGrant() : allow(0) {}
94 // cppcheck-suppress noExplicitConstructor
95 MonCapGrant(mon_rwxa_t a) : allow(a) {}
96 MonCapGrant(string s, mon_rwxa_t a) : service(std::move(s)), allow(a) {}
97 // cppcheck-suppress noExplicitConstructor
98 MonCapGrant(string c) : command(std::move(c)) {}
99 MonCapGrant(string c, string a, StringConstraint co) : command(std::move(c)) {
100 command_args[a] = co;
104 * check if given request parameters match our constraints
107 * @param name entity name
108 * @param service service (if any)
109 * @param command command (if any)
110 * @param command_args command args (if any)
111 * @return bits we allow
113 mon_rwxa_t get_allowed(CephContext *cct,
114 int daemon_type, ///< CEPH_ENTITY_TYPE_*
116 const std::string& service,
117 const std::string& command,
118 const map<string,string>& command_args) const;
120 bool is_allow_all() const {
122 allow == MON_CAP_ANY &&
123 service.length() == 0 &&
124 profile.length() == 0 &&
125 command.length() == 0;
129 ostream& operator<<(ostream& out, const MonCapGrant& g);
133 std::vector<MonCapGrant> grants;
136 explicit MonCap(std::vector<MonCapGrant> g) : grants(g) {}
138 string get_str() const {
142 bool is_allow_all() const;
143 void set_allow_all();
144 bool parse(const std::string& str, ostream *err=NULL);
147 * check if we are capable of something
149 * This method actually checks a description of a particular operation against
150 * what the capability has specified.
152 * @param daemon_type CEPH_ENTITY_TYPE_* for the service (MON or MGR)
153 * @param service service name
154 * @param command command id
155 * @param command_args
156 * @param op_may_read whether the operation may need to read
157 * @param op_may_write whether the operation may need to write
158 * @param op_may_exec whether the operation may exec
159 * @return true if the operation is allowed, false otherwise
161 bool is_capable(CephContext *cct,
164 const string& service,
165 const string& command, const map<string,string>& command_args,
166 bool op_may_read, bool op_may_write, bool op_may_exec) const;
168 void encode(bufferlist& bl) const;
169 void decode(bufferlist::iterator& bl);
170 void dump(Formatter *f) const;
171 static void generate_test_instances(list<MonCap*>& ls);
173 WRITE_CLASS_ENCODER(MonCap)
175 ostream& operator<<(ostream& out, const MonCap& cap);