Previous topic

The cinder.common.deprecated Module

Next topic

The cinder.compute.aggregate_states Module

This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Cinder 2011.2 docs or all OpenStack docs too.

The cinder.common.policy Module

Common Policy Engine Implementation

class Brain(rules=None, default_rule=None)

Bases: object

Implements policy checking.

add_rule(key, match)
check(match_list, target_dict, cred_dict)

Checks authorization of some rules against credentials.

Detailed description of the check with examples in policy.enforce().

Parameters:
  • match_list – nested tuples of data to match against
  • target_dict – dict of object properties
  • credentials_dict – dict of actor properties
Returns:

True if the check passes

classmethod load_json(data, default_rule=None)

Init a brain using json instead of a rules dictionary.

class HttpBrain(rules=None, default_rule=None)

Bases: cinder.common.policy.Brain

A brain that can check external urls for policy.

Posts json blobs for target and credentials.

exception NotAuthorized

Bases: exceptions.Exception

enforce(match_list, target_dict, credentials_dict)

Enforces authorization of some rules against credentials.

Parameters:
  • match_list

    nested tuples of data to match against

    The basic brain supports three types of match lists:

    1. rules
      looks like: ('rule:compute:get_instance',)

      Retrieves the named rule from the rules dict and recursively checks against the contents of the rule.

    2. roles
      looks like: ('role:compute:admin',)

      Matches if the specified role is in credentials_dict[‘roles’].

    3. generic
      looks like: ('tenant_id:%(tenant_id)s',)

      Substitutes values from the target dict into the match using the % operator and matches them against the creds dict.

    Combining rules:

    The brain returns True if any of the outer tuple of rules match and also True if all of the inner tuples match. You can use this to perform simple boolean logic. For example, the following rule would return True if the creds contain the role ‘admin’ OR the if the tenant_id matches the target dict AND the the creds contains the role ‘compute_sysadmin’:
    {
        "rule:combined": (
            'role:admin',
            ('tenant_id:%(tenant_id)s', 'role:compute_sysadmin')
        )
    }
    

    Note that rule and role are reserved words in the credentials match, so you can’t match against properties with those names. Custom brains may also add new reserved words. For example, the HttpBrain adds http as a reserved word.

  • target_dict

    dict of object properties

    Target dicts contain as much information as we can about the object being operated on.

  • credentials_dict

    dict of actor properties

    Credentials dicts contain as much information as we can about the user performing the action.

Raises NotAuthorized:
 

if the check fails

reset()

Clear the brain used by enforce().

set_brain(brain)

Set the brain used by enforce().

Defaults use Brain() if not set.