openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add access control filtering of secret objects 

Ensure that all APIs which list secret objects filter
them against the access control system.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-06-27 12:12:30 +01:00
parent 323049a089
commit f02d65041c
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/secret/secret_driver.c
View File

@ -566,8 +566,11 @@ secretConnectNumOfSecrets(virConnectPtr conn)
secretDriverLock(driver); secretDriverLock(driver);
i = 0; i = 0;
for (secret = driver->secrets; secret != NULL; secret = secret->next) for (secret = driver->secrets; secret != NULL; secret = secret->next) {
i++; if (virConnectNumOfSecretsCheckACL(conn,
secret->def))
i++;
}
secretDriverUnlock(driver); secretDriverUnlock(driver);
return i; return i;
@ -590,6 +593,9 @@ secretConnectListSecrets(virConnectPtr conn, char **uuids, int maxuuids)
i = 0; i = 0;
for (secret = driver->secrets; secret != NULL; secret = secret->next) { for (secret = driver->secrets; secret != NULL; secret = secret->next) {
char *uuidstr; char *uuidstr;
if (!virConnectListSecretsCheckACL(conn,
secret->def))
continue;
if (i == maxuuids) if (i == maxuuids)
break; break;
if (VIR_ALLOC_N(uuidstr, VIR_UUID_STRING_BUFLEN) < 0) { if (VIR_ALLOC_N(uuidstr, VIR_UUID_STRING_BUFLEN) < 0) {
@ -666,6 +672,10 @@ secretConnectListAllSecrets(virConnectPtr conn,
} }
for (entry = driver->secrets; entry != NULL; entry = entry->next) { for (entry = driver->secrets; entry != NULL; entry = entry->next) {
if (!virConnectListAllSecretsCheckACL(conn,
entry->def))
continue;
/* filter by whether it's ephemeral */ /* filter by whether it's ephemeral */
if (MATCH(VIR_CONNECT_LIST_SECRETS_FILTERS_EPHEMERAL) && if (MATCH(VIR_CONNECT_LIST_SECRETS_FILTERS_EPHEMERAL) &&
!((MATCH(VIR_CONNECT_LIST_SECRETS_EPHEMERAL) && !((MATCH(VIR_CONNECT_LIST_SECRETS_EPHEMERAL) &&