-
Notifications
You must be signed in to change notification settings - Fork 131
/
QoSPermissionUtils.java
127 lines (108 loc) · 5.11 KB
/
QoSPermissionUtils.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
/*
COPYRIGHT STATUS:
Dec 1st 2001, Fermi National Accelerator Laboratory (FNAL) documents and
software are sponsored by the U.S. Department of Energy under Contract No.
DE-AC02-76CH03000. Therefore, the U.S. Government retains a world-wide
non-exclusive, royalty-free license to publish or reproduce these documents
and software for U.S. Government purposes. All documents and software
available from this server are protected under the U.S. and Foreign
Copyright Laws, and FNAL reserves all rights.
Distribution of the software available from this server is free of
charge subject to the user following the terms of the Fermitools
Software Legal Information.
Redistribution and/or modification of the software shall be accompanied
by the Fermitools Software Legal Information (including the copyright
notice).
The user is asked to feed back problems, benefits, and/or suggestions
about the software to the Fermilab Software Providers.
Neither the name of Fermilab, the URA, nor the names of the contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
DISCLAIMER OF LIABILITY (BSD):
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL FERMILAB,
OR THE URA, OR THE U.S. DEPARTMENT of ENERGY, OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Liabilities of the Government:
This software is provided by URA, independent from its Prime Contract
with the U.S. Department of Energy. URA is acting independently from
the Government and in its own private capacity and is not acting on
behalf of the U.S. Government, nor as its contractor nor its agent.
Correspondingly, it is understood and agreed that the U.S. Government
has no connection to this software and in no manner whatsoever shall
be liable for nor assume any responsibility or obligation for any claim,
cost, or damages arising out of or resulting from the use of the software
available from this server.
Export Control:
All documents and software available from this server are subject to U.S.
export control laws. Anyone downloading information from this server is
obligated to secure any necessary Government licenses before exporting
documents or software obtained from this server.
*/
package org.dcache.qos.util;
import java.security.Principal;
import java.util.Iterator;
import java.util.Set;
import javax.security.auth.Subject;
import org.dcache.auth.RolePrincipal;
import org.dcache.auth.RolePrincipal.Role;
import org.dcache.auth.Subjects;
import org.dcache.vehicles.FileAttributes;
public class QoSPermissionUtils {
/**
* Determines if the user is allowed to modify qos.
*
* This is a user-facing check done up front by the engine. Verifications and
* adjustments initiated by the QoS service itself are done as ROOT and
* do not need checking.
*
* @param subject of the message received.
* @param useRoles if true, use roles to determine if the user can modify qos.
* @param attributes with OWNER and OWNER_GROUP defined.
*/
public static boolean canModifyQos(Subject subject, boolean useRoles, FileAttributes attributes) {
if (subject == null) {
/*
* with 9.2, the subject is no longer retrieved from the database.
* If it is missing from the message, do not authorize.
*/
return false;
}
if (!useRoles) {
/*
* If we are not using roles, then all users can modify QoS.
*/
return true;
}
Set<Principal> principals = subject.getPrincipals();
for (Iterator<Principal> i = principals.iterator(); i.hasNext(); ) {
Principal next = i.next();
if (next instanceof RolePrincipal) {
RolePrincipal principal = (RolePrincipal) next;
/*
* This may not be something we have immediate need for, but the OR logic here
* allows for there being permissions based on both uid and primary gid.
*/
if (principal.hasRole(Role.ADMIN) ||
(principal.hasRole(Role.QOS_USER)
&& Subjects.getUid(subject) == attributes.getOwner()) ||
(principal.hasRole(Role.QOS_GROUP)
&& Subjects.getPrimaryGid(subject) == attributes.getGroup())) {
return true;
}
}
}
return false;
}
private QoSPermissionUtils() {
// static class
}
}