On Wed, Sep 11, 2013 at 12:55:01PM -0600, Eric Blake wrote:
> On 09/11/2013 07:24 AM, Daniel P. Berrange wrote:
> > From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
> >
> > The polkit access driver used the wrong permission names for checks
> > on storage pools, volumes and node devices. This led to them always
> > being denied access.
> >
> > Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
> > ---
> > src/access/viraccessdriverpolkit.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
>
> I had to do some hunting, but I found that:
>
> src/access/genpolkit.pl defines
> my @objects = (
> "CONNECT", "DOMAIN", "INTERFACE",
> "NETWORK","NODE_DEVICE", "NWFILTER",
> "SECRET", "STORAGE_POOL", "STORAGE_VOL",
> );
>
> which in turn results in src/access/org.libvirt.api.policy generated
> with entries such as:
>
> <action id="org.libvirt.api.node-device.dettach">
>
> [Ugg - did we REALLY mean to mis-spell detach? Is it too late to fix that?]
The bug with using 'nodedevice' instead of 'node-device' means
no one could have made use of the permission 'dettach'. Given that
I think we can justifiably change it without it being a upgrade
problem / breakage. In general though permission names should be
considered ABI stable.
>
> ACK.
So how about adding this
diff --git a/src/access/viraccessperm.c b/src/access/viraccessperm.c
index 17f6243..9c720f9 100644
--- a/src/access/viraccessperm.c
+++ b/src/access/viraccessperm.c
@@ -58,7 +58,7 @@ VIR_ENUM_IMPL(virAccessPermNodeDevice,
VIR_ACCESS_PERM_NODE_DEVICE_LAST,
"getattr", "read", "write",
"start", "stop",
- "dettach");
+ "detach");
VIR_ENUM_IMPL(virAccessPermNWFilter,
VIR_ACCESS_PERM_NWFILTER_LAST,
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
index a1c23da..85ad9ba 100644
--- a/src/remote/remote_protocol.x
+++ b/src/remote/remote_protocol.x
@@ -3696,19 +3696,19 @@ enum remote_procedure {
/**
* @generate: server
- * @acl: node_device:dettach
+ * @acl: node_device:detach
*/
REMOTE_PROC_NODE_DEVICE_DETTACH = 118,
/**
* @generate: server
- * @acl: node_device:dettach
+ * @acl: node_device:detach
*/
REMOTE_PROC_NODE_DEVICE_RE_ATTACH = 119,
/**
* @generate: server
- * @acl: node_device:dettach
+ * @acl: node_device:detach
*/
REMOTE_PROC_NODE_DEVICE_RESET = 120,
@@ -4929,7 +4929,7 @@ enum remote_procedure {
/**
* @generate: server
- * @acl: node_device:dettach
+ * @acl: node_device:detach
*/
REMOTE_PROC_NODE_DEVICE_DETACH_FLAGS = 301,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list