External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-11 12:25:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

access: Modify the VIR_ERR_ACCESS_DENIED to include driverName

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=1631606

Changes made to manage and utilize a secondary connection
driver to APIs outside the scope of the primary connection
driver have resulted in some confusion processing polkit rules
since the simple "access denied" error message doesn't provide
enough of a clue when combined with the "authentication failed:
access denied by policy" as to which connection driver refused
or failed the ACL check.

In order to provide some context, let's modify the existing
"access denied" error returne from the various vir*EnsureACL
API's to provide the connection driver name that is causing
the failure. This should provide the context for writing the
polkit rules that would allow access via the driver.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
John Ferlan 2018-10-14 10:09:32 -04:00
parent 67125e0d33
commit ccc72d5cbd
3 changed files with 16 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/access/viraccessmanager.c
View File

@ -196,11 +196,12 @@ static void virAccessManagerDispose(void *object)
* should the admin need to debug things
*/
static int
virAccessManagerSanitizeError(int ret)
virAccessManagerSanitizeError(int ret,
const char *driverName)
{
if (ret < 0) {
virResetLastError();
virAccessError(VIR_ERR_ACCESS_DENIED, NULL);
virAccessError(VIR_ERR_ACCESS_DENIED, driverName, NULL);
}
return ret;
@ -217,7 +218,7 @@ int virAccessManagerCheckConnect(virAccessManagerPtr manager,
if (manager->drv->checkConnect)
ret = manager->drv->checkConnect(manager, driverName, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
@ -233,7 +234,7 @@ int virAccessManagerCheckDomain(virAccessManagerPtr manager,
if (manager->drv->checkDomain)
ret = manager->drv->checkDomain(manager, driverName, domain, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckInterface(virAccessManagerPtr manager,
@ -248,7 +249,7 @@ int virAccessManagerCheckInterface(virAccessManagerPtr manager,
if (manager->drv->checkInterface)
ret = manager->drv->checkInterface(manager, driverName, iface, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckNetwork(virAccessManagerPtr manager,
@ -263,7 +264,7 @@ int virAccessManagerCheckNetwork(virAccessManagerPtr manager,
if (manager->drv->checkNetwork)
ret = manager->drv->checkNetwork(manager, driverName, network, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckNodeDevice(virAccessManagerPtr manager,
@ -278,7 +279,7 @@ int virAccessManagerCheckNodeDevice(virAccessManagerPtr manager,
if (manager->drv->checkNodeDevice)
ret = manager->drv->checkNodeDevice(manager, driverName, nodedev, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckNWFilter(virAccessManagerPtr manager,
@ -293,7 +294,7 @@ int virAccessManagerCheckNWFilter(virAccessManagerPtr manager,
if (manager->drv->checkNWFilter)
ret = manager->drv->checkNWFilter(manager, driverName, nwfilter, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckNWFilterBinding(virAccessManagerPtr manager,
@ -308,7 +309,7 @@ int virAccessManagerCheckNWFilterBinding(virAccessManagerPtr manager,
if (manager->drv->checkNWFilterBinding)
ret = manager->drv->checkNWFilterBinding(manager, driverName, binding, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckSecret(virAccessManagerPtr manager,
@ -323,7 +324,7 @@ int virAccessManagerCheckSecret(virAccessManagerPtr manager,
if (manager->drv->checkSecret)
ret = manager->drv->checkSecret(manager, driverName, secret, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckStoragePool(virAccessManagerPtr manager,
@ -338,7 +339,7 @@ int virAccessManagerCheckStoragePool(virAccessManagerPtr manager,
if (manager->drv->checkStoragePool)
ret = manager->drv->checkStoragePool(manager, driverName, pool, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}
int virAccessManagerCheckStorageVol(virAccessManagerPtr manager,
@ -354,5 +355,5 @@ int virAccessManagerCheckStorageVol(virAccessManagerPtr manager,
if (manager->drv->checkStorageVol)
ret = manager->drv->checkStorageVol(manager, driverName, pool, vol, perm);
return virAccessManagerSanitizeError(ret);
return virAccessManagerSanitizeError(ret, driverName);
}

2
src/rpc/gendispatch.pl
View File

@ -2199,7 +2199,7 @@ elsif ($mode eq "client") {
print " virObjectUnref(mgr);\n";
if ($action eq "Ensure") {
print " if (rv == 0)\n";
print " virReportError(VIR_ERR_ACCESS_DENIED, NULL);\n";
print " virReportError(VIR_ERR_ACCESS_DENIED, conn->driver->name, NULL);\n";
print " return $fail;\n";
} else {
print " virResetLastError();\n";

4
src/util/virerror.c
View File

@ -1442,9 +1442,9 @@ virErrorMsg(virErrorNumber error, const char *info)
break;
case VIR_ERR_ACCESS_DENIED:
if (info == NULL)
errmsg = _("access denied");
errmsg = _("access denied from '%s'");
else
errmsg = _("access denied: %s");
errmsg = _("access denied from '%s': %s");
break;
case VIR_ERR_DBUS_SERVICE:
if (info == NULL)