Andrew Bogott has submitted this change and it was merged.
Change subject: Sudo policy for service groups
......................................................................
Sudo policy for service groups
Change-Id: I0cda7c4f32709c8c7bf6ac38eadd0d1d39b19767
---
M nova/OpenStackNovaServiceGroup.php
M special/SpecialNovaSudoer.php
2 files changed, 31 insertions(+), 1 deletion(-)
Approvals:
Ryan Lane: Looks good to me, approved
Andrew Bogott: Verified
coren: Looks good to me, but someone else must approve
jenkins-bot: Checked
diff --git a/nova/OpenStackNovaServiceGroup.php
b/nova/OpenStackNovaServiceGroup.php
index cd2bdd3..e9858c4 100644
--- a/nova/OpenStackNovaServiceGroup.php
+++ b/nova/OpenStackNovaServiceGroup.php
@@ -259,6 +259,20 @@
return null;
}
+ # Create Sudo policy so that members of this group can chmod
files
+ if ( OpenStackNovaSudoer::createSudoer( $groupName . '-chmod',
+ $project->projectname,
+ array( $groupName ),
+ array( 'ALL' ),
+ array( 'chown -R ' . $groupName . ':' .
$groupName . ' ' . $homeDir ),
+ array( '!authenticate' ) ) ) {
+ $wgAuth->printDebug( "Successfully created chmod sudo
policy for $groupName",
+ NONSENSITIVE );
+ } else {
+ $wgAuth->printDebug( "Failed to creat chmod sudo
policy for $groupName",
+ NONSENSITIVE );
+ }
+
return $newGroup;
}
diff --git a/special/SpecialNovaSudoer.php b/special/SpecialNovaSudoer.php
index 28dbaad..b43e9b5 100644
--- a/special/SpecialNovaSudoer.php
+++ b/special/SpecialNovaSudoer.php
@@ -398,6 +398,12 @@
$userNames = array();
$projectmembers = $project->getMembers();
$sudoUsers = $sudoer->getSudoerUsers();
+ # Add service users. These aren't editable.
+ foreach ( $project->serviceGroups as $servicegroup ) {
+ if ( in_array( $servicegroup->groupName,
$sudoUsers ) ) {
+ $userNames[] = $servicegroup->groupName;
+ }
+ }
foreach ( $projectmembers as $member ) {
$user = new OpenStackNovaUser( $member );
if ( in_array( $user->getUid(), $sudoUsers ) ) {
@@ -551,7 +557,17 @@
} else {
$options[] = '!authenticate';
}
- $success = $sudoer->modifySudoer(
$this->removeALLFromUserKeys($formData['users']), $formData['hosts'],
$commands, $options );
+
+ # Make sure we aren't pulling service users out of the
list.
+ $users =
$this->removeALLFromUserKeys($formData['users']);
+ $project = OpenStackNovaProject::getProjectByName(
$formData['project'] );
+ foreach ( $this->project->serviceGroups as
$servicegroup ) {
+ if ( in_array( $servicegroup->groupName,
$sudoer->getSudoerUsers() ) ) {
+ $users[] = $servicegroup->groupName;
+ }
+ }
+
+ $success = $sudoer->modifySudoer( $users,
$formData['hosts'], $commands, $options );
if ( ! $success ) {
$this->getOutput()->addWikiMsg(
'openstackmanager-modifysudoerfailed' );
return true;
--
To view, visit https://gerrit.wikimedia.org/r/56523
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I0cda7c4f32709c8c7bf6ac38eadd0d1d39b19767
Gerrit-PatchSet: 4
Gerrit-Project: mediawiki/extensions/OpenStackManager
Gerrit-Branch: master
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Ryan Lane <[email protected]>
Gerrit-Reviewer: coren <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
