admin/milvus
1
0
Fork 0
mirror of https://gitee.com/milvus-io/milvus.git synced 2026-01-07 19:31:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix the Flush privilege can't be granted (#19020)

Browse Source 
Signed-off-by: SimFG <bang.fu@zilliz.com>

Signed-off-by: SimFG <bang.fu@zilliz.com>
This commit is contained in:
SimFG 2022-09-05 21:05:11 +08:00 committed by GitHub
parent 11b4f4e901
commit 2bafdf8c53
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 44 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
internal/proxy/privilege_interceptor.go
View File

@ -39,7 +39,7 @@ p = sub, obj, act
e = some(where (p.eft == allow))
[matchers]
m = r.sub == p.sub && globMatch(r.obj, p.obj) && globMatch(r.act, p.act) || r.sub == "admin" || r.act == "All"
m = r.sub == p.sub && globMatch(r.obj, p.obj) && globMatch(r.act, p.act) || r.sub == "admin" || (r.sub == p.sub && p.act == "PrivilegeAll")
`
ModelKey = "casbin"
)
@ -109,7 +109,7 @@ func PrivilegeInterceptor(ctx context.Context, req interface{}) (context.Context
log.Debug("current request info", zap.String("username", username), zap.Strings("role_names", roleNames),
zap.String("object_type", objectType), zap.String("object_privilege", objectPrivilege),
zap.Int32("object_index", objectNameIndex), zap.String("object_name", objectName),
zap.Strings("object_names", objectNames),
zap.Int32("object_indexs", objectNameIndexs), zap.Strings("object_names", objectNames),
zap.String("policy_info", policyInfo))
policy := fmt.Sprintf("[%s]", policyInfo)
@ -128,43 +128,46 @@ func PrivilegeInterceptor(ctx context.Context, req interface{}) (context.Context
}
for _, roleName := range roleNames {
permitFunc := func(resName string) (bool, error) {
object := funcutil.PolicyForResource(objectType, objectName)
object := funcutil.PolicyForResource(objectType, resName)
isPermit, err := e.Enforce(roleName, object, objectPrivilege)
if err != nil {
log.Error("Enforce fail", zap.String("role", roleName), zap.String("object", object), zap.String("privilege", objectPrivilege), zap.Error(err))
return false, err
}
return isPermit, nil
}
// handle the api which refers one resource
permitObject, err := permitFunc(objectName)
if err != nil {
return ctx, err
}
if permitObject {
return ctx, nil
}
// handle the api which refers many resources
permitObjects := true
for _, name := range objectNames {
p, err := permitFunc(name)
if objectNameIndex != 0 {
// handle the api which refers one resource
permitObject, err := permitFunc(objectName)
if err != nil {
return ctx, err
}
if !p {
permitObjects = false
break
if permitObject {
return ctx, nil
}
}
if permitObjects && len(objectNames) != 0 {
return ctx, nil
if objectNameIndexs != 0 {
// handle the api which refers many resources
permitObjects := true
for _, name := range objectNames {
p, err := permitFunc(name)
if err != nil {
return ctx, err
}
if !p {
permitObjects = false
break
}
}
if permitObjects && len(objectNames) != 0 {
return ctx, nil
}
}
}
log.Debug("permission deny", zap.String("policy", policy), zap.Strings("roles", roleNames))
return ctx, status.Error(codes.PermissionDenied, "permission deny")
return ctx, status.Error(codes.PermissionDenied, fmt.Sprintf("%s: permission deny", objectPrivilege))
}
// isCurUserObject Determine whether it is an Object of type User that operates on its own user information,

14
internal/proxy/privilege_interceptor_test.go
View File

@ -52,9 +52,12 @@ func TestPrivilegeInterceptor(t *testing.T) {
},
PolicyInfos: []string{
funcutil.PolicyForPrivilege("role1", commonpb.ObjectType_Collection.String(), "col1", commonpb.ObjectPrivilege_PrivilegeLoad.String()),
funcutil.PolicyForPrivilege("role1", commonpb.ObjectType_Collection.String(), "col1", commonpb.ObjectPrivilege_PrivilegeFlush.String()),
funcutil.PolicyForPrivilege("role2", commonpb.ObjectType_Global.String(), "*", commonpb.ObjectPrivilege_PrivilegeAll.String()),
},
UserRoles: []string{
funcutil.EncodeUserRoleCache("alice", "role1"),
funcutil.EncodeUserRoleCache("fooo", "role2"),
},
}, nil
}
@ -95,6 +98,17 @@ func TestPrivilegeInterceptor(t *testing.T) {
})
assert.NotNil(t, err)
_, err = PrivilegeInterceptor(ctx, &milvuspb.FlushRequest{
DbName: "db_test",
CollectionNames: []string{"col1"},
})
assert.Nil(t, err)
_, err = PrivilegeInterceptor(GetContext(context.Background(), "fooo:123456"), &milvuspb.LoadCollectionRequest{
DbName: "db_test",
CollectionName: "col1",
})
assert.Nil(t, err)
})
}

7
internal/util/funcutil/policy.go
View File

@ -45,9 +45,10 @@ func GetPrivilegeExtObj(m proto.GeneratedMessage) (commonpb.PrivilegeExt, error)
privilegeExt := extObj.(*commonpb.PrivilegeExt)
log.Debug("GetPrivilegeExtObj success", zap.String("resource_type", privilegeExt.ObjectType.String()), zap.String("resource_privilege", privilegeExt.ObjectPrivilege.String()))
return commonpb.PrivilegeExt{
ObjectType: privilegeExt.ObjectType,
ObjectPrivilege: privilegeExt.ObjectPrivilege,
ObjectNameIndex: privilegeExt.ObjectNameIndex,
ObjectType: privilegeExt.ObjectType,
ObjectPrivilege: privilegeExt.ObjectPrivilege,
ObjectNameIndex: privilegeExt.ObjectNameIndex,
ObjectNameIndexs: privilegeExt.ObjectNameIndexs,
}, nil
}