Xu Ao 4ed29c221b Fix a code logic while doing cyclical reference check to the policy
While there is same rule_check in different branchs of a rule, it shouln't
be judged to having cyclical reference.

For example:
'get_properties': 'rule:is_admin or rule:is_observer'
'is_admin': 'rule:is_member'
'is_observer': 'rule:is_member'

In this situation, it shouldn't be judged to haveing cyclical reference.
So that the parameter 'seen' should be passed like this to prevent it from
missing judgement:
                      get_properties(seen)
                                |
               ---------------  Or -------------------
              |                                       |
        rule:is_admin(seen')                  rule:is_observer(seen'')
              |                                       |
        rule:is_member(seen')                 rule:is_member(seen'')

Change-Id: I904dc60c40b11699c9087e6ebae7aba4d0113dd8
Closes-bug: #1637419
2016-11-08 10:19:41 +08:00
2016-11-01 14:32:01 +08:00
2015-02-17 00:37:33 +00:00
2016-10-11 16:06:59 +07:00
2015-09-17 12:16:08 +00:00
2016-08-02 19:34:19 +08:00

oslo.policy

Latest Version

Downloads

The Oslo Policy library provides support for RBAC policy enforcement across all OpenStack services.

Description
Rules engine to enforce access control policy
Readme 6.6 MiB
Languages
Python 100%