re-enable the permission check for SetSyngroupSpec
The check that the caller of SetSyncgroupSpec has the
Admin ACL was removed since only syncbase servers had
the Admin permission. This CL re-enables that check
and changes the featuretests syncbase server blessings
to be client-based.
This CL makes it so that the clients all have blessings
of root:o:app:client:c%d and the syncgroup acls are set
to name specific clients. The servers are all configured to
have the blessings of all the clients, e.g.
root:o:app:client:c0,root:o:app:client:c1,root:o:app:client:c2,root:o:app:client:c3,root:o:app:client:c4
MultiPart: 2/2
Change-Id: I9238ea2acb5c18e8c87892548bdc626e28449114
diff --git a/services/syncbase/vsync/syncgroup.go b/services/syncbase/vsync/syncgroup.go
index 21ac9f3..f0472f7 100644
--- a/services/syncbase/vsync/syncgroup.go
+++ b/services/syncbase/vsync/syncgroup.go
@@ -1022,17 +1022,12 @@
return verror.NewErrBadState(ctx)
}
- // TODO(hpucha): The code below to be enabled once client blesses syncbase.
- //
// Check if this peer is allowed to change the spec.
- // blessingNames, _ := security.RemoteBlessingNames(ctx, call.Security())
- // vlog.VI(4).Infof("sync: SetSyncgroupSpec: authorizing blessings %v against permissions %v", blessingNames, sg.Spec.Perms)
- // if !isAuthorizedForTag(sg.Spec.Perms, access.Admin, blessingNames) {
- // return verror.New(verror.ErrNoAccess, ctx)
- // }
-
- // TODO(hpucha): Check if the acl change causes neighborhood
- // advertising to change.
+ blessingNames, _ := security.RemoteBlessingNames(ctx, call.Security())
+ vlog.VI(4).Infof("sync: SetSyncgroupSpec: authorizing blessings %v against permissions %v", blessingNames, sg.Spec.Perms)
+ if !isAuthorizedForTag(sg.Spec.Perms, access.Admin, blessingNames) {
+ return verror.New(verror.ErrNoAccess, ctx)
+ }
// Reserve a log generation and position counts for the new syncgroup.
gen, pos := ss.reserveGenAndPosInDbLog(ctx, dbId, sgOID(gid), 1)
diff --git a/services/syncbase/vsync/types.vdl b/services/syncbase/vsync/types.vdl
index 69496e8..591898a 100644
--- a/services/syncbase/vsync/types.vdl
+++ b/services/syncbase/vsync/types.vdl
@@ -17,7 +17,7 @@
type DbSyncState struct {
GenVecs interfaces.Knowledge // knowledge capturing the locally-known generations of remote peers for data in Database.
SgGenVecs interfaces.Knowledge // knowledge capturing the locally-known generations of remote peers for syncgroups in Database.
- IsPaused bool // tracks whether sync is paused by client.
+ IsPaused bool // tracks whether sync is paused by client.
}
// LocalLogRec represents the persistent local state of a log record. Metadata
diff --git a/test/v23test/v23test.go b/test/v23test/v23test.go
index eb61343..c2e95e5 100644
--- a/test/v23test/v23test.go
+++ b/test/v23test/v23test.go
@@ -22,6 +22,7 @@
"v.io/v23"
"v.io/v23/context"
"v.io/v23/rpc"
+ "v.io/v23/security"
"v.io/x/lib/envvar"
"v.io/x/lib/gosh"
"v.io/x/ref"
@@ -148,13 +149,20 @@
// blesses it with the given extensions and no caveats, using this principal's
// default blessings. Additionally, it calls SetDefaultBlessings.
func (sh *Shell) ForkCredentials(extensions ...string) *Credentials {
+ return sh.ForkCredentialsFromPrincipal(v23.GetPrincipal(sh.Ctx), extensions...)
+}
+
+// ForkCredentialsFromPrincipal creates a new Credentials (with a fresh principal) and
+// blesses it with the given extensions and no caveats, using the given principal's
+// default blessings. Additionally, it calls SetDefaultBlessings.
+func (sh *Shell) ForkCredentialsFromPrincipal(principal security.Principal, extensions ...string) *Credentials {
sh.Ok()
creds, err := newCredentials(sh.pm)
if err != nil {
sh.handleError(err)
return nil
}
- if err := addDefaultBlessings(v23.GetPrincipal(sh.Ctx), creds.Principal, extensions...); err != nil {
+ if err := addDefaultBlessings(principal, creds.Principal, extensions...); err != nil {
sh.handleError(err)
return nil
}
