services/mgmt/device/impl: per-instance ACLs control logs access
This change extends per-instance ACLs to provide access control to
logs under the __debug space of a device manager invoked application
and adds additional testing to demonstrate globbing and access control
to the entire __debug space.
Change-Id: I8071fa470bd9c001620c3a1e995d0c2e8e5c8963
diff --git a/services/mgmt/device/impl/dispatcher.go b/services/mgmt/device/impl/dispatcher.go
index b4e6e91..da1e4e3 100644
--- a/services/mgmt/device/impl/dispatcher.go
+++ b/services/mgmt/device/impl/dispatcher.go
@@ -282,7 +282,11 @@
case "logs":
logsDir := filepath.Join(appInstanceDir, "logs")
suffix := naming.Join(components[5:]...)
- return logsimpl.NewLogFileService(logsDir, suffix), auth, nil
+ appSpecificAuthorizer, err := newAppSpecificAuthorizer(auth, d.config, components[1:], d.aclstore)
+ if err != nil {
+ return nil, nil, err
+ }
+ return logsimpl.NewLogFileService(logsDir, suffix), appSpecificAuthorizer, nil
case "pprof", "stats":
info, err := loadInstanceInfo(nil, appInstanceDir)
if err != nil {
