diff options
| author | Daniel Silverstone <daniel.silverstone@codethink.co.uk> | 2012-10-24 14:53:04 +0100 |
|---|---|---|
| committer | Daniel Silverstone <daniel.silverstone@codethink.co.uk> | 2012-10-24 14:53:04 +0100 |
| commit | 466b1eeb08cf73c10b368ac99cc87e6d9029a3c7 (patch) | |
| tree | 6b8510592818c332b5f5cb597df5c285a534b7fd | |
| parent | 632eef1ca193f2066d14172cdc2aa4ac202c8f45 (diff) | |
| download | trove-setup-466b1eeb08cf73c10b368ac99cc87e6d9029a3c7.tar.gz | |
Ensure that trove cannot be impersonated by trove-admin
| -rw-r--r-- | gitano-admin/rules/aschecks.lace | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/gitano-admin/rules/aschecks.lace b/gitano-admin/rules/aschecks.lace index 467e8a4..fc76440 100644 --- a/gitano-admin/rules/aschecks.lace +++ b/gitano-admin/rules/aschecks.lace @@ -15,10 +15,11 @@ define as_is_admin as_group gitano-admin # trove-admin members are permitted to run sshkey and whoami on behalf -# of others in order to check users and grant access +# of others in order to check users and grant access, providing the target +# user is not part of the gitano-admin group. define as_is_trove_admin as_group trove-admin -define as_trove_admin_ok allof as_is_trove_admin op_self +define as_trove_admin_ok allof as_is_trove_admin !is_admin op_self # You are permitted to do things 'as' others if and only if the caller is # either a member of the administration group, or else meets the above |