diff options
author | Pedro Alvarez <pedro.alvarez@codethink.co.uk> | 2014-07-14 15:10:09 +0000 |
---|---|---|
committer | Pedro Alvarez <pedro.alvarez@codethink.co.uk> | 2014-07-14 15:10:09 +0000 |
commit | 160fd3f2f1d372751836c0073bdc944df1cfbb91 (patch) | |
tree | d6b46ce1ec600400883e53b82e12b390fa73f262 /share/gitano/skel/gitano-admin/rules/core.lace | |
parent | eafba37e2bfc3897e3e7f65f2ce087fbee358f43 (diff) | |
parent | d349c9a35d3d53ebfc9f26df373e84fa5986a1b6 (diff) | |
download | trove-setup-160fd3f2f1d372751836c0073bdc944df1cfbb91.tar.gz |
Merge branch 'baserock/pedroalvarez/trove-ansible3'
Reviewed-by: Richard Maw
Reviewed-by: Lars Wirzenius
Diffstat (limited to 'share/gitano/skel/gitano-admin/rules/core.lace')
-rw-r--r-- | share/gitano/skel/gitano-admin/rules/core.lace | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/share/gitano/skel/gitano-admin/rules/core.lace b/share/gitano/skel/gitano-admin/rules/core.lace new file mode 100644 index 0000000..dab7cfb --- /dev/null +++ b/share/gitano/skel/gitano-admin/rules/core.lace @@ -0,0 +1,47 @@ +# _____ +# |_ _| __ _____ _____ +# | || '__/ _ \ \ / / _ \ +# | || | | (_) \ V / __/ +# |_||_| \___/ \_/ \___| +# +# Copyright 2012 Codethink Limited +# +# Core ruleset definitions for Trove. + +default deny "Trove ruleset failed to define result. Access denied." + +include global:defines + +# The users in the administration group (gitano-admin) may do anything +# they choose (providing they're not being impersonated). By default +# Only the user created as part of trove-setup has this level of access. +allow "Administrators can do anything" is_admin !if_asanother + +# Now let's decide if we can use 'as' +include global:aschecks if_asanother + +# Operations which are against 'self' get checked next +include global:selfchecks + +# Administration operations (users, groups) next +include global:siteadmin op_is_admin + +# Site-defined rules for repository creation +include global:createrepo op_createrepo + +# Site-defined rules for repository renaming +include global:renamerepo op_renamerepo + +# Site-defined rules for repository destruction +include global:destroyrepo op_destroyrepo + +# Site-defined rules for project repositories, including admin of them +include global:project + +# Now the project rules themselves +include main + +# If you're running your access control somewhat more openly than most, You can +# now uncomment the following and allow git:// access to *everything* which is +# not the admin repository +# allow "Anonymous access is okay" op_read !is_admin_repo |