diff options
Diffstat (limited to 'gitano-admin/rules/aschecks.lace')
-rw-r--r-- | gitano-admin/rules/aschecks.lace | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/gitano-admin/rules/aschecks.lace b/gitano-admin/rules/aschecks.lace new file mode 100644 index 0000000..2fb2ae6 --- /dev/null +++ b/gitano-admin/rules/aschecks.lace @@ -0,0 +1,14 @@ +# Rules for when we're running as another user. +# Only 'deny' things which are not allowed. +# If you 'allow' then it will allow the actual operation, not just +# fail to deny the fact that it's 'as' someone else. + +define as_is_admin as_group gitano-admin + +# ct-admin members are permitted to run sshkey and whoami on behalf of others +define as_is_ct_admin as_group ct-admin +define as_ct_admin_ok allof as_is_ct_admin op_self + +define as_is_ok anyof as_is_admin as_ct_admin_ok + +deny "You may not run things as another user unless you are an admin" !as_is_ok |