blob: fc764405c6018b5f63e54ea1e23b2310619321ed (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
# _____
# |_ _| __ _____ _____
# | || '__/ _ \ \ / / _ \
# | || | | (_) \ V / __/
# |_||_| \___/ \_/ \___|
#
# Copyright 2012 Codethink Limited
#
# Rules for when we're running as another user.
# Only 'deny' things which are not allowed. If you 'allow' then it will allow
# the actual operation, not just fail to deny the fact that it's 'as' someone
# else.
define as_is_admin as_group gitano-admin
# trove-admin members are permitted to run sshkey and whoami on behalf
# of others in order to check users and grant access, providing the target
# user is not part of the gitano-admin group.
define as_is_trove_admin as_group trove-admin
define as_trove_admin_ok allof as_is_trove_admin !is_admin op_self
# You are permitted to do things 'as' others if and only if the caller is
# either a member of the administration group, or else meets the above
# requirements.
define as_is_ok anyof as_is_admin as_trove_admin_ok
# Explicitly deny any impersonation operation which does not meet the above.
deny "You may not run things as another user unless you are an admin" !as_is_ok
|
