Skip to content
Commit 250b0ebb authored by Przemyslaw Czarnowski's avatar Przemyslaw Czarnowski
Browse files

Permission check for virtual media proxy mode



This patch enables checking of user permission for proxy mode, as start of
this kind service is not triggered by redfish (which has permission check by
default).
Permission check is done in .onopen handler of websocket. For this reason
another dbus call for user privileges is added to verify if user has
"ConfigureManager" privilege.

I have chosen this approach, as generic privilege check for all websockets
introduces significant changes in connection upgrade flow which makes
implementaion vague and caused some memory issues difficult to track down.

It is worth noting that other websockets (eg. kvm) uses .required()
function to set privilege but this information is lost during connection
upgrade and is not checked anywhere in upgrade flow.

Tested:
Manual tests with opening websockets via web browser and dedicated nbd proxy
utility. For users with/without appropriate permissions.
Single request and burst of requests has been tested as well.

Change-Id: I2a56bec606fa0e5f3d4232e48794c9055bf6095e
Signed-off-by: default avatarPrzemyslaw Czarnowski <przemyslaw.hawrylewicz.czarnowski@intel.com>
parent 363c2302
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment