Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2024-11-14 22:35:36 +01:00
Code Issues Projects Releases Wiki Activity

Remove scanner-pull from system admin's permission (#13901)

Browse Source 
Signed-off-by: Daniel Jiang <jiangd@vmware.com>
This commit is contained in:
Daniel Jiang 2021-01-06 12:35:58 +08:00 committed by GitHub
parent 839c36c876
commit 06e993ff76
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/common/security/local/context_test.go
View File

@ -254,3 +254,20 @@ func TestHasPushPullPerm(t *testing.T) {
assert.True(t, ctx.Can(context.TODO(), rbac.ActionPush, resource) && ctx.Can(context.TODO(), rbac.ActionPull, resource))
}
}
func TestSysadminPerms(t *testing.T) {
// authenticated, system admin
ctl := &projecttesting.Controller{}
mock.OnAnything(ctl, "Get").Return(private, nil)
mock.OnAnything(ctl, "ListRoles").Return([]int{}, nil)
ctx := NewSecurityContext(&models.User{
Username: "admin",
SysAdminFlag: true,
})
ctx.ctl = ctl
resource := rbac.NewProjectNamespace(private.ProjectID).Resource(rbac.ResourceRepository)
assert.True(t, ctx.Can(context.TODO(), rbac.ActionPush, resource) && ctx.Can(context.TODO(), rbac.ActionPull, resource))
assert.False(t, ctx.Can(context.TODO(), rbac.ActionScannerPull, resource))
}

4
src/pkg/permission/evaluator/admin/admin.go
View File

@ -17,6 +17,7 @@ package admin
import (
"context"
"github.com/goharbor/harbor/src/common/rbac"
"github.com/goharbor/harbor/src/lib/log"
"github.com/goharbor/harbor/src/pkg/permission/evaluator"
"github.com/goharbor/harbor/src/pkg/permission/types"
@ -32,7 +33,8 @@ type Evaluator struct {
// HasPermission always return true for the system administrator
func (e *Evaluator) HasPermission(ctx context.Context, resource types.Resource, action types.Action) bool {
log.Debugf("system administrator %s require %s action for resource %s", e.username, action, resource)
return true
// scanner-pull is for scanner to bypass the policy checking so admin user should not have this permission
return action != rbac.ActionScannerPull
}
// New returns evaluator.Evaluator for the system administrator