Bug 1440890
Summary: | support ACL roles with "object-type" and "attribute" attributes | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Jan Pokorný [poki] <jpokorny> |
Component: | pcs | Assignee: | Tomas Jelinek <tojeline> |
Status: | CLOSED WONTFIX | QA Contact: | cluster-qe <cluster-qe> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | 7.1 | CC: | cfeist, cluster-maint, idevat, omular, slevine, tojeline |
Target Milestone: | rc | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | 1111369 | Environment: | |
Last Closed: | 2021-01-15 07:33:47 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1111369 | ||
Bug Blocks: |
Description
Jan Pokorný [poki]
2017-04-10 16:57:24 UTC
Correction (showing, by the way, how tricky it is to get XPath routinely right): 2. "object-type", could be passed as "object-type FOO [attr BAR]" & can be mimicked as "xpath //FOO", with the optional part as "xpath //FOO[@BAR] <-- at-sign was missing (In reply to Jan Pokorný from comment #0) > 1. "reference", could be passed as "reference FOO" & can be mimicked > as "xpath //*[@id='FOO']" already implemented: pcs acl role create no-fd-passwd deny id my-fd-passwd > 2. "object-type", could be passed as "object-type FOO [attr BAR]" > & can be mimicked as "xpath //FOO", with the optional part as > "xpath //FOO[BAR]" This is indeed missing in pcs. Summary: pcs does not support ACL roles with "object-type" and "attribute" attributes. re [comment 2]: Indeed, this was an oversight on my side, simply because how confusing the situation is bottom-up (pacemaker code, through two not entirely compatible approaches schema-wise, to terminology used in pcs). I have to wonder if 2. was ever meaningful, simply because common nvpairs encoding of dictionary-like data is not reachable with this provision, and there's not much left beyond that, what could be of interest. re [comment 3]: I meant mostly the "attribute" part, "object-type" on its own can still be useful, simply because the main tags like "configuration" go without IDs and are unique on its own (enforced by the schema). After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |