Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1166160 - 'pcs acl role create' does not check syntax properly
'pcs acl role create' does not check syntax properly
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcs (Show other bugs)
7.1
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Tomas Jelinek
cluster-qe@redhat.com
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-11-20 08:43 EST by michal novacek
Modified: 2015-11-19 04:33 EST (History)
5 users (show)

See Also:
Fixed In Version: pcs-0.9.142-2.el7
Doc Type: Bug Fix
Doc Text:
Cause: User runs a 'pcs acl role create' command with a mistake in it. Consequence: pcs creates an empty acl role and does not report any error to the user. Fix: Validate parameters of the 'pcs acl role create' command properly and report any errors found. Result: pcs reports an error and does not create any acl role.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 04:33:41 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
proposed fix (13.66 KB, patch)
2015-04-17 09:26 EDT, Tomas Jelinek
no flags Details | Diff
proposed fix 2 (5.59 KB, patch)
2015-06-29 06:08 EDT, Tomas Jelinek
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2290 normal SHIPPED_LIVE Moderate: pcs security, bug fix, and enhancement update 2015-11-19 04:43:53 EST

  None (edit)
Description michal novacek 2014-11-20 08:43:58 EST
Description of problem:
'pcs acl create role' accepts incorrect syntax that leads to empty acl role which is confusing behaviour.

Version-Release number of selected component (if applicable):
pcs-0.9.135-1.el7.x86_64

How reproducible: always

Steps to Reproduce:
1. pcs acl role create no-resources2 deny '//resources'
2. pcs acl show

Actual results: role created with no content

Expected results: pcs would not run and complaint about incorrect syntax (id or
xpath missing in this case.)

Additional info:
[root@host-004 pcsd]# pcs acl role create all-except-resources deny '//resources'
[root@host-004 pcsd]# echo $?
0
[root@host-004 pcsd]# pcs acl show
User: misacek
  Roles: 
Role: all-except-resources
[root@host-004 pcsd]# pcs cluster cib | grep acl
    <acls>
      <acl_target id="misacek"/>
      <acl_role id="all-except-resources"/>
    </acls>
Comment 4 Tomas Jelinek 2015-04-17 09:26:58 EDT
Created attachment 1015590 [details]
proposed fix
Comment 6 Tomas Jelinek 2015-06-04 10:33:11 EDT
Before Fix:
[root@rh71-node1 ~]# rpm -q pcs
pcs-0.9.137-13.el7_1.2.x86_64
[root@rh71-node1:~]# pcs acl role create no-resources2 deny '//resources'
[root@rh71-node1:~]# echo $?
0
[root@rh71-node1:~]# pcs acl show
ACLs are disabled, run 'pcs acl enable' to enable

Role: no-resources2
[root@rh71-node1:~]# pcs cluster cib | grep acl
    <acls>
      <acl_role id="no-resources2"/>
    </acls>



After Fix:
[root@rh71-node1:~]# rpm -q pcs
pcs-0.9.140-1.el6.x86_64
[root@rh71-node1:~]# pcs acl role create no-resources2 deny '//resources'

Usage: pcs acl role create...
    role create <role name> [description=<description>] [((read | write | deny)
                                                (xpath <query> | id <id>))...]
        Create a role with the name and (optional) description specified.
        Each role can also have an unlimited number of permissions
        (read/write/deny) applied to either an xpath query or the id
        of a specific element in the cib

[root@rh71-node1:~]# echo $?
1
[root@rh71-node1:~]# pcs acl show
ACLs are disabled, run 'pcs acl enable' to enable

[root@rh71-node1:~]# pcs cluster cib | grep acl
Comment 8 Tomas Jelinek 2015-06-29 06:08:20 EDT
Created attachment 1044306 [details]
proposed fix 2
Comment 9 Tomas Jelinek 2015-07-13 08:43:18 EDT
Before Fix:
[root@rh71-node1 ~]# rpm -q pcs
pcs-0.9.141-1.el7.x86_64
[root@rh71-node1:~]# pcs acl role create test-role read XPath /

Usage: pcs acl role create...
    role create <role name> [description=<description>] [((read | write | deny)
                                                (xpath <query> | id <id>))...]
        Create a role with the name and (optional) description specified.
        Each role can also have an unlimited number of permissions
        (read/write/deny) applied to either an xpath query or the id
        of a specific element in the cib

[root@rh71-node1:~]# echo $?
1
[root@rh71-node1:~]# pcs acl role create test-role read xpath /
[root@rh71-node1:~]# echo $?
0
[root@rh71-node1:~]# pcs acl permission add test-role write XPath /

Usage: pcs acl permission add...
    permission add <role name> ((read | write | deny) (xpath <query> |
                                                                id <id>))...
        Add the listed permissions to the role specified

[root@rh71-node1:~]# echo $?
1
[root@rh71-node1:~]# pcs acl
ACLs are disabled, run 'pcs acl enable' to enable

Role: test-role
  Permission: read xpath / (test-role-read)


Also it is not possible to add permissions to a role using web UI.



After Fix:
[root@rh71-node1:~]# rpm -q pcs
pcs-0.9.142-2.el7.x86_64
[root@rh71-node1:~]# pcs acl role create test-role read XPath /
[root@rh71-node1:~]# echo $?
0
[root@rh71-node1:~]# pcs acl permission add test-role write XPath /
[root@rh71-node1:~]# echo $?
0
[root@rh71-node1:~]# pcs acl
ACLs are disabled, run 'pcs acl enable' to enable

Role: test-role
  Permission: read xpath / (test-role-read)
  Permission: write xpath / (test-role-write)


It is possible to add permissions to a role using web UI.
Comment 13 errata-xmlrpc 2015-11-19 04:33:41 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2290.html

Note You need to log in before you can comment on or make changes to this bug.