diff --git a/lib/cib/cib_file.c b/lib/cib/cib_file.c
index 5562e9e..aa68679 100644
--- a/lib/cib/cib_file.c
+++ b/lib/cib/cib_file.c
@@ -310,6 +310,12 @@ cib_file_perform_op_delegate(cib_t * cib, const char *op, const char *host, cons
}
crm_trace("Performing %s operation as %s", op, user_name);
#endif
+
+ /* Mirror the logic in cib_prepare_common() */
+ if (section != NULL && data != NULL && crm_str_eq(crm_element_name(data), XML_TAG_CIB, TRUE)) {
+ data = get_object_root(section, data);
+ }
+
rc = cib_perform_op(op, call_options, fn, query,
section, request, data, TRUE, &changed, in_mem_cib, &result_cib, &cib_diff,
&output);
diff --git a/lib/common/xml.c b/lib/common/xml.c
index f7779f5..54f1aa7 100644
--- a/lib/common/xml.c
+++ b/lib/common/xml.c
@@ -4848,8 +4848,13 @@ replace_xml_child(xmlNode * parent, xmlNode * child, xmlNode * update, gboolean
xml_accept_changes(tmp);
old = xmlReplaceNode(child, tmp);
- xml_calculate_changes(old, tmp);
+ if(xml_tracking_changes(tmp)) {
+ /* Replaced sections may have included relevant ACLs */
+ __xml_acl_apply(tmp);
+ }
+
+ xml_calculate_changes(old, tmp);
xmlDocSetRootElement(doc, old);
free_xml(old);
}
diff --git a/tools/regression.acls.exp b/tools/regression.acls.exp
index 2cea125..e05e339 100644
--- a/tools/regression.acls.exp
+++ b/tools/regression.acls.exp
@@ -17,11 +17,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -47,11 +54,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -78,11 +92,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -109,11 +130,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -143,11 +171,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -180,11 +215,18 @@ A new shadow instance was created. To begin using it paste the following into y
+
+
+
+
+
+
+
@@ -255,11 +297,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -301,11 +350,18 @@ __xml_acl_post_process: Creation of nvpair=cib-bootstrap-options-stonith-enable
+
+
+
+
+
+
+
@@ -345,11 +401,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -384,11 +447,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -425,11 +495,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -486,11 +563,18 @@ __xml_acl_post_process: Creation of nvpair=dummy-meta_attributes-target-role is
+
+
+
+
+
+
+
@@ -535,11 +619,18 @@ Stopped
+
+
+
+
+
+
+
@@ -582,11 +673,18 @@ Deleted dummy option: id=dummy-meta_attributes-target-role name=target-role
+
+
+
+
+
+
+
@@ -631,11 +729,18 @@ __xml_acl_post_process: Creation of nvpair=dummy-meta_attributes-target-role is
+
+
+
+
+
+
+
@@ -730,11 +835,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -778,11 +890,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -794,12 +913,12 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - modify attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - modify attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl'][@value]: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - modify attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - modify attribute
+=#=#=#= End test: niceguy: Replace - modify attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - modify attribute (deny)
@@ -825,11 +944,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -841,12 +967,12 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - delete attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - delete attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl']: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - delete attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - delete attribute
+=#=#=#= End test: niceguy: Replace - delete attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - delete attribute (deny)
@@ -872,11 +998,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -888,12 +1021,161 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - create attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - create attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/resources/primitive[@id='dummy'][@description]: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - create attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - create attribute
+=#=#=#= End test: niceguy: Replace - create attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - create attribute (deny)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - create attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - create attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - create attribute (allow)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - modify attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - modify attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - modify attribute (allow)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - delete attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - delete attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - delete attribute (allow)
!#!#!#!#! Upgrading to pacemaker-2.0 and retesting !#!#!#!#!
@@ -901,6 +1183,8 @@ Call failed: Permission denied
__xml_acl_post_process: Creation of acl_permission=observer-read-1 is allowed
__xml_acl_post_process: Creation of acl_permission=observer-write-1 is allowed
__xml_acl_post_process: Creation of acl_permission=observer-write-2 is allowed
+__xml_acl_post_process: Creation of acl_permission=admin-read-1 is allowed
+__xml_acl_post_process: Creation of acl_permission=admin-write-1 is allowed
__xml_acl_post_process: Creation of acl_permission=crook-nothing is allowed
__xml_acl_post_process: Creation of acl_permission=badidea-resources is allowed
__xml_acl_post_process: Creation of acl_permission=betteridea-nothing is allowed
@@ -917,11 +1201,7 @@ __xml_acl_post_process: Creation of acl_permission=betteridea-resources is allo
-
-
-
-
-
+
@@ -934,11 +1214,18 @@ __xml_acl_post_process: Creation of acl_permission=betteridea-resources is allo
+
+
+
+
+
+
+
@@ -1019,11 +1306,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1073,11 +1367,18 @@ Error setting enable-acl=false (section=crm_config, set=): Permission deni
+
+
+
+
+
+
+
@@ -1126,11 +1427,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1174,11 +1482,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1224,11 +1539,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1294,11 +1616,18 @@ __xml_acl_post_process: Creation of nvpair=dummy-meta_attributes-target-role is
+
+
+
+
+
+
+
@@ -1352,11 +1681,18 @@ Stopped
+
+
+
+
+
+
+
@@ -1408,11 +1744,18 @@ Deleted dummy option: id=dummy-meta_attributes-target-role name=target-role
+
+
+
+
+
+
+
@@ -1466,11 +1809,18 @@ __xml_acl_post_process: Creation of nvpair=dummy-meta_attributes-target-role is
+
+
+
+
+
+
+
@@ -1574,11 +1924,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1631,11 +1988,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1653,12 +2017,12 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - modify attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - modify attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl'][@value]: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - modify attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - modify attribute
+=#=#=#= End test: niceguy: Replace - modify attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - modify attribute (deny)
@@ -1687,11 +2051,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1709,12 +2080,12 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - delete attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - delete attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl']: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - delete attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - delete attribute
+=#=#=#= End test: niceguy: Replace - delete attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - delete attribute (deny)
@@ -1743,11 +2114,18 @@ Call failed: Permission denied
+
+
+
+
+
+
+
@@ -1765,9 +2143,185 @@ Call failed: Permission denied
-=#=#=#= Begin test: niceguy: Replace - create attribute =#=#=#=
+=#=#=#= Begin test: niceguy: Replace - create attribute (deny) =#=#=#=
__xml_acl_check: 400 access denied to /cib[@epoch]: default
__xml_acl_check: 400 access denied to /cib/configuration/resources/primitive[@id='dummy'][@description]: default
Call failed: Permission denied
-=#=#=#= End test: niceguy: Replace - create attribute - Permission denied (13) =#=#=#=
-* Passed: cibadmin - niceguy: Replace - create attribute
+=#=#=#= End test: niceguy: Replace - create attribute (deny) - Permission denied (13) =#=#=#=
+* Passed: cibadmin - niceguy: Replace - create attribute (deny)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - create attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - create attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - create attribute (allow)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - modify attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - modify attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - modify attribute (allow)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+=#=#=#= Begin test: bob: Replace - delete attribute (allow) =#=#=#=
+=#=#=#= End test: bob: Replace - delete attribute (allow) - OK (0) =#=#=#=
+* Passed: cibadmin - bob: Replace - delete attribute (allow)
diff --git a/tools/regression.sh b/tools/regression.sh
index 0c4896c..63f4445 100755
--- a/tools/regression.sh
+++ b/tools/regression.sh
@@ -487,7 +487,7 @@ function test_acl_loop() {
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" crm_attribute -n enable-acl -v false
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
- desc="$CIB_user: Replace - modify attribute"
+ desc="$CIB_user: Replace - modify attribute (deny)"
cmd="cibadmin --replace --xml-file /tmp/$$.haxor.xml"
test_assert 13 0
@@ -495,7 +495,7 @@ function test_acl_loop() {
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin --replace --xml-text ''
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
- desc="$CIB_user: Replace - delete attribute"
+ desc="$CIB_user: Replace - delete attribute (deny)"
cmd="cibadmin --replace --xml-file /tmp/$$.haxor.xml"
test_assert 13 0
@@ -503,10 +503,36 @@ function test_acl_loop() {
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin --modify --xml-text ''
CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
- desc="$CIB_user: Replace - create attribute"
+ desc="$CIB_user: Replace - create attribute (deny)"
cmd="cibadmin --replace --xml-file /tmp/$$.haxor.xml"
test_assert 13 0
rm -rf /tmp/$$.haxor.xml
+
+
+ CIB_user=bob
+ CIB_user=root cibadmin -Q > /tmp/$$.haxor.xml
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin --modify --xml-text ''
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
+
+ desc="$CIB_user: Replace - create attribute (allow)"
+ cmd="cibadmin --replace -o resources --xml-file /tmp/$$.haxor.xml"
+ test_assert 0 0
+
+ CIB_user=root cibadmin -Q > /tmp/$$.haxor.xml
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin --modify --xml-text ''
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
+
+ desc="$CIB_user: Replace - modify attribute (allow)"
+ cmd="cibadmin --replace -o resources --xml-file /tmp/$$.haxor.xml"
+ test_assert 0 0
+
+ CIB_user=root cibadmin -Q > /tmp/$$.haxor.xml
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin --replace -o resources --xml-text ''
+ CIB_user=root CIB_file=/tmp/$$.haxor.xml CIB_shadow="" cibadmin -Ql
+
+ desc="$CIB_user: Replace - delete attribute (allow)"
+ cmd="cibadmin --replace -o resources --xml-file /tmp/$$.haxor.xml"
+ test_assert 0 0
}
function test_acls() {
@@ -522,11 +548,18 @@ function test_acls() {
+
+
+
+
+
+
+
EOF