From 3732bb03e2f0b710e85b502c772ad7174d91db80 Mon Sep 17 00:00:00 2001
From: Tomas Jelinek <tojeline@redhat.com>
Date: Thu, 8 Jan 2015 16:00:47 +0100
Subject: [PATCH] Add acl enable and disable commands

* add acl enable and disable commands
* display whether acls are enabled in the 'pcs acl' output
---
 pcs/acl.py           | 19 +++++++++++++
 pcs/pcs.8            |  6 ++++
 pcs/usage.py         |  6 ++++
 pcs/utils.py         |  5 ++++
 5 files changed, 92 insertions(+), 21 deletions(-)

diff --git a/pcs/acl.py b/pcs/acl.py
index aa07d40..4c2d696 100644
--- a/pcs/acl.py
+++ b/pcs/acl.py
@@ -1,6 +1,7 @@
 import sys
 import usage
 import utils
+import prop
 
 def acl_cmd(argv):
     if len(argv) == 0:
@@ -18,6 +19,10 @@ def acl_cmd(argv):
         acl_show(argv)
 #    elif (sub_cmd == "grant"):
 #        acl_grant(argv)
+    elif (sub_cmd == "enable"):
+        acl_enable(argv)
+    elif (sub_cmd == "disable"):
+        acl_disable(argv)
     elif (sub_cmd == "role"):
         acl_role(argv)
     elif (sub_cmd == "target" or sub_cmd == "user"):
@@ -33,10 +38,24 @@ def acl_cmd(argv):
 def acl_show(argv):
     dom = utils.get_cib_dom()
 
+    properties = prop.get_set_properties(defaults=prop.get_default_properties())
+    acl_enabled = properties.get("enable-acl", "").lower()
+    if utils.is_cib_true(acl_enabled):
+        print "ACLs are enabled"
+    else:
+        print "ACLs are disabled, run 'pcs acl enable' to enable"
+    print
+
     print_targets(dom)
     print_groups(dom)
     print_roles(dom)
 
+def acl_enable(argv):
+    prop.set_property(["enable-acl=true"])
+
+def acl_disable(argv):
+    prop.set_property(["enable-acl=false"])
+
 def acl_grant(argv):
     print "Not yet implemented"
 
diff --git a/pcs/pcs.8 b/pcs/pcs.8
index 00ac11b..14917f7 100644
--- a/pcs/pcs.8
+++ b/pcs/pcs.8
@@ -316,6 +316,12 @@ Confirm that the host specified is currently down.  WARNING: if this node is not
 [show]
 List all current access control lists
 .TP
+enable
+Enable access control lists
+.TP
+disable
+Disable access control lists
+.TP
 role create <role name> [description=<description>] [((read | write | deny) (xpath <query> | id <id>))...]
 Create a role with the name and (optional) description specified.
 Each role can also have an unlimited number of permissions
diff --git a/pcs/usage.py b/pcs/usage.py
index 7bd3368..2c39901 100644
--- a/pcs/usage.py
+++ b/pcs/usage.py
@@ -969,6 +969,12 @@ Commands:
     [show]
         List all current access control lists
 
+    enable
+        Enable access control lists
+
+    disable
+        Disable access control lists
+
     role create <role name> [description=<description>] [((read | write | deny)
                                                 (xpath <query> | id <id>))...]
         Create a role with the name and (optional) description specified.
diff --git a/pcs/utils.py b/pcs/utils.py
index 8713c81..de000fa 100644
--- a/pcs/utils.py
+++ b/pcs/utils.py
@@ -2129,6 +2129,11 @@ def is_iso8601_date(var):
     output, retVal = run(["iso8601", "-d", var])
     return retVal == 0
 
+# Does pacemaker consider a variable as true in cib?
+# See crm_is_true in pacemaker/lib/common/utils.c
+def is_cib_true(var):
+    return var.lower() in ("true", "on", "yes", "y", "1")
+
 def is_systemctl():
     if os.path.exists('/usr/bin/systemctl'):
         return True
-- 
1.9.1