Allow matrix: -----------ACL---------- SOME NONE ANY -------|-------|-------|------- | SOME | Yes/No| No | Yes | -------|-------|-------|------- Request NONE | No | Yes | No | -------|-------|-------|------- | ANY | No | No | Yes -------|-------|-------|-------
| 127 | // | ANY | No | No | Yes |
| 128 | // -------|-------|-------|------- |
| 129 | static bool allows(const ACL::Entity& request, const ACL::Entity& acl) |
| 130 | { |
| 131 | // NONE is only allowed by NONE. |
| 132 | if (request.type() == ACL::Entity::NONE) { |
| 133 | return acl.type() == ACL::Entity::NONE; |
| 134 | } |
| 135 | |
| 136 | // ANY is only allowed by ANY. |
| 137 | if (request.type() == ACL::Entity::ANY) { |
| 138 | return acl.type() == ACL::Entity::ANY; |
| 139 | } |
| 140 | |
| 141 | if (request.type() == ACL::Entity::SOME) { |
| 142 | // SOME is allowed by ANY. |
| 143 | if (acl.type() == ACL::Entity::ANY) { |
| 144 | return true; |
| 145 | } |
| 146 | |
| 147 | // SOME is not allowed by NONE. |
| 148 | if (acl.type() == ACL::Entity::NONE) { |
| 149 | return false; |
| 150 | } |
| 151 | |
| 152 | // SOME is allowed if the request values are a subset of ACL |
| 153 | // values. |
| 154 | foreach (const string& value, request.values()) { |
| 155 | bool found = false; |
| 156 | foreach (const string& value_, acl.values()) { |
| 157 | if (value == value_) { |
| 158 | found = true; |
| 159 | break; |
| 160 | } |
| 161 | } |
| 162 | |
| 163 | if (!found) { |
| 164 | return false; |
| 165 | } |
| 166 | } |
| 167 | return true; |
| 168 | } |
| 169 | |
| 170 | return false; |
| 171 | } |
| 172 | |
| 173 | |
| 174 | class LocalAuthorizerObjectApprover : public ObjectApprover |