nagaboinaramgopal opened a new pull request, #14141:
URL: https://github.com/apache/cloudstack/pull/14141
### Description
The domain branch guard in updateResourceLimit is `ownDomain && type ==
DOMAIN_ADMIN || type == RESOURCE_DOMAIN_ADMIN`. Since `&&` binds tighter than
`||`, a resource domain admin is denied updating the limits of every domain,
including its own sub-domains ("Unable to update resource limit for domain X,
permission denied"). The intent, like the account branch just above it, is only
to block an admin on its own domain. This adds the missing parentheses.
Resource domain admins exist only in domains that own a private zone, so
this affects those setups. The own domain rule is unchanged, and so is the own
account rule discussed in #10922. The same code is on 4.20, 4.22 and main, so
this targets 4.20.
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] build/CI
- [ ] test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [ ] Minor
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
### Screenshots (if appropriate):
N/A
### How Has This Been Tested?
Added two tests to ResourceLimitManagerImplTest: a resource domain admin
updating a sub-domain (fails before with PermissionDeniedException, passes
after) and the same admin on its own domain (denied before and after). The
class passes (57 tests).
Also verified on a live 4.23 KVM environment with the same change: domain
/rl-live with sub-domain /rl-live/rl-live-sub, and a Resource Admin account
rladmin in /rl-live calling updateResourceLimit (user VMs, max 10).
Before:
rl-live-sub 531 Unable to update resource limit for domain 5,
permission denied
rl-live 531 Unable to update resource limit for domain 4,
permission denied
After:
rl-live-sub 200 {"resourcelimit":{"domain":"rl-live-sub",...,"max":10}}
rl-live 531 Unable to update resource limit for domain 4,
permission denied
#### How did you try to break this feature and the system with this change?
Domain admins and root admins behave exactly as before, and both admin types
are still denied on their own domain. A resource domain admin on another domain
still has to pass checkAccess and the parent domain limit check, so it cannot
reach domains outside its tree.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
