Disable privileged commands if user is not root.

4 files changed, 39 insertions, 3 deletions

diff --git a/rtsadmin/ui_backstore.py b/rtsadmin/ui_backstore.py
index d8595d8..3710231 100644
--- a/rtsadmin/ui_backstore.py
+++ b/rtsadmin/ui_backstore.py
@@ -113,6 +113,7 @@ class UIBackstores(UINode):
         ----------------
         Creates a new backstore, using the B{iblock} I{backstore_plugin}.
         '''
+        self.assert_root()
         self.log.debug("%r" % [(backstore.plugin, backstore.index)
                               for backstore in RTSRoot().backstores])
         indexes = [backstore.index for backstore in RTSRoot().backstores
@@ -188,6 +189,7 @@ class UIBackstores(UINode):
         -----------------
         That would recursively delete the B{iblock} backstore with index 2.
         '''
+        self.assert_root()
         for child in self.children:
             if child.name == backstore:
                 child.backstore.delete()
@@ -283,6 +285,7 @@ class UIBackstore(UINode):
         -------------------
         Deletes the storage object named mystorage, and all associated LUNs.
         '''
+        self.assert_root()
         for child in self.children:
             if child.name == name:
                 child.storage_object.delete()
@@ -331,6 +334,7 @@ class UIPSCSIBackstore(UIBackstore):
         SCSI device ID in the H:C:T:L format, which is not recommended as SCSI
         IDs may vary in time. 
         '''
+        self.assert_root()
         so = PSCSIStorageObject(self.backstore, name, dev)
         self.add_child(UIStorageObject(so))
         self.log.info("Created pscsi storage object %s using %s"
@@ -356,6 +360,7 @@ class UIRDDRBackstore(UIBackstore):
             - B{g}, B{G}, B{gB}, B{GB} for GB (gigabytes)
             - B{t}, B{T}, B{tB}, B{TB} for TB (terabytes)
         '''
+        self.assert_root()
         so = RDDRStorageObject(self.backstore, name, size, self.use_wwn(wwn))
         self.add_child(UIStorageObject(so))
         self.log.info("Created rd_dr ramdisk storage object %s with size %s."
@@ -381,6 +386,7 @@ class UIRDMCPBackstore(UIBackstore):
             - B{g}, B{G}, B{gB}, B{GB} for GB (gigabytes)
             - B{t}, B{T}, B{tB}, B{TB} for TB (terabytes)
         '''
+        self.assert_root()
         so = RDMCPStorageObject(self.backstore, name, size, self.use_wwn(wwn))
         self.add_child(UIStorageObject(so))
         self.log.info("Created rd_mcp ramdisk storage object %s with size %s."
@@ -414,6 +420,7 @@ class UIFileIOBackstore(UIBackstore):
             - B{g}, B{G}, B{gB}, B{GB} for GB (gigabytes)
             - B{t}, B{T}, B{tB}, B{TB} for TB (terabytes)
         '''
+        self.assert_root()
         is_dev = get_block_type(file_or_dev) is not None \
                 or is_disk_partition(file_or_dev)
 
@@ -445,6 +452,7 @@ class UIIBlockBackstore(UIBackstore):
         specifying whether or not we should generate a T10 wwn Serial for the
         unit (by default, yes).
         '''
+        self.assert_root()
         if wwn is None:
             wwn == True
         if wwn:
diff --git a/rtsadmin/ui_node.py b/rtsadmin/ui_node.py
index 3af0b7a..d520d30 100644
--- a/rtsadmin/ui_node.py
+++ b/rtsadmin/ui_node.py
@@ -18,7 +18,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 '''
 
 from os import system
-from configshell import ConfigNode
+from configshell import ConfigNode, ExecutionError
 from rtslib import RTSLibError, RTSRoot
 
 class UINode(ConfigNode):
@@ -32,6 +32,16 @@ class UINode(ConfigNode):
                  [self.ui_type_onoff,
                   'If on, automatically enables TPGTs upon creation.']
 
+    def assert_root(self):
+        '''
+        For commands requiring root privileges, disable command if not the root
+        node's as_root attribute is False.
+        '''
+        root_node = self.get_root()
+        if hasattr(root_node, 'as_root') and not self.get_root().as_root:
+            raise ExecutionError("This privileged command is disabled: "
+                                 + "you are not root.")
+
     def ui_command_refresh(self):
         '''
         Refreshes and updates the objects tree from the current path.
@@ -43,6 +53,7 @@ class UINode(ConfigNode):
         Saves the whole configuration tree to disk so that it will be restored
         on next boot. Unless you do that, changes are lost accross reboots.
         '''
+        self.assert_root()
         self.con.display("WARNING: Saving the current configuration to disk "
                          + "will overwrite your boot settings.")
         self.con.display("The current target configuration will become the "
@@ -124,6 +135,7 @@ class UIParameters(object):
         @param value: The parameter's value
         @type value: arbitrary
         '''
+        self.assert_root()
         self._rtslib_object.set_parameter(parameter, value)
 
 class UIAttributes(object):
@@ -161,4 +173,5 @@ class UIAttributes(object):
         @param value: The attribute's value
         @type value: arbitrary
         '''
+        self.assert_root()
         self._rtslib_object.set_attribute(attribute, value)
diff --git a/rtsadmin/ui_root.py b/rtsadmin/ui_root.py
index 40b1df9..530c266 100644
--- a/rtsadmin/ui_root.py
+++ b/rtsadmin/ui_root.py
@@ -26,10 +26,11 @@ class UIRoot(UINode):
     '''
     The rtsadmin hierarchy root node.
     '''
-    def __init__(self):
+    def __init__(self, as_root=False):
         self.loaded = False
         UINode.__init__(self)
         self.name = '/'
+        self.as_root = as_root
 
     def refresh(self):
         '''
@@ -44,7 +45,7 @@ class UIRoot(UINode):
                     self.log.info("Using %s fabric module." \
                                   % fabric_module.name)
                     self.add_child(UIFabricModule(fabric_module))
-                else:
+                elif self.as_root:
                     try:
                         for step in fabric_module.load(yield_steps=True):
                             (action, taken, desc) = step
diff --git a/rtsadmin/ui_target.py b/rtsadmin/ui_target.py
index 0e1d617..29432a1 100644
--- a/rtsadmin/ui_target.py
+++ b/rtsadmin/ui_target.py
@@ -66,6 +66,7 @@ class UIFabricModule(UINode):
         ========
         B{info}
         '''
+        self.assert_root()
         target = Target(self.fabric_module, wwn, mode='create')
         wwn = target.wwn
         self.add_child(UITarget(target))
@@ -106,6 +107,7 @@ class UIFabricModule(UINode):
         ========
         B{create}
         '''
+        self.assert_root()
         target = Target(self.fabric_module, wwn, mode='lookup')
         target.delete()
         self.log.info("Deleted Target %s." % wwn)
@@ -206,6 +208,7 @@ class UIMultiTPGTarget(UINode):
         ========
         B{delete}
         '''
+        self.assert_root()
         if tag is None:
             tags = [tpg.tag for tpg in self.target.tpgs]
             for index in range(1048576):
@@ -243,6 +246,7 @@ class UIMultiTPGTarget(UINode):
         ========
         B{create}
         '''
+        self.assert_root()
         tpg = TPG(self.target, tag, mode='lookup')
         tpg.delete()
         self.log.info("Deleted TPGT %s." % tag)
@@ -308,6 +312,7 @@ class UITPG(UINode, UIAttributes, UIParameters):
         ========
         B{disable status}
         '''
+        self.assert_root()
         if self.tpg.enable:
             self.log.info("The TPGT is already enabled.")
         else:
@@ -322,6 +327,7 @@ class UITPG(UINode, UIAttributes, UIParameters):
         ========
         B{enable status}
         '''
+        self.assert_root()
         if self.tpg.enable:
             self.tpg.enable = False
             self.log.info("The TPGT has been disabled.")
@@ -381,6 +387,7 @@ class UINodeACLs(UINode):
         ========
         B{delete}
         '''
+        self.assert_root()
         spec = self.tpg.parent_target.fabric_module.spec
         if not utils.is_valid_wwn(spec['wwn_type'], wwn):
             self.log.error("'%s' is not a valid %s WWN."
@@ -404,6 +411,7 @@ class UINodeACLs(UINode):
         ========
         B{create}
         '''
+        self.assert_root()
         node_acl = NodeACL(self.tpg, wwn, mode='lookup')
         node_acl.delete()
         self.log.info("Successfully deleted Node ACL %s." % wwn)
@@ -469,6 +477,7 @@ class UINodeACL(UINode, UIAttributes, UIParameters):
         ========
         B{delete}
         '''
+        self.assert_root()
         try:
             tpg_lun = int(tpg_lun)
             mapped_lun = int(mapped_lun)
@@ -488,6 +497,7 @@ class UINodeACL(UINode, UIAttributes, UIParameters):
         ========
         B{create}
         '''
+        self.assert_root()
         mlun = MappedLUN(self.node_acl, mapped_lun)
         mlun.delete()
         self.log.info("Deleted Mapped LUN %s." % mapped_lun)
@@ -557,6 +567,7 @@ class UILUNs(UINode):
         ========
         B{delete}
         '''
+        self.assert_root()
         if lun is None:
             luns = [lun.lun for lun in self.tpg.luns]
             for index in range(1048576):
@@ -623,6 +634,7 @@ class UILUNs(UINode):
         ========
         B{create}
         '''
+        self.assert_root()
         lun_object = LUN(self.tpg, lun)
         lun_object.delete()
         self.log.info("Successfully deleted LUN %s." % lun)
@@ -717,6 +729,7 @@ class UIPortals(UINode):
         ========
         B{delete}
         '''
+        self.assert_root()
         if ip_port is None:
             # FIXME: Add a specfile parameter to determine that
             ip_port = 3260
@@ -779,6 +792,7 @@ class UIPortals(UINode):
         ========
         B{create}
         '''
+        self.assert_root()
         portal = NetworkPortal(self.tpg, ip_address, ip_port, mode='lookup')
         portal.delete()
         self.log.info("Deleted network portal %s:%s" % (ip_address, ip_port))