Chapter 10. Access Control Lists

Chapter 10. Access Control Lists¶

Contents

10.1. Requirements and Prerequisites
10.2. The Basics of ACLs
10.3. Configuring ACLs with the Pacemaker GUI
10.4. Configuring ACLs with the crm Shell
10.5. For More Information

Abstract

The various tools for administrating clusters, like the crm shell, Hawk, or the Pacemaker GUI, can be used by root or any user in the group haclient. By default, these users have full read-write access. In some cases, you may want to limit access or assign more fine-grained access rights.

Optional Access control lists (ACLs) allow you to define rules for users in the haclient group to allow or deny access to any part of the cluster configuration. Typically, sets or rules are combined into roles. Then you can assign users to a role that fits their tasks.

10.1. Requirements and Prerequisites¶

Before you start using ACLs on your cluster, make sure the following conditions are fulfilled:

The same users must be available on all nodes in your cluster. Use NIS to ensure this.
All users must belong to the haclient group.
All users have to run the crm shell by its absolute path /usr/sbin/crm.

Note the following points:

ACLs are an optional feature. If the ACL feature is disabled, root and users belonging to the haclient group have full read/write access to the cluster configuration.
If you want to enable the ACL feature, use this command:
```
crm configure property enable-acl=true
```
If non-privileged users want to run the crm shell, they have to change the PATH variable and extend it with /usr/sbin.
To use ACLs you need some knowledge about XPath. XPath is a language for selecting nodes in an XML document. Refer to http://en.wikipedia.org/wiki/XPath or look into the specification at http://www.w3.org/TR/xpath/.

10.2. The Basics of ACLs¶

An ACL role is a set of rules which describe access rights to CIB. Rules consist of:

access rights to read, write, or deny, and
a specification where to apply the rule. This specification can be a tag, an id reference, a combination of both, or an XPath expression.

In most cases, it is more convenient to bundle ACLs into roles and assign a role to a user. However, it is possible to give a user certain access rules without defining any roles.

There are two methods to manage ACL rules:

Via an XPath Expression. You need to know the structure of the underlying XML to create ACL rules.
Via a Tag and/or Ref Abbreviation. Create a shorthand syntax and ACL rules apply to the matched objects.

10.2.1. Setting ACL Rules via XPath¶

To manage ACL rules via XPath, you need to know the structure of the underlying XML. Retrieve the structure with the following command:

crm configure show xml

The XML structure can also be displayed in the Pacemaker GUI by selecting Configuration+View XML. Regardless of the tool, the output is your cluster configuration in XML (see Example 10.1, “Excerpt of a Cluster Configuration in XML”).

Example 10.1. Excerpt of a Cluster Configuration in XML¶

<cib admin_epoch="0" 
      cib-last-written="Wed Nov  2 16:42:51 2011" 
      crm_feature_set="3.0.5" 
      dc-uuid="stuttgart" 
      epoch="13" have-quorum="1" num_updates="42" 
      update-client="cibadmin" 
      update-origin="nuernberg" 
      update-user="root"validate-with="pacemaker-1.2">
  <configuration>
    <crm_config>
      <cluster_property_set id="cib-bootstrap-options">
        <nvpair id="cib-bootstrap-options-stonith-enabled" 
                name="stonith-enabled" value="true"/>
      </cluster_property_set>
    </crm_config>
    <nodes>
      <node id="stuttgart" type="normal" uname="stuttgart"/>
      <node id="nuernberg" type="normal" uname="nuernberg"/>
    </nodes>
    <resources> ...  </resources>
    <constraints/>
    <rsc_defaults> ... </rsc_defaults>
    <op_defaults> ... </op_defaults>
  <configuration>
</cib>

With the XPath language you can locate nodes in this XML document. For example, to select the root node (cib) use the XPath expression /cib. To locate the global cluster configurations, use the XPath /cib/configuration/crm_config.

The following table collects the access type and the XPath expression to create an “operator” role:

Table 10.1. Types and XPath Expression for an Operator Role

Type	XPath/Explanation
Write	//crm_config//nvpair[@name='maintenance-mode'] Turn maintenance mode on or off.
Write	//op_defaults//nvpair[@name='record-pending'] Choose whether pending operations are recorded.
Write	//nodes/node//nvpair[@name='standby'] Set node in online or standby mode.
Write	//resources//nvpair[@name='target-role'] Start, stop, promote or demote any resource.
Write	//resources//nvpair[@name='is-managed'] Select if a resource should be managed or not.
Write	//constraints/rsc_location Migrate/move resources from one node to another.
Read	/cib View the status of the cluster.

10.2.2. Setting ACL Rules via Tag Abbreviations¶

For users who do not want to deal with the XML structure there is an easier method. It is a combination of a tag specifier and/or a reference.

For example, consider the following XPath:

/cib/resources/primitive[@id='rsc1']

primitive is a resource with the reference rsc1. The abbreviated syntax is:

tag: "primitive"  ref:"rsc1"

This also works for constraints. Here is the verbose XPath:

/cib/constraint/rsc_location

The abbreviated syntax is written like this:

tag: "rsc_location"

The CIB daemon knows how to apply the ACL rules to the matched objects. The abbreviated syntax can be used in the crm Shell or the Pacemaker GUI.

10.3. Configuring ACLs with the Pacemaker GUI¶

Use the Pacemaker GUI to define your roles and users. The following procedure adds a “monitor” role which has only read access to the CIB. Proceed as follows:

Procedure 10.1. Adding a Monitor Role and Assigning a User with the Pacemaker GUI¶

Start the Pacemaker GUI and log in as described in Section 5.1.1, “Logging in to a Cluster”.
Click the ACLs entry in the Configuration tree.
Click Add. A dialog box appears. Choose between ACL User and ACL Role.
To define your ACL role(s):
1. Choose ACL Role. A window opens in which you add your configuration options.
2. Add a unique identifier in the ID textfield, for example monitor.
3. Click Add and choose the rights (Read, Write, or Deny). In our example, select Read and proceed with Ok.
4. Enter the XPath expression /cib in the Xpath textfield. Proceed with Ok.
  Sidenote: If you have resources or constraints, you can also use the abbreviated syntax as explained in Section 10.2.2, “Setting ACL Rules via Tag Abbreviations”. In this case, enter your tag in the Tag textfield and the optional reference in the Ref textfield. In our example, there is no abbreviated form possible, so you can only use the XPath notation here.
5. If you have other conditions, repeat the steps (Step 4.c and Step 4.d). In our example, this is not the case so your role is finished and you can close the window with Ok.
Assign your role to a user:
1. Click the Add button. A dialog box appears to choose between ACL User and ACL Role.
2. Choose ACL User. A window opens in which you add your configuration options.
3. Enter the username in the ID textfield. Make sure this user belongs to the haclient group.
4. Click Add and choose Role Ref.
5. Use the role name specified in Step 4.b.

10.4. Configuring ACLs with the crm Shell¶

The following procedure adds a “monitor” role as shown in Section 10.3, “Configuring ACLs with the Pacemaker GUI” and assigns it to a user. Proceed as follows:

Procedure 10.2. Adding a Monitor Role and Assigning a User with the crm Shell¶

Log in as root.
Start the interactive mode of the crm shell:
```
# crm configure
crm(live)configure#
```
Define your ACL role(s):
1. Use the role command to define your new role. To define a “monitor” role, use the following command:
```
role monitor read xpath:"/cib"
```
  The previous command creates a new role with name monitor, sets the read rights and applies it to all elements in the CIB by using the XPath /cib. If necessary, you can add more access rights and XPath arguments.
  Sidenote: If you have resources or constraints, you can also use the abbreviated syntax as explained in Section 10.2.2, “Setting ACL Rules via Tag Abbreviations”. If you have a primitive resource with the ID rsc1, use the following notation to set the access rights: write tag:"primitive" ref:"rsc1". You can also refer to the ID with write ref:"rsc1". This has the advantage that it can match a primitive resource and a local resource manager resource (LRM), which enables you to configure rsc1 and also cleanup its status at the same time.
2. Add additional roles as needed.
Assign your roles to users. Make sure this user belongs to the haclient group.
```
crm(live)configure# user tux role:monitor
```
Check your changes:
```
crm(live)configure# show
```
Commit your changes:
```
crm(live)configure# commit
```

10.5. For More Information¶

See http://www.clusterlabs.org/doc/acls.html.