Mailinglist Archive: opensuse-buildservice (343 mails)

< Previous Next >
Re: [opensuse-buildservice] Understanding permissions
  • From: Andreas Bauer <abauer@xxxxxxx>
  • Date: Thu, 31 Jul 2008 15:09:16 +0200
  • Message-id: <4891B97C.4040905@xxxxxxx>
Anas Nashif schrieb:
Hi,
I am trying to understand the permissions in OBS and how to control who can make changes to projects.

Hi,

first, almost all permission configuration is done via <person> entries
in the package or project metadata. The admin interface isn't really
usable for permission management at the moment.

1. What is the difference between global_<permission> and <permission> under roles? I can't see a difference. Users with either permissions can pretty much do anything, at least the things I have tested.

global_* permissions are independent from a specific resource
(project/package). Users having those permissions can do the associated
actions to every resource.

The nonglobal roles are always associated with a specific resource and
currently can't be set properly from within the admin interface. They
are given via <person> elements in the resource metadata.

2. How can I make a user fully control his home project without giving him/her permission to other non home projects? Removing the non global permissions does not work: user is not able to create or change packages or add repos

Make sure <person role="maintainer" userid="his_user_name"/> is set in
his home project metadata. This element should be set automatically on
creation of the project.

3. It seems users with change_package permission can submit requests to a project and accept them.

Interesting... change_package permission on the source package is needed
to create a request, that's true. But only users with change_project on
the target project should be able to accept it. I'm pretty sure it works
as intended, but will check again.

Is there any document online describing this in more details?

Unfortunately not, as there was never any kind of "design phase" for the
role/permission management, it grew (and is still growing) with the code.

Andreas

Thanks
Anas
---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx


---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx

< Previous Next >
References