Bug #834: When Users or Groups are deleted, their ACL rules are also dropped

include/AclManager.h

@@ -93,6 +93,20 @@ public:
      */
     virtual int del_rule(int oid, string& error_str);
 
+    /**
+     * Deletes rules that apply to this user id
+     *
+     * @param uid The user id
+     */
+    void del_uid_rules(int uid);
+
+    /**
+     * Deletes rules that apply to this group id
+     *
+     * @param gid The group id
+     */
+    void del_gid_rules(int gid);
+
     /**
      * Searches what resources of type obj_type the ACL rules set allows
      * the given user to perform the operation.
@@ -199,6 +213,13 @@ private:
             long long group_obj_type,
             multimap<long long, AclRule*> &tmp_rules);
 
+    /**
+     * Deletes all rules that match the user mask
+     *
+     * @param user_req Mask to match
+     */
+    void del_user_matching_rules(long long user_req);
+
     // ----------------------------------------
     // Mutex synchronization
     // ----------------------------------------

include/RequestManagerDelete.h

@@ -180,11 +180,21 @@ public:
     {    
         Nebula& nd = Nebula::instance();
         pool       = nd.get_gpool();
+        aclm       = nd.get_aclm();
+
         auth_object = PoolObjectSQL::GROUP;
         auth_op     = AuthRequest::ADMIN;
     };
 
     ~GroupDelete(){};
+
+    /* -------------------------------------------------------------------- */
+
+    AclManager * aclm;
+
+    /* -------------------------------------------------------------------- */
+
+    int drop(int oid, PoolObjectSQL * object, string& error_msg);
 };
 
 /* ------------------------------------------------------------------------- */
@@ -198,6 +208,9 @@ public:
     {    
         Nebula& nd  = Nebula::instance();
         pool        = nd.get_upool();
+        gpool       = nd.get_gpool();
+        aclm        = nd.get_aclm();
+
         auth_object = PoolObjectSQL::USER;
         auth_op     = AuthRequest::ADMIN;
     };
@@ -206,6 +219,11 @@ public:
 
     /* -------------------------------------------------------------------- */
 
+    GroupPool *  gpool;
+    AclManager * aclm;
+
+    /* -------------------------------------------------------------------- */
+
     int drop(int oid, PoolObjectSQL * object, string& error_msg);
 };
 

src/acl/AclManager.cc

@@ -504,7 +504,6 @@ int AclManager::del_rule(int oid, string& error_str)
     {
         found = *rule == *(it->second);
 
-
         if ( !found )
         {
             it++;
@@ -546,6 +545,56 @@ int AclManager::del_rule(int oid, string& error_str)
 /* -------------------------------------------------------------------------- */
 /* -------------------------------------------------------------------------- */
 
+void AclManager::del_uid_rules(int uid)
+{
+    long long user_req = AclRule::INDIVIDUAL_ID | uid;
+
+    del_user_matching_rules(user_req);
+}
+
+/* -------------------------------------------------------------------------- */
+/* -------------------------------------------------------------------------- */
+
+void AclManager::del_gid_rules(int gid)
+{
+    long long user_req = AclRule::GROUP_ID | gid;
+
+    del_user_matching_rules(user_req);
+}
+
+/* -------------------------------------------------------------------------- */
+/* -------------------------------------------------------------------------- */
+
+void AclManager::del_user_matching_rules(long long user_req)
+{
+    multimap<long long, AclRule *>::iterator        it;
+    pair<multimap<long long, AclRule *>::iterator,
+         multimap<long long, AclRule *>::iterator>  index;
+
+    vector<int>             oids;
+    vector<int>::iterator   oid_it;
+    string                  error_str;
+
+    lock();
+
+    index = acl_rules.equal_range( user_req );
+
+    for ( it = index.first; it != index.second; it++)
+    {
+        oids.push_back(it->second->oid);
+    }
+
+    unlock();
+
+    for ( oid_it = oids.begin() ; oid_it < oids.end(); oid_it++ )
+    {
+        del_rule(*oid_it, error_str);
+    }
+}
+
+/* -------------------------------------------------------------------------- */
+/* -------------------------------------------------------------------------- */
+
 void AclManager::reverse_search(int                       uid,
                                 int                       gid,
                                 PoolObjectSQL::ObjectType obj_type,

src/rm/RequestManagerDelete.cc

@@ -192,6 +192,21 @@ int ImageDelete::drop(int oid, PoolObjectSQL * object, string& error_msg)
 /* ------------------------------------------------------------------------- */
 /* ------------------------------------------------------------------------- */
 
+int GroupDelete::drop(int oid, PoolObjectSQL * object, string& error_msg)
+{
+    int rc = RequestManagerDelete::drop(oid, object, error_msg);
+
+    if ( rc == 0 )
+    {
+        aclm->del_gid_rules(oid);
+    }
+
+    return rc;
+}
+
+/* ------------------------------------------------------------------------- */
+/* ------------------------------------------------------------------------- */
+
 int UserDelete::drop(int oid, PoolObjectSQL * object, string& error_msg)
 {
     User * user  = static_cast<User *>(object);
@@ -211,10 +226,7 @@ int UserDelete::drop(int oid, PoolObjectSQL * object, string& error_msg)
 
     if ( rc == 0 )
     {
-        Nebula&     nd      = Nebula::instance();
-        GroupPool * gpool   = nd.get_gpool();
-
-        Group *     group   = gpool->get(group_id, true);
+        Group * group = gpool->get(group_id, true);
 
         if( group != 0 )
         {
@@ -223,6 +235,8 @@ int UserDelete::drop(int oid, PoolObjectSQL * object, string& error_msg)
 
             group->unlock();
         }
+
+        aclm->del_uid_rules(oid);
     }
 
     return rc;