[lxc-devel] [lxd/master] lxd/rbac: Always allow internal cluster traffic

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200708/782fa832/attachment.bin>
-------------- next part --------------
From ae27e4fce620fb734f408596611f8ffe3a5a3cba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Wed, 8 Jul 2020 09:13:44 -0400
Subject: [PATCH] lxd/rbac: Always allow internal cluster traffic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/daemon.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lxd/daemon.go b/lxd/daemon.go
index f04ceb58dd..c00bf5c6ca 100644
--- a/lxd/daemon.go
+++ b/lxd/daemon.go
@@ -1370,6 +1370,10 @@ func (d *Daemon) userIsAdmin(r *http.Request) bool {
 		return true
 	}
 
+	if r.Context().Value("protocol") == "cluster" {
+		return true
+	}
+
 	if r.Context().Value("protocol") == "tls" {
 		return true
 	}
@@ -1382,6 +1386,10 @@ func (d *Daemon) userHasPermission(r *http.Request, project string, permission s
 		return true
 	}
 
+	if r.Context().Value("protocol") == "cluster" {
+		return true
+	}
+
 	if r.Context().Value("protocol") == "tls" {
 		return true
 	}