Skip to content
Normal view Permalink
server-java.security.policy 29.5 KiB
Newer Older
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
1 2 3 4 5 6 
// SCHEDULER AND RESOURCE MANAGER CLIENTS POLICY
//
// USERS PERMISSIONS (EXAMPLE)
//
//grant principal org.ow2.proactive.authentication.principals.UserNamePrincipal "user" {
//    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getAtMostNodes";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
7 
//    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodes";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
8 9 10 11 12 13 14 
//    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNode";
//    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNodes";
//};

//
// GROUPS PERMISSIONS
//
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
15 16 
// Members of "guest" group can get/free nodes and monitor the state submit jobs
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "guests" {
Mykhailenko's avatar
Async & cached loggers (#3531)  
Mykhailenko committed
17 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.setPendingTasksCount";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
18 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getAtMostNodes";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
19 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodes";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
20 21 22 23 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNodes";
Justine Rochas's avatar
Adapt nodes recovery per node source (#3088)  
Justine Rochas committed
24 25 26 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseBusyNodesNotInList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesKnown";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesRecoverable";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
27 28 29 

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodesList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodeSourcesList";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
30 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.listAliveNodeUrls";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
31 32 33 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getFreeNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalAliveNodesNumber";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
34 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeIsAvailable";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
35 36 37 38 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getRMState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isActive";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isAlive";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
39 40 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeAdmin";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeUser";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
41 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getMonitoring";
Justine Rochas's avatar
Prevent setNodesAvailable to be called for not-yet-available nodes (#3096)  
Justine Rochas committed
42 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.registerAvailableNode";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
43 44 45 46 47 

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.disconnect";

    // AuthPermission is requires for those who would like to access any mbean
    permission javax.security.auth.AuthPermission "getSubject";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
48 
    permission java.lang.RuntimePermission "setContextClassLoader";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
49 50 51 52 53 54 55 56 57 
    permission javax.management.MBeanPermission "-#-[-]", "queryNames";
    permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener";
    permission javax.management.MBeanPermission "org.ow2.proactive.scheduler.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.scheduler.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";
    // Granting file reading permission i.e. to read RRD database via JMX
    permission java.io.FilePermission "<<ALL FILES>>", "read";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
58 59 60 61 
	// --------------------------- scheduling related permission
	//use the following line to allow a user to download full scheduler state and get events from any user
	//"true" means that this user can get only its job in the state and listen for its events
	//"false" means user can get full state and listen for any events.
Marco Castigliego's avatar
Adding HandleOnlyMyJobsPermission as generic permission to execute methods of...  
Marco Castigliego committed
62 
    permission org.ow2.proactive.scheduler.permissions.HandleOnlyMyJobsPermission "true";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
63 64 65 66 67 
    permission org.ow2.proactive.scheduler.permissions.ChangePriorityPermission "1,2,3";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.submit";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobResult";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskResult";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskResultFromIncarnation";
Mykhailenko's avatar
Add REST end point to return submitted job xml (#3364)  
Mykhailenko committed
68 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobContent";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.killTask";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.restartTask";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.removeJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.listenJobLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getStatus";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.addEventListener";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.pauseJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.resumeJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.killJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.changeJobPriority";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobServerLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskServerLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getUsers";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getMyAccountUsage";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getGlobalSpaceURIs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getUserSpaceURIs";
};
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
89
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
90 91 
// Members of "user" group can get/free nodes and monitor the state, submit jobs and see jobs of other people
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "user" {
Mykhailenko's avatar
Async & cached loggers (#3531)  
Mykhailenko committed
92 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.setPendingTasksCount";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
93 94 95 96 97 98 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getAtMostNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNodes";
Justine Rochas's avatar
Adapt nodes recovery per node source (#3088)  
Justine Rochas committed
99 100 101 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseBusyNodesNotInList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesKnown";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesRecoverable";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodesList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.listAliveNodeUrls";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodeSourcesList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getFreeNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalAliveNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeIsAvailable";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getRMState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isActive";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isAlive";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeAdmin";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeUser";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getMonitoring";
Justine Rochas's avatar
Prevent setNodesAvailable to be called for not-yet-available nodes (#3096)  
Justine Rochas committed
117 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.registerAvailableNode";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
118 119 120 121 122 123 124 125 126 127 128 129 130 131 

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.disconnect";

    // AuthPermission is requires for those who would like to access any mbean
    permission javax.security.auth.AuthPermission "getSubject";
    permission java.lang.RuntimePermission "setContextClassLoader";
    permission javax.management.MBeanPermission "-#-[-]", "queryNames";
    permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener";
    permission javax.management.MBeanPermission "org.ow2.proactive.scheduler.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.scheduler.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";
    // Granting file reading permission i.e. to read RRD database via JMX
    permission java.io.FilePermission "<<ALL FILES>>", "read";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
132 133 134 135 136 

	// --------------------------- scheduling related permission
	//use the following line to allow a user to download full scheduler state and get events from any user
	//"true" means that this user can get only its job in the state and listen for its events
	//"false" means user can get full state and listen for any events.
Marco Castigliego's avatar
Adding HandleOnlyMyJobsPermission as generic permission to execute methods of...  
Marco Castigliego committed
137 
    permission org.ow2.proactive.scheduler.permissions.HandleOnlyMyJobsPermission "false";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
138 139 140 141 142 
    permission org.ow2.proactive.scheduler.permissions.ChangePriorityPermission "1,2,3";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.submit";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobResult";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskResult";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskResultFromIncarnation";
Mykhailenko's avatar
Add REST end point to return submitted job xml (#3364)  
Mykhailenko committed
143 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobContent";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
144 145 146 147 148 149 150 151 152 153 154 155 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.killTask";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.restartTask";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.removeJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.listenJobLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getStatus";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.addEventListener";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.pauseJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.resumeJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.killJob";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.changeJobPriority";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
156 157 158 159 160 161 162 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobServerLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getTaskServerLogs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getJobs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getUsers";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getMyAccountUsage";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getGlobalSpaceURIs";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getUserSpaceURIs";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
163 164 165 166 
};

// Resource providers have the same permissions as users + an ability to add remove node
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "providers" {
Mykhailenko's avatar
Async & cached loggers (#3531)  
Mykhailenko committed
167 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.setPendingTasksCount";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
168 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getAtMostNodes";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
169 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodes";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
170 171 172 173 174 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getExactlyNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNodes";
Justine Rochas's avatar
Adapt nodes recovery per node source (#3088)  
Justine Rochas committed
175 176 177 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseBusyNodesNotInList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesKnown";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesRecoverable";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
178 179 180 181 182 183 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeIsAvailable";

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.addNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.removeNode";

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodesList";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
184 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.listAliveNodeUrls";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
185 186 187 188 189 190 191 192 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodeSourcesList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getFreeNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalAliveNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getRMState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isActive";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isAlive";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
193 194 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeAdmin";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeUser";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
195 196 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getMonitoring";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeIsAvailable";
Justine Rochas's avatar
Prevent setNodesAvailable to be called for not-yet-available nodes (#3096)  
Justine Rochas committed
197 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.registerAvailableNode";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
198 199 200 201 202 

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.disconnect";

    // AuthPermission is requires for those who would like to access any mbean
    permission javax.security.auth.AuthPermission "getSubject";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
203 
    permission java.lang.RuntimePermission "setContextClassLoader";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
204 205 206 207 208 209 210 211 212 213 214 
    permission javax.management.MBeanPermission "-#-[-]", "queryNames";
    permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";

    // Granting file reading permission i.e. to read RRD database via JMX
    permission java.io.FilePermission "<<ALL FILES>>", "read";
};

// Members of "nsadmins" can create/remove node sources (according to their policies)
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "nsadmins" {
Mykhailenko's avatar
Async & cached loggers (#3531)  
Mykhailenko committed
215 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.setPendingTasksCount";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
216 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getAtMostNodes";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
217 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodes";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
218 219 220 221 222 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getExactlyNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.freeNodes";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseNodes";
Justine Rochas's avatar
Adapt nodes recovery per node source (#3088)  
Justine Rochas committed
223 224 225 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.releaseBusyNodesNotInList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesKnown";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.areNodesRecoverable";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
226 227 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeIsAvailable";
Justine Rochas's avatar
Split node source creation in two steps (#3138)  
Justine Rochas committed
228 229 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.defineNodeSource";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.deployNodeSource";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
230 231 232 233 234 235 236 237 238 239 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.createNodeSource";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.removeNodeSource";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.nodeSourceUnregister";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.addNode";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.removeNode";

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.internalAddNodeToCore";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.internalRegisterConfiguringNode";

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodesList";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
240 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.listAliveNodeUrls";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
241 242 243 244 245 246 247 248 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getNodeSourcesList";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getFreeNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTotalAliveNodesNumber";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getRMState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isActive";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isAlive";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
249 250 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeAdmin";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.isNodeUser";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
251 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getMonitoring";
Justine Rochas's avatar
Prevent setNodesAvailable to be called for not-yet-available nodes (#3096)  
Justine Rochas committed
252 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.registerAvailableNode";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
253 254 255 256 257 258 259 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getSupportedNodeSourceInfrastructures";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getSupportedNodeSourcePolicies";

    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.disconnect";

    // AuthPermission is requires for those who would like to access any mbean
    permission javax.security.auth.AuthPermission "getSubject";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
260 
    permission java.lang.RuntimePermission "setContextClassLoader";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 
    permission javax.management.MBeanPermission "-#-[-]", "queryNames";
    permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.MyAccountMBeanImpl#*[*:*]", "*";
    permission javax.management.MBeanPermission "org.ow2.proactive.resourcemanager.core.jmx.mbean.RuntimeDataMBeanImpl#*[*:*]", "*";

    // Granting file reading permission i.e. to read RRD database via JMX
    permission java.io.FilePermission "<<ALL FILES>>", "read";
};

// Members of "rmcoreadmins" can call any method of rmcore
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "rmcoreadmins" {
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.*";
};

// Members of "admin" group possess permissions to perform any actions
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "admin" {
    permission org.ow2.proactive.permissions.AllPermission;
};
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
280 
// Members of "watchers" group have only a read access to the scheduler and RM state
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
281 282 283 284 
// and the authorization to register a listener in order to receive updates of the scheduler state
grant principal org.ow2.proactive.authentication.principals.GroupNamePrincipal "watchers" {
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getState";
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.addEventListener";
Marco Castigliego's avatar
Adding HandleOnlyMyJobsPermission as generic permission to execute methods of...  
Marco Castigliego committed
285 
    permission org.ow2.proactive.scheduler.permissions.HandleOnlyMyJobsPermission "false";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
286 
    permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.scheduler.core.SchedulerFrontend.getStatus";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
287 
	permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getMonitoring";
Justine Rochas's avatar
Prevent setNodesAvailable to be called for not-yet-available nodes (#3096)  
Justine Rochas committed
288 
	permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.registerAvailableNode";
Vladimir Bodnartchouk's avatar
SCHEDULING-2018 - RestFuncTHelper should use all-in-one SchedulerStarter to start all components  
Vladimir Bodnartchouk committed
289 
	permission org.ow2.proactive.permissions.MethodCallPermission "org.ow2.proactive.resourcemanager.core.RMCore.getTopology";
Sanka Samaranayake's avatar
PORTAL-226
Sanka Samaranayake committed
290 291 292 293 294 295 296 297 
};
//
// OTHER PERMISSIONS
//
// Allow all actions to subjects without principals above
grant {
	permission java.security.AllPermission;
};