{"action":"created","issue":{"url":"https://api.github.com/repos/chef/chef-server/issues/248","labels_url":"https://api.github.com/repos/chef/chef-server/issues/248/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef-server/issues/248/comments","events_url":"https://api.github.com/repos/chef/chef-server/issues/248/events","html_url":"https://github.com/chef/chef-server/pull/248","id":75355877,"number":248,"title":"ACL Restrictions","user":{"login":"mmzyk","id":66784,"avatar_url":"https://avatars.githubusercontent.com/u/66784?v=3","gravatar_id":"","url":"https://api.github.com/users/mmzyk","html_url":"https://github.com/mmzyk","followers_url":"https://api.github.com/users/mmzyk/followers","following_url":"https://api.github.com/users/mmzyk/following{/other_user}","gists_url":"https://api.github.com/users/mmzyk/gists{/gist_id}","starred_url":"https://api.github.com/users/mmzyk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmzyk/subscriptions","organizations_url":"https://api.github.com/users/mmzyk/orgs","repos_url":"https://api.github.com/users/mmzyk/repos","events_url":"https://api.github.com/users/mmzyk/events{/privacy}","received_events_url":"https://api.github.com/users/mmzyk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chef/chef-server/labels/in%20progress","name":"in progress","color":"ededed"},{"url":"https://api.github.com/repos/chef/chef-server/labels/Signed%20CLA","name":"Signed CLA","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-05-11T21:00:13Z","updated_at":"2015-05-20T15:21:28Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/chef/chef-server/pulls/248","html_url":"https://github.com/chef/chef-server/pull/248","diff_url":"https://github.com/chef/chef-server/pull/248.diff","patch_url":"https://github.com/chef/chef-server/pull/248.patch"},"body":"Add in stubb for performing acl integrity checks\r\n\r\nThis commit changes nothing about how the current code operates. However, it does add a new module and call to that module that gives a hook for performing acl integrity checks, such as if we are removing the admin group from the grant ace, which is something we desire not to be possible.\r\n\r\nThis branch is branched from https://github.com/chef/chef-server/pull/240.\r\n\r\nThe desire at this point is that both of these branches could be merged to master and would essential be no-ops as the desired functionality is built on top of these changes."},"comment":{"url":"https://api.github.com/repos/chef/chef-server/issues/comments/103924108","html_url":"https://github.com/chef/chef-server/pull/248#issuecomment-103924108","issue_url":"https://api.github.com/repos/chef/chef-server/issues/248","id":103924108,"user":{"login":"stevendanna","id":852371,"avatar_url":"https://avatars.githubusercontent.com/u/852371?v=3","gravatar_id":"","url":"https://api.github.com/users/stevendanna","html_url":"https://github.com/stevendanna","followers_url":"https://api.github.com/users/stevendanna/followers","following_url":"https://api.github.com/users/stevendanna/following{/other_user}","gists_url":"https://api.github.com/users/stevendanna/gists{/gist_id}","starred_url":"https://api.github.com/users/stevendanna/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevendanna/subscriptions","organizations_url":"https://api.github.com/users/stevendanna/orgs","repos_url":"https://api.github.com/users/stevendanna/repos","events_url":"https://api.github.com/users/stevendanna/events{/privacy}","received_events_url":"https://api.github.com/users/stevendanna/received_events","type":"User","site_admin":false},"created_at":"2015-05-20T15:21:28Z","updated_at":"2015-05-20T15:21:28Z","body":"@manderson26 and I talked a bit about this at the Chef Server triage meeting last week.  \r\n\r\nTo shortly summarize my original concern:\r\n\r\nThis and other changes are in pursuit of some higher-level policy such as \"admins can always modify objects\".  However, instead of creating a system that directly expresses that desire, we have implemented \"by default, permissions are such that an admin can always modify objects, and we are going to make it hard to alter permissions in a way that would make that untrue\".\r\n\r\nMy worry was that we were describing our desired policy obtusely, possibly making it unclear to future maintainers and making it fragile.\r\n\r\nHowever, there are advantages to this particular implementation:\r\n\r\n- we currently don't have a good place to express higher-level authorization policy in oc_erchef.  We could make one, but it would possible require a high level of churn in the auth code, which is a lot of risk to swallow at once.\r\n\r\n- expressing some of that policy in oc_erchef would require additional bifrost/database calls per request\r\n\r\n- it is even harder to express that policy in oc_bifrost since bifrost has none of the context needed (ie, it has no idea what an admin group is).\r\n\r\n- we have other systems that might be doing permissions lookups to bifrost.  expressing these policies as a set of default bifrost state with change restrictions make it so that the policy is shared across those services.\r\n\r\n@manderson26 feel free to add something I missed.\r\n\r\nThose reasons quelled my initial concerns."}}