{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/942","labels_url":"https://api.github.com/repos/openshift/origin/issues/942/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/942/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/942/events","html_url":"https://github.com/openshift/origin/pull/942","id":56867583,"number":942,"title":"remove deny and negation, add resource groups","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-02-06T21:01:15Z","updated_at":"2015-02-10T14:54:24Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/942","html_url":"https://github.com/openshift/origin/pull/942","diff_url":"https://github.com/openshift/origin/pull/942.diff","patch_url":"https://github.com/openshift/origin/pull/942.patch"},"body":"Deny and negation add significant complication when determining covers relationships for role membership and new role changes.  While the problem is surmountable (I'm still impressed with your implementation @liggitt), the computation involves re-evaluating all effective permissions across every potentially affected user and group in a series of four steps (global deny, global allow, local deny, local allow) in a manner that splits permissions as they are individually covered or not.  Furthermore, there is significant risk in allowing \"every except\" sort of rules as we add additional resources and verbs.  It could result in accidental permissions being granted.\r\n\r\nBecause of the cumbersome nature of listing each individual permission, I've created the idea of a resource group that can contain a list of resources or other resource groups.  This allows the description of policy to reasonably concise, while being strictly positive only.\r\n```\r\nosc describe --namespace=master policy default\r\nName:\t\tdefault\r\nAnnotations:\t<none>\r\nCreated:\t2015-02-06 15:49:56 -0500 EST\r\nLast Modified:\t2015-02-06 15:49:56 -0500 EST\r\nComponentRole\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\tExtension\r\n\t\t[*]\t\t\t\t\t[*]\t\t\t\t\t\t\t\t\r\nadmin\t\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\tExtension\r\n\t\t[get list watch create update delete]\t[group:exposedopenshift group:granter group:exposedkube]\t\r\n\t\t[get list watch]\t\t\t[group:policy group:allkube]\t\t\t\t\t\r\ncluster-admin\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\tExtension\r\n\t\t[*]\t\t\t\t\t[*]\t\t\t\t\t\t\t\t\r\nedit\t\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\tExtension\r\n\t\t[get list watch create update delete]\t[group:exposedopenshift group:exposedkube]\t\t\t\r\n\t\t[get list watch]\t\t\t[group:allkube]\t\t\t\t\t\t\t\r\nview\t\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\tExtension\r\n\t\t[get list watch]\t\t\t[group:exposedopenshift group:allkube]\t\t\r\n```"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/73711873","html_url":"https://github.com/openshift/origin/pull/942#issuecomment-73711873","issue_url":"https://api.github.com/repos/openshift/origin/issues/942","id":73711873,"user":{"login":"openshift-bot","id":1779249,"avatar_url":"https://avatars.githubusercontent.com/u/1779249?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift-bot","html_url":"https://github.com/openshift-bot","followers_url":"https://api.github.com/users/openshift-bot/followers","following_url":"https://api.github.com/users/openshift-bot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-bot/subscriptions","organizations_url":"https://api.github.com/users/openshift-bot/orgs","repos_url":"https://api.github.com/users/openshift-bot/repos","events_url":"https://api.github.com/users/openshift-bot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-bot/received_events","type":"User","site_admin":false},"created_at":"2015-02-10T14:54:24Z","updated_at":"2015-02-10T14:54:24Z","body":"Evaluated for origin up to f802536ad00c871f8986c0489f828b60b24c6956"}}