<p><br>
On Nov 24, 2013 5:08 PM, "i iordanov" <<a href="mailto:iiordanov@gmail.com">iiordanov@gmail.com</a>> wrote:<br>
><br>
> Hi Juan,<br>
><br>
> Thanks for your suggestions!<br>
><br>
> On Sun, Nov 24, 2013 at 5:36 AM, Juan Hernandez <<a href="mailto:jhernand@redhat.com">jhernand@redhat.com</a>> wrote:<br>
>><br>
>> Here you are experiencing two security features of the engine. The first<br>
>> one is the multiple level administration (a.k.a. MLA). The engine<br>
>> organizes objets in hierarchy: a set of data centers, then inside each<br>
>> data center a set of clusters, and inside each cluster a set of virtual<br>
>> machines. When you assign a permission to a user or group you in fact<br>
>> assign it to one of these objects, and objects deeper in the tree<br>
>> inherit them. So if you assign the "create vm" permission to user A and<br>
>> the default data center, then that user will have permission to create<br>
>> VMs on any cluster of that data center. I guess that the two users that<br>
>> you initially created had the permission on the default data center or<br>
>> the default cluster, so they have the permissions apply to all the VMs.<br>
>> Try to go to the data center or cluster tabs and see if the users have<br>
>> permissions there, then remove them as needed.<br>
><br>
><br>
> When I looked at the Data Centers and Clusters tabs and examined the permissions given to the users, UserA and UserB have UserRole permissions granted on both the default data center and the default cluster. Moreover, I am unable to remove them, as the "Remove" selection is always grayed out.<br>
><br>
> Furthermore, examining the permissions on UserA's VM, I can see that only UserA has been granted UseRole permission on it. No other user is mentioned.<br>
><br>
> So do the UserRole permissions granted to UserA and UserB in the Data Center and Cluster explain the fact that they can see and attach to "other people's VM's"?<br>
><br>
> If so, do I have to take the data center and cluster down to remove the UserRole permissions for the users? Also, how could I prevent this permission from getting added to the Data Center and Cluster automatically? I haven't added it myself and it says that it's an inherited permission (System).</p>
<p>You probably added the user role to the user from the users tab, rather than just adding at vm level . You don't need to add the user first.<br>
> <br>
>><br>
>><br>
>> The other thing you are experiencing is the prevention of hijacking of<br>
>> the console of a VM.<br>
><br>
><br>
> Yes, I understand. I remember seeing the option you mention when creating/editing VMs. I mentioned this more as a way to explain why UserB was initially not able to connect to UserA's VM where in fact, it was possible upon a clean boot.<br>
><br>
> Any additional help is appreciated!<br>
><br>
> iordan<br>
> <br>
> -- <br>
> The conscious mind has only one thread of execution.<br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a><br>
><br>
</p>