Roy Golan has submitted this change and it was merged. Change subject: core: Added Roles and groups for cpu profiling ...................................................................... core: Added Roles and groups for cpu profiling The following CPU Profiles were added in order to prevent unauthorized access to cpu profiles: CpuProfileOperator - Will have the ability to Assign CPU Profile to VMs. CpuProfileCreator - Will have the ability to Create/Update/Delete and Assign CPU Profile to VMs. Action groups that were added to engine and REST API: Create CPU Profile, Update CPU Profile, Remove CPU Profile, Assign CPU Profile. Roles that were granted Create/Update/Delete and Assign permissions for cpu profiles (Same as CpuProfileCreator + CpuProfileOperator): SuperUser, PowerUser, ClusterAdmin, DataCenterAdmin. Other roles that were granted permission same as the ones for CpuProfileOperator: CpuProfileCreator, UserVmManager, VmPoolAdmin, VmCreator, UserTemplateBasedVm and UserVmRuntimeManager. Before this patch, any user that had permissions for the cluster associated with the CPU Profile, could Create/Update/Delete and Assign it. The Data Access Objects tests(DAO tests) were changed inorder to comply with the new behaviour. Change-Id: Ief14e9e209b0ce3c7dd836e9dae5eecf8ae6ef47 Bug-Url: https://bugzilla.redhat.com/1143869 Signed-off-by: Tomer Saban <tsaban@redhat.com> --- M backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java M backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java M backend/manager/modules/dal/src/test/java/org/ovirt/engine/core/dao/FixturesTool.java M backend/manager/modules/dal/src/test/java/org/ovirt/engine/core/dao/RoleDaoTest.java M backend/manager/modules/dal/src/test/resources/fixtures.xml M backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java M packaging/dbscripts/cpu_profiles_sp.sql M packaging/dbscripts/create_views.sql A packaging/dbscripts/upgrade/04_00_0140_attach_cpu_profile_permissions.sql A packaging/dbscripts/upgrade/04_00_0150_create_index_cpu_profiles.sql 10 files changed, 238 insertions(+), 22 deletions(-) Approvals: Jenkins CI: Passed CI tests Tomer Saban: Verified Roy Golan: Looks good to me, approved -- To view, visit https://gerrit.ovirt.org/49532 To unsubscribe, visit https://gerrit.ovirt.org/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ief14e9e209b0ce3c7dd836e9dae5eecf8ae6ef47 Gerrit-PatchSet: 23 Gerrit-Project: ovirt-engine Gerrit-Branch: master Gerrit-Owner: Tomer Saban <tsaban@redhat.com> Gerrit-Reviewer: Andrej Krejcir <akrejcir@redhat.com> Gerrit-Reviewer: Eli Mesika <emesika@redhat.com> Gerrit-Reviewer: Jenkins CI Gerrit-Reviewer: Martin Sivák <msivak@redhat.com> Gerrit-Reviewer: Roman Mohr <rmohr@redhat.com> Gerrit-Reviewer: Roy Golan <rgolan@redhat.com> Gerrit-Reviewer: Tomer Saban <tsaban@redhat.com> Gerrit-Reviewer: gerrit-hooks <automation@ovirt.org>