func (ps *PolicyStore) GetPolicy(name string) (*Policy, error) {
	defer metrics.MeasureSince([]string{"policy", "get_policy"}, time.Now())
	if ps.lru != nil {
		if raw, ok := ps.lru.Get(name); ok {
			return raw.(*Policy), nil
		}
	}
	if name == "root" {
		p := &Policy{Name: "root"}
		if ps.lru != nil {
			ps.lru.Add(p.Name, p)
		}
		return p, nil
	}
	out, err := ps.view.Get(name)
	if err != nil {
		return nil, fmt.Errorf("failed to read policy: %v", err)
	}
	if out == nil {
		return nil, nil
	}
	policyEntry := new(PolicyEntry)
	var policy *Policy
	if err := out.DecodeJSON(policyEntry); err == nil {
		p, err := Parse(policyEntry.Raw)
		if err != nil {
			return nil, fmt.Errorf("failed to parse policy: %v", err)
		}
		p.Name = name
		policy = p
	} else {
		p, err := Parse(string(out.Value))
		if err != nil {
			return nil, fmt.Errorf("failed to parse policy: %v", err)
		}
		p.Name = name
		for _, pp := range p.Paths {
			pp.Glob = true
		}
		policy = p
	}
	if ps.lru != nil {
		ps.lru.Add(name, policy)
	}
	return policy, nil
}
GetPolicy is used to fetch the named policy
package vault
import (
	"fmt"
	"time"
	"github.com/armon/go-metrics"
	"github.com/hashicorp/errwrap"
	"github.com/hashicorp/golang-lru"
	"github.com/hashicorp/vault/helper/strutil"
	"github.com/hashicorp/vault/logical"
)
const (
	policySubPath = "policy/"
	policyCacheSize = 1024
	responseWrappingPolicyName = "response-wrapping"
	responseWrappingPolicy = `
path "cubbyhole/response" {
    capabilities = ["create", "read"]
}
path "sys/wrapping/unwrap" {
    capabilities = ["update"]
}
`
	defaultPolicy = `
# Allow tokens to look up their own properties
path "auth/token/lookup-self" {
    capabilities = ["read"]
}
# Allow tokens to renew themselves
path "auth/token/renew-self" {
    capabilities = ["update"]
}
# Allow tokens to revoke themselves
path "auth/token/revoke-self" {
    capabilities = ["update"]
}
# Allow a token to look up its own capabilities on a path
path "sys/capabilities-self" {
    capabilities = ["update"]
}
# Allow a token to renew a lease via lease_id in the request body
path "sys/renew" {
    capabilities = ["update"]
}
# Allow a token to manage its own cubbyhole
path "cubbyhole/*" {
    capabilities = ["create", "read", "update", "delete", "list"]
}
# Allow a token to list its cubbyhole (not covered by the splat above)
path "cubbyhole" {
    capabilities = ["list"]
}
# Allow a token to wrap arbitrary values in a response-wrapping token
path "sys/wrapping/wrap" {
    capabilities = ["update"]
}
# Allow a token to look up the creation time and TTL of a given
# response-wrapping token
path "sys/wrapping/lookup" {
    capabilities = ["update"]
}
# Allow a token to unwrap a response-wrapping token. This is a convenience to
# avoid client token swapping since this is also part of the response wrapping
# policy.
path "sys/wrapping/unwrap" {
    capabilities = ["update"]
}
`
)
var (
	immutablePolicies = []string{
		"root",
		responseWrappingPolicyName,
	}
	nonAssignablePolicies = []string{
		responseWrappingPolicyName,
	}
)
type PolicyStore struct {
	view *BarrierView
	lru  *lru.TwoQueueCache
}
type PolicyEntry struct {
	Version int
	Raw     string
}
func NewPolicyStore(view *BarrierView, system logical.SystemView) *PolicyStore {
	p := &PolicyStore{
		view: view,
	}
	if !system.CachingDisabled() {
		cache, _ := lru.New2Q(policyCacheSize)
		p.lru = cache
	}
	return p
}
func (c *Core) setupPolicyStore() error {
	view := c.systemBarrierView.SubView(policySubPath)
	c.policyStore = NewPolicyStore(view, &dynamicSystemView{core: c})
	policy, err := c.policyStore.GetPolicy("default")
	if err != nil {
		return errwrap.Wrapf("error fetching default policy from store: {{err}}", err)
	}
	if policy == nil {
		err := c.policyStore.createDefaultPolicy()
		if err != nil {
			return err
		}
	}
	policy, err = c.policyStore.GetPolicy(responseWrappingPolicyName)
	if err != nil {
		return errwrap.Wrapf("error fetching response-wrapping policy from store: {{err}}", err)
	}
	if policy == nil || policy.Raw != responseWrappingPolicy {
		err := c.policyStore.createResponseWrappingPolicy()
		if err != nil {
			return err
		}
	}
	return nil
}
func (c *Core) teardownPolicyStore() error {
	c.policyStore = nil
	return nil
}
func (ps *PolicyStore) SetPolicy(p *Policy) error {
	defer metrics.MeasureSince([]string{"policy", "set_policy"}, time.Now())
	if p.Name == "" {
		return fmt.Errorf("policy name missing")
	}
	if strutil.StrListContains(immutablePolicies, p.Name) {
		return fmt.Errorf("cannot update %s policy", p.Name)
	}
	return ps.setPolicyInternal(p)
}
func (ps *PolicyStore) setPolicyInternal(p *Policy) error {
	entry, err := logical.StorageEntryJSON(p.Name, &PolicyEntry{
		Version: 2,
		Raw:     p.Raw,
	})
	if err != nil {
		return fmt.Errorf("failed to create entry: %v", err)
	}
	if err := ps.view.Put(entry); err != nil {
		return fmt.Errorf("failed to persist policy: %v", err)
	}
	if ps.lru != nil {
		ps.lru.Add(p.Name, p)
	}
	return nil
}