Repository: rucio/rucio

Issue:
Add a quota_approver similar to rule_approver
Motivation
----------
Now setting the quota is linked to the `country-xyz=admin` attribute. It would be good to have a quota_approver on the RSEs similar to rule_approver.




docker setup issues
Motivation
----------

I had a few issues setting up the dev environment, mainly with the documentation at `etc/docker/dev/README.rst`.


Modification
------------

`docker exec -it dev_rucio_1 bin/bash` has a typo, it should be `/bin/bash`

It should be mentioned that SELinux will block access to the directories mounted inside the container so it should be disabled.

`logshow` doesn't work:

```[root@rucio rucio]# logshow
 --*- multitail 6.4.2 (C) 2003-2014 by folkert@vanheusden.com -*--

The following problem occured:
-----------------------------
ttyname(0) failed.
If this is a bug, please report the following information:
The last system call returned: 2 which means "No such file or directory"
Terminated
```
After this the terminal freezes up and the multitail processes have to be forcibly killed from outside the container.

The tests create a lot of junk in the database (RSEs, accounts, etc), is there a way to reset the database back to a clean state?



Discussion:

You can run `tools/run_tests_docker.sh -i` to do just the database init again. I'll add the rest to the docs. 

For logshow, you are missing a pseudo-terminal in docker, are you sure you did `-t` to `docker exec` ? Also, make sure you run a recent docker version (e.g., the default in CentOS is `v1.xx`, you need at least `v12.xx`, that's 11 major releases in between ;-) If you install the one from the linked repo in the docs you will get `v19.xx`.
Indeed I was using the default CentOS 7 version 1.13. After updating to 19.03.4 it works. Maybe you can add the requirement for a newer version to the doc as well?



Resolving patch:
diff --git a/lib/rucio/core/permission/atlas.py b/lib/rucio/core/permission/atlas.py
--- a/lib/rucio/core/permission/atlas.py
+++ b/lib/rucio/core/permission/atlas.py
@@ -907,7 +907,11 @@ def perm_set_account_limit(issuer, kwargs):
     for kv in list_account_attributes(account=issuer):
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.append(kv['key'].partition('-')[2])
-    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id']).get('country') in admin_in_country:
+    rse_attr = list_rse_attributes(rse_id=kwargs['rse_id'])
+    if admin_in_country and rse_attr.get('country') in admin_in_country:
+        return True
+    quota_approvers = rse_attr.get('quota_approvers', None)
+    if quota_approvers and issuer.external in quota_approvers.split(','):
         return True
     return False
 
@@ -927,7 +931,11 @@ def perm_delete_account_limit(issuer, kwargs):
     for kv in list_account_attributes(account=issuer):
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.append(kv['key'].partition('-')[2])
-    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id']).get('country') in admin_in_country:
+    rse_attr = list_rse_attributes(rse_id=kwargs['rse_id'])
+    if admin_in_country and rse_attr.get('country') in admin_in_country:
+        return True
+    quota_approvers = rse_attr.get('quota_approvers', None)
+    if quota_approvers and issuer.external in quota_approvers.split(','):
         return True
     return False
 


Test patch: