Module Expr Str ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias identifier ImportFrom alias ClassDef bases NameLoad body Expr Str decorator_list ClassDef bases NameLoad body Expr Str decorator_list ClassDef bases NameLoad body Expr Str decorator_list ClassDef bases NameLoad body Expr Str decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str Assign NameStore AttributeLoad NameLoad attr FunctionDef arguments args NameParam defaults body Assign NameStore Call AttributeLoad NameLoad attr Str If UnaryOpNot NameLoad body Raise Call NameLoad Str Return NameLoad decorator_list NameLoad FunctionDef arguments args NameParam NameParam defaults body If BoolOpOr UnaryOpNot Call NameLoad NameLoad NameLoad UnaryOpNot NameLoad body Raise Call NameLoad Str Expr Call AttributeLoad NameLoad attr Str NameLoad decorator_list AttributeLoad NameLoad attr FunctionDef arguments args NameParam defaults body Return Call AttributeLoad NameLoad attr Str decorator_list NameLoad FunctionDef arguments args NameParam NameParam defaults body If UnaryOpNot Call NameLoad NameLoad NameLoad body Raise Call NameLoad Str Expr Call AttributeLoad NameLoad attr Str NameLoad decorator_list AttributeLoad NameLoad attr FunctionDef arguments args NameParam defaults body Return Call AttributeLoad NameLoad attr Str decorator_list NameLoad FunctionDef arguments args NameParam NameParam defaults body If UnaryOpNot Call NameLoad NameLoad NameLoad body Raise Call NameLoad Str Expr Call AttributeLoad NameLoad attr Str NameLoad decorator_list AttributeLoad NameLoad attr FunctionDef arguments args NameParam defaults body Return Call AttributeLoad NameLoad attr Str decorator_list NameLoad decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str FunctionDef arguments args NameParam defaults body Expr Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Expr Str Return Call NameLoad AttributeLoad AttributeLoad NameLoad attr attr decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad body Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr If NameLoad body Expr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad NameLoad orelse With Call NameLoad SubscriptLoad AttributeLoad NameLoad attr Index Str keyword Str NameStore body Expr Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr NameLoad For NameStore Call AttributeLoad AttributeLoad NameLoad attr attr body For NameStore AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr NameLoad AttributeLoad NameLoad attr For NameStore AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr NameLoad AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad If UnaryOpNot NameLoad body Return NameLoad If AttributeLoad NameLoad attr body If UnaryOpNot Call AttributeLoad NameLoad attr NameLoad NameLoad body Raise Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr NameLoad keyword NameLoad keyword AttributeLoad NameLoad attr Assign NameStore Num For NameStore NameLoad body If BoolOpAnd Call AttributeLoad NameLoad attr NameLoad NameLoad CompareNotEq NameLoad NameLoad body AugAssignAdd NameStore Num If CompareLt NameLoad AttributeLoad NameLoad attr body Raise Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad NameLoad NameLoad AttributeLoad NameLoad attr keyword NameLoad keyword AttributeLoad NameLoad attr Return NameLoad decorator_list decorator_list Assign NameStore NameLoad ClassDef bases AttributeLoad NameLoad attr body FunctionDef arguments args NameParam defaults body Global identifier Assign NameStore Call NameLoad decorator_list decorator_list
N/A N/A Client label approvals authorization manager. grr.lib access_control grr.lib config_lib grr.lib registry grr.lib.authorization auth_manager grr.lib.rdfvalues structs rdf_structs grr.proto acls_pb2 Error N/A Exception N/A N/A Base class for user manager exception. N/A ErrorInvalidClientApprovalAuthorization N/A Error N/A N/A Used when an invalid ClientApprovalAuthorization is defined. N/A ErrorInvalidApprovers N/A Error N/A N/A Raised when approvers.yaml is invalid. N/A ErrorInvalidApprovalSpec N/A Error N/A N/A Raised when approval spec in approvers.yaml is invalid. N/A ClientApprovalAuthorization N/A N/A rdf_structs RDFProtoStruct N/A N/A Authorization to approve clients with a particular label. N/A protobuf N/A acls_pb2 ClientApprovalAuthorization label N/A N/A self N/A N/A N/A label N/A N/A self Get label N/A N/A label N/A N/A N/A ErrorInvalidClientApprovalAuthorization label string cannot be empty N/A label N/A property label N/A N/A self value N/A N/A N/A N/A N/A N/A isinstance value basestring N/A value N/A N/A N/A ErrorInvalidClientApprovalAuthorization label must be a non-empty string N/A N/A N/A self Set label value N/A N/A label setter users N/A N/A self N/A N/A N/A N/A N/A self Get users N/A property users N/A N/A self value N/A N/A N/A N/A N/A isinstance value list N/A N/A N/A ErrorInvalidClientApprovalAuthorization users must be a list N/A N/A N/A self Set users value N/A N/A users setter groups N/A N/A self N/A N/A N/A N/A N/A self Get groups N/A property groups N/A N/A self value N/A N/A N/A N/A N/A isinstance value list N/A N/A N/A ErrorInvalidClientApprovalAuthorization groups must be a list N/A N/A N/A self Set groups value N/A N/A groups setter key N/A N/A self N/A N/A N/A N/A N/A self Get label N/A property N/A ClientApprovalAuthorizationManager N/A N/A auth_manager AuthorizationManager N/A N/A Manage client label approvers from approvers.yaml. Initialize N/A N/A self N/A N/A N/A N/A N/A self LoadApprovals N/A IsActive N/A N/A self N/A N/A N/A Does this manager have any rules loaded? N/A N/A bool N/A N/A self reader auth_objects N/A LoadApprovals N/A N/A self yaml_data N/A None N/A N/A N/A self reader N/A N/A auth_manager AuthorizationReader N/A yaml_data N/A N/A N/A N/A N/A self reader CreateAuthorizations yaml_data ClientApprovalAuthorization N/A N/A N/A open N/A N/A config_lib CONFIG N/A ACL.approvers_config_file mode rb fh N/A N/A N/A N/A N/A self reader CreateAuthorizations N/A N/A fh read ClientApprovalAuthorization N/A approval_spec N/A N/A N/A self reader GetAllAuthorizationObjects N/A N/A group N/A approval_spec groups N/A N/A N/A N/A self AuthorizeGroup group N/A approval_spec label N/A user N/A approval_spec users N/A N/A N/A N/A self AuthorizeUser user N/A approval_spec label N/A CheckApproversForLabel N/A N/A self token client_urn requester approvers label N/A N/A N/A Checks if requester and approvers have approval privileges for labels.

    Checks against list of approvers for each label defined in approvers.yaml to
    determine if the list of approvers is sufficient.

    Args:
      token: user token
      client_urn: ClientURN object of the client
      requester: username string of person requesting approval.
      approvers: list of username strings that have approved this client.
      label: label strings to check approval privs for.
    Returns:
      True if access is allowed, raises otherwise.
     N/A auth N/A N/A N/A self reader GetAuthorizationForSubject label N/A N/A auth N/A N/A True N/A N/A auth requester_must_be_authorized N/A N/A N/A N/A N/A self CheckPermissions requester label N/A N/A N/A N/A access_control UnauthorizedAccess N/A User %s not in %s or groups:%s for %s N/A requester N/A auth users N/A auth groups label subject client_urn requested_access N/A token requested_access N/A approved_count 0 N/A approver approvers N/A N/A N/A N/A N/A self CheckPermissions approver label N/A approver requester N/A N/A approved_count 1 N/A N/A approved_count N/A auth num_approvers_required N/A N/A N/A N/A access_control UnauthorizedAccess N/A Found %s approvers for %s, needed %s N/A approved_count label N/A auth num_approvers_required subject client_urn requested_access N/A token requested_access N/A True N/A N/A N/A CLIENT_APPROVAL_AUTH_MGR None ClientApprovalAuthorizationInit N/A N/A registry InitHook N/A RunOnce N/A N/A self N/A N/A N/A CLIENT_APPROVAL_AUTH_MGR N/A CLIENT_APPROVAL_AUTH_MGR N/A ClientApprovalAuthorizationManager N/A N/A