X-Git-Url: http://xvm.mit.edu/gitweb/invirt/packages/invirt-web.git/blobdiff_plain/d8afec36ce7222a5e60af0d6e9e57e3a22306214..08d8cfbd95b86fbdbd05f228b1541daa12f03332:/code/getafsgroups.py?ds=inline diff --git a/code/getafsgroups.py b/code/getafsgroups.py index e2fece0..13f8cf7 100644 --- a/code/getafsgroups.py +++ b/code/getafsgroups.py @@ -28,10 +28,11 @@ class AfsProcessError(Exception): pass def getAfsGroupMembers(group, cell): - p = subprocess.Popen(["pts", "membership", group, '-c', cell], + p = subprocess.Popen(["pts", "membership", "-noauth", group, '-c', cell], stdout=subprocess.PIPE, stderr=subprocess.PIPE) - if p.wait(): - return [] + err = p.stderr.read() + if err: #Error code doesn't reveal missing groups, but stderr does + raise AfsProcessError(err) return [line.strip() for line in p.stdout.readlines()[1:]] def getLockerPath(locker): @@ -39,12 +40,6 @@ def getLockerPath(locker): raise AfsProcessError("Locker '%s' is invalid." % locker) return '/mit/' + locker -def checkAfsGroup(user, group, cell): - """ - checkAfsGroup(user, group) returns True if and only if user is in AFS group group in cell cell - """ - return user in getAfsGroupMembers(group, cell) - def getCell(locker): p = subprocess.Popen(["fs", "whichcell", getLockerPath(locker)], stdout=subprocess.PIPE, stderr=subprocess.PIPE) @@ -81,18 +76,18 @@ def notLockerOwner(user, locker): return str(e) for entry in values: - if entry == user or (entry[0:6] == "system" and - checkAfsGroup(user, entry, cell)): + if entry == user or (entry[0:6] == "system" and + user in getAfsGroupMembers(entry, cell)): return False return "You don't have admin bits on " + getLockerPath(locker) if __name__ == "__main__": # print list(getldapgroups("tabbott")) - print checkAfsGroup("tabbott", "system:debathena", 'athena.mit.edu') - print checkAfsGroup("tabbott", "system:debathena", 'sipb.mit.edu') - print checkAfsGroup("tabbott", "system:debathena-root", 'athena.mit.edu') - print checkAfsGroup("tabbott", "system:hmmt-request", 'athena.mit.edu') + print "tabbott" in getAfsGroupMembers("system:debathena", 'athena.mit.edu') + print "tabbott" in getAfsGroupMembers("system:debathena", 'sipb.mit.edu') + print "tabbott" in getAfsGroupMembers("system:debathena-root", 'athena.mit.edu') + print "tabbott" in getAfsGroupMembers("system:hmmt-request", 'athena.mit.edu') print notLockerOwner("tabbott", "tabbott") print notLockerOwner("tabbott", "debathena") print notLockerOwner("tabbott", "sipb")