koji

#3925 Tag --perm vs hub policies
Closed: Fixed by tkopecek. Opened by alexi.

Closed: Fixed
Reopen Issue

I'm trying to understand how to lock down all operations within a tag to users with a specific permission. I want to make sure that only users with that permission can add/remove packages, build or tag/untag/move packages in a given tag.

Reading the documentation, I though policies were the way to get this done. I have something like this now:

[policy]
tag =
  has_perm build-lxsoft-admins :: {
    tag mytag9al-* mytag9el-* :: allow
    operation untag && fromtag mytag9al-* mytag9el-* :: allow
  }
  all :: deny Access Denied
package_list =
  has_perm build-lxsoft-admins && tag mytag9al-* mytag9el-* :: allow
  all :: deny Access Denied
build_rpm =
  has_perm build-lxsoft-admins && tag mytag9al-* mytag9el-* :: allow
  all :: deny Access Denied

Is this actually the right way of doing this, or should I be simply doing a koji edit-tag --perm=build-lxsoft-admins mytag9al-* instead? What happens if a tag has a --perm and a policy?

There are more variants and those are checked in the following order:
1) Tag can be "un/locked" by admin koji edit-tag --lock <tag> - no un/tagging can happen at that time (except admin's --force variant)
2) Tag can request permission (edit-tag --perm=<perm>). Then every tag/untag operation requires user to have that permission. BUT other operations (e.g. package list) are not affected by this.
3) Policy - This can contain much more sophisticated rules. If both previous checks were ok, policy is evaluated. (default policies)

So, you first policy is pretty simple and readable. If there would be only a few tags falling under the glob, result will be same as with edit-tag --perm=<perm>. But both other policies are needed as these operations are not covered by --perm variant.
I would suggest to use policy in most cases as it is located at one place and much more transparent. But both approaches work and people are regularly using mix of that. E.g. explicitly requiring "admin" permission to override more benevolent policy.

Metadata Update from @tkopecek:
- Custom field Size adjusted to None

Thanks for the explanation. So if we only set --perm, a user without that permission would be able to add a package to someone else's tag and even build it, but the build wouldn't be added to the tag at the end, right?

If you block tagging access to the destination tag of a build target, then depending on the situation, the build task may fail immediately, or at the tagging step.

The build will not automatically skip the tagging step just because of these settings. It will only skip the tagging step if the user specifies --skip-tag.

If the process fails at the tagging step, then you will have a complete but untagged build that can later be tagged by a user with sufficient access. However, the task entry will show as failed.

So if we only set --perm, a user without that permission would be able to add a package to someone else's tag and even build it, but the build wouldn't be added to the tag at the end, right?

By default, package list management is restricted to admins. This access must be explicitly granted for non-admins.

Conversely, tagging is allowed by default as long as the build in question is on the package list. Restricting this requires using the methods Tomas lines out above.

Unless you are talking about the side-tag plugin, there is no such thing as tag ownership in Koji.

Metadata Update from @tkopecek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/3925

Please continue any further discussion there.
Metadata
None
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.