Gitlab二开从而自定义权限系统
2023年8月13日...大约 5 分钟
Gitlab二开从而自定义权限系统
Gitlab所给的权限太少了,因为业务需要,二开gitlab,自定义权限系统。
下面给guest角色删除源码访问权限。并保留提出issue的权限。查看label的权限
前言
我们都知道gitlab社区版和商业版本的内核是相同的,所以说社区版本的功能是企业版本的全部。只是部分配置没有放到web界面,需要命令行去修改
修改
经过查询,gitlab的权限以文本文件的形式存储在目录中,下面是权限系统的配置文件。
root@83f572345d3c:/# cd /opt/gitlab/embedded/service/gitlab-rails/app/policies/
root@83f572345d3c:/opt/gitlab/embedded/service/gitlab-rails/app/policies# ll
total 344
drwxr-xr-x 1 root root 4096 Jul 12 08:05 ./
drwxr-xr-x 1 root root 4096 Apr 27 2021 ../
drwxr-xr-x 2 root root 4096 Apr 27 2021 alert_management/
drwxr-xr-x 3 root root 4096 Apr 27 2021 analytics/
drwxr-xr-x 2 root root 4096 Apr 27 2021 application_setting/
-rw-r--r-- 1 root root 170 Apr 27 2021 application_setting_policy.rb
-rw-r--r-- 1 root root 307 Apr 27 2021 award_emoji_policy.rb
-rw-r--r-- 1 root root 2245 Apr 27 2021 base_policy.rb
-rw-r--r-- 1 root root 148 Apr 27 2021 blob_policy.rb
-rw-r--r-- 1 root root 905 Apr 27 2021 board_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 ci/
drwxr-xr-x 2 root root 4096 Apr 27 2021 clusters/
-rw-r--r-- 1 root root 204 Apr 27 2021 commit_policy.rb
-rw-r--r-- 1 root root 234 Apr 27 2021 commit_status_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 concerns/
-rw-r--r-- 1 root root 118 Apr 27 2021 container_expiration_policy_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 container_registry/
-rw-r--r-- 1 root root 112 Apr 27 2021 container_repository_policy.rb
-rw-r--r-- 1 root root 102 Apr 27 2021 custom_emoji_policy.rb
-rw-r--r-- 1 root root 416 Apr 27 2021 deploy_key_policy.rb
-rw-r--r-- 1 root root 304 Apr 27 2021 deploy_keys_project_policy.rb
-rw-r--r-- 1 root root 320 Apr 27 2021 deploy_token_policy.rb
-rw-r--r-- 1 root root 573 Apr 27 2021 deployment_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 design_management/
-rw-r--r-- 1 root root 279 Apr 27 2021 draft_note_policy.rb
-rw-r--r-- 1 root root 653 Apr 27 2021 environment_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 error_tracking/
-rw-r--r-- 1 root root 228 Apr 27 2021 event_policy.rb
-rw-r--r-- 1 root root 106 Apr 27 2021 external_issue_policy.rb
-rw-r--r-- 1 root root 2940 Apr 27 2021 global_policy.rb
-rw-r--r-- 1 root root 111 Apr 27 2021 grafana_integration_policy.rb
-rw-r--r-- 1 root root 261 Apr 27 2021 group_deploy_key_policy.rb
-rw-r--r-- 1 root root 297 Apr 27 2021 group_deploy_keys_group_policy.rb
-rw-r--r-- 1 root root 101 Apr 27 2021 group_label_policy.rb
-rw-r--r-- 1 root root 822 Apr 27 2021 group_member_policy.rb
-rw-r--r-- 1 root root 7217 Apr 27 2021 group_policy.rb
-rw-r--r-- 1 root root 435 Apr 27 2021 identity_provider_policy.rb
-rw-r--r-- 1 root root 100 Apr 27 2021 instance_metadata_policy.rb
-rw-r--r-- 1 root root 863 Apr 27 2021 issuable_policy.rb
-rw-r--r-- 1 root root 1199 Apr 27 2021 issue_policy.rb
-rw-r--r-- 1 root root 890 Apr 27 2021 merge_request_policy.rb
drwxr-xr-x 3 root root 4096 Apr 27 2021 metrics/
-rw-r--r-- 1 root root 110 Apr 27 2021 milestone_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 namespace/
-rw-r--r-- 1 root root 825 Apr 27 2021 namespace_policy.rb
-rw-r--r-- 1 root root 95 Apr 27 2021 nil_policy.rb
-rw-r--r-- 1 root root 2736 Apr 27 2021 note_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 operations/
drwxr-xr-x 3 root root 4096 Apr 27 2021 packages/
-rw-r--r-- 1 root root 248 Apr 27 2021 personal_access_token_policy.rb
-rw-r--r-- 1 root root 846 Apr 27 2021 personal_snippet_policy.rb
-rw-r--r-- 1 root root 111 Apr 27 2021 project_ci_cd_setting_policy.rb
-rw-r--r-- 1 root root 105 Apr 27 2021 project_label_policy.rb
-rw-r--r-- 1 root root 681 Apr 27 2021 project_member_policy.rb
-rw-r--r-- 1 root root 23137 Jul 12 08:05 project_policy.rb
-rw-r--r-- 1 root root 22271 Jan 20 2022 project_policy.rb.bak
-rw-r--r-- 1 root root 1868 Apr 27 2021 project_snippet_policy.rb
-rw-r--r-- 1 root root 110 Apr 27 2021 project_statistics_policy.rb
-rw-r--r-- 1 root root 110 Apr 27 2021 prometheus_alert_policy.rb
-rw-r--r-- 1 root root 332 Apr 27 2021 protected_branch_policy.rb
-rw-r--r-- 1 root root 100 Apr 27 2021 release_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 releases/
-rw-r--r-- 1 root root 103 Apr 27 2021 repository_policy.rb
-rw-r--r-- 1 root root 445 Apr 27 2021 resource_label_event_policy.rb
-rw-r--r-- 1 root root 89 Apr 27 2021 service_policy.rb
-rw-r--r-- 1 root root 302 Apr 27 2021 suggestion_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 terraform/
-rw-r--r-- 1 root root 240 Apr 27 2021 timebox_policy.rb
-rw-r--r-- 1 root root 256 Apr 27 2021 todo_policy.rb
-rw-r--r-- 1 root root 1294 Apr 27 2021 user_policy.rb
drwxr-xr-x 2 root root 4096 Apr 27 2021 wiki_page/
-rw-r--r-- 1 root root 160 Apr 27 2021 wiki_page_policy.rb
-rw-r--r-- 1 root root 178 Apr 27 2021 wiki_policy.rb
编辑 project_policy.rb
204 rule { can?(:guest_access) }.policy do
205 enable :read_project
206 enable :create_merge_request_in
207 enable :read_issue_board
208 enable :read_issue_board_list
209 enable :read_wiki
210 enable :read_issue
211 enable :read_label
212 enable :read_milestone
213 enable :read_snippet
214 enable :read_project_member
215 enable :read_note
216 enable :create_project
217 enable :create_issue
218 enable :create_note
219 enable :upload_file
220 enable :read_cycle_analytics
221 enable :award_emoji
222 enable :read_pages_content
223 enable :read_release
224 enable :read_analytics
225 enable :read_insights
226 # new add 2023/07/12: for guest users enable label_create
227 enable :admin_label
228 enable :admin_issue
229 enable :admin_issue_board
230 end
重启服务器
若为rpm安装包安装,运行以下命令
gitlab-ctl reconfigure
若为docker运行,运行以下命令
gitlab-ctl reconfigure
gitlab-ctl restart
权限例子
enable :guest_access
enable :reporter_access
enable :developer_access
enable :maintainer_access
enable :change_namespace
enable :change_visibility_level
enable :rename_project
enable :remove_project
enable :archive_project
enable :remove_fork_project
enable :destroy_merge_request
enable :destroy_issue
enable :set_issue_iid
enable :set_issue_created_at
enable :set_issue_updated_at
enable :set_note_created_at
enable :set_emails_disabled
enable :set_show_default_award_emojis
enable :read_project
enable :create_merge_request_in
enable :read_issue_board
enable :read_issue_board_list
enable :read_wiki
enable :read_issue
enable :read_label
enable :read_milestone
enable :read_snippet
enable :read_project_member
enable :read_note
enable :create_project
enable :create_issue
enable :create_note
enable :upload_file
enable :read_cycle_analytics
enable :award_emoji
enable :read_pages_content
enable :read_release
enable :read_analytics
enable :read_insights
enable :read_board
enable :read_list
enable :read_pipeline
enable :admin_label
enable :admin_issue
enable :public_user_access
enable :read_project_for_iids
enable :public_access
enable :build_download_code
enable :build_read_container_image
enable :request_access
enable :fork_project
enable :read_prometheus
enable :read_deployment
enable :create_metrics_user_starred_dashboard
enable :read_metrics_user_starred_dashboard
enable :create_package
enable :admin_issue_board
enable :admin_merge_request
enable :admin_milestone
enable :update_merge_request
enable :reopen_merge_request
enable :create_commit_status
enable :update_commit_status
enable :create_build
enable :update_build
enable :create_merge_request_from
enable :create_wiki
enable :push_code
enable :resolve_note
enable :create_container_image
enable :update_container_image
enable :destroy_container_image
enable :create_environment
enable :update_environment
enable :destroy_environment
enable :create_deployment
enable :update_deployment
enable :create_release
enable :update_release
enable :daily_statistics
enable :create_metrics_dashboard_annotation
enable :delete_metrics_dashboard_annotation
enable :update_metrics_dashboard_annotation
enable :read_alert_management_alert
enable :update_alert_management_alert
enable :create_design
enable :move_design
enable :destroy_design
enable :read_terraform_state
enable :read_pod_logs
enable :read_feature_flag
enable :create_feature_flag
enable :update_feature_flag
enable :destroy_feature_flag
enable :admin_feature_flag
enable :admin_feature_flags_user_lists
enable :create_pipeline
enable :update_pipeline
enable :create_pipeline_schedule
enable :destroy_package
enable :push_to_delete_protected_branch
enable :update_snippet
enable :admin_snippet
enable :admin_project_member
enable :admin_note
enable :admin_wiki
enable :admin_project
enable :admin_commit_status
enable :admin_build
enable :admin_container_image
enable :admin_pipeline
enable :admin_environment
enable :admin_deployment
enable :admin_pages
enable :read_pages
enable :update_pages
enable :remove_pages
enable :read_cluster
enable :add_cluster
enable :create_cluster
enable :update_cluster
enable :admin_cluster
enable :create_environment_terminal
enable :destroy_release
enable :destroy_artifacts
enable :admin_operations
enable :read_deploy_token
enable :create_deploy_token
enable :destroy_deploy_token
enable :read_prometheus_alerts
enable :admin_terraform_state
enable :create_freeze_period
enable :read_freeze_period
enable :update_freeze_period
enable :destroy_freeze_period
enable :admin_feature_flags_client
enable :metrics_dashboard
enable :read_package
enable :read_merge_request
enable :read_pipeline_schedule
enable :read_environment
enable :read_commit_status
enable :read_container_image
enable :download_code
enable :download_wiki_code
enable :read_build
enable :read_design
enable :read_design_activity
enable :read_issue_link
enable :read_security_configuration
enable :read_repository_graphs
enable :read_build_report_results
enable :admin_resource_access_tokens
enable :set_pipeline_variables
enable :access_security_and_compliance
你认为这篇文章怎么样?
- 0
- 0
- 0
- 0
- 0
- 0
Powered by Waline v3.3.2