allow rodsuser to run a rule string
d-w-moore opened this issue · 1 comments
The command:
irule -r irods_rule_engine_plugin-python-instance python_rule null null
should succeed if executed by a rodsuser.
In this context, the command line argument python_rule should be taken as the identifier of a python function (a rule) defined in the global namespace of /etc/irods/core.py.
Currently this command only succeeds for a rodsadmin. A rodsuser gets the errorSYS_NO_API_PRIV.
The following code is the reason why only rodsadmin users can use irule to invoke rules in core.py.
irods_rule_engine_plugin_python/irods_rule_engine_plugin-python.cxx
Lines 623 to 626 in 0a07fb9
If Boost.Python gives us a way to fetch all rules/functions inside of core.py, then we can use that to determine whether the rule text sent by the client should be executed.