Hi,<br><br>When users list resources in their group, they can see all the existing objects, but only show (see the extended information) and use the public ones. You can customize this behaviour using groups [1] and ACL rules [2].<br>
<br>In the next version, resources will have two flags: public and shared, and it will be a bit more intuitive.<br>You can read more about this in the thread "[one-users] groups and images/templates" [4], or follow the development in its ticket [5]<br>
<br>Regards.<br><br>[1] <a href="http://opennebula.org/documentation:rel3.0:manage_users" target="_blank">http://opennebula.org/documentation:rel3.0:manage_users</a><br>[2] <a href="http://opennebula.org/documentation:rel3.0:manage_acl" target="_blank">opennebula.org/documentation:rel3.0:manage_acl</a><br>
[3] <a href="http://dev.opennebula.org/issues/862" target="_blank">http://dev.opennebula.org/issues/862</a><br>[4] <a href="http://www.mail-archive.com/users@lists.opennebula.org/msg04187.html">http://www.mail-archive.com/users@lists.opennebula.org/msg04187.html</a><br>
[5] <a href="http://dev.opennebula.org/issues/862">http://dev.opennebula.org/issues/862</a><br clear="all"><span style="border-collapse:collapse;color:rgb(136, 136, 136);font-family:arial,sans-serif;font-size:13px">--<br>
Carlos Martín, MSc<br>Project Engineer<br>OpenNebula - The Open Source Toolkit for Data Center Virtualization<br><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> | <a href="http://twitter.com/opennebula" target="_blank">@OpenNebula</a></span><span style="border-collapse:collapse;color:rgb(136, 136, 136);font-family:arial, sans-serif;font-size:13px"><a href="mailto:cmartin@opennebula.org" style="color:rgb(42, 93, 176)" target="_blank"></a></span><br>
<br><br><div class="gmail_quote">2011/11/8 Rolandas Naujikas <span dir="ltr"><<a href="mailto:rolandas.naujikas@mif.vu.lt" target="_blank">rolandas.naujikas@mif.vu.lt</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 2011-11-08 16:16, Carlos Martín Sánchez wrote:<br>
> Hi,<br>
><br>
> Users in the oneadmin group are authorized to perform any operation [1].<br>
<br>
</div>Thanks.<br>
<br>
ID USER GROUP NAME SIZE TYPE REGTIME PUB<br>
PER STAT RVMS<br>
0 oneadmin users 10G-qcow2 0M OS 11/08 09:43:31 Yes<br>
No rdy 0<br>
2 oneadmin users debian-6.0-a 1G OS 11/08 11:04:30 No<br>
No used 7<br>
<br>
When I (regular user from group "users") tried to use this image (ID=2)<br>
I got error (not authorized) - so it works.<br>
<br>
Problem is that regular user could see private (not public) images from<br>
other users.<br>
<br>
Regards, Rolandas<br>
<div><br>
> Regards.<br>
><br>
> [1]<br>
> <a href="http://opennebula.org/documentation:rel3.0:manage_acl#how_permission_is_granted_or_denied" target="_blank">http://opennebula.org/documentation:rel3.0:manage_acl#how_permission_is_granted_or_denied</a><br>
> --<br>
> Carlos Martín, MSc<br>
> Project Engineer<br>
> OpenNebula - The Open Source Toolkit for Data Center Virtualization<br>
> <a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> |<br>
</div>> @OpenNebula<<a href="http://twitter.com/opennebula" target="_blank">http://twitter.com/opennebula</a>><<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a>><br>
<div><div>><br>
><br>
> On Tue, Nov 8, 2011 at 2:25 PM, Rolandas Naujikas <<br>
> <a href="mailto:rolandas.naujikas@mif.vu.lt" target="_blank">rolandas.naujikas@mif.vu.lt</a>> wrote:<br>
><br>
>> Hi,<br>
>><br>
>> Why an user could access private objects from other users in the same<br>
>> group ?<br>
>> OpenNebula 3.0 documentation says opposite.<br>
>> <a href="http://opennebula.org/documentation:rel3.0:manage_users" target="_blank">http://opennebula.org/documentation:rel3.0:manage_users</a><br>
>><br>
>> Regards, Rolandas<br>
>><br>
>> P.S. I have images created with oneadmin and one of them public<br>
>> (published) and others - no. With regular user (in the group oneadmin) I<br>
>> can access all user oneadmin images (and create VM from them).<br>
>> The same was with the group "users".<br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
>><br>
><br>
<br>
</div></div></blockquote></div><br>