{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/84273274","pull_request_review_id":5060261,"id":84273274,"diff_hunk":"@@ -287,20 +303,47 @@ func (c *podSecurityPolicyPlugin) createProvidersFromPolicies(psps []*extensions\n \n // getMatchingPolicies returns policies from the store.  For now this returns everything\n // in the future it can filter based on UserInfo and permissions.\n-func getMatchingPolicies(store cache.Store, user user.Info, sa user.Info) ([]*extensions.PodSecurityPolicy, error) {\n+func getMatchingPolicies(store cache.Store, user user.Info, sa user.Info, authz authorizer.Authorizer) ([]*extensions.PodSecurityPolicy, error) {\n \tmatchedPolicies := make([]*extensions.PodSecurityPolicy, 0)\n \n \tfor _, c := range store.List() {\n \t\tconstraint, ok := c.(*extensions.PodSecurityPolicy)\n \t\tif !ok {\n \t\t\treturn nil, errors.NewInternalError(fmt.Errorf(\"error converting object from store to a pod security policy: %v\", c))\n \t\t}\n-\t\tmatchedPolicies = append(matchedPolicies, constraint)\n+\n+\t\tif authorizedForPolicy(user, constraint, authz) || authorizedForPolicy(sa, constraint, authz) {\n+\t\t\tmatchedPolicies = append(matchedPolicies, constraint)\n+\t\t}\n \t}\n \n \treturn matchedPolicies, nil\n }\n \n+// authorizedForPolicy returns true if info is authorized to perform a \"get\" on policy.\n+func authorizedForPolicy(info user.Info, policy *extensions.PodSecurityPolicy, authz authorizer.Authorizer) bool {\n+\tif info == nil {","path":"plugin/pkg/admission/security/podsecuritypolicy/admission.go","position":94,"original_position":94,"commit_id":"8992e272522824f66ebbb9beea3325d1fe104d40","original_commit_id":"8992e272522824f66ebbb9beea3325d1fe104d40","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"body":"I would expect it to return unauthorized if the PSP plugin was enabled.  Other opinions?","created_at":"2016-10-20T12:43:56Z","updated_at":"2016-10-20T12:43:56Z","html_url":"https://github.com/kubernetes/kubernetes/pull/33080#discussion_r84273274","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/84273274"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/33080#discussion_r84273274"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080","id":85953695,"html_url":"https://github.com/kubernetes/kubernetes/pull/33080","diff_url":"https://github.com/kubernetes/kubernetes/pull/33080.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/33080.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/33080","number":33080,"state":"open","locked":false,"title":"Add authz to psp admission","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"body":"Builds on https://github.com/kubernetes/kubernetes/pull/32555.  Second commit adds authz check to matching policy function in psp admission.\r\n\r\n@deads2k @sttts @timstclair\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/33080)\n<!-- Reviewable:end -->\n","created_at":"2016-09-20T11:02:19Z","updated_at":"2016-10-20T12:43:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5a69fdab639ab478d5cb961740bc28116a7d3484","assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"assignees":[{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/33080/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/8992e272522824f66ebbb9beea3325d1fe104d40","head":{"label":"pweil-:psp-authorizer","ref":"psp-authorizer","sha":"8992e272522824f66ebbb9beea3325d1fe104d40","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"repo":{"id":24119325,"name":"kubernetes","full_name":"pweil-/kubernetes","owner":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pweil-/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/pweil-/kubernetes","forks_url":"https://api.github.com/repos/pweil-/kubernetes/forks","keys_url":"https://api.github.com/repos/pweil-/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pweil-/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pweil-/kubernetes/teams","hooks_url":"https://api.github.com/repos/pweil-/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/pweil-/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/pweil-/kubernetes/events","assignees_url":"https://api.github.com/repos/pweil-/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/pweil-/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/pweil-/kubernetes/tags","blobs_url":"https://api.github.com/repos/pweil-/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pweil-/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pweil-/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/pweil-/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pweil-/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/pweil-/kubernetes/languages","stargazers_url":"https://api.github.com/repos/pweil-/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/pweil-/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/pweil-/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/pweil-/kubernetes/subscription","commits_url":"https://api.github.com/repos/pweil-/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/pweil-/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/pweil-/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/pweil-/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/pweil-/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/pweil-/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pweil-/kubernetes/merges","archive_url":"https://api.github.com/repos/pweil-/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pweil-/kubernetes/downloads","issues_url":"https://api.github.com/repos/pweil-/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/pweil-/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/pweil-/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/pweil-/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pweil-/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/pweil-/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/pweil-/kubernetes/deployments","created_at":"2014-09-16T21:53:37Z","updated_at":"2016-02-05T20:21:53Z","pushed_at":"2016-10-17T19:12:21Z","git_url":"git://github.com/pweil-/kubernetes.git","ssh_url":"git@github.com:pweil-/kubernetes.git","clone_url":"https://github.com/pweil-/kubernetes.git","svn_url":"https://github.com/pweil-/kubernetes","homepage":null,"size":331593,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"1448b87d16875c79e9dd3932caabc61c1cc4312c","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-10-20T12:15:42Z","pushed_at":"2016-10-20T12:29:42Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":598978,"stargazers_count":17754,"watchers_count":17754,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":5773,"mirror_url":null,"open_issues_count":4961,"forks":5773,"open_issues":4961,"watchers":17754,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/33080"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/33080"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/33080/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/33080/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/8992e272522824f66ebbb9beea3325d1fe104d40"}}}}
{"actor":{"display_login":"pweil-"}}