Index: third_party/gsutil/gslib/addlhelp/acls.py |
diff --git a/third_party/gsutil/gslib/addlhelp/acls.py b/third_party/gsutil/gslib/addlhelp/acls.py |
deleted file mode 100644 |
index 64788e72ba49bcd4d989a42a499efbb13a52e541..0000000000000000000000000000000000000000 |
--- a/third_party/gsutil/gslib/addlhelp/acls.py |
+++ /dev/null |
@@ -1,234 +0,0 @@ |
-# Copyright 2012 Google Inc. All Rights Reserved. |
-# |
-# Licensed under the Apache License, Version 2.0 (the "License"); |
-# you may not use this file except in compliance with the License. |
-# You may obtain a copy of the License at |
-# |
-# http://www.apache.org/licenses/LICENSE-2.0 |
-# |
-# Unless required by applicable law or agreed to in writing, software |
-# distributed under the License is distributed on an "AS IS" BASIS, |
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
-# See the License for the specific language governing permissions and |
-# limitations under the License. |
- |
-from gslib.help_provider import HELP_NAME |
-from gslib.help_provider import HELP_NAME_ALIASES |
-from gslib.help_provider import HELP_ONE_LINE_SUMMARY |
-from gslib.help_provider import HelpProvider |
-from gslib.help_provider import HELP_TEXT |
-from gslib.help_provider import HelpType |
-from gslib.help_provider import HELP_TYPE |
- |
-_detailed_help_text = (""" |
-<B>OVERVIEW</B> |
- Access Control Lists (ACLs) allow you to control who can read and write |
- your data, and who can read and write the ACLs themselves. |
- |
- If not specified at the time an object is uploaded (e.g., via the gsutil cp |
- -a option), objects will be created with a default object ACL set on the |
- bucket (see "gsutil help setdefacl"). You can replace the ACL on an object |
- or bucket using the gsutil setacl command (see "gsutil help setacl"), or |
- modify the existing ACL using the gsutil chacl command (see "gsutil help |
- chacl"). |
- |
- |
-<B>BUCKET VS OBJECT ACLS</B> |
- In Google Cloud Storage, the bucket ACL works as follows: |
- |
- - Users granted READ access are allowed to list the bucket contents. |
- |
- - Users granted WRITE access are allowed READ access and also are |
- allowed to write and delete objects in that bucket -- including |
- overwriting previously written objects. |
- |
- - Users granted FULL_CONTROL access are allowed WRITE access and also |
- are allowed to read and write the bucket's ACL. |
- |
- The object ACL works as follows: |
- |
- - Users granted READ access are allowed to read the object's data and |
- metadata. |
- |
- - Users granted FULL_CONTROL access are allowed READ access and also |
- are allowed to read and write the object's ACL. |
- |
- A couple of points are worth noting, that sometimes surprise users: |
- |
- 1. There is no WRITE access for objects; attempting to set an ACL with WRITE |
- permission for an object will result in an error. |
- |
- 2. The bucket ACL plays no role in determining who can read objects; only the |
- object ACL matters for that purpose. This is different from how things |
- work in Linux file systems, where both the file and directory permission |
- control file read access. It also means, for example, that someone with |
- FULL_CONTROL over the bucket may not have read access to objects in |
- the bucket. This is by design, and supports useful cases. For example, |
- you might want to set up bucket ownership so that a small group of |
- administrators have FULL_CONTROL on the bucket (with the ability to |
- delete data to control storage costs), but not grant those users read |
- access to the object data (which might be sensitive data that should |
- only be accessed by a different specific group of users). |
- |
- |
-<B>CANNED ACLS</B> |
- The simplest way to set an ACL on a bucket or object is using a "canned |
- ACL". The available canned ACLs are: |
- |
- project-private Gives permission to the project team based on their |
- roles. Anyone who is part of the team has READ |
- permission, and project owners and project editors |
- have FULL_CONTROL permission. This is the default |
- ACL for newly created buckets. This is also the |
- default ACL for newly created objects unless the |
- default object ACL for that bucket has been |
- changed. For more details see |
- "gsutil help projects". |
- |
- private Gives the requester (and only the requester) |
- FULL_CONTROL permission for a bucket or object. |
- |
- public-read Gives the requester FULL_CONTROL permission and |
- gives all users READ permission. When you apply |
- this to an object, anyone on the Internet can |
- read the object without authenticating. |
- |
- public-read-write Gives the requester FULL_CONTROL permission and |
- gives all users READ and WRITE permission. This |
- ACL applies only to buckets. |
- |
- authenticated-read Gives the requester FULL_CONTROL permission and |
- gives all authenticated Google account holders |
- READ permission. |
- |
- bucket-owner-read Gives the requester FULL_CONTROL permission and |
- gives the bucket owner READ permission. This is |
- used only with objects. |
- |
- bucket-owner-full-control Gives the requester FULL_CONTROL permission and |
- gives the bucket owner FULL_CONTROL |
- permission. This is used only with objects. |
- |
- |
-<B>ACL XML</B> |
- When you use a canned ACL, it is translated into an XML representation |
- that can later be retrieved and edited to specify more fine-grained |
- detail about who can read and write buckets and objects. By running |
- the gsutil getacl command you can retrieve the ACL XML, and edit it to |
- customize the permissions. |
- |
- As an example, if you create an object in a bucket that has no default |
- object ACL set and then retrieve the ACL on the object, it will look |
- something like this: |
- |
- <AccessControlList> |
- <Owner> |
- <ID> |
- 00b4903a9740e42c29800f53bd5a9a62a2f96eb3f64a4313a115df3f3a776bf7 |
- </ID> |
- </Owner> |
- <Entries> |
- <Entry> |
- <Scope type="GroupById"> |
- <ID> |
- 00b4903a9740e42c29800f53bd5a9a62a2f96eb3f64a4313a115df3f3a776bf7 |
- </ID> |
- </Scope> |
- <Permission> |
- FULL_CONTROL |
- </Permission> |
- </Entry> |
- <Entry> |
- <Scope type="GroupById"> |
- <ID> |
- 00b4903a977fd817e9da167bc81306489181a110456bb635f466d71cf90a0d51 |
- </ID> |
- </Scope> |
- <Permission> |
- FULL_CONTROL |
- </Permission> |
- </Entry> |
- <Entry> |
- <Scope type="GroupById"> |
- <ID> |
- 00b4903a974898cc8fc309f2f2835308ba3d3df1b889d3fc7e33e187d52d8e71 |
- </ID> |
- </Scope> |
- <Permission> |
- READ |
- </Permission> |
- </Entry> |
- </Entries> |
- </AccessControlList> |
- |
- The ACL consists of an Owner element and a collection of Entry elements, |
- each of which specifies a Scope and a Permission. Scopes are the way you |
- specify an individual or group of individuals, and Permissions specify what |
- access they're permitted. |
- |
- This particular ACL grants FULL_CONTROL to two groups (which means members |
- of those groups are allowed to read the object and read and write the ACL), |
- and READ permission to a third group. The project groups are (in order) |
- the owners group, editors group, and viewers group. |
- |
- The 64 digit hex identifiers used in this ACL are called canonical IDs, |
- and are used to identify predefined groups associated with the project that |
- owns the bucket. For more information about project groups, see "gsutil |
- help projects". |
- |
- Here's an example of an ACL specified using the GroupByEmail and GroupByDomain |
- scopes: |
- |
- <AccessControlList> |
- <Entries> |
- <Entry> |
- <Permission> |
- FULL_CONTROL |
- </Permission> |
- <Scope type="GroupByEmail"> |
- <EmailAddress>travel-companion-owners@googlegroups.com</EmailAddress> |
- </Scope> |
- </Entry> |
- <Entry> |
- <Permission> |
- READ |
- </Permission> |
- <Scope type="GroupByDomain"> |
- <Domain>example.com</Domain> |
- </Scope> |
- </Entry> |
- </Entries> |
- </AccessControlList> |
- |
- This ACL grants members of an email group FULL_CONTROL, and grants READ |
- access to any user in a domain (which must be a Google Apps for Business |
- domain). By applying email group grants to a collection of objects |
- you can edit access control for large numbers of objects at once via |
- http://groups.google.com. That way, for example, you can easily and quickly |
- change access to a group of company objects when employees join and leave |
- your company (i.e., without having to individually change ACLs across |
- potentially millions of objects). |
- |
- |
-<B>SHARING SCENARIOS</B> |
- For more detailed examples how to achieve various useful sharing use |
- cases see https://developers.google.com/storage/docs/collaboration |
-""") |
- |
- |
-class CommandOptions(HelpProvider): |
- """Additional help about Access Control Lists.""" |
- |
- help_spec = { |
- # Name of command or auxiliary help info for which this help applies. |
- HELP_NAME : 'acls', |
- # List of help name aliases. |
- HELP_NAME_ALIASES : ['acl', 'ACL', 'access control', 'access control list', |
- 'authorization', 'canned', 'canned acl'], |
- # Type of help: |
- HELP_TYPE : HelpType.ADDITIONAL_HELP, |
- # One line summary of this help. |
- HELP_ONE_LINE_SUMMARY : 'Working with Access Control Lists', |
- # The full help text. |
- HELP_TEXT : _detailed_help_text, |
- } |