swarming: switch to a 'capability focused' ACL system

appengine/swarming/server/task_scheduler.py

 # Copyright 2014 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """High level tasks execution scheduling API.
 
 This is the interface closest to the HTTP handlers.
 """
 
 import datetime
@@ skipping 385 matching lines @@
 
   ident = request.authenticated
   dims = request.properties.dimensions
   assert 'id' in dims or 'pool' in dims, dims # see _validate_dimensions
   assert ident is not None # see task_request.init_new_request
 
   # Forbid targeting individual bots for non-admins, but allow using 'id' if
   # 'pool' is used as well (so whoever can posts tasks to 'pool', can target an
   # individual bot in that pool).
   if 'id' in dims and 'pool' not in dims:
-    if not acl.is_admin():
+    # Only super-users can create a task without 'id' nor 'pool'.
+    if not acl.can_edit_config():

[M-A Ruel, 2017/07/24 15:42:51]

This one is a bit awkward, not sure how to change.

[Vadim Sh., 2017/07/24 19:16:47]

Let's remove this clause. I think we have never used this feature and it was
pointed at as a potential security concern during the review.

So it should be:

if 'id' in dims and 'pool' not in dims:
  raise auth.AuthorizationError(
      'Posting a task with "id" dimension require specifying "pool" dimension')

Strictly speaking we can also try to lookup the dimensions of the bot and check
that the caller is allowed to use at least one pool dimensions specified there.
But it is more code.

[M-A Ruel, 2017/07/25 13:46:38]

All removed.

       raise auth.AuthorizationError(
           'Only Swarming administrators can post tasks with "id" dimension '
           'without specifying a "pool" dimension.')
 
   for k, v in sorted(dims.iteritems()):
     if not _can_use_dimension(dim_acls, ident, k, v):
       raise auth.AuthorizationError(
           'User %s is not allowed to schedule tasks with dimension "%s:%s"' %
           (ident.to_bytes(), k, v))
 
@@ skipping 568 matching lines @@
 ## Task queue tasks.
 
 
 def task_handle_pubsub_task(payload):
   """Handles task enqueued by _maybe_pubsub_notify_via_tq."""
   # Do not catch errors to trigger task queue task retry. Errors should not
   # happen in normal case.
   _pubsub_notify(
       payload['task_id'], payload['topic'],
       payload['auth_token'], payload['userdata'])