SIGN IN SIGN UP

Enforce manager EthernetInterface privileges

EthernetInterface resources under a Manager use the base
EthernetInterface privileges, which require ConfigureComponents for
PATCH and DELETE.  The privilege registry defines a subordinate
override requiring ConfigureManager when an EthernetInterface is
subordinate to a Manager, but no route used it.  An Operator, who
holds ConfigureComponents, could therefore change and delete BMC
network addresses.  user-management.md states that an Operator is not
allowed to change network configuration.

The SubOverManager constants have been generated by parse_registries.py
since fff6a4d3, but were never referenced.  Point the following routes
at them:
  POST   /redfish/v1/Managers/<id>/EthernetInterfaces
  PATCH  /redfish/v1/Managers/<id>/EthernetInterfaces/<id>
  DELETE /redfish/v1/Managers/<id>/EthernetInterfaces/<id>

Compatibility: this is a visible change for Operator accounts, which
now receive 403 rather than performing the operation.  Administrator
accounts are unaffected.  The change is intentional and brings bmcweb
in line with the privilege registry and user-management.md.

Tested: Builds clean on master.  Behavior verified on a downstream tree
carrying this change, on a QEMU BMC with a local Operator account:
  POST   /redfish/v1/Managers/bmc/EthernetInterfaces      -> 403
  PATCH  /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 403
  DELETE /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 403
  GET    /redfish/v1/Managers/bmc/EthernetInterfaces/eth0 -> 200
As Administrator, PATCH returns 204 and GET returns 200, both unchanged
from before the patch.

Fixes: https://github.com/openbmc/bmcweb/issues/284

Change-Id: Ic703956a1c3ae9e469589a713e3b2b69c2cb3f23
Signed-off-by: Sathiyaseelan Lakshminarayanan <sathiyaseelan_l@jabil.com>
S
Sathiyaseelan Lakshminarayanan committed
a22a949514a82d954a575933d669bc7526f645c5
Parent: a47c650