Examples with PermissionDeniedException com.cloud.exception.PermissionDeniedException used on opensource projects

Example 76 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class ManagementServerImpl method listStoragePoolsForMigrationOfVolume.

@Override
public Pair<List<? extends StoragePool>, List<? extends StoragePool>> listStoragePoolsForMigrationOfVolume(final Long volumeId) {
    final Account caller = getCaller();
    if (!_accountMgr.isRootAdmin(caller.getId())) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Caller is not a root admin, permission denied to migrate the volume");
        }
        throw new PermissionDeniedException("No permission to migrate volume, only root admin can migrate a volume");
    }
    final VolumeVO volume = _volumeDao.findById(volumeId);
    if (volume == null) {
        final InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find volume with" + " specified id.");
        ex.addProxyObject(volumeId.toString(), "volumeId");
        throw ex;
    }
    // Volume must be attached to an instance for live migration.
    final List<StoragePool> allPools = new ArrayList<StoragePool>();
    final List<StoragePool> suitablePools = new ArrayList<StoragePool>();
    // Volume must be in Ready state to be migrated.
    if (!Volume.State.Ready.equals(volume.getState())) {
        s_logger.info("Volume " + volume + " must be in ready state for migration.");
        return new Pair<List<? extends StoragePool>, List<? extends StoragePool>>(allPools, suitablePools);
    }
    if (!_volumeMgr.volumeOnSharedStoragePool(volume)) {
        s_logger.info("Volume " + volume + " is on local storage. It cannot be migrated to another pool.");
        return new Pair<List<? extends StoragePool>, List<? extends StoragePool>>(allPools, suitablePools);
    }
    final Long instanceId = volume.getInstanceId();
    VMInstanceVO vm = null;
    if (instanceId != null) {
        vm = _vmInstanceDao.findById(instanceId);
    }
    if (vm == null) {
        s_logger.info("Volume " + volume + " isn't attached to any vm. Looking for storage pools in the " + "zone to which this volumes can be migrated.");
    } else if (vm.getState() != State.Running) {
        s_logger.info("Volume " + volume + " isn't attached to any running vm. Looking for storage pools in the " + "cluster to which this volumes can be migrated.");
    } else {
        s_logger.info("Volume " + volume + " is attached to any running vm. Looking for storage pools in the " + "cluster to which this volumes can be migrated.");
        boolean storageMotionSupported = false;
        // Check if the underlying hypervisor supports storage motion.
        final Long hostId = vm.getHostId();
        if (hostId != null) {
            final HostVO host = _hostDao.findById(hostId);
            HypervisorCapabilitiesVO capabilities = null;
            if (host != null) {
                capabilities = _hypervisorCapabilitiesDao.findByHypervisorTypeAndVersion(host.getHypervisorType(), host.getHypervisorVersion());
            } else {
                s_logger.error("Details of the host on which the vm " + vm + ", to which volume " + volume + " is " + "attached, couldn't be retrieved.");
            }
            if (capabilities != null) {
                storageMotionSupported = capabilities.isStorageMotionSupported();
            } else {
                s_logger.error("Capabilities for host " + host + " couldn't be retrieved.");
            }
        }
        if (!storageMotionSupported) {
            s_logger.info("Volume " + volume + " is attached to a running vm and the hypervisor doesn't support" + " storage motion.");
            return new Pair<List<? extends StoragePool>, List<? extends StoragePool>>(allPools, suitablePools);
        }
    }
    // Source pool of the volume.
    final StoragePoolVO srcVolumePool = _poolDao.findById(volume.getPoolId());
    // Get all the pools available. Only shared pools are considered because only a volume on a shared pools
    // can be live migrated while the virtual machine stays on the same host.
    List<StoragePoolVO> storagePools = null;
    if (srcVolumePool.getClusterId() == null) {
        storagePools = _poolDao.findZoneWideStoragePoolsByTags(volume.getDataCenterId(), null);
    } else {
        storagePools = _poolDao.findPoolsByTags(volume.getDataCenterId(), srcVolumePool.getPodId(), srcVolumePool.getClusterId(), null);
    }
    storagePools.remove(srcVolumePool);
    for (final StoragePoolVO pool : storagePools) {
        if (pool.isShared()) {
            allPools.add((StoragePool) dataStoreMgr.getPrimaryDataStore(pool.getId()));
        }
    }
    // Get all the suitable pools.
    // Exclude the current pool from the list of pools to which the volume can be migrated.
    final ExcludeList avoid = new ExcludeList();
    avoid.addPool(srcVolumePool.getId());
    // Volume stays in the same cluster after migration.
    final DataCenterDeployment plan = new DataCenterDeployment(volume.getDataCenterId(), srcVolumePool.getPodId(), srcVolumePool.getClusterId(), null, null, null);
    final VirtualMachineProfile profile = new VirtualMachineProfileImpl(vm);
    final DiskOfferingVO diskOffering = _diskOfferingDao.findById(volume.getDiskOfferingId());
    final DiskProfile diskProfile = new DiskProfile(volume, diskOffering, profile.getHypervisorType());
    // Call the storage pool allocator to find the list of storage pools.
    for (final StoragePoolAllocator allocator : _storagePoolAllocators) {
        final List<StoragePool> pools = allocator.allocateToPool(diskProfile, profile, plan, avoid, StoragePoolAllocator.RETURN_UPTO_ALL);
        if (pools != null && !pools.isEmpty()) {
            suitablePools.addAll(pools);
            break;
        }
    }
    return new Pair<List<? extends StoragePool>, List<? extends StoragePool>>(allPools, suitablePools);
}

Example 77 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class ManagementServerImpl method listHostsForMigrationOfVM.

@Override
public Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> listHostsForMigrationOfVM(final Long vmId, final Long startIndex, final Long pageSize, final String keyword) {
    final Account caller = getCaller();
    if (!_accountMgr.isRootAdmin(caller.getId())) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Caller is not a root admin, permission denied to migrate the VM");
        }
        throw new PermissionDeniedException("No permission to migrate VM, Only Root Admin can migrate a VM!");
    }
    final VMInstanceVO vm = _vmInstanceDao.findById(vmId);
    if (vm == null) {
        final InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find the VM with given id");
        throw ex;
    }
    if (vm.getState() != State.Running) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("VM is not running, cannot migrate the vm" + vm);
        }
        final InvalidParameterValueException ex = new InvalidParameterValueException("VM is not Running, cannot " + "migrate the vm with specified id");
        ex.addProxyObject(vm.getUuid(), "vmId");
        throw ex;
    }
    if (_serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()) != null) {
        s_logger.info(" Live Migration of GPU enabled VM : " + vm.getInstanceName() + " is not supported");
        // Return empty list.
        return new Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>>(new Pair<List<? extends Host>, Integer>(new ArrayList<HostVO>(), new Integer(0)), new ArrayList<Host>(), new HashMap<Host, Boolean>());
    }
    if (!vm.getHypervisorType().equals(HypervisorType.XenServer) && !vm.getHypervisorType().equals(HypervisorType.VMware) && !vm.getHypervisorType().equals(HypervisorType.KVM) && !vm.getHypervisorType().equals(HypervisorType.Ovm) && !vm.getHypervisorType().equals(HypervisorType.Hyperv) && !vm.getHypervisorType().equals(HypervisorType.LXC) && !vm.getHypervisorType().equals(HypervisorType.Simulator) && !vm.getHypervisorType().equals(HypervisorType.Ovm3)) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug(vm + " is not XenServer/VMware/KVM/Ovm/Hyperv/Ovm3, cannot migrate this VM.");
        }
        throw new InvalidParameterValueException("Unsupported Hypervisor Type for VM migration, we support " + "XenServer/VMware/KVM/Ovm/Hyperv/Ovm3 only");
    }
    if (vm.getType().equals(VirtualMachine.Type.User) && vm.getHypervisorType().equals(HypervisorType.LXC)) {
        throw new InvalidParameterValueException("Unsupported Hypervisor Type for User VM migration, we support XenServer/VMware/KVM/Ovm/Hyperv/Ovm3 only");
    }
    final long srcHostId = vm.getHostId();
    final Host srcHost = _hostDao.findById(srcHostId);
    if (srcHost == null) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Unable to find the host with id: " + srcHostId + " of this VM:" + vm);
        }
        final InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find the host (with specified id) of VM with specified id");
        ex.addProxyObject(String.valueOf(srcHostId), "hostId");
        ex.addProxyObject(vm.getUuid(), "vmId");
        throw ex;
    }
    // Check if the vm can be migrated with storage.
    boolean canMigrateWithStorage = false;
    if (vm.getType() == VirtualMachine.Type.User) {
        final HypervisorCapabilitiesVO capabilities = _hypervisorCapabilitiesDao.findByHypervisorTypeAndVersion(srcHost.getHypervisorType(), srcHost.getHypervisorVersion());
        if (capabilities != null) {
            canMigrateWithStorage = capabilities.isStorageMotionSupported();
        }
    }
    // Check if the vm is using any disks on local storage.
    final VirtualMachineProfile vmProfile = new VirtualMachineProfileImpl(vm, null, _offeringDao.findById(vm.getId(), vm.getServiceOfferingId()), null, null);
    final List<VolumeVO> volumes = _volumeDao.findCreatedByInstance(vmProfile.getId());
    boolean usesLocal = false;
    for (final VolumeVO volume : volumes) {
        final DiskOfferingVO diskOffering = _diskOfferingDao.findById(volume.getDiskOfferingId());
        final DiskProfile diskProfile = new DiskProfile(volume, diskOffering, vmProfile.getHypervisorType());
        if (diskProfile.useLocalStorage()) {
            usesLocal = true;
            break;
        }
    }
    if (!canMigrateWithStorage && usesLocal) {
        throw new InvalidParameterValueException("Unsupported operation, VM uses Local storage, cannot migrate");
    }
    final Type hostType = srcHost.getType();
    Pair<List<HostVO>, Integer> allHostsPair = null;
    List<HostVO> allHosts = null;
    final Map<Host, Boolean> requiresStorageMotion = new HashMap<Host, Boolean>();
    DataCenterDeployment plan = null;
    if (canMigrateWithStorage) {
        allHostsPair = searchForServers(startIndex, pageSize, null, hostType, null, srcHost.getDataCenterId(), null, null, null, keyword, null, null, srcHost.getHypervisorType(), srcHost.getHypervisorVersion());
        allHosts = allHostsPair.first();
        allHosts.remove(srcHost);
        for (final VolumeVO volume : volumes) {
            final StoragePool storagePool = _poolDao.findById(volume.getPoolId());
            final Long volClusterId = storagePool.getClusterId();
            for (final Iterator<HostVO> iterator = allHosts.iterator(); iterator.hasNext(); ) {
                final Host host = iterator.next();
                if (volClusterId != null) {
                    if (!host.getClusterId().equals(volClusterId) || usesLocal) {
                        if (hasSuitablePoolsForVolume(volume, host, vmProfile)) {
                            requiresStorageMotion.put(host, true);
                        } else {
                            iterator.remove();
                        }
                    }
                } else {
                    if (storagePool.isManaged()) {
                        if (srcHost.getClusterId() != host.getClusterId()) {
                            requiresStorageMotion.put(host, true);
                        }
                    }
                }
            }
        }
        plan = new DataCenterDeployment(srcHost.getDataCenterId(), null, null, null, null, null);
    } else {
        final Long cluster = srcHost.getClusterId();
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Searching for all hosts in cluster " + cluster + " for migrating VM " + vm);
        }
        allHostsPair = searchForServers(startIndex, pageSize, null, hostType, null, null, null, cluster, null, keyword, null, null, null, null);
        // Filter out the current host.
        allHosts = allHostsPair.first();
        allHosts.remove(srcHost);
        plan = new DataCenterDeployment(srcHost.getDataCenterId(), srcHost.getPodId(), srcHost.getClusterId(), null, null, null);
    }
    final Pair<List<? extends Host>, Integer> otherHosts = new Pair<List<? extends Host>, Integer>(allHosts, new Integer(allHosts.size()));
    List<Host> suitableHosts = new ArrayList<Host>();
    final ExcludeList excludes = new ExcludeList();
    excludes.addHost(srcHostId);
    // call affinitygroup chain
    final long vmGroupCount = _affinityGroupVMMapDao.countAffinityGroupsForVm(vm.getId());
    if (vmGroupCount > 0) {
        for (final AffinityGroupProcessor processor : _affinityProcessors) {
            processor.process(vmProfile, plan, excludes);
        }
    }
    for (final HostAllocator allocator : hostAllocators) {
        if (canMigrateWithStorage) {
            suitableHosts = allocator.allocateTo(vmProfile, plan, Host.Type.Routing, excludes, allHosts, HostAllocator.RETURN_UPTO_ALL, false);
        } else {
            suitableHosts = allocator.allocateTo(vmProfile, plan, Host.Type.Routing, excludes, HostAllocator.RETURN_UPTO_ALL, false);
        }
        if (suitableHosts != null && !suitableHosts.isEmpty()) {
            break;
        }
    }
    if (s_logger.isDebugEnabled()) {
        if (suitableHosts.isEmpty()) {
            s_logger.debug("No suitable hosts found");
        } else {
            s_logger.debug("Hosts having capacity and suitable for migration: " + suitableHosts);
        }
    }
    return new Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>>(otherHosts, suitableHosts, requiresStorageMotion);
}

Example 78 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class ResourceLimitManagerImpl method updateResourceLimit.

@Override
public ResourceLimitVO updateResourceLimit(Long accountId, Long domainId, Integer typeId, Long max) {
    Account caller = CallContext.current().getCallingAccount();
    if (max == null) {
        max = new Long(Resource.RESOURCE_UNLIMITED);
    } else if (max.longValue() < Resource.RESOURCE_UNLIMITED) {
        throw new InvalidParameterValueException("Please specify either '-1' for an infinite limit, or a limit that is at least '0'.");
    }
    // Map resource type
    ResourceType resourceType = null;
    if (typeId != null) {
        for (ResourceType type : Resource.ResourceType.values()) {
            if (type.getOrdinal() == typeId.intValue()) {
                resourceType = type;
            }
        }
        if (resourceType == null) {
            throw new InvalidParameterValueException("Please specify valid resource type");
        }
    }
    //Convert max storage size from GiB to bytes
    if ((resourceType == ResourceType.primary_storage || resourceType == ResourceType.secondary_storage) && max >= 0) {
        max = max * ResourceType.bytesToGiB;
    }
    ResourceOwnerType ownerType = null;
    Long ownerId = null;
    if (accountId != null) {
        Account account = _entityMgr.findById(Account.class, accountId);
        if (account == null) {
            throw new InvalidParameterValueException("Unable to find account " + accountId);
        }
        if (account.getId() == Account.ACCOUNT_ID_SYSTEM) {
            throw new InvalidParameterValueException("Can't update system account");
        }
        //only Unlimited value is accepted if account is  Root Admin
        if (_accountMgr.isRootAdmin(account.getId()) && max.shortValue() != Resource.RESOURCE_UNLIMITED) {
            throw new InvalidParameterValueException("Only " + Resource.RESOURCE_UNLIMITED + " limit is supported for Root Admin accounts");
        }
        if ((caller.getAccountId() == accountId.longValue()) && (_accountMgr.isDomainAdmin(caller.getId()) || caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN)) {
            // If the admin is trying to update his own account, disallow.
            throw new PermissionDeniedException("Unable to update resource limit for his own account " + accountId + ", permission denied");
        }
        if (account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
            _accountMgr.checkAccess(caller, AccessType.ModifyProject, true, account);
        } else {
            _accountMgr.checkAccess(caller, null, true, account);
        }
        ownerType = ResourceOwnerType.Account;
        ownerId = accountId;
    } else if (domainId != null) {
        Domain domain = _entityMgr.findById(Domain.class, domainId);
        _accountMgr.checkAccess(caller, domain);
        if (Domain.ROOT_DOMAIN == domainId.longValue()) {
            // no one can add limits on ROOT domain, disallow...
            throw new PermissionDeniedException("Cannot update resource limit for ROOT domain " + domainId + ", permission denied");
        }
        if ((caller.getDomainId() == domainId.longValue()) && caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN || caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) {
            // if the admin is trying to update their own domain, disallow...
            throw new PermissionDeniedException("Unable to update resource limit for domain " + domainId + ", permission denied");
        }
        Long parentDomainId = domain.getParent();
        if (parentDomainId != null) {
            DomainVO parentDomain = _domainDao.findById(parentDomainId);
            long parentMaximum = findCorrectResourceLimitForDomain(parentDomain, resourceType);
            if ((parentMaximum >= 0) && (max.longValue() > parentMaximum)) {
                throw new InvalidParameterValueException("Domain " + domain.getName() + "(id: " + parentDomain.getId() + ") has maximum allowed resource limit " + parentMaximum + " for " + resourceType + ", please specify a value less that or equal to " + parentMaximum);
            }
        }
        ownerType = ResourceOwnerType.Domain;
        ownerId = domainId;
    }
    if (ownerId == null) {
        throw new InvalidParameterValueException("AccountId or domainId have to be specified in order to update resource limit");
    }
    ResourceLimitVO limit = _resourceLimitDao.findByOwnerIdAndType(ownerId, ownerType, resourceType);
    if (limit != null) {
        // Update the existing limit
        _resourceLimitDao.update(limit.getId(), max);
        return _resourceLimitDao.findById(limit.getId());
    } else {
        return _resourceLimitDao.persist(new ResourceLimitVO(resourceType, max, ownerId, ownerType));
    }
}

Example 79 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class CreateSnapshotFromVMSnapshotCmd method getEntityOwnerId.

@Override
public long getEntityOwnerId() {
    VMSnapshot vmsnapshot = _entityMgr.findById(VMSnapshot.class, getVMSnapshotId());
    if (vmsnapshot == null) {
        throw new InvalidParameterValueException("Unable to find vmsnapshot by id=" + getVMSnapshotId());
    }
    Account account = _accountService.getAccount(vmsnapshot.getAccountId());
    //Can create templates for enabled projects/accounts only
    if (account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
        Project project = _projectService.findByProjectAccountId(vmsnapshot.getAccountId());
        if (project == null) {
            throw new InvalidParameterValueException("Unable to find project by account id=" + account.getUuid());
        }
        if (project.getState() != Project.State.Active) {
            throw new PermissionDeniedException("Can't add resources to the project id=" + project.getUuid() + " in state=" + project.getState() + " as it's no longer active");
        }
    } else if (account.getState() == Account.State.disabled) {
        throw new PermissionDeniedException("The owner of template is disabled: " + account);
    }
    return vmsnapshot.getAccountId();
}

Example 80 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class CreateSnapshotPolicyCmd method getEntityOwnerId.

@Override
public long getEntityOwnerId() {
    Volume volume = _entityMgr.findById(Volume.class, getVolumeId());
    if (volume == null) {
        throw new InvalidParameterValueException("Unable to find volume by id=" + volumeId);
    }
    Account account = _accountService.getAccount(volume.getAccountId());
    //Can create templates for enabled projects/accounts only
    if (account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
        Project project = _projectService.findByProjectAccountId(volume.getAccountId());
        if (project.getState() != Project.State.Active) {
            PermissionDeniedException ex = new PermissionDeniedException("Can't add resources to the specified project id in state=" + project.getState() + " as it's no longer active");
            ex.addProxyObject(project.getUuid(), "projectId");
            throw ex;
        }
    } else if (account.getState() == Account.State.disabled) {
        throw new PermissionDeniedException("The owner of template is disabled: " + account);
    }
    return volume.getAccountId();
}