keystone-moon/etc/policies/policy_authz/metarule.json


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

{
    "sub_meta_rules": {
		"mls_rule": {
			"subject_categories": ["subject_security_level"],
			"action_categories": ["resource_action"],
			"object_categories": ["object_security_level"],
			"algorithm": "inclusion"
		},
		"dte_rule": {
			"subject_categories": ["domain"],
			"action_categories": ["access"],
			"object_categories": ["type"],
			"algorithm": "inclusion"
		},
		"rbac_rule": {
			"subject_categories": ["role", "domain"],
			"action_categories": ["access"],
			"object_categories": ["object_id"],
			"algorithm": "inclusion"
		}
	},
	"aggregation": "all_true"
}