Change cynara client check to admin check for allowed privs

Cynara client check will trigger custom plugins evaluation.
This would be an unwanted behavior, as getAppAllowedPrivileges
should return current state without involvement of the user.
Using Cynara admin check we can achieve the same thing without
triggering of the plugins.

Change-Id: I6d60f9d70fa0d39ac6e9d108fef40227ba9e62d6

diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp
index 6f40dd1bfedabdde5c54f447b3699607a83686ad..8be980fec14df071fb53e3251d183eb4407188e8 100644 (file)
--- a/src/common/service_impl.cpp
+++ b/src/common/service_impl.cpp
@@ -1414,7 +1414,11 @@ int ServiceImpl::getAppAllowedPrivileges(const std::string &appProcessLabel,
 
         vectorRemoveDuplicates(privileges);
         for (auto &privilege : privileges) {
-            if (m_cynara.check(appProcessLabel, privilege, uidStr, "")) {
+            int result = CYNARA_ADMIN_DENY;
+            std::string resultExtra;
+            m_cynaraAdmin.check(appProcessLabel, uidStr, privilege, CynaraAdmin::Buckets[Bucket::PRIVACY_MANAGER], result, resultExtra, true);
+            if (result == CYNARA_ADMIN_ALLOW) {
+                LogDebug("Application " << appProcessLabel << " has " << privilege << " allowed");
                 allowedPrivileges.push_back(privilege);
             }
         }