How to return out of a policy.d module

4 Nov 2016

      Is it possible to jump out of a policy.d function, without exiting the 
whole request?

For example, suppose I have policy.d/foo which contains

foo {
     if (..some complex condition..) {
         ...
         if (..another condition..) {
             ...
             ok
             /* I WANT TO RETURN FROM HERE */
        }
        ...
        ... more logic
        ...
        reject
     }
}

At the place given, I want to finish processing the 'foo' policy and 
continue.

However if I use "return", it terminates the whole enclosing authorize 
section:

authorize {
    ...
    foo
    bar     # "bar" is not executed if "foo" says "return"
}

I can possibly write the policy I want entirely as carefully written if 
... elsif ... elsif ... sections, but it would give me some more options 
for writing it clearly if there were a way for the policy to return. I 
just haven't been able to work out how to do that.

Thanks,

Brian.

Brian Candler

Alan DeKok

tags

participants (2)