Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1189811

Summary: [RFE][glance]: Pass Targets to Glance's Policy Enforcer
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: openstack-glanceAssignee: Flavio Percoco <fpercoco>
Status: CLOSED ERRATA QA Contact: nlevinki <nlevinki>
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dnavale, eglynn, fpercoco, markmc, scohen, yeylon
Target Milestone: Upstream M3Keywords: FutureFeature, OtherQA
Target Release: 7.0 (Kilo)   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/glance/+spec/pass-targets-to-policy-enforcer
Whiteboard: upstream_milestone_kilo-3 upstream_definition_approved upstream_status_implemented
Fixed In Version: openstack-glance-2015.1.0-6.el7ost Doc Type: Enhancement
Doc Text:
Previously, every call to policy.enforce passed an empty dictionary as the target. This prevented operators from using tenant specific restrictions in their policy.json files since the target would always be an empty dictionary. If you tried to restrict some actions so an image owner (users with the correct tenant id) could perform actions, the check categorically failed because the target is okay is an empty dictionary. With this update, you can pass the ImageTarget instance wrapping an Image to the enforcer so these rules can be used and properly enforced. You can now properly grant access to the image owner(s) based on tenant (e.g., owner:%(tenant)). Without this fix, the only check that actually works in Image service is a RoleCheck (e.g., role:admin).
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-05 13:20:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description RHOS Integration 2015-02-05 14:55:26 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/glance/+spec/pass-targets-to-policy-enforcer.

Description:

Currently it's possible to define custom rules in Glance's ``policy.json``
that rely on attributes other than a user's roles. Unfortunately, if you
attempt to apply one of those rules, it will always cause the user to be
prevented from performing the associated action. This specification proposes
that we pass the proper target objects to the enforcer so these rules can be
used and properly enforced.

Specification URL (additional information):

https://review.openstack.org/149112
Comment 6 errata-xmlrpc 2015-08-05 13:20:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1548