Bug 1852447

Summary:	User can list other tenant's and admin's export locations
Product:	Red Hat OpenStack	Reporter:	lkuchlan <lkuchlan>
Component:	python-manila-tests-tempest	Assignee:	Goutham Pacha Ravi <gouthamr>
Status:	CLOSED ERRATA	QA Contact:	lkuchlan <lkuchlan>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	13.0 (Queens)	CC:	ahyder, alfrgarc, gouthamr, vhariria, vimartin
Target Milestone:	z13	Keywords:	TestBlocker, Triaged, ZStream
Target Release:	13.0 (Queens)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-manila-tests-tempest-1.1.0-1.el7ost	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-28 18:26:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description lkuchlan 2020-06-30 12:42:06 UTC

Description of problem:
Currently, the share export locations API is allowing any tenant to obtain export locations of any tenant's share.

See the below URL:

http://172.24.47.101:8786/v2/64350ec996cb4d91bfaa728fd7199313/shares/e93eb079-58fb-4758-9d95-a9a645b0250a/export_locations

64350ec996cb4d91bfaa728fd7199313: this is a non-admin tenant ID

e93eb079-58fb-4758-9d95-a9a645b0250a: this is an admin's share ID

This is because the API layer of the share export locations controller is going directly to the database to obtain the export locations of the supplied share ID.

The ownership check is performed at the Share/API layer, which is not invoked in this workflow.

Most surprisingly of all, the tempest tests:

- test_export_locations.ExportLocationsTest.test_list_share_export_locations_by_member
- test_export_locations.ExportLocationsTest.test_get_share_export_location_by_member

... should not be passing at all (and should be negative tests), as they are testing if a non-admin tenant is able to obtain and list export locations of a share created by the admin_client used by tempest.

Comment 2 Goutham Pacha Ravi 2020-08-25 21:56:52 UTC

Moving this to POST because the fixes indicated:  https://review.opendev.org/714181 and https://review.opendev.org/710661 have merged upstream, and the manila tests package has been tagged on RDO: https://review.rdoproject.org/r/#/c/28654/

This should be part of the next downstream import into RHOSP

Comment 19 errata-xmlrpc 2020-10-28 18:26:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 13 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4387