Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1143869

Summary: Impossible to limit access to CPU profiles via user WEBUI portal on user/group basis.
Product: Red Hat Enterprise Virtualization Manager Reporter: Nikolai Sednev <nsednev>
Component: ovirt-engineAssignee: Doron Fediuck <dfediuck>
Status: CLOSED ERRATA QA Contact: Nikolai Sednev <nsednev>
Severity: high Docs Contact:
Priority: high    
Version: 3.5.0CC: dfediuck, eedri, jniederm, lpeer, lsurette, mavital, mgoldboi, michal.skrivanek, rbalakri, rgolan, Rhev-m-bugs, sherold, srevivo, ykaul
Target Milestone: ovirt-3.6.7Keywords: Triaged, ZStream
Target Release: 3.6.1   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1291267 1341535 (view as bug list) Environment:
Last Closed: 2016-06-29 16:19:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: SLA RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1291267, 1316849, 1341535    

Description Nikolai Sednev 2014-09-18 07:43:36 UTC
Description of problem:
Impossible to limit access to CPU profiles via user WEBUI portal on user/group basis.
All CPU profiles are visible for all users via user portal, regardless their belongings to any user groups.

Version-Release number of selected component (if applicable):
rhevm-3.5.0-0.12.beta.el6ev.noarch
sanlock-2.8-1.el6.x86_64
libvirt-0.10.2-29.el6_5.12.x86_64
qemu-kvm-rhev-0.12.1.2-2.415.el6_5.14.x86_64
vdsm-4.16.3-3.el6ev.beta.x86_64


How reproducible:
100%

Steps to Reproduce:
1.Create several CPU profiles via admin WEBUI.
2.Enter as a user via user WEBUI and create VM.
3.Try to assign CPU profile to created VM and you'll see all possible CPU profiles created by admin. 

Actual results:
All possible CPU profiles created by admim, exposed to users via user WEBUI.

Expected results:
Users have to be limited in their access to CPU profofiles, based on their roles and group associations.

Additional info:

Comment 1 Eyal Edri 2014-12-08 16:40:49 UTC
not a blocker bug, moving to 3.5.1

Comment 3 Eyal Edri 2015-02-25 08:39:38 UTC
3.5.1 is already full with bugs (over 80), and since none of these bugs were added as urgent for 3.5.1 release in the tracker bug, moving to 3.5.2

Comment 4 Eyal Edri 2015-04-28 11:21:55 UTC
moving to 3.5.4 due to capacity planning for 3.5.3.
if you believe this should remain in 3.5.3, please sync with pm/dev/qe and a full triple ack for it. also - ensure priority is set accordingly.

Comment 5 Roy Golan 2015-06-10 09:16:40 UTC
Missed the train for Z - moving to 3.6

Comment 7 Tomer Saban 2015-10-19 15:43:29 UTC
Reproduced on commit-id: 75de7b43380589df82703c1124ea11ff3d95f6f8

Comment 8 Roy Golan 2015-11-24 12:55:53 UTC
Doron, Moran we don't have CpuProfileUser role while for disk we do have. Do you know the reason? This is something I saw in the code review. The proposed fix check if the profile have any permission with any role on this profile and this is not streamlined with other profile behavior.

Comment 9 Roy Golan 2015-11-25 11:19:40 UTC
after speaking with Doron there was no reason why there is no such profile. Please create one Tomer.

Comment 13 Tomer Saban 2016-01-27 14:09:02 UTC
*** Bug 1297920 has been marked as a duplicate of this bug. ***

Comment 15 Mike McCune 2016-03-28 23:40:50 UTC
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions

Comment 17 Nikolai Sednev 2016-05-15 13:54:39 UTC
Works for me on these components:
Engine:
rhevm-extensions-api-impl-3.6.6.2-0.1.el6.noarch
rhevm-3.6.6.2-0.1.el6.noarch
rhevm-dependencies-3.6.0-1.el6ev.noarch
rhevm-sdk-python-3.6.5.0-1.el6ev.noarch
rhevm-dwh-setup-3.6.6-1.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-common-3.6.6.2-0.1.el6.noarch
rhevm-vmconsole-proxy-helper-3.6.6.2-0.1.el6.noarch
rhevm-dbscripts-3.6.6.2-0.1.el6.noarch
rhevm-spice-client-x86-msi-3.6-6.el6.noarch
rhevm-guest-agent-common-1.0.11-6.el6ev.noarch
rhevm-reports-setup-3.6.5.1-1.el6ev.noarch
rhevm-setup-plugin-websocket-proxy-3.6.6.2-0.1.el6.noarch
rhevm-setup-plugin-vmconsole-proxy-helper-3.6.6.2-0.1.el6.noarch
rhevm-userportal-3.6.6.2-0.1.el6.noarch
rhevm-backend-3.6.6.2-0.1.el6.noarch
rhevm-doc-3.6.0-7.el6eng.noarch
rhevm-log-collector-3.6.1-1.el6ev.noarch
rhevm-branding-rhev-3.6.0-9.el6ev.noarch
rhevm-spice-client-x64-msi-3.6-6.el6.noarch
rhevm-iso-uploader-3.6.0-1.el6ev.noarch
rhevm-cli-3.6.2.0-1.el6ev.noarch
rhevm-dwh-3.6.6-1.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-3.6.6.2-0.1.el6.noarch
rhevm-websocket-proxy-3.6.6.2-0.1.el6.noarch
rhevm-webadmin-portal-3.6.6.2-0.1.el6.noarch
rhevm-spice-client-x86-cab-3.6-6.el6.noarch
rhevm-image-uploader-3.6.0-1.el6ev.noarch
rhevm-reports-3.6.5.1-1.el6ev.noarch
rhevm-tools-backup-3.6.6.2-0.1.el6.noarch
rhevm-restapi-3.6.6.2-0.1.el6.noarch
rhevm-setup-base-3.6.6.2-0.1.el6.noarch
rhevm-setup-3.6.6.2-0.1.el6.noarch
rhevm-tools-3.6.6.2-0.1.el6.noarch
rhevm-spice-client-x64-cab-3.6-6.el6.noarch
rhevm-setup-plugins-3.6.5-1.el6ev.noarch
rhevm-lib-3.6.6.2-0.1.el6.noarch
Red Hat Enterprise Linux Server release 6.7 (Santiago)
Linux 2.6.32-573.22.1.el6.x86_64 #1 SMP Thu Mar 17 03:23:39 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux

Host:
ovirt-hosted-engine-setup-1.3.6.0-1.el7ev.noarch
sanlock-3.2.4-2.el7_2.x86_64
ovirt-host-deploy-1.4.1-1.el7ev.noarch
ovirt-setup-lib-1.0.1-1.el7ev.noarch
qemu-kvm-rhev-2.3.0-31.el7_2.12.x86_64
libvirt-client-1.2.17-13.el7_2.4.x86_64
ovirt-vmconsole-1.0.2-2.el7ev.noarch
ovirt-hosted-engine-ha-1.3.5.3-1.el7ev.noarch
ovirt-vmconsole-host-1.0.2-2.el7ev.noarch
mom-0.5.3-1.el7ev.noarch
vdsm-4.17.27-0.el7ev.noarch
Red Hat Enterprise Linux Server release 7.2 (Maipo)
Linux 3.10.0-327.18.2.el7.x86_64 #1 SMP Fri Apr 8 05:09:53 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux


I've followed the reproduction steps for newly created user at the engine and gave it relevant permissions too, then logged in as the user via user portal and I was able to select existing CPU profiles to newly created VM.

Comment 20 errata-xmlrpc 2016-06-29 16:19:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1364