Bug 1189811 - [RFE][glance]: Pass Targets to Glance's Policy Enforcer
Summary: [RFE][glance]: Pass Targets to Glance's Policy Enforcer
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-glance
Version: unspecified
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: Upstream M3
: 7.0 (Kilo)
Assignee: Flavio Percoco
QA Contact: nlevinki
URL: https://blueprints.launchpad.net/glan...
Whiteboard: upstream_milestone_kilo-3 upstream_de...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-02-05 14:55 UTC by RHOS Integration
Modified: 2016-04-27 03:36 UTC (History)
6 users (show)

Fixed In Version: openstack-glance-2015.1.0-6.el7ost
Doc Type: Enhancement
Doc Text:
Previously, every call to policy.enforce passed an empty dictionary as the target. This prevented operators from using tenant specific restrictions in their policy.json files since the target would always be an empty dictionary. If you tried to restrict some actions so an image owner (users with the correct tenant id) could perform actions, the check categorically failed because the target is okay is an empty dictionary. With this update, you can pass the ImageTarget instance wrapping an Image to the enforcer so these rules can be used and properly enforced. You can now properly grant access to the image owner(s) based on tenant (e.g., owner:%(tenant)). Without this fix, the only check that actually works in Image service is a RoleCheck (e.g., role:admin).
Clone Of:
Environment:
Last Closed: 2015-08-05 13:20:58 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2015:1548 0 normal SHIPPED_LIVE Red Hat Enterprise Linux OpenStack Platform Enhancement Advisory 2015-08-05 17:07:06 UTC

Description RHOS Integration 2015-02-05 14:55:26 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/glance/+spec/pass-targets-to-policy-enforcer.

Description:

Currently it's possible to define custom rules in Glance's ``policy.json``
that rely on attributes other than a user's roles. Unfortunately, if you
attempt to apply one of those rules, it will always cause the user to be
prevented from performing the associated action. This specification proposes
that we pass the proper target objects to the enforcer so these rules can be
used and properly enforced.

Specification URL (additional information):

https://review.openstack.org/149112
Comment 6 errata-xmlrpc 2015-08-05 13:20:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2015:1548
Note You need to log in before you can comment on or make changes to this bug.