Bug 1302034 - It's possible to remove inherited permissions from Everyone's group
Summary: It's possible to remove inherited permissions from Everyone's group
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: Backend.Core
Version: 3.6.3
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ovirt-4.0.0-beta
: 4.0.0
Assignee: Ondra Machacek
QA Contact: Gonza
URL:
Whiteboard:
Depends On:
Blocks: 1340932
TreeView+ depends on / blocked
 
Reported: 2016-01-26 15:20 UTC by Ondra Machacek
Modified: 2016-07-05 07:38 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1340932 (view as bug list)
Environment:
Last Closed: 2016-07-05 07:38:35 UTC
oVirt Team: Infra
rule-engine: ovirt-4.0.0+
rule-engine: planning_ack+
mperina: devel_ack+
pnovotny: testing_ack+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 55107 0 master MERGED engine: don't allow removal of inherited perms via rest 2016-04-02 17:51:36 UTC
oVirt gerrit 55882 0 master MERGED aaa: fix group's permissions removal 2016-04-12 07:14:53 UTC

Description Ondra Machacek 2016-01-26 15:20:27 UTC 
Description of problem:
It's possible to remove inhertied permissions from Everyone's group.
If for example user will inherit UserTemplateBasedVm role on Blank template.
Then if he check in webadmin this inhertited permission, he can't remove it,
but if he try to remove this inherited permission via REST it's removed successfully
and also removed from Everyone's group.

Version-Release number of selected component (if applicable):
3.6.3

How reproducible:
always

Steps to Reproduce:
1. Add external user to system.
2. Remove some of the inhertied permissions from Everyone group from user
$ curl -X DELETE -H "Content-type: application/xml" -k -u admin@internal:password $URL/users/1905239d-0c8a-48bb-b454-f24915a128f7/permissions/00000004-0004-0004-0004-000000000355

Actual results:
It's successfully deleted. Also from Everyone group

Expected results:
Inherited permissions from group shouldn't be possible to remove.
Or could be, but don't remove it from group as well.

Additional info:
Comment 1 Juan Hernández 2016-01-26 15:54:23 UTC 
The API doesn't perform this kind of check, it just forwards the request from the caller to the backend. If deleting these permissions shouldn't be allowed then the backend should reject the operation and respond to the API with the appropriate error message.
Comment 2 Gonza 2016-06-21 09:59:41 UTC 
Verified with:
rhevm-4.0.0.5-0.1.el7ev.noarch
Comment 3 Sandro Bonazzola 2016-07-05 07:38:35 UTC 
oVirt 4.0.0 has been released, closing current release.
Note You need to log in before you can comment on or make changes to this bug.